clearotron 0.3.0-beta.6 → 0.3.0-beta.7

package/.env.example

@@ -561,8 +561,9 @@ CLEAROTRON_DEMO_PROFILES=
 # Your organisation's name. `npm run setup` asks for it (and, on a local install, not for a sign-in
 # address) and writes it here, quoted, so a name holding a `#` survives. The first `clearotron start` files it as the first
 # organisation in the grants file (CLEAROTRON_ACCESS_FILE) when that file holds none; from then on the
-# grants file holds the name, renaming is an edit there, and this is not read. Unset or empty, no
-# organisation is invented. `clearotron start --organisation <name>` supplies it for one start, and a
-# demo never reads it. Read by bin/start.mjs.
+# grants file holds the name and renaming is an edit there. The portal also reads it, to name the
+# organisation on its top bar and on its sign-in refusal page. Unset or empty, no organisation is
+# invented. `clearotron start --organisation <name>` supplies it for one start, and a demo never reads
+# it. Read by bin/start.mjs and shared/brand.mjs.
 # effect: deployment
 CLEAROTRON_ORGANISATION_NAME=

package/bin/start.mjs

@@ -111,6 +111,7 @@ async function runTables() {
 import { spawn, spawnSync, execFileSync } from "node:child_process";
 import { storeInRepo, storeOutsideRepoMessage, storeCommitRefusal } from "../shared/store-in-repo.mjs";   //
 import { stdioConnectOffer } from "../shared/stdio-connect.mjs";
+import { demoProgramPlan } from "../shared/permanent-install.mjs";   // — a demo from npx keeps its own copy
 import { mergeEnvFile } from "../shared/env-file-merge.mjs";
 import { mcpOriginFor } from "../shared/lane-address.mjs";   // — one author for the origin
 import { SERVER_INSTALL_SET, unitsToRestartOnRefresh, unitHealthVerdict } from "../shared/server-units.mjs";   // — one authority, two callers
@@ -756,6 +757,10 @@ export function childEnv({ ports, paths, user, portalSecret, tokenSecret, opsTok
       // already wrong for a process that is not the portal.
       ...(demo ? {
         CLEAROTRON_DEMO: "1",
+        // A DEMO NAMES NO ORGANISATION. The portal reads this to name the one running the install, on its
+        // top bar and its sign-in refusal page, and an exported value is the reader's real organisation.
+        // The portal's alone: no door names an organisation, and the doors stay as a live install's.
+        CLEAROTRON_ORGANISATION_NAME: "",
         // AND THE SIGN-IN CREDENTIAL LIVES IN THE DEMO'S OWN BASE. Without this it defaults to
         // ~/.cordillera/portal-local-credential.json — shared with every install on the box — and the
         // demo then inherits a digest minted for somebody else's address: the portal prints "the
@@ -1389,8 +1394,9 @@ if (isMain) {
     const { publishSource, seedDemoRuns } = await import("../driver/demo-container.mjs");
     const seed = await seedPool({ pool: paths.pool, examplesDir: publishSource(join(REPO, "demo"), { repoRoot: REPO }), republish: republishRun });
     // AND AS RUNS, so the assistant this demo's connect line wires has them to list, brief and open. Under
-    // the demo's own workspace only: nothing of it reaches an install started afterwards.
-    const runs = seedDemoRuns({ workspace: paths.workspace, examplesDir: join(REPO, "demo") });
+    // the demo's own workspace only: nothing of it reaches an install started afterwards. Their report
+    // links are stamped with this portal's address, the one the Open line prints.
+    const runs = seedDemoRuns({ workspace: paths.workspace, examplesDir: join(REPO, "demo"), portalOrigin: `http://${HOST}:${ports.portal}` });
     if (runs.seeded.length) say(`  runs           ${runs.seeded.length} sample run(s) your assistant can list, brief and open`);
     // WHAT WAS ALREADY THERE IS SAID TOO. This branch used to run only when the pool
     // was empty; it now tops a stale pool up to the package's set, so "seeded 1" on an upgrade is a fact
@@ -1451,6 +1457,33 @@ if (isMain) {
   // the file the verb resets is the file the portal reads. A demo keeps its own, by layout (childEnv).
   const { installCredential } = await import("../driver/portal-local-auth.mjs");
   const signIn = DEMO ? null : installCredential({ base: paths.base, env: process.env, firstStart: firstStartOfThisInstall });
+  // ── A DEMO RUN FROM NPX KEEPS ITS OWN COPY OF THE PROGRAM ───────────────────────────────────────────
+  //
+  // Its connect line launched the connector from npm's cache, which npm deletes when it cleans up, so an
+  // assistant registered with it lost the demo without a word (measured on a published beta, 2026-09-11).
+  // The same version goes into `<base>/program` (shared/permanent-install.mjs), BEFORE the services start
+  // so the portal's connect rows name it too, and only when it is not there already. It never stops the
+  // demo: if npm fails, the demo runs as before and says the line will not survive a cache clean.
+  let demoProgramRoot = null;
+  if (DEMO) {
+    const plan = demoProgramPlan({ base: paths.base });
+    if (plan?.current) demoProgramRoot = plan.root;
+    else if (plan && !plan.skip) {
+      say(`  program        copying clearotron ${plan.version} into ${plan.prefix}, so your assistant's connection survives npm cleaning its cache`);
+      // The npm that launched this, when npm says which: no second npm is guessed at.
+      const npmCli = process.env.npm_execpath;
+      const r = npmCli && existsSync(npmCli)
+        ? spawnSync(process.execPath, [npmCli, ...plan.npmArgs], { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8", timeout: 180_000 })
+        : spawnSync("npm", plan.npmArgs, { stdio: ["ignore", "ignore", "pipe"], encoding: "utf8", timeout: 180_000 });
+      if (r.status === 0 && existsSync(join(plan.root, "mcp-server", "server.mjs"))) demoProgramRoot = plan.root;
+      else {
+        const why = r.error ? r.error.message : String(r.stderr ?? "").trim().split("\n").pop() || `npm exited ${r.status}`;
+        say(`  program        could not be copied (${why}). The connect line below runs from npm's temporary cache,`);
+        say("                 so it stops working when npm cleans that cache; start the demo again to retry.");
+      }
+    }
+  }
+
   const envs = childEnv({ ports, paths, user, portalSecret, tokenSecret, opsToken,
     localWorker: wantWorker, demo: DEMO, clientFence: declaredFence || null,
     credential: signIn && signIn.source !== "shared" ? signIn.path : null });
@@ -2233,7 +2266,8 @@ if (isMain) {
   // and a line of instruction with more than one author drifts silently.
   // THE WORKSPACE AND POOL THE SERVICES WERE HANDED, not this process's environment: a demo reads no env
   // file, so its own line named no workspace and the connector fell back to the real install's.
-  const connect = stdioConnectOffer({ workDir: paths.workspace, reportsDir: paths.pool });
+  // A demo run from npx names its own copy of the program, which a cache clean does not remove.
+  const connect = stdioConnectOffer({ workDir: paths.workspace, reportsDir: paths.pool, ...(demoProgramRoot ? { installRoot: demoProgramRoot } : {}) });
   say("  Connect your assistant to this install — one line, no address and no sign-in:");
   say("");
   say(`    ${connect.command}`);

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "d96db92fd1989500c9b107df8e7f7a8b7f715500",
-  "version": "0.3.0-beta.6"
+  "commit": "263794e3f7267c8ed0c25d9906efbb1694883674",
+  "version": "0.3.0-beta.7"
 }

package/demo/full-country-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "https://test-trademark.cordillera.ch/tmpdemo2014fullcountrysearch-venqori-2026-09-03-sample-capture/report.html",
+  "url": "/portal/report/tmpdemo2014fullcountrysearch-venqori-2026-09-03-sample-capture/",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-03T18:06:17.281Z",

package/demo/global-preliminary-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "https://test-trademark.cordillera.ch/tmpdemo2014globalpreliminarysearch-venqori-2026-09-02-sample-capture/report.html",
+  "url": "/portal/report/tmpdemo2014globalpreliminarysearch-venqori-2026-09-02-sample-capture/",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T17:33:15.625Z",

package/demo/knockout-search/run/email-body.md

@@ -1,3 +1,3 @@
-<p style="font-family:Calibri,sans-serif;font-size:11pt">Knockout trademark review — DEMO-2014-knockout-search: <b>1 mark</b>, worst band <b style="color:#2f55a4">Low</b>. <a href="https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html">Open the full report</a> · <a href="https://test-trademark.cordillera.ch/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/audit.xlsx">audit workbook</a>.</p>
+<p style="font-family:Calibri,sans-serif;font-size:11pt">Knockout trademark review — DEMO-2014-knockout-search: <b>1 mark</b>, worst band <b style="color:#2f55a4">Low</b>. <a href="/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/">Open the full report</a> · <a href="/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/audit.xlsx">audit workbook</a>.</p>
 <ul style="font-family:Calibri,sans-serif;font-size:11pt"><li><b>VENQORI</b>: <b style="color:#2f55a4">Low</b> — Classes 9, 42, 41 — Register filings (classes 9, 42, 41): 0 identical, 0 containing, 0 on close variations.</li></ul>
 <p style="font-family:Calibri,sans-serif;font-size:11pt"><i>Ratings reflect our common law assessment. Register analysis may adjust ratings in either direction.</i></p>

package/demo/knockout-search/run/status.json

@@ -33,7 +33,7 @@
   "stepN": 6,
   "stepTotal": 6,
   "verdict": "Low",
-  "url": "https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html",
+  "url": "/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T21:46:53.238Z",
@@ -254,7 +254,7 @@
   "reports": [
     {
       "mark": "VENQORI",
-      "url": "https://test-trademark.cordillera.ch/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/report.html"
+      "url": "/portal/report/tmpdemo2014knockoutsearch-venqori-2026-09-02-sample-capture/"
     }
   ],
   "sendPending": true,

package/demo/multi-country-focus-search/run/status.json

@@ -27,7 +27,7 @@
   "stepTotal": 9,
   "lastStage": "publish",
   "verdict": "CONDITIONAL",
-  "url": "https://test-trademark.cordillera.ch/tmpdemo2014multicountryfocussearch-venqori-2026-09-02-sample-capture/report.html",
+  "url": "/portal/report/tmpdemo2014multicountryfocussearch-venqori-2026-09-02-sample-capture/",
   "failedStage": null,
   "reason": null,
   "deliveredAt": "2026-09-02T19:51:48.801Z",

package/docs/architecture/04-configuration-reference.md

@@ -285,7 +285,7 @@ because the rule is about what PRODUCT CODE reads, not about what a run reads.
 | `CLEAROTRON_DEMO` | unset | `1` puts this install in the DEMO posture. **Ordering is real**: the four products are listed and orderable, the form, the plan and the confirmation are the product's own, and the confirmation resolves to a finished report that already exists rather than dispatching — no engine turn, no register call, no queue entry, no run directory (ruling 2026-08-31, superseding the greyed-control ruling of the same day). A product the demo carries no finished report for refuses and names which one. It also re-aims two boot warnings written for an operator of a real deployment at the visitor who is not one, from one place (`driver/demo-posture.mjs`). **Set by `npx clearotron demo`, not by an operator** — it is passed explicitly to the two processes that have a reason to know (the portal and the MCP door; the worker is not told, because a demo never queues anything for it to drain), and those run with `CLEAROTRON_NO_ENV_FILE=1`, so a stray `.env` can neither put a live install into demo mode nor take a demo out of one. Anything but the literal `1` is not a demo. Replaces `PORTAL_DEMO`, which named only one of the processes that has to know. |
 | `CLEAROTRON_TEST_FIXTURE_PROFILES` | unset | `1` makes the profile loader return the three suite fixtures, which are refused from every roster otherwise. Set by `scripts/test-run.mjs`, never by an operator; an explicit `includeTestFixtures` argument beats it. Effect class `harness`; the full contract is its row in `.env.example`. |
 | `CLEAROTRON_DEMO_PROFILES` | unset | `1` makes the profile loader return the bundled demo account, which a fresh install does not resolve (ruling 2026-09-08). Set by `clearotron demo`, `start --demo` and the suite runner, never by an operator. The gate is on the bundled layer, so a deployment's own configured store keeps its `demoData` accounts either way. Effect class `harness`; the full contract is its row in `.env.example`. |
-| `CLEAROTRON_ORGANISATION_NAME` | unset | Your organisation's name, written quoted by `npx clearotron install`, which asks for it and not for a sign-in address. The first `clearotron start` files it as the first organisation in the grants file (`CLEAROTRON_ACCESS_FILE`) when that file holds none; from then on the grants file holds the name, renaming is an edit there, and this is not read. Unset ⇒ no organisation is invented. `clearotron start --organisation <name>` supplies it for one start, and a demo never reads it. Effect class `deployment`; the full contract is its row in `.env.example`. |
+| `CLEAROTRON_ORGANISATION_NAME` | unset | Your organisation's name, written quoted by `npx clearotron install`, which asks for it and not for a sign-in address. The first `clearotron start` files it as the first organisation in the grants file (`CLEAROTRON_ACCESS_FILE`) when that file holds none; from then on the grants file holds the name and renaming is an edit there. The portal also reads it, to name the organisation on its top bar and on its sign-in refusal page. Unset ⇒ no organisation is invented. `clearotron start --organisation <name>` supplies it for one start, and a demo never reads it. Effect class `deployment`; the full contract is its row in `.env.example`. |
 | `PORTAL_LOCAL_CREDENTIAL` | `~/.cordillera/portal-local-credential.json` | Where local sign-in keeps its passphrase DIGEST. `clearotron start` points it inside the install's own base directory for a new install, so it mints its own passphrase instead of adopting a digest another install left; an install that has been signing in with the shared file keeps it. `npx clearotron demo` always points it inside the demo's own base directory and mints a new passphrase there on every start, so a demo never inherits a digest minted for another address, and removing the demo stays one `rm -rf`. |
 | `PORTAL_LOCAL_PASSPHRASE` | unset | **NEVER set this in a file.** An internal one-shot handoff, not an operator control: on a first FOREGROUND start the supervisor mints the passphrase and hands it to the portal it spawns *at the spawn call*, so the closing summary can print the value beside the address rather than sending a first-time reader back into eleven startup log lines for the one value in this product that cannot be read back. It is deliberately absent from the composed child environments, because that composition is what `--background` writes into the units' env file — a passphrase there would be a permanent plaintext copy on disk and the product's own sentence, "it is stored only as a digest", would stop being true. Setting it in any env file recreates exactly that. Lost passphrase: `clearotron passphrase --reset`. |
 | `PORTAL_URL` | `http://127.0.0.1:18802`, or built from `PORTAL_SERVICE_HOST`/`PORTAL_SERVICE_PORT` | Where the deploy tick's live-surface check expects to reach the portal. |

package/driver/CHANGELOG.md

@@ -1,5 +1,13 @@
 # clearotron-driver
 
+## 0.3.0-beta.7
+
+### Patch Changes
+
+- c5744bf: Fixed: A demo started with npx keeps its assistant connection working after npm cleans its cache.
+- c5744bf: Fixed: An assistant connected to the demo now opens each sample report on the demo's own portal, not on another server.
+- c5744bf: Fixed: The portal names the organisation setup recorded, and the product keeps its own name beside it.
+
 ## 0.3.0-beta.6
 
 ### Patch Changes

package/driver/demo-container.mjs

@@ -23,7 +23,7 @@
 // stage apart. This module is the single answer. `cut/` cannot import it (that directory does not travel
 // and this one does), so the pack gate restates the disjunction and its own test pins the two together.
 
-import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync } from "node:fs";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join, resolve, sep } from "node:path";
 
@@ -89,9 +89,17 @@ export function publishSource(dir, { repoRoot, tmp = tmpdir() } = {}) {
  * anywhere else, so a real install started afterwards sees none of it (the demo is its own install).
  *
  * Copied, never linked: a connector reading a run may write beside it, and `demo/` is tracked. A run
- * already in place is left alone, so a visitor's second start changes nothing.
+ * already in place is not copied again, so a visitor's second start changes nothing but its links.
+ *
+ * ITS REPORT LINKS POINT AT THIS DEMO'S PORTAL. Each sample's `status.json` carried the report URL it was
+ * stamped with where it was captured, a test instance's address, and the connector hands a run's `url` to
+ * the assistant as-is, so an assistant asked to open a demo report sent the person to that host (measured
+ * on a published beta, 2026-09-11). The tracked samples now carry the portal's own route,
+ * `/portal/report/<runId>/`, with no host, and each copy here is stamped with `portalOrigin`, the demo
+ * portal's address. Stamped on EVERY start, the copies already in place included: `--port` moves the
+ * portal, and a copy laid down by an earlier version still carries the old host.
  */
-export function seedDemoRuns({ workspace, examplesDir }) {
+export function seedDemoRuns({ workspace, examplesDir, portalOrigin = null }) {
   const seeded = [], already = [];
   for (const name of demoChildren(examplesDir)) {
     const run = join(examplesDir, name, "run");
@@ -99,10 +107,37 @@ export function seedDemoRuns({ workspace, examplesDir }) {
     try { s = JSON.parse(readFileSync(join(run, "status.json"), "utf8")); } catch { continue; }
     if (!s?.slug || !s?.codename || !s?.date) continue;
     const dir = join(workspace, `workspace-${s.agent || "clawdi"}`, "studio", "prelim-search", s.slug, `${s.date}-${s.codename}`);
-    if (existsSync(join(dir, "status.json"))) { already.push(s.runId); continue; }
-    mkdirSync(dirname(dir), { recursive: true });
-    cpSync(run, dir, { recursive: true });
-    seeded.push(s.runId);
+    if (existsSync(join(dir, "status.json"))) already.push(s.runId);
+    else {
+      mkdirSync(dirname(dir), { recursive: true });
+      cpSync(run, dir, { recursive: true });
+      seeded.push(s.runId);
+    }
+    if (portalOrigin) stampReportLinks(join(dir, "status.json"), portalOrigin);
   }
   return { seeded, already };
 }
+
+/** The portal route that serves a run's report: the one `scanAccountRuns` hands the portal's own list. */
+export const reportRoute = (runId) => `/portal/report/${encodeURIComponent(runId)}/`;
+
+/**
+ * Point a seeded run's report links at `origin`. A link already on the portal's route keeps its path; any
+ * other (the host an older sample carried) becomes the run's own route. Written only when something moved.
+ */
+export function stampReportLinks(statusFile, origin) {
+  let s;
+  try { s = JSON.parse(readFileSync(statusFile, "utf8")); } catch { return false; }
+  if (!s?.runId) return false;
+  const base = String(origin).replace(/\/+$/, "");
+  const local = (url) => {
+    const path = String(url ?? "").replace(/^https?:\/\/[^/]+/, "");
+    return `${base}${path.startsWith("/portal/report/") ? path : reportRoute(s.runId)}`;
+  };
+  const next = { ...s, url: local(s.url) };
+  if (Array.isArray(s.reports)) next.reports = s.reports.map((r) => (r && typeof r === "object" ? { ...r, url: local(r.url) } : r));
+  const text = `${JSON.stringify(next, null, 2)}\n`;
+  if (text === `${JSON.stringify(s, null, 2)}\n`) return false;
+  writeFileSync(statusFile, text);
+  return true;
+}

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.7",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/suite-census.json

@@ -970,9 +970,9 @@
           "todos": 0
         },
         "an-install-from-npx-moves-out-of-the-cache.test.mjs": {
-          "tests": 8,
-          "asserts": 45,
-          "skips": 4,
+          "tests": 11,
+          "asserts": 61,
+          "skips": 6,
           "todos": 0
         },
         "an-mcp-route-says-which-challenge-it-answers-with.test.mjs": {
@@ -2745,6 +2745,12 @@
           "skips": 0,
           "todos": 0
         },
+        "no-internal-hostname-ships-in-the-package.test.mjs": {
+          "tests": 1,
+          "asserts": 3,
+          "skips": 0,
+          "todos": 0
+        },
         "no-nul-bytes.test.mjs": {
           "tests": 3,
           "asserts": 7,
@@ -4408,8 +4414,8 @@
           "todos": 0
         },
         "the-bar-names-no-organisation-nobody-named.test.mjs": {
-          "tests": 4,
-          "asserts": 7,
+          "tests": 6,
+          "asserts": 13,
           "skips": 0,
           "todos": 0
         },
@@ -4503,6 +4509,12 @@
           "skips": 0,
           "todos": 0
         },
+        "the-demo-links-its-reports-to-its-own-portal.test.mjs": {
+          "tests": 3,
+          "asserts": 13,
+          "skips": 0,
+          "todos": 0
+        },
         "the-door-answers-the-address-it-advertises.test.mjs": {
           "tests": 9,
           "asserts": 37,

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.3.0-beta.7
+
+No changes in this release.
+
 ## 0.3.0-beta.6
 
 No changes in this release.

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.7",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.7",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.7",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.0-beta.7
+
+No changes in this release.
+
 ## 0.3.0-beta.6
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.0-beta.6",
+  "version": "0.3.0-beta.7",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/shared/brand.mjs

@@ -87,10 +87,14 @@ export const BRAND = {
  * installation, which on a fresh install has no answer, and answering it with the product's name puts
  * "Organisation: Clearotron" on the top bar of every install that never set it.
  *
- * Null rather than an empty string, so a caller cannot render it by accident. Nothing sets the variable
- * today; setup gains the question that will.
+ * Null rather than an empty string, so a caller cannot render it by accident.
+ *
+ * ITS OWN SETTING, `CLEAROTRON_ORGANISATION_NAME`, the one setup writes. This read `CLEAROTRON_BRAND_NAME`,
+ * which renames the PRODUCT: a wizard-configured organisation was never named, and an operator who set
+ * the brand to reach it got "This is Acme's Acme portal" with the title and the logo renamed too
+ * (measured on a published beta, 2026-09-11). The two differ on presence as well as on absence now.
  */
-export const ORGANISATION_NAME = process.env.CLEAROTRON_BRAND_NAME?.trim() || null;
+export const ORGANISATION_NAME = process.env.CLEAROTRON_ORGANISATION_NAME?.trim() || null;
 
 /**
  * THE CONFIDENTIALITY POSTURE ON A DELIVERED DOCUMENT — one rule, both report templates.

package/shared/permanent-install.mjs

@@ -161,7 +161,43 @@ export function packagedUpdate({ installDir = INSTALL_DIR, version = ownVersion(
  */
 export function stableInstallRoot({ installRoot = INSTALL_DIR, env = process.env, exists = existsSync } = {}) {
   if (!inNpxCache(installRoot)) return installRoot;
+  const has = (root) => !!root && exists(join(root, "mcp-server", "server.mjs"));
+  // A DEMO'S OWN COPY FIRST: it is this version, and it lives inside the demo's base. The demo's children
+  // are handed `CLEAROTRON_DEMO=1` and their workspace, `<base>/workspace`, which is how they find it.
+  const work = String(env?.CLEAROTRON_WORK_DIR ?? "").trim();
+  const demoRoot = env?.CLEAROTRON_DEMO === "1" && work ? packageRootUnder(demoProgramPrefix(dirname(work))) : null;
+  if (has(demoRoot)) return demoRoot;
   const prefix = permanentPrefix(env);
   const root = prefix ? packageRootUnder(prefix) : null;
-  return root && exists(join(root, "mcp-server", "server.mjs")) ? root : installRoot;
+  return has(root) ? root : installRoot;
+}
+
+/**
+ * WHERE A DEMO RUN FROM NPX KEEPS ITS OWN COPY OF THE PROGRAM: inside the demo's base, never `~/.local`.
+ *
+ * `npx clearotron demo` ran from npm's cache like `install` did, so the connect line it printed launched
+ * the connector from `_npx/<hash>/`, which npm deletes when it cleans up (measured on a published beta,
+ * 2026-09-11). The install's answer, a copy under `~/.local`, would leave a trace of the demo outside the
+ * demo's directory; this copy lives in `<base>/program`, so removing the demo is still one directory.
+ */
+export function demoProgramPrefix(base) {
+  return join(base, "program");
+}
+
+/**
+ * What `demo` does about its program. PURE given its inputs. `null` outside npx's cache; `{ skip }` on
+ * Windows, where npm's global layout differs, or with an unreadable version; otherwise a plan whose
+ * `current` says the copy is already this version, so a second start runs no npm at all.
+ */
+export function demoProgramPlan({ base, installDir = INSTALL_DIR, platform = process.platform, version = ownVersion(installDir), exists = existsSync, read = readFileSync } = {}) {
+  if (!inNpxCache(installDir)) return null;
+  if (platform === "win32") return { skip: "windows" };
+  if (!version) return { skip: "no-version" };
+  const prefix = demoProgramPrefix(base);
+  const root = packageRootUnder(prefix);
+  const current = exists(join(root, "mcp-server", "server.mjs")) && ownVersion(root, read) === version;
+  return {
+    prefix, root, version, current,
+    npmArgs: ["install", "--global", "--prefix", prefix, "--prefer-offline", "--no-fund", "--no-audit", `clearotron@${version}`],
+  };
 }