clearotron 0.3.0-beta.3 → 0.3.0-beta.5

package/driver/engine/openai-agent.mjs

@@ -22,7 +22,8 @@
 // CLEAROTRON_CODEX_SANDBOX_BYPASS=1 swaps that `--sandbox workspace-write` for
 // `--dangerously-bypass-approvals-and-sandbox` — see buildCodexArgs below for why.
 
-import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync, symlinkSync, lstatSync, realpathSync } from "node:fs";
+import { writeSecretFile } from "../../shared/secret-file.mjs";   // the rotated login goes back the way every credential is written
 import { tmpdir, homedir } from "node:os";
 import { join } from "node:path";
 import { runStreamingChild, absolutizeSkillRefs, WRITE_DISCIPLINE, buildEnvelope, resolveSpawnCwd } from "./common.mjs";
@@ -174,6 +175,49 @@ export function spawnEnv(base = process.env, codexHome) {
 
 const authFilePath = (env = process.env) => env.CLEAROTRON_OPENAI_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 
+// ── THE LOGIN IS THE MASTER'S, NOT A COPY'S ─────────────────────────────────────────────────────────
+//
+// codex refreshes its access token inside a turn and rotates the refresh token as it does, and the
+// provider accepts each refresh token once. The stage home used to be seeded with a COPY of the master
+// login and deleted when its ladder settled, so the rotated token was deleted with it. The master kept a
+// token the provider had already consumed, and every later stage on every run failed its refresh with a
+// 401 until a person signed in again. The engine's only report was an exit code.
+//
+// So the stage home LINKS to the master: a refresh codex writes in place lands where the next stage
+// reads, including a ladder running beside this one. If codex replaces the link with a file of its own,
+// `returnAuth` writes that file back.
+
+/** Point `<codexHome>/auth.json` at the master login. Returns what the master held, for `returnAuth`. */
+function seedAuth(masterPath, codexHome) {
+  const seat = join(codexHome, "auth.json");
+  // A LINK LEFT BY THIS LADDER'S PREVIOUS TURN is removed first: copying the master onto a link to
+  // itself would truncate the one file the login lives in.
+  rmSync(seat, { force: true });
+  symlinkSync(masterPath, seat);
+  return readFileSync(masterPath, "utf8");
+}
+
+/**
+ * After a turn: a login codex rewrote as its own file goes back to the master.
+ *
+ * ONLY WHILE THE MASTER STILL HOLDS WHAT THIS TURN WAS SEEDED WITH. A master that moved meanwhile was
+ * rotated by another ladder, and the provider accepts one refresh per token, so of two rotations from
+ * one seed only one can be live. Writing ours over theirs could put back the spent one.
+ */
+export function returnAuth(masterPath, codexHome, seeded) {   // @internal
+  const seat = join(codexHome, "auth.json");
+  let st;
+  try { st = lstatSync(seat); } catch { return false; }
+  if (st.isSymbolicLink() || !st.isFile()) return false;   // written through the link, or not there
+  const now = readFileSync(seat, "utf8");
+  if (now === seeded) return false;
+  let master;
+  try { master = readFileSync(masterPath, "utf8"); } catch { return false; }
+  if (master !== seeded) return false;
+  writeSecretFile(masterPath, now);
+  return true;
+}
+
 // Build the codex argv. Prompt rides STDIN via the `-` placeholder (no MAX_ARG_STRLEN ceiling on a 150KB
 // register prompt). Global flags precede the `resume` subcommand (flag-corpus ordering). config.toml
 // (mcp_servers + developer_instructions) rides CODEX_HOME, not argv.
@@ -530,6 +574,7 @@ export const openaiAgentEngine = {
     const ownHome = !providedHome;
     try { codexHome = providedHome ?? mkdtempSync(join(tmpdir(), "codex-home-")); }
     catch (e) { return errResult(t0, e, resumeRef); }
+    let authMaster = null, seeded = null;
     try {
       // Auth toggle (may throw loud on api-key-without-key — a config error, not a retryable failure).
       const { env, mode } = spawnEnv(process.env, codexHome);
@@ -537,7 +582,9 @@ export const openaiAgentEngine = {
         const af = authFilePath(process.env);
         if (!existsSync(af))
           throw new Error(`CLEAROTRON_AI_BILLING=subscription but no auth.json at ${af} — run \`codex login\` (or set CLEAROTRON_OPENAI_AUTH_FILE — NOT an aliased name, and deliberately left as it is), or use CLEAROTRON_AI_BILLING=api-key + CODEX_API_KEY.`);
-        copyFileSync(af, join(codexHome, "auth.json"));
+        // The REAL path, so a master that is itself a link is written where its login actually lives.
+        authMaster = realpathSync(af);
+        seeded = seedAuth(authMaster, codexHome);
       }
       // Per-run config.toml: the gather MCP servers (translated from the claude-shaped mcpConfig, so
       // gather-config.mjs is untouched) + developer_instructions = WRITE_DISCIPLINE (codex's
@@ -574,6 +621,9 @@ export const openaiAgentEngine = {
       if (!ev.model) ev.model = readServedModel(codexHome, spawnedAtMs);
       return settleTuple({ r, ev, resumeRef });
     } finally {
+      // BEFORE the home can be deleted, here or by the ladder that owns it. A failed write-back leaves the
+      // turn's result as it was; the next turn is seeded from the master either way.
+      try { if (authMaster) returnAuth(authMaster, codexHome, seeded); } catch { /* the master is unchanged */ }
       try { if (ownHome && codexHome) rmSync(codexHome, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
     }
   },

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.3",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-upstream.mjs

@@ -420,6 +420,11 @@ export function makeUpstream({ callUpstream, callRecipes = null, recipesOff = nu
       const draft = {};
       for (const k of CREATABLE_FIELDS) if (body[k] !== undefined) draft[k] = body[k];
       const r = await call("POST", "/profiles", draft, principal);
+      // A STORE THAT CANNOT RECORD THE COMPANY is answered with its path and the git commands that fix it.
+      // That sentence is for whoever runs the installation. A manager who holds an organisation cannot act
+      // on it and must not be shown the server's paths, so they are told what to do instead.
+      if (r.status === 409 && String(r.json?.code ?? "").startsWith("store_") && !seesEverything(principal))
+        return { status: 409, json: { code: r.json.code, error: STORE_REFUSAL_FOR_MANAGERS } };
       if (r.status !== 201 || org == null || !fileCompany) return r;
       const key = r.json?.key ?? r.json?.profile?.key ?? draft.key;
       try { await fileCompany({ tenant: org, account: key }); }
@@ -431,6 +436,10 @@ export function makeUpstream({ callUpstream, callRecipes = null, recipesOff = nu
   };
 }
 
+/** The store refusal as a manager who does not run the installation reads it: no path, no command. */
+export const STORE_REFUSAL_FOR_MANAGERS = "No company was created: this installation cannot save new companies yet, "
+  + "and nothing was changed. Ask whoever runs it to fix the company store.";
+
 /**
  * What a browser may state when creating a company.
  *

package/driver/suite-census.json

@@ -135,6 +135,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-codex-login-survives-its-own-refresh.test.mjs": {
+          "tests": 3,
+          "asserts": 14,
+          "skips": 0,
+          "todos": 0
+        },
         "a-company-can-be-given-a-framework-after-it-exists.test.mjs": {
           "tests": 8,
           "asserts": 19,
@@ -381,6 +387,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-local-install-hands-its-stores-to-every-reader.test.mjs": {
+          "tests": 1,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "a-mark-name-cannot-lie-about-how-it-reads.test.mjs": {
           "tests": 9,
           "asserts": 37,
@@ -747,6 +759,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-store-refusal-reaches-the-person-who-can-fix-it.test.mjs": {
+          "tests": 3,
+          "asserts": 11,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stored-territory-that-does-nothing-is-named.test.mjs": {
           "tests": 6,
           "asserts": 12,
@@ -1366,8 +1384,8 @@
           "todos": 0
         },
         "connect-clients-are-data.test.mjs": {
-          "tests": 12,
-          "asserts": 46,
+          "tests": 15,
+          "asserts": 75,
           "skips": 0,
           "todos": 0
         },
@@ -1397,7 +1415,7 @@
         },
         "connector-annotations-and-pack.test.mjs": {
           "tests": 7,
-          "asserts": 11,
+          "asserts": 12,
           "skips": 0,
           "todos": 0
         },
@@ -1804,8 +1822,8 @@
           "todos": 0
         },
         "doctor-reads-the-units-not-the-shell.test.mjs": {
-          "tests": 30,
-          "asserts": 85,
+          "tests": 32,
+          "asserts": 93,
           "skips": 0,
           "todos": 0
         },
@@ -4725,6 +4743,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-proving-question-names-no-engines-model.test.mjs": {
+          "tests": 2,
+          "asserts": 5,
+          "skips": 0,
+          "todos": 0
+        },
         "the-public-residue-is-a-floor.test.mjs": {
           "tests": 15,
           "asserts": 59,
@@ -5404,7 +5428,7 @@
         },
         "describe-options.test.mjs": {
           "tests": 23,
-          "asserts": 98,
+          "asserts": 99,
           "skips": 0,
           "todos": 0
         },
@@ -5594,8 +5618,8 @@
       "ext": "ts",
       "perFile": {
         "api.test.ts": {
-          "tests": 43,
-          "asserts": 170,
+          "tests": 44,
+          "asserts": 176,
           "skips": 0,
           "todos": 0
         },
@@ -5774,8 +5798,8 @@
           "todos": 0
         },
         "newCompanyReachableFromProfile.test.ts": {
-          "tests": 3,
-          "asserts": 7,
+          "tests": 5,
+          "asserts": 13,
           "skips": 0,
           "todos": 0
         },
@@ -5913,7 +5937,7 @@
         },
         "useYourAI.test.ts": {
           "tests": 13,
-          "asserts": 46,
+          "asserts": 41,
           "skips": 0,
           "todos": 0
         },

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,15 @@
 # trademark-artifacts-mcp
 
+## 0.3.0-beta.5
+
+### Patch Changes
+
+- e7cd9e1: Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
+
+## 0.3.0-beta.4
+
+No changes in this release.
+
 ## 0.3.0-beta.3
 
 No changes in this release.
@@ -14,11 +24,11 @@ No changes in this release.
 
 ### Patch Changes
 
-- b8ec213: Fixed: a company you create in the browser now appears in your assistant's list of companies straight away.
+- b8ec213: Fixed: A company you create in the browser now appears in your assistant's list of companies straight away.
   
   It used to appear only after the service restarted, although a search could already be started for it. Its projects were missing from the list in the same way, and so was its account in the search options.
   
-  The live surface check no longer reports a company outside the portal's trigger key as the service and the store disagreeing. It names the key's gap on a line of its own, with the command to widen the key.
+  The check comparing the running service with the configuration store no longer calls a company the portal's key does not cover a disagreement. It names that gap on a line of its own, with the command that widens the key.
 
 ## 0.2.4
 

package/mcp-server/lib/options.mjs

@@ -193,7 +193,10 @@ function accountFor(key, { scope, now }) {
     profile = loadProfiles().get(key) ?? null;
     if (!profile) { fresh = loadProfiles({ force: true }); profile = fresh.get(key) ?? null; }
   } catch { return null; }   // unreadable roster ⇒ say nothing
-  if (!profile || profile.key === "generic") return null;
+  // GENERIC IS ANSWERED LIKE ANY COMPANY (owner ruling, 2026-09-11). It owns saved searches in the portal,
+  // and a fresh install holds Generic alone, so treating it as nobody's account told the assistant on
+  // every such install that none existed.
+  if (!profile) return null;
 
   let projects = [];
   try {

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.0-beta.3",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.0-beta.3",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/dist/assets/{index-CsCuPshD.css → index-Cv-E_agg.css}

@@ -2205,127 +2205,249 @@ input.filter {
 }
 
 
-.ai-connect-head { margin-top: 28px; }
+/* ── WHAT YOU CAN DO ─────────────────────────────────────────────────────────────────────────────── */
+.ai-can { margin-top: 20px; max-width: 860px; }
 
-/* ── ONE QUESTION, WHEN THE DEPLOYMENT LEAVES IT OPEN ─────────────────────────── */
-.ai-where { margin: 0 0 14px; max-width: var(--screen-measure); }
+.ai-screen .ai-can h2 { font-size: 14.5px; margin: 0 0 3px; }
 
-.ai-where-q { margin: 0 0 8px; font-size: 15px; color: var(--text-strong); }
+.ai-can-list {
+  list-style: none;
+  margin: 8px 0 0;
+  padding: 0;
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 8px 28px;
+}
 
-.ai-seg { display: inline-flex; border: 1px solid var(--border-hairline); border-radius: 7px; overflow: hidden; }
+@media (max-width: 700px) { .ai-can-list { grid-template-columns: 1fr; } }
 
-.ai-seg-btn {
-  appearance: none;
-  border: 0;
-  background: transparent;
-  padding: 7px 14px;
-  font: inherit;
+.ai-can-list li { display: flex; gap: 9px; font-size: 14px; line-height: 1.5; color: var(--text-body); }
+
+.ai-can-list li svg { margin-top: 3px; color: var(--accent-quiet); }
+
+.ai-can-foot {
+  margin: 13px 0 0;
+  padding-top: 11px;
+  border-top: 1px solid var(--border-hairline);
+  font-size: 13.5px;
   color: var(--text-muted);
-  cursor: pointer;
 }
 
-.ai-seg-btn + .ai-seg-btn { border-left: 1px solid var(--border-hairline); }
-
-.ai-seg-btn[data-on] { background: var(--surface-sunken); color: var(--text-strong); }
+.ai-can-foot strong { color: var(--text-strong); }
 
-.ai-where-sub { margin: 10px 0 14px; color: var(--text-muted); max-width: var(--screen-measure); }
+.ai-connect { margin-top: 34px; }
 
-.ai-none { margin: 0; max-width: var(--screen-measure); color: var(--text-muted); line-height: 1.65; }
+.ai-screen .ai-connect-head { margin: 0 0 12px; }
 
-.ai-none strong { color: var(--text-strong); }
+/* ── THE WHERE-CHOICE ─────────────────────────────────────────────────────────────────────────────
+   ONE control, the same size before and after a pick. Selection is shown the way every other choice in
+   the portal shows it — accent wash, accent border, filled radio — and never a second colour. */
+.where-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
 
-/* ── THE DESTINATION LIST ─────────────────────────────────────────────────────────────────────────── */
-.ai-dests {
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  max-width: var(--screen-measure);
-}
+@media (max-width: 640px) { .where-grid { grid-template-columns: 1fr; } }
 
-/* ONE HEIGHT AND ONE WIDTH, ALWAYS. The owner reported the old row set as "stacked, inconsistent
-   heights"; more importantly a row that resizes when it is pressed moves its neighbours, which is the
-   reflow this rebuild exists to end. */
-.ai-dest {
+.where-card {
   display: flex;
   align-items: center;
-  justify-content: space-between;
-  gap: 16px;
-  width: 100%;
-  min-height: 46px;
-  padding: 8px 14px;
-  border: 1px solid var(--border-hairline);
-  border-radius: 8px;
+  gap: 12px;
+  padding: 18px;
+  border: 1px solid var(--border-strong);
+  border-radius: 12px;
   background: var(--surface-raised);
   font: inherit;
+  font-size: 16px;
+  font-weight: 700;
+  line-height: 1.35;
+  color: var(--text-strong);
   text-align: left;
   cursor: pointer;
 }
 
-.ai-dest[data-selected] { border-color: var(--accent); }
+.where-card:hover { border-color: var(--accent-ink); }
 
-/* THE PRESSED CONTROL IS THE CONFIRMATION. Solid accent, not a muted caption underneath — the previous
-   feedback was grey text below the button and the owner could not see it happen. */
-.ai-dest[data-copied] {
-  background: var(--accent);
-  border-color: var(--accent);
-  color: var(--text-on-accent);
+.where-card[aria-pressed='true'],
+.where-card[aria-pressed='true']:hover { border-color: var(--accent); background: var(--accent-wash); }
+
+.ai-none { margin: 22px 0 0; max-width: 860px; border-left-color: var(--tone-medium); }
+
+.ai-none p { margin: 6px 0 0; color: var(--text-muted); font-size: 13.5px; line-height: 1.55; }
+
+/* ── THE APP LIST AND THE PANEL BESIDE IT ─────────────────────────────────────────────────────── */
+.ai-connect-grid {
+  display: grid;
+  grid-template-columns: minmax(260px, 360px) minmax(0, 1fr);
+  gap: 20px;
+  margin-top: 22px;
+  align-items: start;
 }
 
-.ai-dest[data-copied] .ai-dest-sub { color: inherit; opacity: 0.85; }
+@media (max-width: 860px) { .ai-connect-grid { grid-template-columns: 1fr; } }
+
+.ai-apps { display: flex; flex-direction: column; gap: 8px; margin-top: 6px; }
+
+/* The New Clearance picker's radio-row, centred because these rows carry a name and at most one line. */
+.ai-app { width: 100%; align-items: center; font: inherit; }
 
-.ai-dest-name { display: flex; flex-direction: column; gap: 2px; color: var(--text-strong); }
+.ai-app-label { min-width: 0; }
 
-.ai-dest[data-copied] .ai-dest-name { color: inherit; }
+.ai-app-name { display: block; font-size: 14px; font-weight: 700; color: var(--text-strong); }
 
-.ai-dest-sub { font-size: 12.5px; color: var(--text-faint); }
+.ai-app-sub { display: block; margin-top: 1px; font-size: 12px; line-height: 1.5; color: var(--text-muted); }
+
+.ai-app-go { margin-left: auto; display: inline-flex; color: var(--text-accent); opacity: 0; }
+
+.pick-row-on .ai-app-go { opacity: 1; }
+
+/* ── THE RESERVED SLOT ──────────────────────────────────────────────────────────────────────────────
+   A MINIMUM HEIGHT WHETHER OR NOT ANYTHING IS IN IT, and the page raises it to the tallest panel this
+   card can show — so neither picking an app nor pressing Copy moves anything around it. */
+.ai-slot { position: relative; min-height: 180px; }
+
+/* The hidden copy of every panel the slot's height is taken from. Laid out at the slot's own width, never
+   seen, never reached by a pointer or a keyboard. */
+.ai-probe {
+  position: absolute;
+  top: 0;
+  left: 0;
+  right: 0;
+  display: grid;
+  align-items: start;
+  visibility: hidden;
+  pointer-events: none;
+}
 
-/* THE SLOT BOTH LABELS SHARE. Laid out with a grid so the cell is as wide as the WIDER of the two, in
-   every row, whether or not it has been pressed — swapping the text then costs zero layout. */
-.ai-dest-say { display: grid; font-size: 13px; }
+/* Stacked in one cell, so the copy is as tall as its tallest panel and never taller than the slot. */
+.ai-probe > * { grid-area: 1 / 1; }
 
-.ai-dest-idle, .ai-dest-done { grid-area: 1 / 1; white-space: nowrap; }
+.steps-panel {
+  border: 1px solid var(--border-strong);
+  border-left: 3px solid var(--accent);
+  border-radius: 12px;
+  background: var(--surface-raised);
+  padding: 18px 20px 20px;
+}
 
-.ai-dest-idle { color: var(--text-faint); }
+.ai-slot > .steps-panel { min-height: inherit; }
 
-.ai-dest-done { color: inherit; font-weight: 600; visibility: hidden; }
+.steps-panel-empty {
+  border-left-color: var(--border-strong);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
 
-.ai-dest[data-copied] .ai-dest-idle { visibility: hidden; }
+.steps-empty { display: flex; align-items: center; gap: 9px; color: var(--text-faint); font-size: 14px; }
 
-.ai-dest[data-copied] .ai-dest-done { visibility: visible; }
+.ai-screen .steps-name { margin: 3px 0 0; font-size: 18px; font-weight: 700; color: var(--text-strong); }
 
-/* ── THE RESERVED SLOT ────────────────────────────────────────────────────────────────────────────── */
-/* A MINIMUM HEIGHT WHETHER OR NOT ANYTHING IS IN IT. This is what makes "nothing above the panel moves"
-   a property of the layout rather than a hope about content sizes. */
-.ai-slot {
+/* ── THE NUMBERED STEPS ─────────────────────────────────────────────────────────────────────────── */
+ol.steps {
+  list-style: none;
+  counter-reset: step;
   margin: 16px 0 0;
-  min-height: 240px;
-  max-width: var(--screen-measure);
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 16px;
 }
 
-.ai-slot-empty { margin: 0; color: var(--text-faint); }
+ol.steps > li {
+  counter-increment: step;
+  display: grid;
+  grid-template-columns: 24px minmax(0, 1fr);
+  gap: 11px;
+}
 
-.ai-panel {
-  padding: 14px 16px;
-  border: 1px solid var(--border-hairline);
-  border-radius: 8px;
+ol.steps > li::before {
+  content: counter(step);
+  width: 23px;
+  height: 23px;
+  margin-top: -1px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  border-radius: 50%;
   background: var(--surface-sunken);
+  border: 1px solid var(--border-hairline);
+  font-family: var(--font-mono);
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--text-muted);
 }
 
-.ai-panel-head { margin: 0 0 8px; font-size: 15px; color: var(--text-strong); }
+.step-text { font-size: 14px; line-height: 1.55; color: var(--text-body); }
+
+.step-text b { color: var(--text-strong); }
+
+.step-hint { margin-top: 4px; font-size: 12.5px; line-height: 1.5; color: var(--text-muted); }
 
-.ai-panel-landed { margin: 0 0 10px; font-size: 13px; color: var(--text-muted); }
+.ai-code {
+  padding: 1px 5px;
+  border: 1px solid var(--border-hairline);
+  border-radius: 4px;
+  background: var(--surface-sunken);
+  font-family: var(--font-mono);
+  font-size: 12px;
+  color: var(--text-strong);
+  overflow-wrap: anywhere;
+}
 
-.ai-panel-steps {
+.codeblock {
+  margin-top: 8px;
+  display: flex;
+  align-items: flex-start;
+  gap: 10px;
+  padding: 10px 10px 10px 13px;
+  border: 1px solid var(--border-hairline);
+  border-radius: 10px;
+  background: var(--surface-sunken);
+}
+
+.codeblock pre {
+  flex: 1;
+  min-width: 0;
   margin: 0;
-  padding-left: 20px;
-  line-height: 1.7;
-  color: var(--text-body);
+  padding-top: 3px;
+  overflow-x: auto;
+  font-family: var(--font-mono);
+  font-size: 12px;
+  line-height: 1.6;
+  color: var(--text-strong);
 }
 
-.ai-panel-stamp { margin: 10px 0 0; font-size: 12.5px; color: var(--text-faint); }
+.codeblock .btn-ghost { padding: 6px 12px; white-space: nowrap; }
+
+.secret-btn { margin-top: 8px; }
+
+/* THE PRESSED CONTROL IS THE CONFIRMATION: solid accent on the button pressed, never a muted caption. */
+.is-copied,
+.is-copied:hover,
+.btn-primary.is-copied:hover:not(:disabled) { background: var(--accent); border-color: var(--accent); color: var(--text-on-accent); }
+
+.landed {
+  margin-top: 10px;
+  padding: 10px 13px;
+  border: 1px solid var(--border-hairline);
+  border-radius: 10px;
+  background: var(--surface-sunken);
+}
+
+.landed-label {
+  font-size: 10px;
+  font-weight: 700;
+  letter-spacing: 0.13em;
+  text-transform: uppercase;
+  color: var(--text-faint);
+}
+
+.landed .mono { font-size: 12px; color: var(--text-strong); overflow-wrap: anywhere; }
+
+.landed .mono + .mono { margin-top: 2px; }
 
 .ai-said { margin: 0 0 6px; color: var(--text-muted); }
 
+.ai-failed { margin: 10px 0 0; }
+
 .ai-pre {
   margin: 0;
   padding: 10px;
@@ -2335,21 +2457,12 @@ input.filter {
   font-size: 13px;
 }
 
-/* The help a person needs, on the page. The link to the document keeps an honest label beside it. */
-.ai-help { margin: 30px 0 0; max-width: var(--screen-measure); }
-
-.ai-help > summary {
-  cursor: pointer;
-  color: var(--text-muted);
-  font-size: 13px;
-  font-style: italic;
-}
-
-.ai-help-body { margin: 10px 0 0; color: var(--text-muted); line-height: 1.65; }
+/* The help a person needs, as a quiet notice. The link opens the document where a reader's own AI can
+   read it too. */
+.ai-help { margin-top: 30px; max-width: 860px; }
 
-.ai-help-body p { margin: 0 0 10px; }
+.ai-help p { margin: 6px 0 0; color: var(--text-muted); font-size: 13.5px; line-height: 1.55; }
 
-.ai-help-doc { font-size: 13px; }
 
 /* ── Give someone access: the points on the tree a new person can be given ─────────────────────────────
    One row per point. A BUTTON, because choosing a point is an action and a keyboard has to reach it; the