clearotron 0.3.0-beta.4 → 0.3.0-beta.5

package/INSTALL.md

@@ -749,6 +749,8 @@ Use the demo to see what this system produces. Use `npx clearotron start` to run
 
 - Generates `PORTAL_SECRET` and `TRADEMARK_MCP_TOKEN_SECRET` and **appends** them to `~/.config/clearotron/.env` at
   mode 600. Append, never rewrite: that file also holds the credentials `npx clearotron install` collected.
+  It also records where saved searches are kept, `CLEAROTRON_RECIPES_DIR` and `RECIPE_REPO_ROOT`, so
+  `clearotron doctor` and a connected assistant read the same saved searches as the portal.
 - Creates `~/trademark/` — `pool/`, `workspace/`, `queue/`, `outbox/`, `locks/`, an empty grants file,
   and a small git repository for saved searches. Same base directory `npx clearotron install` uses, so whichever
   of the two you ran first, the other finds the same install. Move it with `npx clearotron start --base <dir>`.

package/bin/onboard.mjs

@@ -99,7 +99,15 @@ import { entrypointOf } from "../driver/systemd/install-census.mjs";         //
 import { overlayReport, renderOverlayReport } from "../shared/doctrine-overlay.mjs";   // — the doctor reports the overlay
 import { whereSavesGo, storeCommitRefusal, storeInRepo, storeOutsideRepoMessage, resolveStoreRepoRoot } from "../shared/store-in-repo.mjs";   // — doctor says where a portal save goes once it is committed, and why saved searches are off
 import { engineInventory, engineMode, ENGINE_MODES } from "../driver/config-inventory.mjs";   //
-import { probeEngineTurn, probeFailureText, PROBE_MODEL, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
+import { probeEngineTurn, probeFailureText, PROBE_TIMEOUT_SEC, engineEnvKeys } from "../driver/engine/probe.mjs";
+
+// THE PROVING SENTENCES NAME NO MODEL. They printed the driver's tier word, which is an Anthropic model's
+// name, on both engines, so a codex user was told setup was about to spend on a model family they do not
+// use. "Its cheapest model" is true of either engine and brands neither.
+export const probingLine = (engineId) =>
+  `Probing ${engineId} with one turn on its cheapest model (this SPENDS; ${PROBE_TIMEOUT_SEC}s ceiling)…`;
+export const proveQuestion = ({ engineId, lane }) =>
+  `Prove ${engineId} on the ${lane} lane now with one turn on its cheapest model (a few tokens, ${PROBE_TIMEOUT_SEC}s ceiling)?`;
 import { runRequiredNames, missingRequirements, REGISTER_ENV, ENGINE_ENV } from "../driver/run-requirements.mjs";   // the order-time gate's own question, asked here rather than restated
 import { pinEnv, envFrom } from "../shared/env-aliases.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — one entry-point test, all spellings
@@ -1206,7 +1214,7 @@ export async function runCheck() {
   // deliberate — a second reader would drift from this one exactly as the composer and the checker did
   // in F41, and the drift is invisible because both sides keep passing their own arms.
   const unitDir = join(homedir(), ".config", "systemd", "user");
-  const { BACKGROUND_UNITS } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
+  const { BACKGROUND_UNITS, startPaths } = await import(pathToFileURL(join(REPO, "bin", "start.mjs")).href);
   const hosted = BACKGROUND_UNITS.some((u) => existsSync(join(unitDir, u)));
   const unitEnv = hosted
     ? unitEnvironment({
@@ -1440,7 +1448,7 @@ export async function runCheck() {
     } else if (!bin.executable || bin.relative) {
       info("not probed — there is no usable binary to probe. Fix the line above first.");
     } else {
-      say(`\n  Probing ${engineId} with one ${PROBE_MODEL}-tier turn (this SPENDS; ${PROBE_TIMEOUT_SEC}s ceiling)…`);
+      say(`\n  ${probingLine(engineId)}`);
       // The engine as a RUN would see it: environment first, .env behind it. Only the engine-selection
       // keys — the probe must bill exactly the way this box bills and moves no other variable.
       const probeEnv = { ...process.env };
@@ -1628,6 +1636,13 @@ export async function runCheck() {
         // because a reader debugging `clearotron run` by hand IS this process.
         info(`this command's own process ${where} — a CLI is not started by the units' EnvironmentFile, so `
           + "that differs by design and is not what a run uses");
+      } else if (!hosted && svcCustomers?.from === serviceEnvLabel) {
+        // NAMED IN THE ENV FILE ALONE, ON AN INSTALL WITH NO UNITS. `clearotron start` loads that file and
+        // its services inherit the store; this command does not load it, so its own process fell back to
+        // the bundled roster and printed that as the answer, one line below a ✓ for the same variable.
+        ok(`the services resolve profiles from ${svcCustomers.v} (${svcCustomers.from})`);
+        info(`this command's own process ${where} — it does not load ${serviceEnvFile}, so that differs by `
+          + `design and is not what \`${invoke("start")}\` hands the services`);
       } else {
         if (r.situation === "overlay" && !r.findings.length) ok(`${where} — the configured store`);
         else if (r.situation === "bundled-fallback") info(`${where} — THE BUNDLED DEMO ROSTER, because CLEAROTRON_CUSTOMERS_DIR is unset. Legitimate on a generic-defaults install; a fallback either way, and it is what a misconfigured deployment also looks like`);
@@ -1638,7 +1653,8 @@ export async function runCheck() {
         info(`the units are installed but their environment could not be read (${unitEnv?.why ?? "no reason given"}) — `
           + "what the services resolve is not judged here, and the line above is this process's own answer");
       info("what a RUN used is its own `profile-store` journal line — this command reports what the "
-        + (hosted ? "units' file says, which the running services read at their own start" : "environment you are typing in says"));
+        + (hosted ? "units' file says, which the running services read at their own start"
+          : `environment you are typing in and your environment file say, which \`${invoke("start")}\` reads at its own start`));
       // ── AND WHO IS ACTUALLY IN IT ─────────────────────────────────────────
       //
       // The line above names the STORE. An operator who has just configured one wants to know their
@@ -1807,16 +1823,32 @@ export async function runCheck() {
   // be read, the lines above already said so and nothing is judged here. A store that is configured but
   // holds a file that cannot be read fails every company's saved searches, in the portal and the
   // connector alike, so that is read here too.
+  //
+  // WITH NO UNITS, THE SERVICES ARE `clearotron start`'s CHILDREN, and it hands every one of them a store
+  // whether or not the env file names it. So "off" is only ever true of a hosted box. This read the env
+  // file alone, and on a local install started before `start` wrote the store there, it told a portal
+  // that was listing saved searches that they were off.
   if (!hosted || serviceKnown) {
-    const recipesSet = hosted ? effectiveForService("CLEAROTRON_RECIPES_DIR") : effective("CLEAROTRON_RECIPES_DIR");
+    // Layered as effectiveForService layers it — this command's environment over the services' file — so
+    // the repository root is read from the same place the store directory is.
+    let storeEnv = { ...(serviceFileEnv ?? {}), ...process.env };
+    let recipesSet = effectiveForService("CLEAROTRON_RECIPES_DIR");
+    let handedBy = "";
+    if (!hosted && !recipesSet?.v) {
+      const handed = startPaths({ env: storeEnv });
+      recipesSet = { v: handed.recipes, from: "clearotron start", name: "CLEAROTRON_RECIPES_DIR" };
+      storeEnv = { ...storeEnv, RECIPE_REPO_ROOT: handed.configStore };
+      handedBy = ` — where \`${invoke("start")}\` puts them`;
+    }
     const recipesDir = recipesSet?.v || null;
     if (!recipesDir) {
       info("saved searches are off: CLEAROTRON_RECIPES_DIR is not set, so Custom searches in the portal and the "
         + "connector offer none. Name a directory inside a git repository to switch them on");
+    } else if (handedBy && !existsSync(join(storeEnv.RECIPE_REPO_ROOT, ".git"))) {
+      // NOT CREATED YET IS NOT UNREADABLE. The store does not exist until the first start makes it, and
+      // reading it now would report a missing directory as a broken one.
+      info(`saved searches switch on at the first \`${invoke("start")}\`, which creates their store in ${recipesDir}`);
     } else {
-      // Layered as effectiveForService layers it — this command's environment over the services' file — so
-      // the repository root is read from the same place the store directory above was.
-      const storeEnv = { ...(serviceFileEnv ?? {}), ...process.env };
       const resolved = resolveStoreRepoRoot({ names: ["RECIPE_REPO_ROOT", "PROFILE_REPO_ROOT"], fallback: REPO, env: storeEnv });
       const reach = storeInRepo(recipesDir, resolved.root);
       if (!reach.ok) {
@@ -1829,7 +1861,7 @@ export async function runCheck() {
         if (unreadable) {
           warn(`saved searches cannot be read from ${recipesDir}: ${unreadable}. Every company's saved searches fail `
             + "to load, in the portal and the connector, until that file is fixed");
-        } else ok(`saved searches are read from ${recipesDir}, and saves are committed in ${reach.repo}`);
+        } else ok(`saved searches are read from ${recipesDir}${handedBy}, and saves are committed in ${reach.repo}`);
       }
     }
   }
@@ -3281,7 +3313,7 @@ try {
     // skipping it costs an hour later.
     info("A file that exists is not an engine that works — so setup tries one before writing anything.");
     info("It takes a few seconds here. Skipped, a broken engine surfaces an hour into a real search.");
-    if (!await confirm(`Prove ${pick.id} on the ${authPick.id} lane now with one ${PROBE_MODEL}-tier turn (a few tokens, ${PROBE_TIMEOUT_SEC}s ceiling)?`, true)) {
+    if (!await confirm(proveQuestion({ engineId: pick.id, lane: authPick.id }), true)) {
       info("Not proven, so not written. Pick again — the last row configures no engine at all.");
       continue;
     }

package/bin/start.mjs

@@ -355,6 +355,50 @@ export function defaultGrantsPath({ env = process.env, demo = false } = {}) {
   return installPaths(join(homedir(), demo ? "trademark-demo" : "trademark")).grants;
 }
 
+/**
+ * The paths `clearotron start` hands its services: the install's layout under `base`, with whatever the
+ * environment already names winning over the layout's default, as `start` has always applied it.
+ *
+ * EXPORTED FOR THE ONE OTHER READER THAT MUST AGREE WITH IT. On an install with no background units,
+ * `clearotron doctor` has no unit file to read the services' environment from: the services are this
+ * command's children and get the saved-search store from here. An install started before the store was
+ * written to the env file has no line there to read, so doctor asks this function for it, and the
+ * answer it prints and the one the services were given have one author.
+ *
+ * NOT IN A DEMO. Nothing the environment says about an install is the demo's: with the reader's settings
+ * in force, 0.3.0-beta.1's demo seeded its example reports into their real archive.
+ */
+export function startPaths({ env = process.env, base = join(homedir(), "trademark"), demo = false } = {}) {
+  const paths = installPaths(base);
+  if (demo) return paths;
+  for (const [k, name] of [["pool", "CLEAROTRON_REPORTS_DIR"], ["workspace", "CLEAROTRON_WORK_DIR"], ["queue", "CLEAROTRON_QUEUE_DIR"],
+    ["outbox", "CLEAROTRON_OUTBOX_DIR"], ["locks", "CLEAROTRON_RUN_LOCK_DIR"], ["grants", "CLEAROTRON_ACCESS_FILE"],
+    ["recipes", "CLEAROTRON_RECIPES_DIR"]]) if (env[name]) paths[k] = env[name];
+  if (env.RECIPE_REPO_ROOT) paths.configStore = env.RECIPE_REPO_ROOT;
+  if (env.PORTAL_AUDIT) paths.audit = env.PORTAL_AUDIT;
+  return paths;
+}
+
+/**
+ * The saved-search store, as the env file must record it for every reader OUTSIDE this command's tree.
+ *
+ * The services are handed the store by `childEnv`. A connector an assistant launches, `clearotron doctor`
+ * and every other hand-run command are not this command's children: they read the env file, and the
+ * file never named the store. So on a local install the portal listed a company's saved searches, the
+ * connected assistant was told there were none, and doctor said saved searches were off. Written
+ * add-only beside the secrets, as `npx clearotron install` writes the reports and work directories: a
+ * line an operator wrote wins.
+ */
+export function storesForOtherReaders(paths) {
+  return { CLEAROTRON_RECIPES_DIR: paths.recipes, RECIPE_REPO_ROOT: paths.configStore };
+}
+
+// Written above each line, so a reader who moves the install sees that these two move with it.
+const STORE_NOTES = {
+  CLEAROTRON_RECIPES_DIR: "Where saved searches are kept. `clearotron start` created it; edit both lines if you move the install.",
+  RECIPE_REPO_ROOT: "The git repository saved searches are committed in, which holds the directory above.",
+};
+
 /** Everything this install keeps on disk, under one base directory. */
 export function installPaths(base) {
   return {
@@ -846,20 +890,11 @@ if (isMain) {
   const DEMO = argv.includes("--demo");
   // The same base `npm run setup` writes under, so whichever of the two a reader ran first, the other
   // finds the same install rather than a second one beside it.
-  const paths = installPaths(flag("--base", join(homedir(), DEMO ? "trademark-demo" : "trademark")));
   // Whatever the environment already says wins over the base-derived default, for every path — a reader
-  // who ran `npm run setup` has these in .env already and this must not move their data.
-  //
-  // NOT IN A DEMO. Nothing the environment says about an install is the demo's: with the reader's
-  // settings in force, 0.3.0-beta.1's demo seeded its example reports into their real archive. Not read,
-  // rather than deleted from the environment, so a real start cannot be reached by this branch at all.
-  if (!DEMO) {
-    for (const [k, name] of [["pool", "CLEAROTRON_REPORTS_DIR"], ["workspace", "CLEAROTRON_WORK_DIR"], ["queue", "CLEAROTRON_QUEUE_DIR"],
-      ["outbox", "CLEAROTRON_OUTBOX_DIR"], ["locks", "CLEAROTRON_RUN_LOCK_DIR"], ["grants", "CLEAROTRON_ACCESS_FILE"],
-      ["recipes", "CLEAROTRON_RECIPES_DIR"]]) if (process.env[name]) paths[k] = process.env[name];
-    if (process.env.RECIPE_REPO_ROOT) paths.configStore = process.env.RECIPE_REPO_ROOT;
-    if (process.env.PORTAL_AUDIT) paths.audit = process.env.PORTAL_AUDIT;
-  }
+  // who ran `npm run setup` has these in .env already and this must not move their data. Not in a demo,
+  // which `startPaths` says why. One author, because `doctor` asks the same function what the services
+  // were handed.
+  const paths = startPaths({ env: process.env, base: flag("--base", join(homedir(), DEMO ? "trademark-demo" : "trademark")), demo: DEMO });
   // ── THIS INSTALL'S FIRST START, read before this start writes either file that answers it ────────────
   //
   // The grants file and the config store's repository are both written further down, on every start
@@ -1117,14 +1152,19 @@ if (isMain) {
   const portalSecret = secretFor("PORTAL_SECRET");
   const tokenSecret = secretFor("TRADEMARK_MCP_TOKEN_SECRET");
   if (!process.env.PORTAL_LOCAL_USER) generated.PORTAL_LOCAL_USER = user;
+  const stores = DEMO ? {} : storesForOtherReaders(paths);
 
   // A DEMO WRITES NO SECRETS AND NO ADDRESS. They are generated per run and live in memory only, which
   // is the same posture the ops key already has here — and it is what makes "removing the demo is one
   // directory" true rather than nearly true.
-  if (Object.keys(generated).length && !DEMO) {
+  //
+  // THE STORES ARE WRITTEN EVEN WHEN NO SECRET IS. An install whose secrets are already in the file is
+  // exactly the install whose connector and doctor could not see its saved searches, and a gate on the
+  // secrets alone would never reach it.
+  if ((Object.keys(generated).length || Object.keys(stores).length) && !DEMO) {
     let existing = "";
     try { existing = readFileSync(ENV_PATH, "utf8"); } catch (e) { if (e.code !== "ENOENT") fatal(`${ENV_PATH} exists but could not be read (${e.code}).`); }
-    const merged = mergeEnvFile(existing, generated);
+    const merged = mergeEnvFile(existing, { ...generated, ...stores }, { notes: STORE_NOTES });
     if (merged.added.length) {
       // ONE WRITER FOR EVERY FILE THAT HOLDS CREDENTIALS, and it creates the directory. This site had its
       // own copy of the write and did not learn what the wizard's copy learned when `.env` moved under
@@ -1135,7 +1175,7 @@ if (isMain) {
       } catch (e) {
         fatal(`could not write ${ENV_PATH} (${String(e?.message ?? e)}).`);
       }
-      // NAMES only. This file is where the credentials are.
+      // NAMES only. Some of what this file holds is credentials.
       say(`  wrote          ${merged.added.join(", ")} to ${ENV_PATH} (mode 600)`);
     }
   }

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "0fb023f5822c9458f9c63bf993876c3a3a8053e3",
-  "version": "0.3.0-beta.4"
+  "commit": "a9ac3366ee814b9faf6a5d23fe7d0c8f3a5c0d3f",
+  "version": "0.3.0-beta.5"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,14 @@
 # clearotron-driver
 
+## 0.3.0-beta.5
+
+### Patch Changes
+
+- 5f7e295: Fixed: A Clearotron install signed in to OpenAI's `codex` with a subscription keeps working after codex refreshes its login. Before, every search after the first refresh failed within seconds until you signed in again.
+- 2878809: Fixed: When the company store cannot record a new company, the New company page now says why and what fixes it, instead of "Try again shortly". Someone who does not run the installation is told to ask whoever does.
+- e7cd9e1: Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
+- e7cd9e1: Fixed: When setup offers to try your engine, it no longer names an Anthropic model to someone who chose OpenAI's `codex`.
+
 ## 0.3.0-beta.4
 
 ### Minor Changes
@@ -23,9 +32,9 @@
 - a782aad: Fixed: Creating a company is refused, with nothing left behind, when the configuration store cannot record it. The company used to be created anyway, with no record of who made it or when, and its organisation was given access to it.
   
   A store with no git identity is the usual cause on a new machine, and the refusal names the command that fixes it. Setup and `clearotron start` now check a store they adopt for this straight away.
-- d1ef225: Fixed: A stage stopped at its time limit now records the output it actually produced. It used to record a small fraction, so a stage that was working read as one that had stalled.
+- d1ef225: Fixed: A search step stopped at its time limit now records the output it actually produced. It used to record a small fraction, so a step that was working read as one that had stalled.
   
-  The token totals `clearotron tokens` reports for runs with a stopped stage now include that output.
+  The token totals `clearotron tokens` reports for runs with a stopped step now include that output.
 - 0ff42d1: Fixed: `clearotron doctor` now says when saved searches are switched off and why, and when a saved search file cannot be read.
   
   An assistant asking for saved searches is told when they could not be read, instead of being told there are none.
@@ -79,11 +88,11 @@
   
   Fixed: A search now records any of your default territories that the engine cannot search, in the record of that search. A mistyped default no longer narrows a search silently.
 - eacfce4: Fixed: An assistant connected to a local install now sees the saved searches the portal shows, and can plan a run from one of them. Before, outside the demo, only the portal was told where saved searches are kept, so an assistant was told the install had none.
-- 34cc1c7: For operators: A health check that could not look now fails instead of reporting success. Two halves of the unit check can go quiet. One goes quiet when the installation does not say which installation it is; the other when the walk over the unit files does not finish. Both used to note that they had not run and then pass.
+- 34cc1c7: For operators: A deployment health check that could not finish now fails instead of reporting success. Two parts of the service check could skip themselves. One skipped when the installation did not say which installation it is; the other when the scan of the service files did not finish. Both used to note that they had not run and then pass.
   
   For operators: Set `CLEAROTRON_BOX` to `prod` or `test`. Those are the only two values the check accepts; anything else, including any other name, reads as unnamed and fails. The failure names the setting and says what went unchecked.
   
-  For operators: The half that goes quiet is the one that notices a service that has stopped and stayed stopped. The other half lists what is running, so it cannot see something that is no longer there. While that half is suppressed, a service can disappear without the check saying anything.
+  For operators: The part that could skip itself is the one that notices a service that has stopped and stayed stopped. The other part lists what is running, so it cannot see something that is no longer there. While the first part is skipped, a service can disappear without the check saying anything.
 - b45a5cf: Fixed: `clearotron doctor` now reports everything a search would be refused for, checked against the environment the search will run in. So an installation it passes is one that can run a search.
   
   Fixed: A token set in the installation's own configuration file now reaches the engine check. A headless server set up the documented way proves its engine instead of reporting it signed out.
@@ -128,7 +137,7 @@
   Fixed: When a feature is switched off on your installation, the screen says so and what to change. It used to suggest trying again shortly.
   
   Fixed: The link to the risk-framework guide opens in a new tab and goes straight to the section on writing your own. It also appears on the Company profile screen.
-- ad088d6: Fixed: The audit workbook's "What was searched" sheet is now in plain words. Its Result and Note columns carry the search log's own notes. Engine vocabulary could reach them: a receipt "deferred", a full web address, a bare HTTP code. Those words are now replaced as the workbook is built, a republished report included. A search recorded as not run still reads as not searched. Search terms and names stay exactly as written, because they record what was searched.
+- ad088d6: Fixed: The audit workbook's "What was searched" sheet is now in plain words. Its Result and Note columns carry the search log's own notes. Internal terms could reach them: a status such as "deferred", a full web address, a bare HTTP code. Those words are now replaced as the workbook is built, a republished report included. A search recorded as not run still reads as not searched. Search terms and names stay exactly as written, because they record what was searched.
 - ff16a3b: For operators: The deployment health check now reports whether the component that updates an installation is itself up to date. It was the one part of a deployment the check could not identify. An installation kept current by an out-of-date updater could report healthy while serving stale code.
   
   For operators: An updater that cannot be identified is now reported as a failure rather than passed over. A copy old enough to predate this reporting writes nothing at all. That silence is the case worth knowing about, so it is treated as a finding.
@@ -158,7 +167,7 @@
   
   The product now says company throughout. It used to say brand owner, account, client and customer for the same thing. The firm running the installation is named separately, in the top bar.
   
-  Companies created through the settings page were saved without a risk framework. Their matters were then rated under the house default, with nothing on screen saying so. Every company created now carries one, and says which.
+  Companies created through the settings page were saved without a risk framework. Their matters were then rated under the default risk framework, with nothing on screen saying so. Every company created now carries one, and says which.
 - f75266d: New: The setup wizard now asks for the organisation's name after the sign-in address, and the person who installs starts with access to everything.
   
   `clearotron grant add` sets a person's two permissions with `--run` and `--manage`; with neither, the person can look and start nothing.
@@ -180,18 +189,18 @@
   
   Getting the deck's shape wrong used to fail quietly. The profile screen showed the framework's title and your band colours, and silently omitted the box saying what the bands mean. The new command answers that question directly, using the screen's own read of the deck.
   
-  Fixed: a framework served from the product's own files, while you have a configuration store set, now says so.
+  Fixed: When you have a configuration store set and a risk framework comes from the product's own files instead, the product now says so.
   
   Your store is looked in first, and the product's files answer when it is silent. The product ships decks under names you may also have chosen. So a deck that went missing from your store was replaced by ours rather than reported absent. Same band words, different rubric, nothing raised anywhere. The profile screen now writes one line naming what happened, and the new command reports it.
   
-  Fixed: the house triage ladder's profile page explains its bands again.
+  Fixed: The built-in triage framework's profile page explains its bands again.
   
   Its band sections stated their meanings as plain paragraphs, which the screen does not read. Every company without a framework of its own saw band colours and no explanation. The wording is unchanged.
-- cfb9a9f: Fixed: `clearotron doctor` now says which companies your portal's trigger key can start.
+- cfb9a9f: Fixed: `clearotron doctor` now lists the companies your portal's key may start runs for.
   
   The key carries a list of the companies it may start runs for. A company added after the key was minted is outside it. Doctor reported the key's expiry and never its coverage. So the one command whose job is to tell you what a machine is configured for said nothing about it.
   
-  It reads the roster the services read, not the one a command-line process resolves, and it says which. Those two can disagree, and when they do the difference is the whole answer.
+  It reads the company list the background services read, not the one a command run in a terminal would find, and it says which. The two can differ, and when they do, that difference is the answer.
   
   The line is a note, not a failure. Your portal takes a fresh credential at the start of every call, so a company outside the key is not normally refused. It is refused when the portal cannot take a fresh one, and the line says so and gives you the command to widen the key.
 - ba2899b: Fixed: On reports searched through Signa, each register finding now links to the office's own page for that record, where the office publishes one. Singapore publishes no such page, so its registrations are cited by number, and the report says why. A number that an office's page cannot take is cited the same way.

package/driver/engine/openai-agent.mjs

@@ -22,7 +22,8 @@
 // CLEAROTRON_CODEX_SANDBOX_BYPASS=1 swaps that `--sandbox workspace-write` for
 // `--dangerously-bypass-approvals-and-sandbox` — see buildCodexArgs below for why.
 
-import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { mkdtempSync, writeFileSync, copyFileSync, existsSync, rmSync, readFileSync, readdirSync, statSync, symlinkSync, lstatSync, realpathSync } from "node:fs";
+import { writeSecretFile } from "../../shared/secret-file.mjs";   // the rotated login goes back the way every credential is written
 import { tmpdir, homedir } from "node:os";
 import { join } from "node:path";
 import { runStreamingChild, absolutizeSkillRefs, WRITE_DISCIPLINE, buildEnvelope, resolveSpawnCwd } from "./common.mjs";
@@ -174,6 +175,49 @@ export function spawnEnv(base = process.env, codexHome) {
 
 const authFilePath = (env = process.env) => env.CLEAROTRON_OPENAI_AUTH_FILE || join(homedir(), ".codex", "auth.json");
 
+// ── THE LOGIN IS THE MASTER'S, NOT A COPY'S ─────────────────────────────────────────────────────────
+//
+// codex refreshes its access token inside a turn and rotates the refresh token as it does, and the
+// provider accepts each refresh token once. The stage home used to be seeded with a COPY of the master
+// login and deleted when its ladder settled, so the rotated token was deleted with it. The master kept a
+// token the provider had already consumed, and every later stage on every run failed its refresh with a
+// 401 until a person signed in again. The engine's only report was an exit code.
+//
+// So the stage home LINKS to the master: a refresh codex writes in place lands where the next stage
+// reads, including a ladder running beside this one. If codex replaces the link with a file of its own,
+// `returnAuth` writes that file back.
+
+/** Point `<codexHome>/auth.json` at the master login. Returns what the master held, for `returnAuth`. */
+function seedAuth(masterPath, codexHome) {
+  const seat = join(codexHome, "auth.json");
+  // A LINK LEFT BY THIS LADDER'S PREVIOUS TURN is removed first: copying the master onto a link to
+  // itself would truncate the one file the login lives in.
+  rmSync(seat, { force: true });
+  symlinkSync(masterPath, seat);
+  return readFileSync(masterPath, "utf8");
+}
+
+/**
+ * After a turn: a login codex rewrote as its own file goes back to the master.
+ *
+ * ONLY WHILE THE MASTER STILL HOLDS WHAT THIS TURN WAS SEEDED WITH. A master that moved meanwhile was
+ * rotated by another ladder, and the provider accepts one refresh per token, so of two rotations from
+ * one seed only one can be live. Writing ours over theirs could put back the spent one.
+ */
+export function returnAuth(masterPath, codexHome, seeded) {   // @internal
+  const seat = join(codexHome, "auth.json");
+  let st;
+  try { st = lstatSync(seat); } catch { return false; }
+  if (st.isSymbolicLink() || !st.isFile()) return false;   // written through the link, or not there
+  const now = readFileSync(seat, "utf8");
+  if (now === seeded) return false;
+  let master;
+  try { master = readFileSync(masterPath, "utf8"); } catch { return false; }
+  if (master !== seeded) return false;
+  writeSecretFile(masterPath, now);
+  return true;
+}
+
 // Build the codex argv. Prompt rides STDIN via the `-` placeholder (no MAX_ARG_STRLEN ceiling on a 150KB
 // register prompt). Global flags precede the `resume` subcommand (flag-corpus ordering). config.toml
 // (mcp_servers + developer_instructions) rides CODEX_HOME, not argv.
@@ -530,6 +574,7 @@ export const openaiAgentEngine = {
     const ownHome = !providedHome;
     try { codexHome = providedHome ?? mkdtempSync(join(tmpdir(), "codex-home-")); }
     catch (e) { return errResult(t0, e, resumeRef); }
+    let authMaster = null, seeded = null;
     try {
       // Auth toggle (may throw loud on api-key-without-key — a config error, not a retryable failure).
       const { env, mode } = spawnEnv(process.env, codexHome);
@@ -537,7 +582,9 @@ export const openaiAgentEngine = {
         const af = authFilePath(process.env);
         if (!existsSync(af))
           throw new Error(`CLEAROTRON_AI_BILLING=subscription but no auth.json at ${af} — run \`codex login\` (or set CLEAROTRON_OPENAI_AUTH_FILE — NOT an aliased name, and deliberately left as it is), or use CLEAROTRON_AI_BILLING=api-key + CODEX_API_KEY.`);
-        copyFileSync(af, join(codexHome, "auth.json"));
+        // The REAL path, so a master that is itself a link is written where its login actually lives.
+        authMaster = realpathSync(af);
+        seeded = seedAuth(authMaster, codexHome);
       }
       // Per-run config.toml: the gather MCP servers (translated from the claude-shaped mcpConfig, so
       // gather-config.mjs is untouched) + developer_instructions = WRITE_DISCIPLINE (codex's
@@ -574,6 +621,9 @@ export const openaiAgentEngine = {
       if (!ev.model) ev.model = readServedModel(codexHome, spawnedAtMs);
       return settleTuple({ r, ev, resumeRef });
     } finally {
+      // BEFORE the home can be deleted, here or by the ladder that owns it. A failed write-back leaves the
+      // turn's result as it was; the next turn is seeded from the master either way.
+      try { if (authMaster) returnAuth(authMaster, codexHome, seeded); } catch { /* the master is unchanged */ }
       try { if (ownHome && codexHome) rmSync(codexHome, { recursive: true, force: true }); } catch { /* best-effort cleanup */ }
     }
   },

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.4",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-upstream.mjs

@@ -420,6 +420,11 @@ export function makeUpstream({ callUpstream, callRecipes = null, recipesOff = nu
       const draft = {};
       for (const k of CREATABLE_FIELDS) if (body[k] !== undefined) draft[k] = body[k];
       const r = await call("POST", "/profiles", draft, principal);
+      // A STORE THAT CANNOT RECORD THE COMPANY is answered with its path and the git commands that fix it.
+      // That sentence is for whoever runs the installation. A manager who holds an organisation cannot act
+      // on it and must not be shown the server's paths, so they are told what to do instead.
+      if (r.status === 409 && String(r.json?.code ?? "").startsWith("store_") && !seesEverything(principal))
+        return { status: 409, json: { code: r.json.code, error: STORE_REFUSAL_FOR_MANAGERS } };
       if (r.status !== 201 || org == null || !fileCompany) return r;
       const key = r.json?.key ?? r.json?.profile?.key ?? draft.key;
       try { await fileCompany({ tenant: org, account: key }); }
@@ -431,6 +436,10 @@ export function makeUpstream({ callUpstream, callRecipes = null, recipesOff = nu
   };
 }
 
+/** The store refusal as a manager who does not run the installation reads it: no path, no command. */
+export const STORE_REFUSAL_FOR_MANAGERS = "No company was created: this installation cannot save new companies yet, "
+  + "and nothing was changed. Ask whoever runs it to fix the company store.";
+
 /**
  * What a browser may state when creating a company.
  *

package/driver/suite-census.json

@@ -135,6 +135,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-codex-login-survives-its-own-refresh.test.mjs": {
+          "tests": 3,
+          "asserts": 14,
+          "skips": 0,
+          "todos": 0
+        },
         "a-company-can-be-given-a-framework-after-it-exists.test.mjs": {
           "tests": 8,
           "asserts": 19,
@@ -381,6 +387,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-local-install-hands-its-stores-to-every-reader.test.mjs": {
+          "tests": 1,
+          "asserts": 10,
+          "skips": 0,
+          "todos": 0
+        },
         "a-mark-name-cannot-lie-about-how-it-reads.test.mjs": {
           "tests": 9,
           "asserts": 37,
@@ -747,6 +759,12 @@
           "skips": 0,
           "todos": 0
         },
+        "a-store-refusal-reaches-the-person-who-can-fix-it.test.mjs": {
+          "tests": 3,
+          "asserts": 11,
+          "skips": 0,
+          "todos": 0
+        },
         "a-stored-territory-that-does-nothing-is-named.test.mjs": {
           "tests": 6,
           "asserts": 12,
@@ -1804,8 +1822,8 @@
           "todos": 0
         },
         "doctor-reads-the-units-not-the-shell.test.mjs": {
-          "tests": 30,
-          "asserts": 85,
+          "tests": 32,
+          "asserts": 93,
           "skips": 0,
           "todos": 0
         },
@@ -4725,6 +4743,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-proving-question-names-no-engines-model.test.mjs": {
+          "tests": 2,
+          "asserts": 5,
+          "skips": 0,
+          "todos": 0
+        },
         "the-public-residue-is-a-floor.test.mjs": {
           "tests": 15,
           "asserts": 59,
@@ -5404,7 +5428,7 @@
         },
         "describe-options.test.mjs": {
           "tests": 23,
-          "asserts": 98,
+          "asserts": 99,
           "skips": 0,
           "todos": 0
         },
@@ -5594,8 +5618,8 @@
       "ext": "ts",
       "perFile": {
         "api.test.ts": {
-          "tests": 43,
-          "asserts": 170,
+          "tests": 44,
+          "asserts": 176,
           "skips": 0,
           "todos": 0
         },

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,11 @@
 # trademark-artifacts-mcp
 
+## 0.3.0-beta.5
+
+### Patch Changes
+
+- e7cd9e1: Fixed: On an install run with `clearotron start`, a connected assistant now lists the same saved searches as the portal, including Generic's. `clearotron doctor` no longer says working saved searches are off, and it names one place profiles come from.
+
 ## 0.3.0-beta.4
 
 No changes in this release.
@@ -18,11 +24,11 @@ No changes in this release.
 
 ### Patch Changes
 
-- b8ec213: Fixed: a company you create in the browser now appears in your assistant's list of companies straight away.
+- b8ec213: Fixed: A company you create in the browser now appears in your assistant's list of companies straight away.
   
   It used to appear only after the service restarted, although a search could already be started for it. Its projects were missing from the list in the same way, and so was its account in the search options.
   
-  The live surface check no longer reports a company outside the portal's trigger key as the service and the store disagreeing. It names the key's gap on a line of its own, with the command to widen the key.
+  The check comparing the running service with the configuration store no longer calls a company the portal's key does not cover a disagreement. It names that gap on a line of its own, with the command that widens the key.
 
 ## 0.2.4
 

package/mcp-server/lib/options.mjs

@@ -193,7 +193,10 @@ function accountFor(key, { scope, now }) {
     profile = loadProfiles().get(key) ?? null;
     if (!profile) { fresh = loadProfiles({ force: true }); profile = fresh.get(key) ?? null; }
   } catch { return null; }   // unreadable roster ⇒ say nothing
-  if (!profile || profile.key === "generic") return null;
+  // GENERIC IS ANSWERED LIKE ANY COMPANY (owner ruling, 2026-09-11). It owns saved searches in the portal,
+  // and a fresh install holds Generic alone, so treating it as nobody's account told the assistant on
+  // every such install that none existed.
+  if (!profile) return null;
 
   let projects = [];
   try {

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.0-beta.4",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.0-beta.4",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/dist/assets/{index-DWYCsOCJ.js → index-DBUVdQT-.js}

@@ -10309,6 +10309,12 @@ function decodeStatus(status, body) {
 			};
 			return { kind: "notFound" };
 		case 409: {
+			const refused = refusalDetail(body);
+			if (refused?.code.startsWith("store_")) return {
+				kind: "reject",
+				errors: errorsOf(body),
+				detail: refused
+			};
 			const msg = errorsOf(body)[0] ?? "This action could not be completed.";
 			return /version|conflict/i.test(msg) && !/confirmation|plan again|re-confirm/i.test(msg) ? {
 				kind: "conflict",

package/portal-ui/dist/index.html

@@ -49,7 +49,7 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-DWYCsOCJ.js"></script>
+    <script type="module" crossorigin src="/portal/assets/index-DBUVdQT-.js"></script>
     <link rel="stylesheet" crossorigin href="/portal/assets/index-Cv-E_agg.css">
   </head>
   <body>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.4",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.0-beta.5
+
+No changes in this release.
+
 ## 0.3.0-beta.4
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.0-beta.4",
+  "version": "0.3.0-beta.5",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/scripts/engine-probe.mjs

@@ -35,7 +35,7 @@
 // env at module top — and every static import evaluates before this file's own body runs, so applying the
 // aliases in the body would be too late for the capture it is meant to fix.
 import "../shared/env-local.mjs";
-import { probeEngineTurn, probeFailureText, PROBE_MODEL, PROBE_TIMEOUT_SEC } from "../driver/engine/probe.mjs";
+import { probeEngineTurn, probeFailureText, PROBE_TIMEOUT_SEC } from "../driver/engine/probe.mjs";
 import { isEntrypoint } from "../shared/is-entrypoint.mjs";   // — realpath both sides, or a symlinked invocation exits 0 silently
 
 const argv = process.argv.slice(2);
@@ -62,7 +62,7 @@ if (isEntrypoint(import.meta.url)) {
   const env = engine ? { ...process.env, CLEAROTRON_AI: engine } : process.env;
   const asJson = argv.includes("--json");
   if (!asJson) {
-    console.error(`engine-probe: one ${PROBE_MODEL}-tier turn, up to ${PROBE_TIMEOUT_SEC}s, on this box's own `
+    console.error(`engine-probe: one turn on the engine's cheapest model, up to ${PROBE_TIMEOUT_SEC}s, on this box's own `
       + `credential — real, and it costs whatever one cheap turn costs.`);
   }
   const verdict = await probeEngineTurn({ env });