clearotron 0.3.0-beta.10 → 0.3.0-beta.2

package/docs/architecture/04-configuration-reference.md

@@ -285,13 +285,12 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
 | `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo account, which a fresh install does not resolve (ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` accounts either way. Effect class `harness`; the full contract is its row in `.env.example`. |
-| `CLEAROTRON_ORGANISATION_NAME` | unset | Your organisation's name, written quoted by `npx clearotron install`, which asks for it and not for a sign-in address. The first `clearotron start` files it as the first organisation in the grants file (`CLEAROTRON_ACCESS_FILE`) when that file holds none; from then on the grants file holds the name and renaming is an edit there. The portal also reads it, to name the organisation on its top bar and on its sign-in refusal page. Unset ⇒ no organisation is invented. `clearotron start --organisation <name>` supplies it for one start, and a demo never reads it. Effect class `deployment`; the full contract is its row in `.env.example`. |
+| `CLEAROTRON_ORGANISATION_NAME` | unset | Your organisation's name, written quoted by `npx clearotron install`, which asks for it and not for a sign-in address. The first `clearotron start` files it as the first organisation in the grants file (`CLEAROTRON_ACCESS_FILE`) when that file holds none; from then on the grants file holds the name, renaming is an edit there, and this is not read. Unset ⇒ no organisation is invented. `clearotron start --organisation <name>` supplies it for one start, and a demo never reads it. Effect class `deployment`; the full contract is its row in `.env.example`. |
 | `PORTAL_LOCAL_CREDENTIAL` | `~/.cordillera/portal-local-credential.json` | Where local sign-in keeps its passphrase DIGEST. `clearotron start` points it inside the install's own base directory for a new install, so it mints its own passphrase instead of adopting a digest another install left; an install that has been signing in with the shared file keeps it. `npx clearotron demo` always points it inside the demo's own base directory and mints a new passphrase there on every start, so a demo never inherits a digest minted for another address, and removing the demo stays one `rm -rf`. |
 | `PORTAL_LOCAL_PASSPHRASE` | unset | **NEVER set this in a file.** An internal one-shot handoff, not an operator control: on a first FOREGROUND start the supervisor mints the passphrase and hands it to the portal it spawns *at the spawn call*, so the closing summary can print the value beside the address rather than sending a first-time reader back into eleven startup log lines for the one value in this product that cannot be read back. It is deliberately absent from the composed child environments, because that composition is what `--background` writes into the units' env file — a passphrase there would be a permanent plaintext copy on disk and the product's own sentence, "it is stored only as a digest", would stop being true. Setting it in any env file recreates exactly that. Lost passphrase: `clearotron passphrase --reset`. |
 | `PORTAL_URL` | `http://127.0.0.1:18802`, or built from `PORTAL_SERVICE_HOST`/`PORTAL_SERVICE_PORT` | Where the deploy tick's live-surface check expects to reach the portal. |
 | `PORTAL_OPS_TOKEN_FILE` | `~/.config/systemd/user/trademark-portal.service.d/secrets.conf` | The systemd drop-in the live-surface check reads `PORTAL_OPS_TOKEN` out of. It reads the FILE rather than the environment so a check run by hand sees the same token the service does. |
 | `CLEAROTRON_INVOKED_AS` | unset (⇒ the verb's own `argv[1]`) | How the reader typed the command, so every command a verb prints for them to type next is spelled the way they type it: `clearotron …` after a global install, `npx clearotron …` otherwise. The dispatcher runs each verb as a process of its own, whose `argv[1]` is always `bin/<verb>.mjs`, so `bin/clearotron.mjs` passes its own `argv[1]` down in this name. **Set by the dispatcher, never by an operator.** Effect class `deployment`; the full contract is its row in `.env.example`. |
-| `CLEAROTRON_RELOCATED` | unset (⇒ an install running from npx's cache moves itself to `~/.local` first) | Marks an install that has already made that move. `npx clearotron install` installs the same version under `~/.local`, then runs that copy's install with this set to `1`, so the copy does not try to move itself again. **Set by the install on the one process it starts, never by an operator.** Effect class `deployment`; the full contract is its row in `.env.example`. |
 | `CLEAROTRON_REQUIRE_EXPLICIT_PORTS` | unset | `1` makes a service that would listen on a built-in default port refuse to start instead of warning. For a box that runs more than one instance, where one instance's default is another's port on the day that other instance is down. Unset, a service on a default port still says so as it starts. Effect class `deployment`. |
 | `CLEAROTRON_UPDATER_STAMP` | `_updater-identity.json` beside the update script, in the directory the updater runs from | The full path of the file in which the updater that deploys this box records which copy of itself ran. The updater writes it and deploy health reads it under this one name, so a box that moves the stamp sets it once for both. On a box with no updater unit, setting it says an updater exists elsewhere and is to be judged. Effect class `deployment`. |
 | `CLEAROTRON_CUT_REF` | `HEAD` | Which ref the cut decision reads the version from. **Read only by the release workflow, never set on a deployment.** The jobs that ask about `main` set it to `origin/main` explicitly, because their checkout is pinned to the run's own ref and `HEAD` there is that ref rather than the branch they are deciding about. A job that asks the wrong subject gets a confident wrong answer. |

package/driver/CHANGELOG.md

@@ -1,104 +1,5 @@
 # clearotron-driver
 
-## 0.3.0-beta.10
-
-### Patch Changes
-
-- fd3a4f7: Fixed: A portal address that does not exist now says so wherever it is. Addresses under the admin path used to show the Global config screen.
-- fd3a4f7: New: The install guide now says how to remove Clearotron, naming every path it writes and which one holds your reports.
-
-## 0.3.0-beta.9
-
-### Patch Changes
-
-- 86061f4: Fixed: Commands printed while running from npx name the published version, so they still work after npm cleans its cache.
-- ab9dc2d: Fixed: When the engine cannot answer "Describe it", the page names the check that finds out why. It says "just now" only for a usage limit.
-- ab9dc2d: Fixed: `clearotron status` says whether a product started in a terminal is up, and on which addresses. `clearotron stop` says how to stop it.
-- ab9dc2d: Fixed: The demo no longer offers `start --background`, which set up an empty install in your home instead of running the demo.
-- ab9dc2d: Fixed: The key command the demo prints issues a key the demo's client door accepts, run exactly as printed.
-
-## 0.3.0-beta.8
-
-### Patch Changes
-
-- 9181d6a: Fixed: Commands the install, start and the New company screen print now run as printed, from any directory and after npm cleans its cache.
-- 0d75b4a: Fixed: A demo started with npx prints commands that keep working after npm cleans its cache.
-- 9181d6a: Fixed: Doctor, run before the first start, describes the local sign-in that start brings up, and drops checkout-only warnings on a packaged install.
-- 91888b2: Fixed: The package no longer names the hosted service's own hostnames; a deployment names its own.
-- 9181d6a: Fixed: The README installs with `npx clearotron install`, which needs no root, and no longer says the demo opens a browser.
-
-## 0.3.0-beta.7
-
-### Patch Changes
-
-- c5744bf: Fixed: A demo started with npx keeps its assistant connection working after npm cleans its cache.
-- c5744bf: Fixed: An assistant connected to the demo now opens each sample report on the demo's own portal, not on another server.
-- c5744bf: Fixed: The portal names the organisation setup recorded, and the product keeps its own name beside it.
-
-## 0.3.0-beta.6
-
-### Patch Changes
-
-- 2ca849d: Fixed: When codex's sign-in can no longer be refreshed, the search stops and says to run `codex login`. It used to retry with a bare exit code.
-- a81279f: Fixed: When the portal address opens someone else's page, for example a port forwarded from outside WSL, Clearotron now says so and points you to `--port`.
-- a81279f: Fixed: The sign-in page clears a session left by another Clearotron on the same address and says so. A refusal that is not about the passphrase now says what it is about.
-- f133f7d: Fixed: A passphrase pasted with a space or line break at either end now signs in, instead of being refused as wrong.
-- 2ca849d: Fixed: A manager who does not run the installation no longer sees server file paths when a new company cannot be recorded or filed.
-- a81279f: Fixed: The local sign-in page no longer invites the browser to fill in a saved password from another install.
-- a81279f: Fixed: `npx clearotron install` now installs Clearotron permanently under `~/.local` before setting up. The `clearotron` command and your assistants' connections keep working after npm cleans its cache.
-- 2ca849d: Fixed: When the saved-search store exists but cannot be read, the connector and `clearotron doctor` now say so, instead of reporting no saved searches.
-- a81279f: Fixed: On WSL, the "on this computer" connect steps now say to run them inside WSL. The Claude Code line registers Clearotron for every project and works in Windows PowerShell.
-- a81279f: New: An assistant connected to `clearotron demo` can now list, brief and open the demo's four sample runs. They stay inside the demo's own folder.
-- a81279f: Fixed: The sign-in page's reset line now runs for a demo started with npx, and resets that demo's own passphrase.
-- a81279f: New: `clearotron update` now updates an npm-installed copy itself, and a beta install moves on to the release once it is published.
-
-## 0.3.0-beta.5
-
-### Patch Changes
-
-- 5f7e295: Fixed: A Clearotron install signed in to OpenAI's `codex` with a subscription keeps working after codex refreshes its login. Before, every search after the first refresh failed within seconds until you signed in again.
-- 2878809: Fixed: When the company store cannot record a new company, the New company page now says why and what fixes it, instead of "Try again shortly". Someone who does not run the installation is told to ask whoever does.
-- e7cd9e1: Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
-- e7cd9e1: Fixed: When setup offers to try your engine, it no longer names an Anthropic model to someone who chose OpenAI's `codex`.
-
-## 0.3.0-beta.4
-
-### Minor Changes
-
-- a9f5375: New: Use your own AI asks first where Clearotron is running, then shows the steps for your app beside the list. The same five apps are offered either way.
-  
-  New: Claude Code and Codex can connect to an installation running elsewhere, and the ChatGPT desktop app to one on the same machine.
-  
-  Fixed: Codex was told to paste a settings block into a terminal. Its steps now name the file the block goes in.
-  
-  For operators: `clearotron connect` and `clearotron disconnect` take `--where here` or `--where elsewhere`. Assistant names used before, such as `cowork`, still work.
-
-### Patch Changes
-
-- a9f5375: New: the company switcher in the sidebar ends with `+ New company`. Making a company is now one click from every screen, whether or not a company is selected.
-
-## 0.3.0-beta.3
-
-### Patch Changes
-
-- a782aad: Fixed: Creating a company is refused, with nothing left behind, when the configuration store cannot record it. The company used to be created anyway, with no record of who made it or when, and its organisation was given access to it.
-  
-  A store with no git identity is the usual cause on a new machine, and the refusal names the command that fixes it. Setup and `clearotron start` now check a store they adopt for this straight away.
-- d1ef225: Fixed: A search step stopped at its time limit now records the output it actually produced. It used to record a small fraction, so a step that was working read as one that had stalled.
-  
-  The token totals `clearotron tokens` reports for runs with a stopped step now include that output.
-- 0ff42d1: Fixed: `clearotron doctor` now says when saved searches are switched off and why, and when a saved search file cannot be read.
-  
-  An assistant asking for saved searches is told when they could not be read, instead of being told there are none.
-- a782aad: Fixed: `clearotron doctor` reports the register and the research key the background services will use, read from the file they read. Run from a new terminal, it used to say no register was selected on an install whose searches were running.
-- 0ff42d1: Fixed: Global config appears in the account menu only for people who can open it. Someone managing one organisation used to be offered it, and the page then said it was not available.
-  
-  Clearances and People no longer ask for installation-wide data that a manager of one organisation cannot see.
-- a782aad: Fixed: A clearance or knockout searched through Compumark now links each register record to the trade mark office's own page for it. Those records used to show an internal reference nobody could open.
-  
-  The offices linked are the United States, the European Union, the United Kingdom, Canada, Australia, Switzerland, France, Norway, Sweden and WIPO. A record from any other office is cited by its number, and the report says why once, under the findings.
-- a782aad: Fixed: Saved searches work on a fresh install and in the demo, for every company, Generic included. They used to fail to load for every company, with a message saying to try again shortly.
-
 ## 0.3.0-beta.2
 
 ### Minor Changes
@@ -140,11 +41,11 @@
   
   Fixed: A search now records any of your default territories that the engine cannot search, in the record of that search. A mistyped default no longer narrows a search silently.
 - eacfce4: Fixed: An assistant connected to a local install now sees the saved searches the portal shows, and can plan a run from one of them. Before, outside the demo, only the portal was told where saved searches are kept, so an assistant was told the install had none.
-- 34cc1c7: For operators: A deployment health check that could not finish now fails instead of reporting success. Two parts of the service check could skip themselves. One skipped when the installation did not say which installation it is; the other when the scan of the service files did not finish. Both used to note that they had not run and then pass.
+- 34cc1c7: For operators: A health check that could not look now fails instead of reporting success. Two halves of the unit check can go quiet. One goes quiet when the installation does not say which installation it is; the other when the walk over the unit files does not finish. Both used to note that they had not run and then pass.
   
   For operators: Set `CLEAROTRON_BOX` to `prod` or `test`. Those are the only two values the check accepts; anything else, including any other name, reads as unnamed and fails. The failure names the setting and says what went unchecked.
   
-  For operators: The part that could skip itself is the one that notices a service that has stopped and stayed stopped. The other part lists what is running, so it cannot see something that is no longer there. While the first part is skipped, a service can disappear without the check saying anything.
+  For operators: The half that goes quiet is the one that notices a service that has stopped and stayed stopped. The other half lists what is running, so it cannot see something that is no longer there. While that half is suppressed, a service can disappear without the check saying anything.
 - b45a5cf: Fixed: `clearotron doctor` now reports everything a search would be refused for, checked against the environment the search will run in. So an installation it passes is one that can run a search.
   
   Fixed: A token set in the installation's own configuration file now reaches the engine check. A headless server set up the documented way proves its engine instead of reporting it signed out.
@@ -189,7 +90,7 @@
   Fixed: When a feature is switched off on your installation, the screen says so and what to change. It used to suggest trying again shortly.
   
   Fixed: The link to the risk-framework guide opens in a new tab and goes straight to the section on writing your own. It also appears on the Company profile screen.
-- ad088d6: Fixed: The audit workbook's "What was searched" sheet is now in plain words. Its Result and Note columns carry the search log's own notes. Internal terms could reach them: a status such as "deferred", a full web address, a bare HTTP code. Those words are now replaced as the workbook is built, a republished report included. A search recorded as not run still reads as not searched. Search terms and names stay exactly as written, because they record what was searched.
+- ad088d6: Fixed: The audit workbook's "What was searched" sheet is now in plain words. Its Result and Note columns carry the search log's own notes. Engine vocabulary could reach them: a receipt "deferred", a full web address, a bare HTTP code. Those words are now replaced as the workbook is built, a republished report included. A search recorded as not run still reads as not searched. Search terms and names stay exactly as written, because they record what was searched.
 - ff16a3b: For operators: The deployment health check now reports whether the component that updates an installation is itself up to date. It was the one part of a deployment the check could not identify. An installation kept current by an out-of-date updater could report healthy while serving stale code.
   
   For operators: An updater that cannot be identified is now reported as a failure rather than passed over. A copy old enough to predate this reporting writes nothing at all. That silence is the case worth knowing about, so it is treated as a finding.
@@ -219,7 +120,7 @@
   
   The product now says company throughout. It used to say brand owner, account, client and customer for the same thing. The firm running the installation is named separately, in the top bar.
   
-  Companies created through the settings page were saved without a risk framework. Their matters were then rated under the default risk framework, with nothing on screen saying so. Every company created now carries one, and says which.
+  Companies created through the settings page were saved without a risk framework. Their matters were then rated under the house default, with nothing on screen saying so. Every company created now carries one, and says which.
 - f75266d: New: The setup wizard now asks for the organisation's name after the sign-in address, and the person who installs starts with access to everything.
   
   `clearotron grant add` sets a person's two permissions with `--run` and `--manage`; with neither, the person can look and start nothing.
@@ -241,18 +142,18 @@
   
   Getting the deck's shape wrong used to fail quietly. The profile screen showed the framework's title and your band colours, and silently omitted the box saying what the bands mean. The new command answers that question directly, using the screen's own read of the deck.
   
-  Fixed: When you have a configuration store set and a risk framework comes from the product's own files instead, the product now says so.
+  Fixed: a framework served from the product's own files, while you have a configuration store set, now says so.
   
   Your store is looked in first, and the product's files answer when it is silent. The product ships decks under names you may also have chosen. So a deck that went missing from your store was replaced by ours rather than reported absent. Same band words, different rubric, nothing raised anywhere. The profile screen now writes one line naming what happened, and the new command reports it.
   
-  Fixed: The built-in triage framework's profile page explains its bands again.
+  Fixed: the house triage ladder's profile page explains its bands again.
   
   Its band sections stated their meanings as plain paragraphs, which the screen does not read. Every company without a framework of its own saw band colours and no explanation. The wording is unchanged.
-- cfb9a9f: Fixed: `clearotron doctor` now lists the companies your portal's key may start runs for.
+- cfb9a9f: Fixed: `clearotron doctor` now says which companies your portal's trigger key can start.
   
   The key carries a list of the companies it may start runs for. A company added after the key was minted is outside it. Doctor reported the key's expiry and never its coverage. So the one command whose job is to tell you what a machine is configured for said nothing about it.
   
-  It reads the company list the background services read, not the one a command run in a terminal would find, and it says which. The two can differ, and when they do, that difference is the answer.
+  It reads the roster the services read, not the one a command-line process resolves, and it says which. Those two can disagree, and when they do the difference is the whole answer.
   
   The line is a note, not a failure. Your portal takes a fresh credential at the start of every call, so a company outside the key is not normally refused. It is refused when the portal cannot take a fresh one, and the line says so and gives you the command to widen the key.
 - ba2899b: Fixed: On reports searched through Signa, each register finding now links to the office's own page for that record, where the office publishes one. Singapore publishes no such page, so its registrations are cited by number, and the report says why. A number that an office's page cannot take is cited the same way.

package/driver/compose-read.mjs

@@ -325,26 +325,7 @@ export function jsonFromTurnText(text) {
   return null;
 }
 
-/**
- * What the page says when the engine did not answer a read.
- *
- * "JUST NOW" ONLY WHERE IT IS TRUE. Every failed turn said the reader "could not reach the engine just
- * now", and on a fresh install whose engine was not signed in that sent a stranger to press the button
- * again, forever: the failure was the sign-in, which no retry changes (measured on a published beta,
- * 2026-09-11). A rate limit is the one failure known to pass, so it alone says so, with its reset time
- * when the engine gave one. Everything else names the check that finds the cause — `checkCommand`, in the
- * reader's own invocation and with no machine path, because the page is not a place to print one.
- */
-export function engineFailureMessage(t, { checkCommand = "clearotron doctor --probe-engine" } = {}) {
-  if (t?.rateLimited) {
-    const at = t.resetsAt ? new Date(t.resetsAt) : null;
-    const when = at && !Number.isNaN(at.getTime()) ? ` It resets at ${at.toISOString().slice(11, 16)} UTC.` : "";
-    return `The engine is at its usage limit just now.${when} Try again then, or set the search up below.`;
-  }
-  return `The request could not be read: the engine did not answer it. \`${checkCommand}\` finds out why — set the search up below meanwhile.`;
-}
-
-export function makeComposeReader({ turn, now = () => new Date(), checkCommand } = {}) {
+export function makeComposeReader({ turn, now = () => new Date() } = {}) {
   if (typeof turn !== "function") return null;
   return async function read(brief) {
     const text = String(brief ?? "").trim();
@@ -380,7 +361,7 @@ export function makeComposeReader({ turn, now = () => new Date(), checkCommand }
         + `${JSON.stringify(READ_SCHEMA)}\n\nThe brief:\n${text}`,
     });
     if (!t?.ok) {
-      return { ok: false, error: "engine", message: engineFailureMessage(t, { ...(checkCommand ? { checkCommand } : {}) }),
+      return { ok: false, error: "engine", message: "The reader could not reach the engine just now — set the search up below.",
         cause: t?.cause ?? "the engine turn did not complete", vendor: t?.vendor ?? null, authMode: t?.authMode ?? null,
         engine: t?.engine ?? null, model: t?.model ?? null };
     }

package/driver/contract-e3-backlog.mjs

@@ -221,7 +221,7 @@ export const E3_BACKLOG = [
     where: "driver/skills/prelim-common-law/SKILL.md:192 (restated at driver/skills/prelim-search/synthesis-rules.md:394)",
     surface: "skill-file",
     evidence: "A clean PR/connotation row MUST cite its search — add a `**Connotation-search source:** <URL | \"perplexity_research — no result\">` line.",
-    reparsedBy: "driver/connotation-search.mjs — validators.commonLaw rejects a clean claim with no such line (connotation_search_missing); the hint is re-dictated by correctionHint() in gateway.mjs",
+    reparsedBy: "driver/connotation-search.mjs — validators.commonLaw rejects a clean claim with no such line (connotation_search_missing); the hint is re-dictated at driver/gateway.mjs:1824",
     removedByMove: "NOTHING ON THE #850 PLAN REMOVES THIS",
   },
   {

package/driver/demo-container.mjs

@@ -23,9 +23,9 @@
 // stage apart. This module is the single answer. `cut/` cannot import it (that directory does not travel
 // and this one does), so the pack gate restates the disjunction and its own test pins the two together.
 
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { cpSync, existsSync, mkdtempSync, readdirSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { dirname, join, resolve, sep } from "node:path";
+import { join, resolve, sep } from "node:path";
 
 /** The entry file each lane's publisher reads as its source, in the order a child is probed for one. */
 export const ENTRY_FILES = Object.freeze(["report.md", "knockout-findings.json"]);
@@ -78,66 +78,3 @@ export function publishSource(dir, { repoRoot, tmp = tmpdir() } = {}) {
   cpSync(here, copy, { recursive: true });
   return copy;
 }
-
-/**
- * THE DEMO'S SAMPLE RUNS, WHERE AN ASSISTANT LOOKS FOR RUNS.
- *
- * The demo published its samples as reports and made no run directory, so the connector its own connect
- * line wires listed nothing: an assistant, one of the demo's three faces, had nothing to explore. Each
- * sample's finished `run/` is copied to the layout the connector walks, under the DEMO'S OWN workspace:
- * `<workspace>/workspace-<agent>/studio/prelim-search/<slug>/<date>-<codename>/`. Nothing is written
- * anywhere else, so a real install started afterwards sees none of it (the demo is its own install).
- *
- * Copied, never linked: a connector reading a run may write beside it, and `demo/` is tracked. A run
- * already in place is not copied again, so a visitor's second start changes nothing but its links.
- *
- * ITS REPORT LINKS POINT AT THIS DEMO'S PORTAL. Each sample's `status.json` carried the report URL it was
- * stamped with where it was captured, a test instance's address, and the connector hands a run's `url` to
- * the assistant as-is, so an assistant asked to open a demo report sent the person to that host (measured
- * on a published beta, 2026-09-11). The tracked samples now carry the portal's own route,
- * `/portal/report/<runId>/`, with no host, and each copy here is stamped with `portalOrigin`, the demo
- * portal's address. Stamped on EVERY start, the copies already in place included: `--port` moves the
- * portal, and a copy laid down by an earlier version still carries the old host.
- */
-export function seedDemoRuns({ workspace, examplesDir, portalOrigin = null }) {
-  const seeded = [], already = [];
-  for (const name of demoChildren(examplesDir)) {
-    const run = join(examplesDir, name, "run");
-    let s;
-    try { s = JSON.parse(readFileSync(join(run, "status.json"), "utf8")); } catch { continue; }
-    if (!s?.slug || !s?.codename || !s?.date) continue;
-    const dir = join(workspace, `workspace-${s.agent || "clawdi"}`, "studio", "prelim-search", s.slug, `${s.date}-${s.codename}`);
-    if (existsSync(join(dir, "status.json"))) already.push(s.runId);
-    else {
-      mkdirSync(dirname(dir), { recursive: true });
-      cpSync(run, dir, { recursive: true });
-      seeded.push(s.runId);
-    }
-    if (portalOrigin) stampReportLinks(join(dir, "status.json"), portalOrigin);
-  }
-  return { seeded, already };
-}
-
-/** The portal route that serves a run's report: the one `scanAccountRuns` hands the portal's own list. */
-export const reportRoute = (runId) => `/portal/report/${encodeURIComponent(runId)}/`;
-
-/**
- * Point a seeded run's report links at `origin`. A link already on the portal's route keeps its path; any
- * other (the host an older sample carried) becomes the run's own route. Written only when something moved.
- */
-export function stampReportLinks(statusFile, origin) {
-  let s;
-  try { s = JSON.parse(readFileSync(statusFile, "utf8")); } catch { return false; }
-  if (!s?.runId) return false;
-  const base = String(origin).replace(/\/+$/, "");
-  const local = (url) => {
-    const path = String(url ?? "").replace(/^https?:\/\/[^/]+/, "");
-    return `${base}${path.startsWith("/portal/report/") ? path : reportRoute(s.runId)}`;
-  };
-  const next = { ...s, url: local(s.url) };
-  if (Array.isArray(s.reports)) next.reports = s.reports.map((r) => (r && typeof r === "object" ? { ...r, url: local(r.url) } : r));
-  const text = `${JSON.stringify(next, null, 2)}\n`;
-  if (text === `${JSON.stringify(s, null, 2)}\n`) return false;
-  writeFileSync(statusFile, text);
-  return true;
-}

package/driver/driver.config.mjs

@@ -1110,11 +1110,6 @@ export const PROVIDERS = {
           office: row?.office ?? null,
           application_date: row?.application_date ?? null,
           registration_date: row?.registration_date ?? null,
-          // The office's own numbers: publish addresses the filing at the office's page from these, the
-          // way it does for this register's clearance findings. Compumark states no filing route or IR
-          // number of its own, so a Madrid designation is addressed as the national filing it is listed as.
-          application_number: row?.application_number ?? null,
-          registration_number: row?.registration_number ?? null,
           // hasPublicRecordUrl:false on this provider — there is no per-record page to link, and a
           // fabricated one would be worse than none.
           record_url: null,

package/driver/engine/anthropic-agent.mjs

@@ -467,32 +467,19 @@ export const anthropicAgentEngine = {
       let rateLimitEvent = null;   // a 429 session-cap rejection rides a `rate_limit_event` (status:"rejected" + resetsAt)
       // Streamed-usage accumulator: what the turn PROVABLY moved, observed from the stream itself, so a
       // killed turn is never journalled as usage:null when millions of tokens moved (the "137 + usage:null
-      // ⇒ mislabelled transient/lane-wedge" class).
-      //
-      // KEYED BY MESSAGE, AND EACH FIELD IS THE LARGEST READING SEEN FOR THAT MESSAGE. One API call's usage
-      // reaches the stream several times: on `message_start`, on every `assistant` event (one per content
-      // block), and on its `message_delta`, whose output count is the call's own running total. Summing the
-      // assistant events counted a call's input and cache once per block and its output at whatever it
-      // was when the block went out, and dropping the delta lost the rest: a turn killed after 75 calls
-      // journalled 810 output tokens. Which event carries the final count need not be known here, and the
-      // order is inferred rather than recorded, so every reading is kept and the largest wins. A delta names
-      // no message, so it belongs to the one its last `message_start` opened; an assistant event with no id
-      // and no open message is a call of its own, as it always was.
-      const perMessage = new Map();
-      let openMessage = null, anonMessages = 0;
-      const foldUsage = (key, u) => {
-        if (!u) return;
-        const was = perMessage.get(key);
-        perMessage.set(key, was
-          ? { input: Math.max(was.input, u.input), output: Math.max(was.output, u.output),
-              cacheRead: Math.max(was.cacheRead, u.cacheRead), cacheWrite: Math.max(was.cacheWrite, u.cacheWrite) }
-          : { input: u.input, output: u.output, cacheRead: u.cacheRead, cacheWrite: u.cacheWrite });
-      };
+      // ⇒ mislabelled transient/lane-wedge" class). Per completed API call the `assistant` event's usage is
+      // authoritative (summed); an in-flight call contributes its `message_start` usage + the latest
+      // `message_delta` output count until its own assistant event supersedes them (no double count).
+      const streamTotals = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+      let pendingStart = null, pendingDeltaOut = 0;
       const streamedUsage = () => {
-        const u = { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
-        for (const m of perMessage.values()) {
-          u.input += m.input; u.output += m.output; u.cacheRead += m.cacheRead; u.cacheWrite += m.cacheWrite;
-        }
+        const p = mapUsage(pendingStart) ?? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 };
+        const u = {
+          input: streamTotals.input + p.input,
+          output: streamTotals.output + p.output + pendingDeltaOut,
+          cacheRead: streamTotals.cacheRead + p.cacheRead,
+          cacheWrite: streamTotals.cacheWrite + p.cacheWrite,
+        };
         u.total = u.input + u.output + u.cacheRead + u.cacheWrite;
         return u.total > 0 ? u : null;   // zero observed movement stays null — a never-admitted turn must keep classifying as a lane wedge
       };
@@ -716,9 +703,9 @@ export const anthropicAgentEngine = {
             periodStart = now; periodChunk = chunkSeq;
           }
           syncOpenAsk();
-          // This block's usage, folded into its own call: the largest reading wins, so a block's early count
-          // never replaces the delta's running total, and a second block of the same call adds nothing twice.
-          foldUsage(ev.message?.id ?? openMessage ?? `__assistant_${++anonMessages}`, mapUsage(ev.message?.usage));
+          const u = mapUsage(ev.message?.usage);
+          if (u) { streamTotals.input += u.input; streamTotals.output += u.output; streamTotals.cacheRead += u.cacheRead; streamTotals.cacheWrite += u.cacheWrite; }
+          pendingStart = null; pendingDeltaOut = 0;   // this call's usage is now authoritative — drop its partials
           progress();
         }
         else if (ev.type === "user") {
@@ -750,12 +737,8 @@ export const anthropicAgentEngine = {
         }
         else if (ev.type === "stream_event") {
           const t = ev.event?.type;
-          if (t === "message_start") {
-            openMessage = ev.event.message?.id ?? `__start_${++anonMessages}`;
-            foldUsage(openMessage, mapUsage(ev.event.message?.usage));
-            progress();
-          }
-          else if (t === "message_delta") { foldUsage(openMessage ?? "__delta_without_start", mapUsage(ev.event?.usage)); progress(); }
+          if (t === "message_start") { pendingStart = ev.event.message?.usage ?? null; progress(); }
+          else if (t === "message_delta") { const o = Number(ev.event?.usage?.output_tokens); if (o > 0) pendingDeltaOut = o; progress(); }
           else if (t === "content_block_delta" || t === "content_block_start") progress();
           // THINKING GAUGE (partials): the earliest tells. Any one is sufficient; belt-and-braces so a
           // display-mode or CLI-version change cannot silently blind the gauge.

package/driver/engine/jx-turn.mjs

@@ -94,10 +94,7 @@ export function readJxTuple(tuple, { vendor, authMode, engine }) {
   if (tuple?.killed || tuple?.signals?.stalled)
     return { ok: false, cause: "the engine turn was killed before it answered (stall or wall)", truncationObservable: observable, ...base };
   if (tuple?.signals?.rateLimited)
-    // FLAGGED, not only described: a rate limit is the one failure a caller may call passing, and it
-    // needs to know that without parsing this sentence. `resetsAt` is the adapter's, when it read one.
-    return { ok: false, cause: "the engine turn was rate-limited", rateLimited: true, resetsAt: tuple?.signals?.resetsAt ?? null,
-      truncationObservable: observable, ...base };
+    return { ok: false, cause: "the engine turn was rate-limited", truncationObservable: observable, ...base };
   if (tuple?.code !== 0 || tuple?.json?.status !== "ok")
     return { ok: false, cause: `the engine turn did not complete cleanly (code ${tuple?.code ?? "?"}, status ${tuple?.json?.status ?? "none"})`,
       truncationObservable: observable, ...base };

package/driver/engine/openai-agent.mjs

@@ -22,8 +22,7 @@
 // CLEAROTRON_CODEX_SANDBOX_BYPASS=1 swaps that `--sandbox workspace-write` for
 // `--dangerously-bypass-approvals-and-sandbox` — see buildCodexArgs below for why.
 
-import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync, symlinkSync, lstatSync, realpathSync } from "node:fs";
-import { writeSecretFile } from "../../shared/secret-file.mjs";   // the rotated login goes back the way every credential is written
+import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { tmpdir, homedir } from "node:os";
 import { join } from "node:path";
 import { runStreamingChild, absolutizeSkillRefs, WRITE_DISCIPLINE, buildEnvelope, resolveSpawnCwd } from "./common.mjs";
@@ -175,49 +174,6 @@ export function spawnEnv(base = process.env, codexHome) {
 
 const authFilePath = (env = process.env) => env.CLEAROTRON_OPENAI_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 
-// ── THE LOGIN IS THE MASTER'S, NOT A COPY'S ─────────────────────────────────────────────────────────
-//
-// codex refreshes its access token inside a turn and rotates the refresh token as it does, and the
-// provider accepts each refresh token once. The stage home used to be seeded with a COPY of the master
-// login and deleted when its ladder settled, so the rotated token was deleted with it. The master kept a
-// token the provider had already consumed, and every later stage on every run failed its refresh with a
-// 401 until a person signed in again. The engine's only report was an exit code.
-//
-// So the stage home LINKS to the master: a refresh codex writes in place lands where the next stage
-// reads, including a ladder running beside this one. If codex replaces the link with a file of its own,
-// `returnAuth` writes that file back.
-
-/** Point `<codexHome>/auth.json` at the master login. Returns what the master held, for `returnAuth`. */
-function seedAuth(masterPath, codexHome) {
-  const seat = join(codexHome, "auth.json");
-  // A LINK LEFT BY THIS LADDER'S PREVIOUS TURN is removed first: copying the master onto a link to
-  // itself would truncate the one file the login lives in.
-  rmSync(seat, { force: true });
-  symlinkSync(masterPath, seat);
-  return readFileSync(masterPath, "utf8");
-}
-
-/**
- * After a turn: a login codex rewrote as its own file goes back to the master.
- *
- * ONLY WHILE THE MASTER STILL HOLDS WHAT THIS TURN WAS SEEDED WITH. A master that moved meanwhile was
- * rotated by another ladder, and the provider accepts one refresh per token, so of two rotations from
- * one seed only one can be live. Writing ours over theirs could put back the spent one.
- */
-export function returnAuth(masterPath, codexHome, seeded) {   // @internal
-  const seat = join(codexHome, "auth.json");
-  let st;
-  try { st = lstatSync(seat); } catch { return false; }
-  if (st.isSymbolicLink() || !st.isFile()) return false;   // written through the link, or not there
-  const now = readFileSync(seat, "utf8");
-  if (now === seeded) return false;
-  let master;
-  try { master = readFileSync(masterPath, "utf8"); } catch { return false; }
-  if (master !== seeded) return false;
-  writeSecretFile(masterPath, now);
-  return true;
-}
-
 // Build the codex argv. Prompt rides STDIN via the `-` placeholder (no MAX_ARG_STRLEN ceiling on a 150KB
 // register prompt). Global flags precede the `resume` subcommand (flag-corpus ordering). config.toml
 // (mcp_servers + developer_instructions) rides CODEX_HOME, not argv.
@@ -412,10 +368,6 @@ export function readServedModel(codexHome, sinceMs = 0) {
 // that cannot recur. This alternation is still a list of prose a vendor may change without notice,
 // which is exactly why `rateLimitBasis: "text-match"` stays on the record.
 const RATE_LIMIT_RE = /\b429\b|rate.?limit|usage limit|quota|too many requests|insufficient_quota/i;
-// A SIGN-IN THAT CAN NO LONGER BE REFRESHED, in codex's own words (measured on a live install, 2026-09-11).
-// Narrow on purpose: a register provider's 401 or 403 can land in a stage's stderr too, and reading that as
-// the operator's codex login having expired would send them to sign in again for nothing.
-const REFRESH_FAILED_RE = /refresh token (?:has|was) already been used|access token could not be refreshed|failed to refresh token/i;
 
 // A retry hint, WHEN THE MESSAGE HAPPENS TO CARRY ONE. Two anchored shapes and nothing clever: an
 // explicit timestamp, or a relative delay with a unit. Anything else yields undefined and the driver
@@ -488,7 +440,6 @@ function settleTuple({ r, ev, resumeRef }) {
   // backoff (CLEAROTRON_RATE_LIMIT_DEFAULT_BACKOFF_MS), exactly as the anthropic no-reset 429 path does.
   const rateLimitText = `${ev.turnFailed || ""}\n${ev.streamError || ""}\n${r.stderr || ""}`;
   const rateLimited = !killed && RATE_LIMIT_RE.test(rateLimitText);
-  const signedOut = !killed && REFRESH_FAILED_RE.test(rateLimitText);
   const resetsAt = rateLimited ? parseResetHint(rateLimitText) : undefined;
   return {
     code: killed ? 137 : (failed ? (r.rawCode || 1) : 0),
@@ -526,9 +477,6 @@ function settleTuple({ r, ev, resumeRef }) {
       // receives and is not this adapter's call — but nothing downstream can any longer fail to know.
       mcpRefused: mcpToolGauge(ev).mcpToolCallsRefused > 0 || undefined,
       rateLimited: rateLimited || undefined,
-      // The engine's sign-in could not be refreshed: what the operator runs to fix it. The gateway names the
-      // stage's failure with it.
-      signedOut: signedOut ? "codex sign-in expired — run `codex login`, then start the search again" : undefined,
       rateLimitBasis: rateLimited ? "text-match" : undefined,
       // resetsAtBasis (2026-08-20): same honesty as rateLimitBasis one line up, for the reset
       // CLOCK rather than the classification. codex states its reset as human prose with NO timezone
@@ -582,7 +530,6 @@ export const openaiAgentEngine = {
     const ownHome = !providedHome;
     try { codexHome = providedHome ?? mkdtempSync(join(tmpdir(), "codex-home-")); }
     catch (e) { return errResult(t0, e, resumeRef); }
-    let authMaster = null, seeded = null;
     try {
       // Auth toggle (may throw loud on api-key-without-key — a config error, not a retryable failure).
       const { env, mode } = spawnEnv(process.env, codexHome);
@@ -590,9 +537,7 @@ export const openaiAgentEngine = {
         const af = authFilePath(process.env);
         if (!existsSync(af))
           throw new Error(`CLEAROTRON_AI_BILLING=subscription but no auth.json at ${af} — run \`codex login\` (or set CLEAROTRON_OPENAI_AUTH_FILE — NOT an aliased name, and deliberately left as it is), or use CLEAROTRON_AI_BILLING=api-key + CODEX_API_KEY.`);
-        // The REAL path, so a master that is itself a link is written where its login actually lives.
-        authMaster = realpathSync(af);
-        seeded = seedAuth(authMaster, codexHome);
+        copyFileSync(af, join(codexHome, "auth.json"));
       }
       // Per-run config.toml: the gather MCP servers (translated from the claude-shaped mcpConfig, so
       // gather-config.mjs is untouched) + developer_instructions = WRITE_DISCIPLINE (codex's
@@ -629,9 +574,6 @@ export const openaiAgentEngine = {
       if (!ev.model) ev.model = readServedModel(codexHome, spawnedAtMs);
       return settleTuple({ r, ev, resumeRef });
     } finally {
-      // BEFORE the home can be deleted, here or by the ladder that owns it. A failed write-back leaves the
-      // turn's result as it was; the next turn is seeded from the master either way.
-      try { if (authMaster) returnAuth(authMaster, codexHome, seeded); } catch { /* the master is unchanged */ }
       try { if (ownHome && codexHome) rmSync(codexHome, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
     }
   },

package/driver/enqueue-schema.mjs

@@ -456,9 +456,7 @@ export function validateJob(job, { atClaim = false } = {}) {
       if (projectKey) consulted.push(`the project ${JSON.stringify(projectKey)}`);
       // The saved search is a rung above the project. `clarify` means the selector itself is wrong, which
       // the recipeKey/product checks further down report properly — here it just means no scope to read.
-      // The store is read only for a job that names a saved search, as every other door reads it: one that
-      // cannot be read must not refuse a job that never asked for anything in it.
-      const resolved = resolveSearchPolicy(job, { profile, recipes: job.recipeKey ? loadRecipes({ force: true, proseGuard: recipeProseGuard }) : null });
+      const resolved = resolveSearchPolicy(job, { profile, recipes: loadRecipes({ force: true, proseGuard: recipeProseGuard }) });
       if (job.recipeKey) consulted.push(`the saved search ${JSON.stringify(String(job.recipeKey))}`);
       const scope = resolveEffectiveScope(job, profile, resolved?.clarify ? null : resolved);
       inherited = Array.isArray(scope?.classes) ? scope.classes : [];