clearotron 0.3.0-beta.10 → 0.3.0-beta.2

package/bin/start.mjs

@@ -109,25 +109,23 @@ async function runTables() {
   return { registers: PROVIDERS, engines: ENGINE_BINARIES, defaultEngine: RUN_DEFAULT_ENGINE };
 }
 import { spawn, spawnSync, execFileSync } from "node:child_process";
-import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
+import { storeInRepo, storeOutsideRepoMessage } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
-import { ensureDemoProgram } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
 import { mergeEnvFile } from "../shared/env-file-merge.mjs";
 import { mcpOriginFor } from "../shared/lane-address.mjs";   // — one author for the origin
 import { SERVER_INSTALL_SET, unitsToRestartOnRefresh, unitHealthVerdict } from "../shared/server-units.mjs";   // — one authority, two callers
 // — the door --background now INSTALLS, and the one authority for the settings
 // it refuses to start without. (Until 2026-09-03 this import read "the one unit --background may
 // tolerate and never manage"; settled point 2 superseded that.)
-import { defaultDenylistPath, denylistPathFor, denylistFor, ensureDenylistFile, CLIENT_DOOR_UNIT, enablePlan, clientDoorPort, demoTokenSecret, demoTokenSecretPath, keyIssueCommand } from "../shared/client-door.mjs";   // — one owner for the revocation list's path
+import { defaultDenylistPath, denylistPathFor, denylistFor, ensureDenylistFile, CLIENT_DOOR_UNIT, enablePlan, clientDoorPort } from "../shared/client-door.mjs";   // — one owner for the revocation list's path
 import { createServer } from "node:net";
 import { listenErrorMessage, nextFreePort } from "../shared/listen.mjs";
 import { chmodSync, copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { randomBytes } from "node:crypto";
-import { invocationPrefix, invoke, reachableCommand } from "../shared/invocation.mjs";   // — the banner names the verb
-import { unitEnvPath, activeEnvPath } from "../shared/env-local.mjs";   // — the file the units read, named once
-import { parseEnvFile } from "../shared/env-file-merge.mjs";   // ONE KEY=value reader, in a leaf: render-units is a COMMAND, and importing it from here closed a cycle
+import { invocationPrefix, invoke } from "../shared/invocation.mjs";   // — the banner names the verb
+import { unitEnvPath } from "../shared/env-local.mjs";   // — the file the units read, named once
 import { homedir, userInfo } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { usageBlock } from "../shared/usage-block.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -143,7 +141,6 @@ import { addressRefusal } from "../shared/staff-domain.mjs";
 import { withPerson, withOrganisation, withCompany } from "../shared/grants-edit.mjs";
 import { assertGrantsShape, resolvePerson } from "../shared/scope.mjs";
 import { backgroundManager } from "../shared/os-advice.mjs";
-import { recordRunning } from "../shared/running-start.mjs";
 import { frontingVariablesSet } from "../shared/install-auth.mjs";   // — one owner for what counts as a proxy in front of a door
 
 const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
@@ -303,22 +300,6 @@ export function resolvePorts(env = {}) {
     client: one("CLIENT_MCP_HTTP_PORT", clientDoorPort({})) };
 }
 
-/**
- * WHAT TO DO WHEN THE PAGE THAT OPENS IS NOT OURS. Printed under every "Open" line.
- *
- * A port can be free where this runs and taken where the browser runs: on WSL, a Windows-side listener
- * (VS Code's Remote-SSH forwarding is the one measured, 2026-09-11) answers 127.0.0.1 before WSL does. The
- * doors bind cleanly, the in-use detection has nothing to see, and the browser shows somebody else's page
- * with nothing on this screen saying so. `--port` already moves all three doors; the reader has to be told
- * about it at the moment the address is handed over, which is here.
- */
-export function foreignPageHint(verb) {
-  return [
-    "If the page that opens is not this install's sign-in, another program on this machine holds that",
-    `port from outside this environment. Run \`${invoke(verb)} --port 28802\` (or any free number) instead.`,
-  ];
-}
-
 /**
  * Apply `--port <n>` to the three doors.
  *
@@ -374,50 +355,6 @@ export function defaultGrantsPath({ env = process.env, demo = false } = {}) {
   return installPaths(join(homedir(), demo ? "trademark-demo" : "trademark")).grants;
 }
 
-/**
- * The paths `clearotron start` hands its services: the install's layout under `base`, with whatever the
- * environment already names winning over the layout's default, as `start` has always applied it.
- *
- * EXPORTED FOR THE ONE OTHER READER THAT MUST AGREE WITH IT. On an install with no background units,
- * `clearotron doctor` has no unit file to read the services' environment from: the services are this
- * command's children and get the saved-search store from here. An install started before the store was
- * written to the env file has no line there to read, so doctor asks this function for it, and the
- * answer it prints and the one the services were given have one author.
- *
- * NOT IN A DEMO. Nothing the environment says about an install is the demo's: with the reader's settings
- * in force, 0.3.0-beta.1's demo seeded its example reports into their real archive.
- */
-export function startPaths({ env = process.env, base = join(homedir(), "trademark"), demo = false } = {}) {
-  const paths = installPaths(base);
-  if (demo) return paths;
-  for (const [k, name] of [["pool", "CLEAROTRON_REPORTS_DIR"], ["workspace", "CLEAROTRON_WORK_DIR"], ["queue", "CLEAROTRON_QUEUE_DIR"],
-    ["outbox", "CLEAROTRON_OUTBOX_DIR"], ["locks", "CLEAROTRON_RUN_LOCK_DIR"], ["grants", "CLEAROTRON_ACCESS_FILE"],
-    ["recipes", "CLEAROTRON_RECIPES_DIR"]]) if (env[name]) paths[k] = env[name];
-  if (env.RECIPE_REPO_ROOT) paths.configStore = env.RECIPE_REPO_ROOT;
-  if (env.PORTAL_AUDIT) paths.audit = env.PORTAL_AUDIT;
-  return paths;
-}
-
-/**
- * The saved-search store, as the env file must record it for every reader OUTSIDE this command's tree.
- *
- * The services are handed the store by `childEnv`. A connector an assistant launches, `clearotron doctor`
- * and every other hand-run command are not this command's children: they read the env file, and the
- * file never named the store. So on a local install the portal listed a company's saved searches, the
- * connected assistant was told there were none, and doctor said saved searches were off. Written
- * add-only beside the secrets, as `npx clearotron install` writes the reports and work directories: a
- * line an operator wrote wins.
- */
-export function storesForOtherReaders(paths) {
-  return { CLEAROTRON_RECIPES_DIR: paths.recipes, RECIPE_REPO_ROOT: paths.configStore };
-}
-
-// Written above each line, so a reader who moves the install sees that these two move with it.
-const STORE_NOTES = {
-  CLEAROTRON_RECIPES_DIR: "Where saved searches are kept. `clearotron start` created it; edit both lines if you move the install.",
-  RECIPE_REPO_ROOT: "The git repository saved searches are committed in, which holds the directory above.",
-};
-
 /** Everything this install keeps on disk, under one base directory. */
 export function installPaths(base) {
   return {
@@ -759,10 +696,6 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       // already wrong for a process that is not the portal.
       ...(demo ? {
         CLEAROTRON_DEMO: "1",
-        // A DEMO NAMES NO ORGANISATION. The portal reads this to name the one running the install, on its
-        // top bar and its sign-in refusal page, and an exported value is the reader's real organisation.
-        // The portal's alone: no door names an organisation, and the doors stay as a live install's.
-        CLEAROTRON_ORGANISATION_NAME: "",
         // AND THE SIGN-IN CREDENTIAL LIVES IN THE DEMO'S OWN BASE. Without this it defaults to
         // ~/.cordillera/portal-local-credential.json — shared with every install on the box — and the
         // demo then inherits a digest minted for somebody else's address: the portal prints "the
@@ -911,46 +844,21 @@ if (isMain) {
   // Decided before any path is, because in a demo every path below is the demo's own. The posture
   // itself is described at the DEMO block further down.
   const DEMO = argv.includes("--demo");
-  // A DEMO HAS NO BACKGROUND FORM, and asking for one is refused before anything is written. The
-  // background path installs units that run the reader's own install, so `--demo --background` would set
-  // up an empty install in their home and call it the demo.
-  if (DEMO && wantBackground)
-    fatal("the demo has no background form — it runs as long as its terminal does. `--background` starts your own install as services, not the demo.");
   // The same base `npm run setup` writes under, so whichever of the two a reader ran first, the other
   // finds the same install rather than a second one beside it.
+  const paths = installPaths(flag("--base", join(homedir(), DEMO ? "trademark-demo" : "trademark")));
   // Whatever the environment already says wins over the base-derived default, for every path — a reader
-  // who ran `npm run setup` has these in .env already and this must not move their data. Not in a demo,
-  // which `startPaths` says why. One author, because `doctor` asks the same function what the services
-  // were handed.
-  const paths = startPaths({ env: process.env, base: flag("--base", join(homedir(), DEMO ? "trademark-demo" : "trademark")), demo: DEMO });
-  // ── NOTHING OF THE DEMO LANDS IN AN INSTALL, AND THAT IS CHECKED BEFORE ANYTHING IS WRITTEN ───────
-  //
-  // The demo keeps its signing secret in its base and `key issue --base` reads it from there, so a demo
-  // pointed at an install's directory would leave a secret where that install's own key command looks:
-  // every key issued afterwards would be signed with the demo's while the install's door verified with
-  // its own — a key that looks issued and is refused, with nothing said either way. The settings are
-  // READ here and never applied; a demo still takes nothing from them.
-  if (DEMO) {
-    const base = resolve(paths.base);
-    const inside = (p) => { const v = String(p ?? "").trim(); if (!v) return false; const r = resolve(v); return r === base || r.startsWith(base + sep); };
-    let settings = {};
-    try { settings = parseEnvFile(readFileSync(activeEnvPath(), "utf8")); } catch { /* no settings in force: nothing of an install to collide with */ }
-    const found = [];
-    if (inside(settings.CLEAROTRON_REPORTS_DIR)) found.push(`an install keeps its reports in ${settings.CLEAROTRON_REPORTS_DIR}`);
-    if (inside(settings.RECIPE_REPO_ROOT)) found.push(`an install keeps its saved searches in ${settings.RECIPE_REPO_ROOT}`);
-    if (inside(settings.CLEAROTRON_WORK_DIR)) found.push(`an install works in ${settings.CLEAROTRON_WORK_DIR}`);
-    if (existsSync(join(paths.base, ".env"))) found.push(`it holds a settings file, ${join(paths.base, ".env")}`);
-    if (!found.length && base === resolve(join(homedir(), "trademark"))) found.push("it is the directory an install is set up in by default");
-    // AN INSTALL NOBODY CONFIGURED still answers. `start --base <dir>` writes a guest list on every start
-    // and no settings at all, so an install somewhere of its own passes every check above. A guest list
-    // with no demo secret beside it is somebody's install; a demo's own base has both.
-    if (!found.length && existsSync(paths.grants) && !existsSync(demoTokenSecretPath(paths.base)))
-      found.push(`it holds a guest list, ${paths.grants}, and no demo of its own`);
-    if (found.length)
-      fatal(`--demo cannot run in ${paths.base}: ${found.join("; ")}.\n`
-        + "  The demo keeps its own data, and its own signing secret, in its base. Leaving those in an\n"
-        + "  install's directory would make keys issued for that install refuse at its door.\n"
-        + "  Run the demo without --base, or give it a directory of its own.");
+  // who ran `npm run setup` has these in .env already and this must not move their data.
+  //
+  // NOT IN A DEMO. Nothing the environment says about an install is the demo's: with the reader's
+  // settings in force, 0.3.0-beta.1's demo seeded its example reports into their real archive. Not read,
+  // rather than deleted from the environment, so a real start cannot be reached by this branch at all.
+  if (!DEMO) {
+    for (const [k, name] of [["pool", "CLEAROTRON_REPORTS_DIR"], ["workspace", "CLEAROTRON_WORK_DIR"], ["queue", "CLEAROTRON_QUEUE_DIR"],
+      ["outbox", "CLEAROTRON_OUTBOX_DIR"], ["locks", "CLEAROTRON_RUN_LOCK_DIR"], ["grants", "CLEAROTRON_ACCESS_FILE"],
+      ["recipes", "CLEAROTRON_RECIPES_DIR"]]) if (process.env[name]) paths[k] = process.env[name];
+    if (process.env.RECIPE_REPO_ROOT) paths.configStore = process.env.RECIPE_REPO_ROOT;
+    if (process.env.PORTAL_AUDIT) paths.audit = process.env.PORTAL_AUDIT;
   }
   // ── THIS INSTALL'S FIRST START, read before this start writes either file that answers it ────────────
   //
@@ -1207,29 +1115,16 @@ if (isMain) {
     return v;
   };
   const portalSecret = secretFor("PORTAL_SECRET");
-  // A DEMO'S SIGNING SECRET IS KEPT IN ITS OWN BASE, so the key command it prints can sign for it; see
-  // `demoTokenSecret`. Every other secret a demo uses stays in memory.
-  const tokenSecret = DEMO
-    ? demoTokenSecret(paths.base, {
-      read: (f) => readFileSync(f, "utf8"),
-      write: (f, text) => { mkdirSync(dirname(f), { recursive: true }); writeSecretFile(f, text); },
-      mint: () => randomBytes(32).toString("base64url"),
-    })
-    : secretFor("TRADEMARK_MCP_TOKEN_SECRET");
+  const tokenSecret = secretFor("TRADEMARK_MCP_TOKEN_SECRET");
   if (!process.env.PORTAL_LOCAL_USER) generated.PORTAL_LOCAL_USER = user;
-  const stores = DEMO ? {} : storesForOtherReaders(paths);
 
   // A DEMO WRITES NO SECRETS AND NO ADDRESS. They are generated per run and live in memory only, which
   // is the same posture the ops key already has here — and it is what makes "removing the demo is one
   // directory" true rather than nearly true.
-  //
-  // THE STORES ARE WRITTEN EVEN WHEN NO SECRET IS. An install whose secrets are already in the file is
-  // exactly the install whose connector and doctor could not see its saved searches, and a gate on the
-  // secrets alone would never reach it.
-  if ((Object.keys(generated).length || Object.keys(stores).length) && !DEMO) {
+  if (Object.keys(generated).length && !DEMO) {
     let existing = "";
     try { existing = readFileSync(ENV_PATH, "utf8"); } catch (e) { if (e.code !== "ENOENT") fatal(`${ENV_PATH} exists but could not be read (${e.code}).`); }
-    const merged = mergeEnvFile(existing, { ...generated, ...stores }, { notes: STORE_NOTES });
+    const merged = mergeEnvFile(existing, generated);
     if (merged.added.length) {
       // ONE WRITER FOR EVERY FILE THAT HOLDS CREDENTIALS, and it creates the directory. This site had its
       // own copy of the write and did not learn what the wizard's copy learned when `.env` moved under
@@ -1240,7 +1135,7 @@ if (isMain) {
       } catch (e) {
         fatal(`could not write ${ENV_PATH} (${String(e?.message ?? e)}).`);
       }
-      // NAMES only. Some of what this file holds is credentials.
+      // NAMES only. This file is where the credentials are.
       say(`  wrote          ${merged.added.join(", ")} to ${ENV_PATH} (mode 600)`);
     }
   }
@@ -1297,7 +1192,7 @@ if (isMain) {
         say(`  grants         ${paths.grants} named nobody, so ${user} was added: Run, Manage, access to everything`);
       if (seeded.changed.includes("organisation")) say(`                 organisation "${organisation}", filed there — rename it there too`);
       else if (seeded.changed.includes("person") && !Object.keys(seeded.grants.tenants ?? {}).length)
-        say(`                 no organisation named yet — \`${reachableCommand('start --organisation "<name>"')}\` files the first one`);
+        say(`                 no organisation named yet — \`${invocationPrefix()}clearotron start --organisation "<name>"\` files the first one`);
       // REPORTED, NOT REPAIRED. A file that names other people is somebody's decision, and adding this
       // address to it would give access to everything to an address nobody enrolled.
       if (seeded.unadmitted)
@@ -1357,12 +1252,6 @@ if (isMain) {
       // search is what will fail.
       err(`  WARNING: could not initialise the saved-search store at ${paths.configStore} (${String(e?.message ?? e)}). Searches will list and run; SAVING one will fail until this is a git repository.`);
     }
-  } else {
-    // AN ADOPTED STORE IS ASKED WHETHER IT CAN RECORD A SAVE, HERE, not at the first save. A repository
-    // made by hand has no identity unless somebody gave it one, and on a machine with no global identity
-    // the first company created in the portal is then refused. The one created above sets its own.
-    const cannot = storeCommitRefusal(paths.configStore);
-    if (cannot) err(`  WARNING: ${cannot.message}. Until then, creating a company or saving a search is refused.`);
   }
 
   // ── THE DEMO'S OWN STORE, WITH ITS COMPANY IN IT ────────────────────────────────────────────────
@@ -1435,13 +1324,8 @@ if (isMain) {
     // SEEDED FROM A COPY, for the reason the player publishes from one: republishing writes a receipt
     // into the run directory it reads, and `demo/` is tracked. This is the path a reader actually takes
     // — `clearotron demo` hands over to this — so fixing the player alone left the defect where it was.
-    const { publishSource, seedDemoRuns } = await import("../driver/demo-container.mjs");
+    const { publishSource } = await import("../driver/demo-container.mjs");
     const seed = await seedPool({ pool: paths.pool, examplesDir: publishSource(join(REPO, "demo"), { repoRoot: REPO }), republish: republishRun });
-    // AND AS RUNS, so the assistant this demo's connect line wires has them to list, brief and open. Under
-    // the demo's own workspace only: nothing of it reaches an install started afterwards. Their report
-    // links are stamped with this portal's address, the one the Open line prints.
-    const runs = seedDemoRuns({ workspace: paths.workspace, examplesDir: join(REPO, "demo"), portalOrigin: `http://${HOST}:${ports.portal}` });
-    if (runs.seeded.length) say(`  runs           ${runs.seeded.length} sample run(s) your assistant can list, brief and open`);
     // WHAT WAS ALREADY THERE IS SAID TOO. This branch used to run only when the pool
     // was empty; it now tops a stale pool up to the package's set, so "seeded 1" on an upgrade is a fact
     // about what was MISSING and says nothing on its own about how many are now listed.
@@ -1501,17 +1385,6 @@ if (isMain) {
   // the file the verb resets is the file the portal reads. A demo keeps its own, by layout (childEnv).
   const { installCredential } = await import("../driver/portal-local-auth.mjs");
   const signIn = DEMO ? null : installCredential({ base: paths.base, env: process.env, firstStart: firstStartOfThisInstall });
-  // ── A DEMO RUN FROM NPX KEEPS ITS OWN COPY OF THE PROGRAM ───────────────────────────────────────────
-  //
-  // Its connect line launched the connector from npm's cache, which npm deletes when it cleans up, so an
-  // assistant registered with it lost the demo without a word (measured on a published beta, 2026-09-11).
-  // The same version goes into `<base>/program` (shared/permanent-install.mjs), BEFORE the services start
-  // so the portal's connect rows name it too, and only when it is not there already. It never stops the
-  // demo: if npm fails, the demo runs as before and says the line will not survive a cache clean.
-  // `clearotron demo` makes the copy before it starts this file, and starts this file FROM the copy, so
-  // there this finds nothing to do; it acts for a `start --demo` typed at npx directly.
-  const demoProgramRoot = DEMO ? ensureDemoProgram({ base: paths.base, say }) : null;
-
   const envs = childEnv({ ports, paths, user, portalSecret, tokenSecret, opsToken,
     localWorker: wantWorker, demo: DEMO, clientFence: declaredFence || null,
     credential: signIn && signIn.source !== "shared" ? signIn.path : null });
@@ -1960,7 +1833,6 @@ if (isMain) {
     }
     say("");
     say(`  Open:            ${envs.url}`);
-    for (const line of foreignPageHint(DEMO ? "demo" : "start")) say(`                   ${line}`);
     say("  This SURVIVES the terminal — close the window, the product keeps running.");
     say(`  Stop it:         ${invoke("stop")}   (stops and removes the units; issued connect keys survive — \`${invoke("disconnect")}\` revokes those)`);
     say(`  Is it up?        ${invoke("status")}`);
@@ -2194,7 +2066,6 @@ if (isMain) {
 
   say("");
   say(`  Open   ${envs.url}`);
-  for (const line of foreignPageHint(DEMO ? "demo" : "start")) say(`         ${line}`);
   say("");
   // ── TWO DOORS, TWO AUDIENCES, BOTH NAMED ( — F26) ─────────────────────────
   //
@@ -2220,26 +2091,12 @@ if (isMain) {
     if (adoptedClientDoor)
       say(`               Already running as ${CLIENT_DOOR_UNIT}; this start kept it, so existing keys still work.`);
     else
-      say(`               It refuses every caller until a key is issued: ${keyIssueCommand({ prefix: invocationPrefix(), demo: DEMO, user, base: paths.base, defaultBase: join(homedir(), "trademark") })}`);
+      say(`               It refuses every caller until a key is issued: ${invocationPrefix()}clearotron key issue <email>`);
   } else {
     say(`  Client door  NOT RUNNING on ${HOST}:${ports.client} — its output above says why. The portal and`);
     say("               the engine door are unaffected; a client assistant cannot connect until it is up.");
   }
   say("");
-  // ── WHAT `status` AND `stop` READ ABOUT THIS START ───────────────────────────────────────────────
-  //
-  // Both verbs knew only about background units, so with this start serving, `status` described units
-  // nobody installed and `stop` said nothing was running (measured on a published beta, 2026-09-11). The
-  // record is the address this banner just printed. It goes on every exit — Ctrl-C, a fatal refusal, a
-  // crash — and a start killed outright leaves a record whose process is gone, which the readers ignore.
-  try {
-    const forget = recordRunning({ pid: process.pid, demo: DEMO, base: paths.base, url: envs.url, host: HOST,
-      ports: { portal: ports.portal, mcp: ports.mcp, client: doorRunning ? ports.client : null },
-      startedAt: new Date().toISOString() });
-    process.on("exit", forget);
-  } catch (e) {
-    say(`  (\`status\` will not see this start: its record could not be written — ${String(e?.message ?? e)})`);
-  }
   // — THE BANNER TOLD THE SAME STORY ON EVERY START, and it was only true of the first.
   //
   // "printed once, above" describes what a FIRST start does. On every start after it the passphrase was
@@ -2306,10 +2163,7 @@ if (isMain) {
   //
   // The string comes from the ONE composer, not from a literal here: three surfaces state this route
   // and a line of instruction with more than one author drifts silently.
-  // THE WORKSPACE AND POOL THE SERVICES WERE HANDED, not this process's environment: a demo reads no env
-  // file, so its own line named no workspace and the connector fell back to the real install's.
-  // A demo run from npx names its own copy of the program, which a cache clean does not remove.
-  const connect = stdioConnectOffer({ workDir: paths.workspace, reportsDir: paths.pool, ...(demoProgramRoot ? { installRoot: demoProgramRoot } : {}) });
+  const connect = stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null });
   say("  Connect your assistant to this install — one line, no address and no sign-in:");
   say("");
   say(`    ${connect.command}`);
@@ -2331,35 +2185,17 @@ if (isMain) {
   // cannot succeed and given a service manager that is not on the machine and cannot be put there.
   // Reported from a real run. Same rule as the engine refusal above: do not name a route this platform
   // does not have.
-  for (const line of backgroundOfferLines({ demo: DEMO, manager: backgroundManager(), start: invoke("start") })) say(line);
+  const manager = backgroundManager();
+  if (manager) {
+    say(`  To get your prompt back instead, stop this and run  ${invoke("start")} --background`);
+    say(`  — same product, managed by ${manager}, and it survives logout.`);
+  } else {
+    say("  There is no background form on this platform: the product runs as long as this window does.");
+    say("  Leave it open and use a second terminal for the commands above.");
+  }
   say("");
 }
 
-/**
- * The closing offer of a foreground start: how to get the prompt back, where there is a way.
- *
- * NOT IN A DEMO. The offer ran `start --background`, which set up a new, empty install in the reader's
- * home — not the demo, its samples or its sign-in — and then failed where the user's systemd was not
- * reachable (measured on a published beta, 2026-09-11). A demo has no background form, so it is not
- * offered one. Where the offer stands, it names what it needs BEFORE the reader stops what is running.
- * PURE.
- */
-export function backgroundOfferLines({ demo = false, manager = null, start = "clearotron start" } = {}) {
-  if (demo) return [
-    "  The demo has no background form: it runs as long as this window does. Leave it open and use a",
-    "  second terminal for the commands above.",
-  ];
-  if (!manager) return [
-    "  There is no background form on this platform: the product runs as long as this window does.",
-    "  Leave it open and use a second terminal for the commands above.",
-  ];
-  return [
-    `  To get your prompt back instead, stop this and run  ${start} --background`,
-    `  — same product, managed by ${manager}, and it survives logout. It needs ${manager}'s user manager`,
-    "  reachable from this session; where it is not, that command says so and changes nothing you use.",
-  ];
-}
-
 /**
  * What a reader is told when a child this install cannot run without exits.
  *

package/bin/status.mjs

@@ -18,7 +18,6 @@ import { BACKGROUND_UNITS, resolvePorts } from "./start.mjs";
 import { parseEnvFile } from "../driver/systemd/render-units.mjs";   // ONE KEY=value reader — what systemd actually reads
 import { CLIENT_DOOR_UNIT, clientDoorPort } from "../shared/client-door.mjs";
 import { invoke } from "../shared/invocation.mjs";
-import { readRunning, probe } from "../shared/running-start.mjs";
 import { configStaleness, stalenessWarning, parseSystemdTimestamp } from "../driver/config-staleness.mjs";   // — F48
 
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
@@ -58,34 +57,15 @@ const startedEpochMs = (u) => {
     return parseSystemdTimestamp(line?.slice("ActiveEnterTimestamp=".length));
   } catch { return null; }
 };say("");
-// ── A FOREGROUND START ANSWERS HERE TOO ─────────────────────────────────────────────────────────────
-//
-// The README starts the product in a terminal, and this verb answered only for background units: with
-// everything up it printed a sentence about units the reader never installed (measured on a published
-// beta, 2026-09-11). The record gives the address `start` printed; the portal itself says whether it is up.
-const running = readRunning();
-for (const r of running) {
-  const what = r.demo ? "The demo" : "The product";
-  // The portal's liveness route, which answers without a session: the address itself asks for a sign-in
-  // and read as "not answering" over a portal that was up (driven 2026-09-11).
-  if (await probe(new URL("/portal/health", r.url).href)) say(`  ${what} is up, in the foreground — a terminal holds \`start\` (pid ${r.pid}); Ctrl-C there stops it.`);
-  else say(`  ${what} was started in the foreground (pid ${r.pid}), but its portal at ${r.url} is not answering.`);
-  say(`    Open         ${r.url}`);
-  say(`    Engine door  http://${r.host}:${r.ports.mcp}/mcp`);
-  if (r.ports.client) say(`    Client door  http://${r.host}:${r.ports.client}/mcp`);
-  say("");
-}
 let installed = 0;
 for (const u of BACKGROUND_UNITS) {
   if (!existsSync(join(UNIT_DIR, u))) continue;
   installed++;
   say(`  ${u.padEnd(34)} ${state(u)}`);
 }
-if (!installed && running.length) {
-  say("  No background units are installed.");
-} else if (!installed) {
-  say("  The product is not running: no terminal holds `start`, and no background units are installed.");
-  say(`  \`${invoke("start")}\` runs it in a terminal; \`${invoke("start")} --background\` runs it as services that survive logout.`);
+if (!installed) {
+  say("  No background units are installed — this box runs the product only while a terminal holds");
+  say(`  \`clearotron start\`. \`clearotron start --background\` is the form that survives the terminal.`);
 } else {
   // The ports come from the same resolver start uses, RESOLVED OVER THE UNITS' OWN FILE: the running
   // services read %h/.env via systemd, and this CLI's shell env may know nothing of it — the first

package/bin/stop.mjs

@@ -23,7 +23,6 @@ import { systemdSaid, looksLikeBusFailure, busRemedy, CAPTURE_STDERR } from "../
 import { BACKGROUND_UNITS } from "./start.mjs";
 import { CLIENT_DOOR_UNIT } from "../shared/client-door.mjs";
 import { invoke } from "../shared/invocation.mjs";
-import { readRunning } from "../shared/running-start.mjs";
 
 const UNIT_DIR = join(homedir(), ".config", "systemd", "user");
 const say = (s = "") => console.log(s);
@@ -92,31 +91,17 @@ for (const u of BACKGROUND_UNITS) {
 }
 // THE COMMENT HERE ALREADY NAMED THE CAUSE AND SHRUGGED AT IT. If there is no user bus, the disables
 // above did not happen either — so this is where that is said.
-// ONLY WHEN THERE WAS SOMETHING TO RELOAD. On a box with no unit installed the reload has nothing to do,
-// and asking anyway printed a bus error and `su` advice to a reader whose product was running in a
-// terminal — a WSL distribution without systemd meets exactly that (measured 2026-09-11).
-if (found) {
-  try {
-    execFileSync("systemctl", ["--user", "daemon-reload"], CAPTURE_STDERR);
-  } catch (e) {
-    const said = systemdSaid(e);
-    err(`  could not ask systemd to reload its units — ${said}`);
-    if (looksLikeBusFailure(said)) err(`\n${busRemedy()}\n`);
-  }
+try {
+  execFileSync("systemctl", ["--user", "daemon-reload"], CAPTURE_STDERR);
+} catch (e) {
+  const said = systemdSaid(e);
+  err(`  could not ask systemd to reload its units — ${said}`);
+  if (looksLikeBusFailure(said)) err(`\n${busRemedy()}\n`);
 }
 
 if (!found) {
-  // A FOREGROUND START IS NOT "NOTHING RUNNING". It is not this verb's to stop — its terminal holds it —
-  // but saying nothing was running while it served is the answer that sent a reader looking elsewhere.
-  const foreground = readRunning();
-  if (foreground.length) {
-    say("  No background product is installed, but the product is running in the foreground:");
-    for (const r of foreground) say(`    ${r.demo ? "the demo" : "the product"} at ${r.url} (pid ${r.pid})`);
-    say("  Ctrl-C in the terminal that holds it stops it. This verb stops only what `start --background` installed.");
-  } else {
-    say("  Nothing was running in the background — no pinned unit is installed on this box.");
-    say("  Nothing to do, and nothing was changed.");
-  }
+  say("  Nothing was running in the background — no pinned unit is installed on this box.");
+  say("  Nothing to do, and nothing was changed.");
 } else if (failures.length) {
   // THE SENTENCE THAT WAS WRONG. "The background product is stopped and the box runs nothing again" was
   // printed unconditionally — including on the run where four services stayed up. A reader who is told

package/bin/update.mjs

@@ -59,8 +59,6 @@ import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-p
 import { readEnvFile } from "./onboard.mjs";
 import { invoke, invocationPrefix } from "../shared/invocation.mjs";   // — name a command the reader can actually type
 import { rebuildIfStale } from "../shared/bundle-rebuild.mjs";   // a pull cannot update an untracked bundle
-import { packagedUpdate } from "../shared/permanent-install.mjs";   // — a packaged install updates at its own prefix
-import { installShim, inspectShim, shimPath } from "../shared/verb-shim.mjs";   // — npm's link replaces the launcher
 
 const REPO = join(dirname(fileURLToPath(import.meta.url)), "..");
 const ENV_PATH = envLocalPath({ repoRoot: REPO });   // resolved, never composed: one resolver, so moving this file later is one line
@@ -248,22 +246,13 @@ export async function update(argv = process.argv.slice(2)) {
   // not succeed` — true, useless, and pointing at the wrong thing entirely. `update` is the verb a
   // stranger reaches for, so the one install we expect most people to have must not be answered with
   // a git error about a directory that was never a repository.
-  //
-  // A PACKAGED INSTALL NOW UPDATES ITSELF, the way it was installed: npm, at the prefix it lives under, on
-  // the channel it came from (shared/permanent-install.mjs). It runs AFTER the live-run refusal below,
-  // because npm replaces the program's files as surely as `npm ci` does. Only a layout that cannot be
-  // named is still refused.
-  let packaged = null;
   if (!isGitCheckout()) {
-    packaged = packagedUpdate();
-    if (!packaged) {
-      console.error("\n  This install is not a git checkout, so there is nothing to pull.");
-      console.error("  It was installed from a package rather than cloned, which is the ordinary way.");
-      console.error("\n  Update it the way it was installed:\n");
-      console.error("      npm install -g clearotron@latest\n");
-      console.error("  Nothing was touched.");
-      return 4;
-    }
+    console.error("\n  This install is not a git checkout, so there is nothing to pull.");
+    console.error("  It was installed from a package rather than cloned, which is the ordinary way.");
+    console.error("\n  Update it the way it was installed:\n");
+    console.error("      npm install -g clearotron@latest\n");
+    console.error("  Nothing was touched.");
+    return 4;
   }
 
   // ── AND THE SECOND REFUSAL: NOT OVER A LIVE RUN ──────────────────────────────────────────────
@@ -300,27 +289,6 @@ export async function update(argv = process.argv.slice(2)) {
     return 4;
   }
 
-  if (packaged) {
-    if (packaged.current) {
-      say(`\n  This install is ${packaged.installed}, and nothing newer is published (${packaged.tag}: ${packaged.version}). Nothing was touched.\n`);
-      return 0;
-    }
-    if (packaged.unread) say(`\n  npm did not say which versions are published, so this follows the ${packaged.tag} channel.`);
-    say(`\n  Updating this install at ${packaged.prefix} from ${packaged.installed ?? "an unreadable version"} to clearotron@${packaged.spec}.`);
-    const rc = runInCheckout("npm", packaged.npmArgs);
-    if (rc !== 0) return rc;
-    // npm puts its own link back at `<prefix>/bin/clearotron` on every install, over the launcher the
-    // install wrote, and that link runs whichever `node` is first on PATH. Put the launcher back, but only
-    // over npm's link or our own: anything else there was not ours before this update either.
-    const kind = inspectShim(shimPath()).kind;
-    if (kind === "npm-link" || kind === "ours" || kind === "ours-other-install") {
-      const shim = installShim();
-      if (!shim.ok) console.error(`\n  The update worked, but the launcher at ${shim.path ?? "~/.local/bin/clearotron"} could not be written back: ${shim.detail}.`);
-    }
-    say("\n  Updated. An assistant starts the new version the next time it launches Clearotron; restart the services for the portal.\n");
-    return 0;
-  }
-
   say("\n  Configuration store is outside the checkout. Updating the product.");
   for (const e of entries) say(`    ${e.name}=${e.value} (${e.from})`);
   if (!entries.length) {

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "f0c89eaba3add8ab33c46e0434cb3333b876681f",
-  "version": "0.3.0-beta.10"
+  "commit": "f24d87c471bd3073f3a56dbf0edff39d1a640175",
+  "version": "0.3.0-beta.2"
 }

package/demo/full-country-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "/portal/report/tmpdemo2014fullcountrysearch-venqori-2026-09-03-sample-capture/",
+  "url": "https://test-trademark.cordillera.ch/tmpdemo2014fullcountrysearch-venqori-2026-09-03-sample-capture/report.html",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-03T18:06:17.281Z",

package/demo/global-preliminary-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "/portal/report/tmpdemo2014globalpreliminarysearch-venqori-2026-09-02-sample-capture/",
+  "url": "https://test-trademark.cordillera.ch/tmpdemo2014globalpreliminarysearch-venqori-2026-09-02-sample-capture/report.html",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T17:33:15.625Z",

package/demo/knockout-search/run/email-body.md

@@ -1,3 +1,3 @@
-<p style="font-family:Calibri,sans-serif;font-size:11pt">Knockout trademark review — DEMO-2014-knockout-search: <b>1 mark</b>, worst band <b style="color:#2f55a4">Low</b>. <a href="/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/">Open the full report</a> · <a href="/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/audit.xlsx">audit workbook</a>.</p>
+<p style="font-family:Calibri,sans-serif;font-size:11pt">Knockout trademark review — DEMO-2014-knockout-search: <b>1 mark</b>, worst band <b style="color:#2f55a4">Low</b>. <a href="https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html">Open the full report</a> · <a href="https://test-trademark.cordillera.ch/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/audit.xlsx">audit workbook</a>.</p>
 <ul style="font-family:Calibri,sans-serif;font-size:11pt"><li><b>VENQORI</b>: <b style="color:#2f55a4">Low</b> — Classes 9, 42, 41 — Register filings (classes 9, 42, 41): 0 identical, 0 containing, 0 on close variations.</li></ul>
 <p style="font-family:Calibri,sans-serif;font-size:11pt"><i>Ratings reflect our common law assessment. Register analysis may adjust ratings in either direction.</i></p>

package/demo/knockout-search/run/status.json

@@ -33,7 +33,7 @@
   "stepN": 6,
   "stepTotal": 6,
   "verdict": "Low",
-  "url": "/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/",
+  "url": "https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T21:46:53.238Z",
@@ -254,7 +254,7 @@
   "reports": [
     {
       "mark": "VENQORI",
-      "url": "/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/"
+      "url": "https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html"
     }
   ],
   "sendPending": true,

package/demo/multi-country-focus-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "/portal/report/tmpdemo2014multicountryfocussearch-venqori-2026-09-02-sample-capture/",
+  "url": "https://test-trademark.cordillera.ch/tmpdemo2014multicountryfocussearch-venqori-2026-09-02-sample-capture/report.html",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T19:51:48.801Z",