clearotron 0.3.2-beta.12 → 0.3.2-beta.14

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.14",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/serve.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+//
+// serve.mjs — the MCP server over stdio, with the Node check in front of it. The connect lines name
+// this file.
+//
+// server.mjs cannot check the Node it runs on. An ES module's imports are all loaded before any of its
+// code runs, so on a Node below the floor the server fails while loading, with an error that names a
+// module and says nothing about the version. Measured on Node 18.20.8: "SyntaxError: The requested
+// module 'node:util' does not provide an export named 'parseEnv'". On a Windows laptop running the
+// connect line through WSL, the distribution's own Node 18 met "SyntaxError: Unexpected token 'with'"
+// (2026-09-19). This file imports only what an old Node can load, refuses in one plain line, and only
+// then loads the server.
+import { fileURLToPath } from "node:url";
+import { nodeFloorVerdict, nodeFloorRefusal } from "../shared/node-floor.mjs";   // one floor, read from package.json
+
+const floor = nodeFloorVerdict();
+if (!floor.ok) {
+  console.error(`clearotron: ${nodeFloorRefusal(floor)}`);
+  process.exit(1);
+}
+
+// THE SERVER STARTS AS THE ENTRY IT WOULD HAVE BEEN. It starts its stdio transport, and reads the
+// install's settings, only when it is the process's entry file, so the entry is handed over first.
+process.argv[1] = fileURLToPath(new URL("./server.mjs", import.meta.url));
+await import("./server.mjs");

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.14",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.14",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/free-tier/src/capabilities.js

@@ -48,9 +48,9 @@
 // The question that DOES depend on the box — which offices this deployment can reach right now — is
 // answered in driver/register-availability.mjs, and the answer rides the plan as a disclosed
 // `deferred_coverage` row. It is deliberately not answered here, and `covered` is deliberately not
-// narrowed there either: 's admission gate reads this field to decide which territories a client may
+// narrowed there either: the admission gate reads this field to decide which territories a client may
 // ORDER, so narrowing it to the configured half would refuse a US-only matter at the door instead of
-// disclosing its US gap ('s ruling is that such a matter must START and disclose).
+// disclosing its US gap (the rule is that such a matter must START and disclose).
 //
 // ── THE "NO SHAPE FOR HALF OF THIS RAN" RULE IS UNCHANGED — IT MOVED THE SPLIT, NOT REPEALED IT ──────
 //

package/providers/jx/src/core.js

@@ -13,10 +13,10 @@
 // SEARCH MACHINERY (query terms), never registry facts — the never-invent rule binds registry DATA,
 // not the queries we choose to run.
 //
-// BILLING RIDES THE RUN, NOT THIS FILE (/ at e49868e3, and the transport deleted at).
+// BILLING RIDES THE RUN, NOT THIS FILE.
 // These lanes used to POST to the Anthropic Messages API on ANTHROPIC_API_KEY at a hardcoded haiku
-// tier while the rest of the run used whatever program the customer chose — the mix the owner's D6
-// ruling forbids. They now go through `engine.runTurn()` like every other model call, so whatever
+// tier while the rest of the run used whatever program the customer chose — the mix the product's one-provider-per-run
+// rule forbids. They now go through `engine.runTurn()` like every other model call, so whatever
 // program and billing mode the run is on carries them, and nothing here selects a vendor.
 //
 // `callMessagesAPI` — with its own MESSAGES_API_URL, x-api-key header and retry ladder — is DELETED

package/providers/jx/src/turn-envelope.mjs

@@ -3,7 +3,7 @@
 // turn-envelope.mjs — render a forced-tool request as a CLI-turn prompt, and read the turn's text back
 // into the envelope the three lane parsers already understand. PURE. No driver import, no network.
 //
-// ── why this exists ( /) ─────────────────────────────────────────────────────────────────
+// ── why this exists ─────────────────────────────────────────────────────────────────
 //
 // The jx lanes called the Anthropic Messages API directly with `tool_choice: {type:"tool"}`, on a key,
 // at a hardcoded tier — regardless of which AI program the customer configured. The owner's standing

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,13 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.2-beta.14
+
+No changes in this release.
+
+## 0.3.2-beta.13
+
+No changes in this release.
+
 ## 0.3.2-beta.12
 
 No changes in this release.

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.3.2-beta.12",
+  "version": "0.3.2-beta.14",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/perplexity/README.md

@@ -11,7 +11,7 @@ optional: without `PERPLEXITY_API_KEY` the run door refuses by name
 (`preflightResearchCredential`, `../../driver/driver.config.mjs`) rather than searching less. A
 KNOCKOUT is the exception and it is deliberate — its register half is a whole product without the
 sweep, so `../../driver/pipeline-knockout.mjs` SKIPS this adapter and discloses the half it did not
-run ( acceptance 6). Nothing is billed for a sweep that never runs.
+run. Nothing is billed for a sweep that never runs.
 (`CLEAROTRON_KNOCKOUT_SWEEP_FIXTURES` is the $0 dev route to a knockout WITH a sweep.)
 
 The header's `index.js` and `build.js` belong to the plugin packaging this core was extracted from;

package/providers/signa/src/capabilities.js

@@ -20,7 +20,7 @@
 //   * predicates.wildcardInfix — `contains` would appear to serve it and does not. The kernel hands
 //     the infix case its RAW pattern with the asterisks still in it, so the sweep would search the
 //     punctuation. Declaring it would be declaring a capability the executor cannot serve, which is
-//     the one thing 's criteria forbid. Stays null; the slice defers, disclosed.
+//     the one thing a declaration must never do. Stays null; the slice defers, disclosed.
 //   * resultCeiling — there is no single number to put here, and the reason is worth the paragraph.
 //     An unscoped term pages to exhaustion whatever its size, on every predicate — no ceiling. But add
 //     `filters.owner_name` and the SAME term stops dead at the owner-scoped window (400), which the
@@ -194,7 +194,7 @@ export const CAPABILITIES = Object.freeze({
 
     // ── WHICH BINDING LAYERS DOES A SEARCH SCOPED TO THIS OFFICE ACTUALLY RETURN? ──────────
     //
-    // 's first task, answered for this provider by driving the three scopings against each other rather
+    // The first question for every provider, answered here by driving the three scopings against each other rather
     // than by reading the documentation. One term, one limit, France:
     //
     //   filters.offices                              the national register ALONE

package/providers/signa/src/core.js

@@ -680,8 +680,8 @@ export function toSignaParams(p = {}) {
     // and this branch is the only thing standing between that and `strategies: ["exact"]`. With
     // `predicates.default` declared `"contains"` and no mapping here, every unanchored slice would
     // have gone to the wire as an EXACT search: narrower than the plan asked for, returning fewer
-    // rows, and answering as though it were the query requested. That is 's defect exactly, and
-    // declaring a predicate without wiring it is the one thing this issue's criteria forbid.
+    // rows, and answering as though it were the query requested. That is the silent narrowing this branch
+    // prevents, and declaring a predicate without wiring it is the one thing a declaration must never do.
     //
     // A `*` in the term means this is the infix-wildcard case, which shares the empty {} and which
     // `contains` cannot serve — the kernel hands the RAW pattern, asterisks included, so a contains

package/providers/uspto-local/src/core.js

@@ -67,7 +67,7 @@ function resolveDbPath(auth) {
     // marker added by one consumer is a marker the other consumers do not get. Marking at the throw
     // means every path out of this provider carries it, including ones written later.
     //
-    // 's composite backstop caught a THROW and converted it. That backstop never fired against this
+    // The composite backstop caught a THROW and converted it. That backstop never fired against this
     // provider, because four of its five entry points catch their own throw and return a plain error
     // first — and the test that claimed it worked drove a stub that throws, which this does not do.
     throw new Error(

package/providers/uspto-local/src/sync.js

@@ -312,7 +312,7 @@ export async function syncIndex({ dbPath, files, ingest = ingestFile, onFile = n
     await onPhase?.("ingest");
     // BLOCKS THE EVENT LOOP FOR THE WHOLE REBUILD — node:sqlite is synchronous, and this is one
     // transaction over every row in the index. Nothing on this thread runs again until it commits,
-    // which is why 's disk sampler is a worker thread rather than a timer.
+    // which is why the disk sampler is a worker thread rather than a timer.
     rebuildFts(db);
     await onPhase?.("fts");
     const rows = db.prepare("SELECT count(*) AS n FROM mark").get().n;

package/scripts/README.md

@@ -52,14 +52,10 @@ than its contents, and the whole reason the browser checks exist is that a fix f
 scrollbars" shipped a report with two scrollbars past 1,500 passing tests. Those checks run in CI's
 `build-and-verify` job and nowhere else — so **CI, not your machine, is what covers them.**
 
-`render-check.mjs` is a further step out, running in **neither** — and wiring it up is what found out
-why that mattered. CI left it out because it measures a PUBLISHED RUN and had no pool to point at;
-`--fixture-pool` removed that reason, so wired it into`build-and-verify` as a blocking step.
-
-**Its first run anywhere reported 6 of 9 assertions failing with `no-probe` and `null`** — not a layout
+**`render-check.mjs`'s first run anywhere reported 6 of 9 assertions failing with `no-probe` and `null`** — not a layout
 defect, an inability to *measure*. The three assertions that look inside the report frame (the height
 bridge, the scrollbar loop, the sideways overflow) depend on a probe script in the sandboxed iframe
-posting back to the shell. The pool built fine; the harness cannot see inside its own frame. **.**
+posting back to the shell. The pool built fine; the harness cannot see inside its own frame.
 
 **The first explanation written down here was wrong, and how it was wrong is the useful part.** This
 paragraph used to say the message never arrives under `file://` with production's sandbox. Measured in

package/scripts/citation-anchor-report.mjs

@@ -113,7 +113,7 @@ export function anchorRows(citations, linesOf) {
     if (!others.length) { rows.push({ ...c, verdict: "silent", anchor }); continue; }
     let elsewhere = null;
     for (const n of others) {
-      const decl = new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?(?:function|const|let|var|class)\\s+${n.replace(/\$/g, "\\$")}\\b`);
+      const decl = new RegExp(`^\\s*(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?(?:function|const|let|var|class)\\s+${n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`);
       for (let i = 0; i < target.length; i++) {
         if (!decl.test(target[i])) continue;
         // THE CITATION POINTING INSIDE WHAT IT NAMES IS CORRECT, not drifted — see the header.

package/scripts/citation-line-check.mjs

@@ -528,7 +528,7 @@ function main() {
 //     WATCHLIST_OWNERS_MAX declared in variant-manifest-model.mjs   anything else — `declared` marks it
 //
 // A BARE WORD BEFORE `in <file>` IS NOT A SYMBOL CITATION, deliberately, and this is the difference
-// between this arm and 's. reads the token beside a number SPECULATIVELY and drops it when it
+// between this arm and the line arm, which reads the token beside a number SPECULATIVELY and drops it when it
 // is not declared, because "ALREADY computes (coverage-ledger.mjs:180)" would otherwise manufacture a
 // defect out of emphatic prose. This arm cannot do that: an undeclared symbol has to FAIL or the check
 // has no teeth at all. So the form is opted into. `the field in scope-ledger.mjs` and `checked in
@@ -923,8 +923,8 @@ export function symbolMisses(citations, readLines) {
 // WHAT IT CANNOT SEE, and why this stays a slice. A citation that lands on the WRONG NON-BLANK LINE is
 // invisible to it — that looks identical to a correct one. Three of the eleven citations repointed in
 // `stages.mjs` under this issue were exactly that: `stages.mjs:1474` pointed at a transliteration `why:`
-// row, `pipeline.mjs:2908` at a different function entirely, and neither line was blank. Only 's
-// arm can decide those, and only where the citation names a symbol. A clean run here is evidence about
+// row, line 2908 of `pipeline.mjs` at a different function entirely, and neither line was blank. Only the
+// symbol arm can decide those, and only where the citation names a symbol. A clean run here is evidence about
 // punctuation, not about correctness.
 //
 // AN OVERRUN IS NOT THIS FINDING. A span running past the file's last line is already reported as

package/scripts/e2e.mjs

@@ -2370,7 +2370,7 @@ const TERMINAL_BY_SUFFIX_RAN = { failed: "failed", done: "delivered", cancelled:
 
 // REPAIR — the live-state vocabulary is IMPORTED, not retyped. This file's first draft spelled it
 // out twice more (an in-flight suffix set and a claim-lock regex), which is exactly the failure
-// queue-markers.mjs was created for: "written down three times and the copies disagreed ". 's
+// queue-markers.mjs was created for: "written down three times and the copies disagreed". The
 // claim lock in particular is a NORMAL in-flight state — a live token is a claim in progress, a dead one
 // is restored by sweepAbandonedTakeovers — and one more private copy of that rule is one more chance to
 // report a claim race as a stranded job.

package/scripts/env-audit.mjs

@@ -624,7 +624,7 @@ const EXTERNAL_RE = /^#\s*external:\s*(\S.*)$/;
 //
 // THE TWO MARKERS DO NOT CLEAR EACH OTHER. `pending` was a single slot, and any comment line that was
 // not an `# external:` reset it. Adding a second marker to that shape would mean an `# effect:` line
-// silently DELETED the `# external:` declaration above it — the row would go orphaned and 's
+// silently DELETED the `# external:` declaration above it — the row would go orphaned and the orphan
 // guard would red, with the cause three lines away and invisible. Each marker carries its own slot.
 const EFFECT_RE = /^#\s*effect:\s*(\S.*)$/;
 // A COMMENTED-OUT ROW STILL COUNTS, the same rule `assigned` uses above and for the same reason: `# X=`

package/scripts/env-classify.mjs

@@ -248,7 +248,7 @@ function namesMergedIntoCandidate(src) {
   const helpers = new Set([...src.matchAll(/Object\.assign\(\s*candidate\s*,\s*(?:await\s+)?([A-Za-z_$][\w$]*)\s*\(/g)]
     .map((m) => m[1]));
   for (const fn of helpers) {
-    const at = src.search(new RegExp(`\\bfunction\\s+${fn.replace(/\$/g, "\\$")}\\s*\\(`));
+    const at = src.search(new RegExp(`\\bfunction\\s+${fn.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*\\(`));
     const refuse = (why) => new Error(`env-classify: bin/onboard.mjs writes what ${fn}() returns, and ${why}, so `
       + "the names it writes cannot be read. Read as none, they would land in `tuning` and on the deletion "
       + "population; that is this script failing to look, not a finding about the wizard.");

package/scripts/pack-publishable.mjs

@@ -123,7 +123,7 @@ async function main() {
     try {
       ({ reconcileAndScan: gate } = await import("../cut/packed-artifact.mjs"));
     } catch (e) {
-      console.error("  REFUSING (exit 2, could-not-look): cut/packed-artifact.mjs did not load —"
+      console.error("  REFUSING (exit 2, could not look): cut/packed-artifact.mjs did not load —"
         + ` ${String(e?.message ?? e)}.\n`
         + "  That module carries the only rule that says which files may leave this repository, and a\n"
         + "  pack that cannot ask it produces an artifact nobody has checked. An exported tree does not\n"

package/scripts/release-artifact-seal.mjs

@@ -106,10 +106,10 @@ function main() {
     console.error("usage: node scripts/release-artifact-seal.mjs --tarball <path>");
     process.exit(2);
   }
-  // A path that is not there is a could-not-look, never a seal that found nothing to do. Exit 2 is
+  // A path that is not there is a check that could not look, never a seal that found nothing to do. Exit 2 is
   // the house meaning and it keeps this distinguishable from a tarball that was sealed and was clean.
   if (!existsSync(tarball)) {
-    console.error(`  REFUSING (exit 2, could-not-look): ${tarball} does not exist, so nothing was sealed.`);
+    console.error(`  REFUSING (exit 2, could not look): ${tarball} does not exist, so nothing was sealed.`);
     process.exit(2);
   }
 

package/scripts/settings-render-check.mjs

@@ -148,6 +148,10 @@ const sessionId = sess.sessionId
 const cmd = (method, params = {}) => new Promise((r) => { const i = ++id; pending.set(i, r); ws.send(JSON.stringify({ id: i, sessionId, method, params })) })
 await cmd('Page.enable')
 // A probe that throws says so, rather than returning nothing for the assertions after it to misread.
+// A value pasted into code the page evaluates, as a JavaScript string or object literal. JSON.stringify
+// alone leaves `<`, `>`, `/` and the two line separators as they are; escaped, they read the same once
+// parsed and cannot close or break the code they are pasted into.
+const jsLiteral = (v) => JSON.stringify(v).replace(/[<>\/\u2028\u2029]/g, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, '0')}`)
 const evalIn = async (expr) => {
   const r = (await cmd('Runtime.evaluate', { expression: expr, awaitPromise: true, returnByValue: true })).result
   if (r?.exceptionDetails) console.error(`  ! a probe threw: ${r.exceptionDetails.exception?.description ?? r.exceptionDetails.text}`)
@@ -184,7 +188,7 @@ async function reload(ready, what) {
 }
 
 async function setTheme(theme) {
-  await evalIn(`(() => { document.documentElement.setAttribute('data-theme', ${JSON.stringify(theme)}); try { localStorage.setItem('cordillera-theme', ${JSON.stringify(theme)}) } catch {} return true })()`)
+  await evalIn(`(() => { document.documentElement.setAttribute('data-theme', ${jsLiteral(theme)}); try { localStorage.setItem('cordillera-theme', ${jsLiteral(theme)}) } catch {} return true })()`)
   await sleep(250)
 }
 

package/scripts/strip-tracker-citations.mjs

@@ -2,15 +2,15 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 //
-// Removes the internal citation OPENER from comments and prose in the tree (tracker issue 309).
+// Removes the internal citation OPENER from comments and prose in the tree.
 //
 // The form is `tracker issue NNN — ` standing at the head of a sentence, where the citation is not part
 // of what the sentence says but a label in front of it. Stripping the opener leaves the sentence intact:
 //
-//     // tracker issue 1149 — the walk must start at the repository root
+//     // tracker issue NNNN — the walk must start at the repository root
 //     // the walk must start at the repository root
 //
-//     assert.ok(x, "Refs tracker issue 2075 — an absent file is a finding")
+//     assert.ok(x, "Refs tracker issue NNNN — an absent file is a finding")
 //     assert.ok(x, "an absent file is a finding")
 //
 // WHY THE PATTERN LOOKS OVER-SPECIFIED. Three parts of it are load-bearing and each was measured, not
@@ -20,7 +20,7 @@
 //     and the replacement is `$1`, which puts that opener back. Without the group the sweep deletes the
 //     opening quote of every test name it touches, and a broken string literal is a syntax error in the
 //     lucky cases and a changed assertion in the unlucky ones.
-//   · `\s+` AFTER THE SEPARATOR, never `\s*`. `tracker issue 1149-12` is an ITEM suffix, not a citation
+//   · `\s+` AFTER THE SEPARATOR, never `\s*`. `tracker issue NNNN-12` is an ITEM suffix, not a citation
 //     followed by prose: there is no space after its hyphen. `\s*` eats the item number.
 //   · THE `i` FLAG. `Refs tracker issue NNN` is capitalised at the head of a commit-style line and is a
 //     fifth of the corpus.

package/scripts/test-run.mjs

@@ -271,8 +271,8 @@ process.env.CLEAROTRON_DEMO_PROFILES ??= "1";
 // driver/test/*.test.mjs. They are indistinguishable from code defects. An agent who runs the suite on a
 // branch, sees 295 red, and diffs the failing NAMES against a baseline taken the same way sees zero
 // regressions and calls the branch clean — and it is, but roughly 190 tests never executed, and a real
-// regression inside any of them is invisible by exactly that arithmetic. It has already happened: 's
-// first full-suite comparison was taken against a 295-fail baseline.
+// regression inside any of them is invisible by exactly that arithmetic. It has already happened: a
+// full-suite comparison was taken against a 295-fail baseline.
 //
 // So: refuse, name what is missing, and name the command. REFUSE RATHER THAN INSTALL — this wrapper is
 // what CI and scripts/publication-scan.mjs run the suite through, and a wrapper that can start a network
@@ -751,6 +751,37 @@ const repoBefore = snapshotRepo(REPO_ROOT);
 const RUN_HOME = String(process.env.HOME ?? "").trim() || homedir();
 const homeBefore = snapshotHome(RUN_HOME);
 
+// ── AND NOTHING THE RUN MADE IS LEFT IN THE MACHINE'S TEMP DIRECTORY ────────────────────────────────
+//
+// The run's own root is removed on every exit. What escapes it is a child handed an environment without
+// TMPDIR: it falls back to the machine's temp directory, and nothing removes what it made there. Measured
+// 2026-09-19: fifteen `clearotron-demo-*` directories per `npm test`, from the demo's temporary sample
+// copies, and 36 GB accumulated on one box. Named by the product prefix, so the guard reads only what
+// this product makes; owned by this account, so another user's run is not ours to count.
+//
+// THE OUTERMOST RUN WATCHES THE MACHINE'S TEMP ROOTS. A nested run watches only its own base, and only
+// when a test arms it (CT_TEMP_LEAK_GUARD=1): the runner's own tests drive nested runs while the rest of
+// the suite is working, and a nested guard reading the shared root would count its neighbours' files.
+const LEAK_PREFIXES = Object.freeze(["clearotron-demo-"]);
+const OUTERMOST = !String(process.env.CT_TEST_MACHINE_TMP ?? "").trim();
+const LEAK_ROOTS = OUTERMOST
+  ? [...new Set([MACHINE_TMP, REAL_TMP, ...PLATFORM_TMP].map((p) => resolve(p)))]
+  : String(process.env.CT_TEMP_LEAK_GUARD ?? "") === "1" ? [resolve(REAL_TMP)] : [];
+function tempLeftovers() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : null;
+  const out = new Set();
+  for (const r of LEAK_ROOTS) {
+    let names;
+    try { names = readdirSync(r); } catch { continue; }
+    for (const n of names) {
+      if (!LEAK_PREFIXES.some((p) => n.startsWith(p))) continue;
+      try { if (uid == null || statSync(join(r, n)).uid === uid) out.add(join(r, n)); } catch { /* gone already */ }
+    }
+  }
+  return out;
+}
+const tempBefore = tempLeftovers();
+
 
 child = spawn(argv[0], argv.slice(1), {
   stdio: "inherit",
@@ -808,8 +839,20 @@ child.on("close", (code, signal) => {
   if (wrote.length) for (const line of explainRepoWrites(wrote)) console.error(line);
   const wroteHome = repoWrites(homeBefore, snapshotHome(RUN_HOME), RUN_HOME);
   if (wroteHome.length) for (const line of explainHomeWrites(wroteHome, RUN_HOME)) console.error(line);
+  const leftInTemp = [...tempLeftovers()].filter((p) => !tempBefore.has(p)).sort();
+  if (leftInTemp.length) {
+    console.error("");
+    console.error(`[test-run] THIS RUN LEFT ${leftInTemp.length} DIRECTOR${leftInTemp.length === 1 ? "Y" : "IES"} IN THE MACHINE'S TEMP DIRECTORY:`);
+    for (const p of leftInTemp) console.error(`  + ${p}`);
+    console.error("");
+    console.error("  A child handed an environment without TMPDIR puts its temporary files in the machine's temp");
+    console.error("  directory, where nothing removes them. Pass `TMPDIR: tmpdir()` in that child's env, so they land");
+    console.error("  in this run's own root, which is removed on every exit.");
+    console.error("");
+    console.error("  (Another run on this account making the same directories at the same time prints this too.)");
+  }
   // THIS MAY TURN A GREEN RUN RED. IT MUST NEVER TURN A RED RUN GREEN — a failing suite keeps its own
   // exit code, because what the tests found matters more than what they wrote while finding it.
   const childCode = code ?? 1;
-  process.exit(childCode !== 0 ? childCode : (wrote.length || wroteHome.length ? 1 : 0));
+  process.exit(childCode !== 0 ? childCode : (wrote.length || wroteHome.length || leftInTemp.length ? 1 : 0));
 });

package/shared/browser-temp-root.mjs

@@ -111,13 +111,20 @@ export function browserTempRoot() {
 }
 
 /**
- * The environment a browser must be spawned with so its singleton lock lands under `root`.
+ * The environment a browser must be spawned with so everything it writes lands under `root`.
  *
- * `TMPDIR` is the whole mechanism, so this refuses rather than passing a root that cannot work.
+ * `TMPDIR` puts its singleton lock there, so this refuses rather than passing a root that cannot work.
+ * AND A HOME OF ITS OWN. A profile directory does not hold everything a browser writes: it keeps its
+ * font cache, certificate store, desktop settings and crash folder under the user's home, so a suite run
+ * left `.cache/fontconfig`, `.local/share/pki`, `.local/share/applications` and
+ * `.config/google-chrome/Crash Reports` in the real home of whoever ran it (measured on a fresh home,
+ * 2026-09-19). The home and the three XDG folders now sit inside the root, and go with it.
  */
 export function browserEnv(root, env = process.env) {
   assertRootFits(root);
-  return { ...env, TMPDIR: root };
+  const home = join(root, "home");
+  for (const d of [home, join(home, ".config"), join(home, ".cache"), join(home, ".local", "share")]) mkdirSync(d, { recursive: true });
+  return { ...env, TMPDIR: root, HOME: home, XDG_CONFIG_HOME: join(home, ".config"), XDG_CACHE_HOME: join(home, ".cache"), XDG_DATA_HOME: join(home, ".local", "share") };
 }
 
 /**

package/shared/client-door.mjs

@@ -214,7 +214,7 @@ export const clientDoorAddress = (env = {}) => `http://127.0.0.1:${clientDoorPor
  * the fence off accepts no account key, and the fence on with nothing listening is a setting with no
  * server. Reporting "standing" on half of it would send a reader to paste an address at nothing.
  */
-export function clientDoorState({ env = {}, unitDir, exists, active = null, listening = null, activeState = null, subState = null } = {}) {
+export function clientDoorState({ env = {}, unitDir, exists, active = null, listening = null, ownListener = null, activeState = null, subState = null } = {}) {
   const fenceOn = String(env.CLIENT_MCP_ACCOUNT_ACCESS ?? "").trim() === "1";
   const unitInstalled = Boolean(exists(join(unitDir, CLIENT_DOOR_UNIT)));
   // `standing` IS UNCHANGED AND STILL MEANS CONFIGURED — a file on disk and a fence flag. Two callers
@@ -238,7 +238,7 @@ export function clientDoorState({ env = {}, unitDir, exists, active = null, list
     // so a crash loop (`activating/auto-restart`) and a unit that was never started (`inactive/dead`)
     // reduce to the same `false` and printed the same sentence — one is a fault to read the journal for,
     // the other is a connect that stopped half-way.
-    listening, activeState, subState, standing, fenceOn, unitInstalled, active, serving: standing && active === true };
+    listening, ownListener, activeState, subState, standing, fenceOn, unitInstalled, active, serving: standing && active === true };
 }
 
 /**
@@ -300,10 +300,17 @@ export function describeDoorState(door, {
       // reader whose foreground door was up to run the command they had just run — and it is NOT enough
       // to call it theirs: the product's ports are fixed defaults, so on a shared box the answer may be
       // another install's door entirely. Caught by 2145's arm on a machine where exactly that was true.
+      //
+      // AND WHOSE IT IS IS ASKED, NOT GUESSED. On a shared box the port is often another account's door,
+      // and "something is listening on the client door's address for this environment" read as this
+      // install's (measured 2026-09-19). `ownListener` is true only when this install's own record says
+      // it holds the port; anything else is said as exactly what was measured, a process on the port.
+      if (door.ownListener === true)
+        return { level: "info",
+          text: `this install's client door is running in the foreground — it stops when that terminal does; `
+            + `\`${startCmd} --background\` installs the unit.` };
       return { level: "info",
-        text: `something is listening on the client door's address for this environment — no ${unit} is `
-          + "installed, so either this install is running in the foreground (it stops when that terminal "
-          + `does; \`${startCmd} --background\` installs the unit) or another install holds the port.` };
+        text: "a process holds the client door's port, and nothing here shows it is this install's door." };
     }
     return { level: "info",
       text: `the client door is not set up here — ${missing}. \`${startCmd}\` writes both. Since the `
@@ -313,11 +320,16 @@ export function describeDoorState(door, {
   if (door.active === null) {
     // THE PROBE STILL COUNTS HERE. Not asking systemd is not the same as knowing nothing: if the port
     // answers, the door is serving whatever systemd would have said.
-    if (door.listening === true) {
+    if (door.listening === true && door.ownListener === true) {
       return { level: "ok",
         text: `${unit} is installed and account access is enabled, and the client door's port is `
           + "answering — systemd was not asked, so this is the port's word rather than the unit's" };
     }
+    if (door.listening === true) {
+      return { level: "info",
+        text: `${unit} is installed and account access is enabled — whether it is RUNNING was not checked. `
+          + "A process holds the client door's port, and nothing here shows it is this install's door." };
+    }
     return { level: "info",
       text: `${unit} is installed and account access is enabled — whether it is RUNNING was not checked, `
         + "so this says the door is set up, not that it answers" };

package/shared/connect-clients.mjs

@@ -429,6 +429,8 @@ const splitSides = (step) => {
   return variants.map((v) => ({
     ...step,
     text: v.heading,
+    // A side that needs something filled in before it is pasted says so under its own copy.
+    hint: v.hint ?? step.hint,
     copy: { ...step.copy, text: v.text, stdio: { ...step.copy.stdio, text: v.text, variants: null } },
   }));
 };

package/shared/demo-start-args.mjs

@@ -12,6 +12,16 @@
  * `--demo-own-base` says it is the demo's default, which is what lets the supervisor remove the folder
  * when the window closes. `--keep` is the reader's, and it travels as given.
  */
+/**
+ * The Node flag the demo runs under, so Node's one-time warning that its built-in SQLite is experimental
+ * does not land on the demo's first screen. Named once: the launcher puts it on the demo's own process,
+ * and `bin/example.mjs` hands it to the services it starts through NODE_OPTIONS.
+ */
+export const EXPERIMENTAL_WARNING_OFF = "--disable-warning=ExperimentalWarning";
+
+/** The same flag added to whatever NODE_OPTIONS the reader already has, which is kept. PURE. */
+export const withWarningOff = (nodeOptions) => [nodeOptions, EXPERIMENTAL_WARNING_OFF].filter(Boolean).join(" ");
+
 export function demoStartArgs({ demoBase, readerBase = false, keep = false, port = null, noOpen = false } = {}) {
   const args = ["--demo", "--base", demoBase];
   if (!readerBase) args.push("--demo-own-base");

package/shared/identifier-scan.mjs

@@ -152,7 +152,7 @@ export function firesOn(name, line, suffixable) {
  * @returns {{start: number, end: number}[]}
  */
 export function matchSpans(name, line, suffixable) {
-  const body = name.replace(/[&]/g, "\\&").replace(/ /g, SEPARATOR_CLASS);
+  const body = name.replace(/[.*+?^${}()|[\]\\&]/g, "\\$&").replace(/ /g, SEPARATOR_CLASS);
   const tail = suffixable.has(name) ? "" : "(?![A-Za-z0-9])";
   const re = new RegExp(`(?<![A-Za-z0-9])${body}${tail}`, "gi");
   const out = [];
@@ -332,7 +332,7 @@ const COMMENT_LINE = /^\s*(\/\/|#|\*|<!--)/;
 // this repository is about to start printing addresses at — an allowlist for those mailboxes would
 // have been inert, because nothing ever examined them.
 //
-// WHY THE RULED MAILBOXES JOIN ROLE_LOCALPART RATHER THAN THE DOMAIN GETTING AN EXEMPTION. 's
+// WHY THE RULED MAILBOXES JOIN ROLE_LOCALPART RATHER THAN THE DOMAIN GETTING AN EXEMPTION. The
 // ruling says `security` joins ROLE_LOCALPART "in the same PR, never a bypass", and that is the
 // right shape: exempting the whole domain would also pass a named person's address at it, which is
 // exactly the thing nobody should paste into a public README. Measured before widening rather than

package/shared/invocation.mjs

@@ -312,7 +312,7 @@ export function reachableCommand(verb, { argv1 = process.argv[1] ?? "", env = pr
 /**
  * The verb by NAME ONLY — no prefix, no path, no `npx`.
  *
- * ✕ A DELIBERATE EXCEPTION TO "ONE TREATMENT", AND THE ONE SURFACE THAT NEEDS IT. 's
+ * ✕ A DELIBERATE EXCEPTION TO "ONE TREATMENT", AND THE ONE SURFACE THAT NEEDS IT. The
  * second requirement is that the choice is made once rather than per site, so an exception has to be
  * named rather than quietly spelled differently somewhere.
  *

package/shared/reference-guard-classes.mjs

@@ -85,10 +85,12 @@ export const withoutColourValues = (line) => String(line).replace(HEX_COLOUR, (m
 });
 
 /** Strip the spans where a `#NNN` is an address rather than a reference. */
-export const withoutLinkTargets = (line) => String(line)
+export const withoutLinkTargets = (line) => withoutAngleSpans(String(line)
   .replace(/\]\([^)]*\)/g, "]()")                 // markdown link targets, anchors included
-  .replace(/https?:\/\/\S+/g, "")                  // bare URLs and their fragments
-  .replace(/<[^>]*>/g, "");                        // angle-bracket autolinks
+  .replace(/https?:\/\/\S+/g, ""));                // bare URLs and their fragments
+
+/** Angle-bracket spans (autolinks, tags), removed until none is left: one pass can reassemble one. */
+const withoutAngleSpans = (s) => { for (let prev = null; prev !== s;) { prev = s; s = s.replace(/<[^>]*>/g, ""); } return s; };
 
 // A `#` COMMENT IS A COMMENT WHEREVER THE FILE FORMAT SAYS SO, not only in YAML. Extensionless is
 // deliberate: a systemd unit or a dotfile often has no extension worth matching, so the KNOWN