clearotron 0.2.4 → 0.3.0-beta.1

package/driver/portal-service.mjs

@@ -13,7 +13,7 @@
 //   POST /portal/login                 rather than in the SPA (CI greps the built bundle for internal
 //   POST /portal/logout                variable names, and a login screen has to explain configuration).
 //                                      Absent on a Cloudflare-fronted instance, where the edge is the door.
-//   GET  /portal/api/me              — { role, email, accounts }
+//   GET  /portal/api/me              — { email, permissions, access, organisations, accounts, … }
 //   GET  /portal/api/searches[?account=] — registry levels + the account's saved searches
 //   POST /portal/api/run/plan        — the CONFIRMATION GATE: validate + resolve + honest summary +
 //                                      short-TTL HMAC confirmationToken. Nothing spends yet.
@@ -41,14 +41,46 @@ import { clientFailureNote } from "../shared/client-failure-note.mjs";   // —
 import { bareInvocation, invocationPrefix, installRoute } from "../shared/invocation.mjs";   // — and why this one surface is by NAME
 import { stdioConnectOffer, stdioConnectFor, STDIO_SHAPES } from "../shared/stdio-connect.mjs";   // — ONE author for the connect route
 import { connectOffers, offersForWire } from "../shared/connect-clients.mjs";                 // — ONE table, resolved server-side
-// — the portal became an ISSUANCE PATH here, deliberately and by owner ruling.
+
+/**
+ * The ops credential for one trigger call: the boot token's cap, re-taken against the roster now.
+ *
+ * Separated from the call site and exported because the service's `trigger` is injected in tests, so
+ * logic left inside it can only ever be asserted by reading the source — and the case that matters is
+ * the one where something fails.
+ *
+ * BOTH FALLBACKS HAND BACK THE BOOT TOKEN, never an uncapped one. An empty roster is the single case
+ * the boot mint reads as "do not cap", so re-deriving it here would turn an unreadable store into a
+ * token good for every account. A mint that throws — an unset secret — lands the same way. The failure
+ * direction is the whole point: a stale cap refuses the newest company, which is the bug being fixed;
+ * a widened cap admits every company, which is a larger and quieter one.
+ */
+export function opsTokenFor({ bootToken, roster, mint }) {
+  if (!Array.isArray(roster) || !roster.length) return bootToken;
+  try {
+    return mint({ scope: "ops", sub: "portal", verbs: ["start_run", "stop_run"],
+      accounts: roster, ttlSec: 300 });
+  } catch (e) {
+    // THE FALLBACK DIRECTION IS RIGHT AND ITS SILENCE WAS NOT. Handing back the boot credential is
+    // correct — it is narrower than the one that failed to mint, never wider — but a bare catch here
+    // restores the exact refusal this lane exists to remove, for a company created after boot, with
+    // nothing anywhere naming the cause. An unset signing secret and an unreadable store both land here
+    // and both look like the feature simply not working.
+    console.error(`[portal] could not re-mint the engine credential (${String(e?.message ?? e)}) — `
+      + `falling back to the one minted at boot, which does not cover companies created since`);
+    return bootToken;
+  }
+}
+
+// — the portal became an ISSUANCE PATH here, deliberately and by ruling.
 // A comment further down this file said "the portal cannot mint from here … this process deliberately
 // holds no engine/MCP secrets — issuance is one path on purpose". MEASURED 2026-08-31: that wall is not
 // built. `bin/start.mjs` generates TRADEMARK_MCP_TOKEN_SECRET into `~/.env`, the portal unit loads
 // `EnvironmentFile=%h/.env`, and `childEnv` passes the same value to the portal child — so this process
 // has held the signing secret on both start paths for as long as both have existed. The comment has been
 // corrected in place rather than left to be trusted.
-import { mintToken, accountsForEmail, loadGrants } from "../shared/scope.mjs";
+import { mintToken, loadGrants, resolvePerson } from "../shared/scope.mjs";
+import { withPerson, withCompany } from "../shared/grants-edit.mjs";
 import { resolvePort } from "../shared/listen.mjs";   // — the port SOURCE, decided once
 import { fileURLToPath } from "node:url";
 
@@ -73,7 +105,8 @@ const READ_OFF_NOTE = "Reading a brief is not available on this instance — set
 import { basename, dirname, join, resolve as pathResolve } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { createHmac, timingSafeEqual } from "node:crypto";
-import { makePrincipal, assertPrincipal, PortalDeny } from "./portal-access.mjs";
+import { makePrincipal, assertPrincipal, genericOrgOf, mayReadRun, reachCovers, principalView, seesEverything, mayRun,
+  PortalDeny } from "./portal-access.mjs";
 // — the THIRD identity source (after the CF Access edge and, until, the deleted bypass). It
 // decides nothing about access: it turns a passphrase into an email string, which then goes through
 // makePrincipal and assertPrincipal exactly as a Cloudflare-verified address does.
@@ -92,7 +125,7 @@ import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor
 import { isDemo, demoPostureLine } from "./demo-posture.mjs";   
 import { triggerCapGap, triggerCapWarning } from "./trigger-cap.mjs";   // F51 — one answer, three surfaces
 import { makeUpstream } from "./portal-upstream.mjs";
-import { flagView, accessView, observedView, authView, staffRuleSource } from "./portal-config-view.mjs";
+import { flagView, accessView, observedView, authView } from "./portal-config-view.mjs";
 import { livePosture } from "./flag-snapshot.mjs";   // — for the capture-vs-box comparison only, never for a value
 import { familiesView, groupRuns, ungroupRuns } from "./portal-families.mjs";
 import { validateJob } from "./enqueue-schema.mjs";
@@ -108,12 +141,12 @@ import { engineCommit } from "./engine-build.mjs";                  // — the S
 import { engineCommitDate, engineProvenance } from "./engine-build.mjs";
 import { classifySkillsStore } from "./skills-store-provenance.mjs";
 import { makeStaticHandler, reportCsp, docCsp } from "./portal-static.mjs";
-import { bundleVerdict, healthUi } from "../shared/bundle-freshness.mjs";   // one definition of a usable bundle, shared with `doctor` (tracker issue 160)
+import { bundleVerdict, healthUi } from "../shared/bundle-freshness.mjs";   // one definition of a usable bundle, shared with `doctor`
 import { readReport, reportsOf, resolveReportFile, batchSummaryOf } from "./portal-report.mjs";
 import { readArchivedSet, updateArchived } from "./publish/archive-tags.mjs";
 import { readAcks, setAck, withAcks, ACKNOWLEDGEABLE } from "./portal-acks.mjs";
 import { MAX_BRIEF, makeReadBudget } from "./compose-read.mjs";
-import { BRAND, PALETTE, FONT_LINK, FAVICON_LINK, bracketMark, DOOR_ROOT, DOOR_ROOT_DARK, DOOR_THEME_INIT } from "../shared/brand.mjs";
+import { BRAND, ORGANISATION_NAME, PALETTE, FONT_LINK, FAVICON_LINK, bracketMark, DOOR_ROOT, DOOR_ROOT_DARK, DOOR_THEME_INIT } from "../shared/brand.mjs";
 import { envFrom, pinEnv } from "../shared/env-aliases.mjs";   // — a refusal names the name in force
 import { accessAudience, audienceLabel } from "../shared/access-audience.mjs";   // — F54; jose-free on purpose
 import { resolveNumericSetting } from "./numeric-setting.mjs";   // — the same table the engine enforces, without the throw a rendering surface must not take
@@ -221,14 +254,21 @@ const productNameOf = (product) => (typeof product === "string" ? reportIdentity
 // already fetch one key at a time, so it widens no boundary; it just spares the browser one request per
 // brand owner against a 120/min limit. It is NOT a wildcard: an empty array matches nothing, which is
 // the safe direction, and `null` (every account) stays reachable only from scanAllRuns.
-export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, includeRetired = false,
+export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, generic = null, includeRetired = false,
   // — THE QUEUES THE RUNNER ACTUALLY DRAINS, which is not the same set as the
   // directories under `workspaceRoot`. Defaults to [] so a caller that passes none keeps exactly the
   // behaviour it had; the service passes `config.queueDirs`, the same getter the allowance counter reads.
   queueDirs = [] }) {
   const out = [];
   const only = Array.isArray(account) ? new Set(account) : null;
-  const mine = (owner) => (only ? only.has(owner) : account === null || owner === account);
+  // GENERIC IS MATCHED BY ORGANISATION when the caller says which. `generic` is `{ all: true }` or
+  // `{ orgs, unfiled }`: a Generic run matches when it was filed under one of `orgs`, or was filed under
+  // none and `unfiled` asks for those too. Without it, `account` alone decides, exactly as before.
+  const mine = (owner, organisation = null) => {
+    if (owner === "generic" && generic) return generic.all === true
+      || (organisation != null ? (generic.orgs ?? []).includes(organisation) : generic.unfiled === true);
+    return only ? only.has(owner) : account === null || owner === account;
+  };
   // RETIRED RUNS ARE NOT LISTED HERE — unless the caller is the staff retired view, and asks.
   //
   // `pool-admin archive` has always written this sidecar, and until now the ONLY reader was the old
@@ -261,7 +301,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
       try {
         const meta = JSON.parse(readFileSync(metaPath, "utf8"));
         const owner = meta.customerKey || "generic";
-        if (!mine(owner)) continue;
+        if (!mine(owner, meta.organisation ?? null)) continue;
         // Tagged by runId — the same key pool-admin writes, which is the pool DIRECTORY name. Checking
         // both guards the one case where they differ: a meta whose runId was rewritten by a republish.
         const isRetired = retired.has(meta.runId ?? name) || retired.has(name);
@@ -281,7 +321,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
         const hasReport = docs.length > 0;
         const { bands, toneFor } = ladderOf(meta);
         const band = meta.overall ?? meta.verdict ?? null;
-        out.push({ runId: meta.runId ?? name, account: owner,
+        out.push({ runId: meta.runId ?? name, account: owner, ...(owner === "generic" ? { organisation: meta.organisation ?? null } : {}),
           title: meta.title ?? meta.matter ?? name, kind: meta.kind ?? "clearance",
           // THE MARK, separate from the report's headline.
           //
@@ -382,7 +422,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
       const s = JSON.parse(readFileSync(join(dir, "status.json"), "utf8"));
       const p = JSON.parse(readFileSync(driverDir(dir, "profile.json"), "utf8"));
       const owner = p.profileKey ?? p.key ?? "generic";
-      if (!mine(owner)) return;
+      if (!mine(owner, p.organisation ?? null)) return;
       if (s.state === "delivered") return;   // the pool row is the delivered face
       // ── — RETIREMENT REACHES A RUN THAT NEVER PUBLISHED ──────────────────
       //
@@ -419,7 +459,7 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
       // zombie face this state exists to end. pausedKind "operator" tells the UI which words to use.
       const paused = s.state === "postponed" || s.state === "recovering" || s.state === "parked-for-human";
       out.push({ ...(liveRetired ? { retired: true } : {}),
-        runId: s.runId, account: owner, title: s.markName ?? s.slug, kind: s.lane === "knockout" ? "knockout-batch" : "clearance",
+        runId: s.runId, account: owner, ...(owner === "generic" ? { organisation: p.organisation ?? null } : {}), title: s.markName ?? s.slug, kind: s.lane === "knockout" ? "knockout-batch" : "clearance",
         markName: typeof s.markName === "string" ? s.markName : null,
         // The project, straight off the frozen sidecar this branch already reads as `p`. A LIVE run needs
         // no publish stamp and no back-fill — the sidecar is right there, and freezeProfile has written
@@ -444,6 +484,11 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
         // preserved by writeRunStatus's spread-merge, replaced by the terminal when the honour check
         // fires. The UI derives "Stopping…" from this beside a non-terminal state.
         stopRequestedAt: typeof s.stopRequestedAt === "string" ? s.stopRequestedAt : null,
+        // — whether a stop can still prevent delivery. FALSE only once a lane has written it, at the
+        // moment it commits to publishing. Absent means the run has not reached that point, which is
+        // the truthful reading on this build: both lanes write it immediately after their last cancel
+        // read. The screen shows its promise on true and withdraws it on false.
+        stoppable: s.stoppable === false ? false : true,
         // A failed run with no reason on screen is a run the user has to phone somebody about. Both
         // fields are already written by every failure path (pipeline-knockout.mjs, the driver's
         // writeRunStatus); the listing simply used to drop them.
@@ -533,12 +578,12 @@ export function scanAccountRuns({ poolRoot, workspaceRoot, account = null, inclu
       try {
         const j = JSON.parse(readFileSync(join(dir, f), "utf8"));
         const owner = j.profileKey ?? "generic";
-        if (!mine(owner)) continue;
+        if (!mine(owner, j.tenant ?? null)) continue;
         // ALL the names, spelled the way the run's own status.json and its delivered meta.json spell
         // them — this took `marks[0].name` and named ONE mark of N, so a client who had just ordered a
         // three-name knockout screen saw a single name on the row that tells them it went in.
         const mark = batchMarkName(j.marks, typeof j.markName === "string" && j.markName ? j.markName : undefined);
-        queuedRows.push({ lane: dir, laneIdx, row: { runId: j.id ?? f.replace(/\.json$/, ""), account: owner, title: mark ?? (j.id ?? "Queued"),
+        queuedRows.push({ lane: dir, laneIdx, row: { runId: j.id ?? f.replace(/\.json$/, ""), account: owner, ...(owner === "generic" ? { organisation: j.tenant ?? null } : {}), title: mark ?? (j.id ?? "Queued"),
           // THE JOB'S OWN PIPELINE, not the literal "clearance". The row already carried
           // `product: "knockout-search"` and still called itself a clearance, so it was the one row in
           // the listing that contradicted its own product field — and Result.tsx gates the names line on
@@ -665,10 +710,10 @@ export const concurrentRunsCap = () => {
 };
 
 function forRole(runs, principal) {
-  // Staff see failure reasons verbatim; clients get the plain note. That redaction is the ONLY
+  // A person who sees everything reads failure reasons verbatim; everyone else gets the plain note. That redaction is the ONLY
   // role-shaping left: the held-run suppression is retired (one report, spec 2026-07-30 §5 — a run you
   // have rights to is always listed; the machine-QC record lives on the audit workbook).
-  if (principal?.role === "staff") return runs;
+  if (seesEverything(principal)) return runs;
   return runs.map((r) => {
     let out = r;
     // — the redaction must take `reasonDetail` with it. `reason` is replaced by a fixed note for a
@@ -799,6 +844,8 @@ export const PORTAL_JOB_FIELDS = Object.freeze({
   carries: Object.freeze([
     "id", "profileKey", "forwarder", "forwarderEmail",
     "markName", "marks", "classes", "goods", "ref", "projectKey",
+    // which organisation's Generic, resolved by jobFor from the verified principal — see `stamped`
+    "tenant",
     "jurisdictions", "platforms", "geography",
     "product", "recipeKey", "nativeLanguage", "caseLaw", "searchLevel", "deliveryRoute",
     "upfrontInstructions", "commercialFlexibility", "priorUse", "campaignShape", "deadline",
@@ -809,7 +856,7 @@ export const PORTAL_JOB_FIELDS = Object.freeze({
   ]),
   // The subset of `carries` whose value is the DOOR's, not the requester's. A body value for one of
   // these is ignored on purpose, so the guard drives them with a lie and requires the lie to lose.
-  stamped: Object.freeze(["id", "profileKey", "forwarder", "forwarderEmail", "clientPrincipal"]),
+  stamped: Object.freeze(["id", "profileKey", "forwarder", "forwarderEmail", "clientPrincipal", "tenant"]),
   notCarried: Object.freeze({
     // — A CLIENT MAY NEVER DECLARE A RUN A DEMO. The banner it produces says the report
     // is fiction, and a field the requester controls that can mark their own report fiction — or, arriving
@@ -820,7 +867,7 @@ export const PORTAL_JOB_FIELDS = Object.freeze({
     registerFixtures: "a run that reads canned register payloads instead of calling a register. A CLIENT may "
       + "never ask for that: the result would be fiction wearing a real report's clothes, which is the failure "
       + "the demo marker exists to prevent one level up. Refused by omission here, and only ever set by a job "
-      + "file somebody wrote deliberately (tracker issue 2038).",
+      + "file somebody wrote deliberately.",
     promptParts: "the requester's declaration that the prose rides as SIDECAR files (<base>.brief.md, …), "
       + "which exists because the hand-emitting email-loop agent can only `write` files. The portal composer "
       + "sends structured fields and writes no sidecars, so a job it built is never in that shape — carrying "
@@ -1028,12 +1075,16 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
 
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
-  staffDomains = [], grants = null,
-  // Where the staff-domain rule is written, for the People & access page to name. INJECTED, because
-  // the answer is a fact about the PROCESS — which file, if any, it took its configuration from — and
-  // this constructor is deliberately pure over its inputs. Null means "no rule, or could not tell",
-  // and the page then says nothing rather than guessing at a path.
-  staffRule = null,
+  grants = null,
+  // WHETHER THIS INSTALL SIGNS PEOPLE IN LOCALLY — one address and one passphrase, which cannot hold a
+  // second person. The People page reads it to disable Add and say why. Injected, like every fact about
+  // the process, because this constructor is pure over its inputs.
+  localSignIn = false,
+  // How the People page and company creation write the grants file. INJECTED so the service stays pure
+  // over its inputs and an arm can watch the write; boot hands it an atomic write to
+  // CLEAROTRON_ACCESS_FILE. Null means this service cannot write the file, and the routes that would
+  // need to say so rather than pretend.
+  writeGrants = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -1164,7 +1215,7 @@ export function makePortalService({
         //
         // The owner, on his own install with a partial register: "i cannot press the button for Global
         // clearotron search. Why. it doesnt appear disabled, no message etc — but i cant select it." The
-        // product is orderable now (owner ruling on that issue), and what the register does not reach
+        // product is orderable now (ruling on that issue), and what the register does not reach
         // is a SENTENCE on a live row rather than the reason a dead one cannot be pressed.
         //
         // A SEPARATE FIELD, because the two say opposite things to the screen: `unavailableNote`
@@ -1253,7 +1304,7 @@ export function makePortalService({
   // reported back as conflicts. On this door the applicant is already known: the account resolved it,
   // and the profile behind it is staff-curated. Letting a body re-state it would let a client widen or
   // silence their own exclusion, which is a rating-authority change wearing a scope field's clothes.
-  const jobFor = ({ principal, account, body }) => {
+  const jobFor = ({ principal, account, tenant = null, body }) => {
     const marks = Array.isArray(body.marks)
       ? body.marks.map((m) => (typeof m === "string" ? { name: m } : m)).filter((m) => m?.name && String(m.name).trim())
       : undefined;
@@ -1261,6 +1312,11 @@ export function makePortalService({
     const job = {
       id: `portal-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
       profileKey: account,
+      // WHICH ORGANISATION'S GENERIC — the pair's other half, on a Generic run only, and resolved from the
+      // principal rather than read off the body: `genericOrgOf` has already refused an organisation this
+      // person does not see. Absent means filed under none, which only a person who sees everything can
+      // order (portal-access.mjs).
+      ...(account === "generic" && genericOrgOf(principal, tenant) != null ? { tenant: genericOrgOf(principal, tenant) } : {}),
       forwarder: "portal", forwarderEmail: principal.email,
       markName: body.markName != null ? String(body.markName) : marks?.[0]?.name,
       marks, classes: Array.isArray(body.classes) ? body.classes.map(Number).filter(Number.isFinite) : undefined,
@@ -1376,7 +1432,8 @@ export function makePortalService({
   }
 
   async function route(method, path, identity, body = {}, query = {}) {
-    const principal = makePrincipal({ email: identity?.email, grants: grantsNow(), staffDomains });
+    const grantsHere = grantsNow();
+    const principal = makePrincipal({ email: identity?.email, grants: grantsHere });
     const parts = path.replace(/\/+$/, "").split("/").filter(Boolean);   // ["portal", ...]
     if (parts[0] !== "portal") return { status: 404, json: { error: "not_found" } };
     try {
@@ -1395,18 +1452,35 @@ export function makePortalService({
         // Cordillera's customer list on the one route every signed-in identity can reach — the exact
         // leak /profiles is never proxied for (portal-upstream: "a client reaching it would learn the
         // customer base"). `"*"` identities get {} and keep using the roster, which is staff-gated.
+        //
+        // `accountFacts` rides in the SAME loop, under the SAME scoping decision, for the same reason
+        // the names do: the pick panel shows industry, marketplace count and territories per company,
+        // and a client with several grants meets that panel. One loop, so there is one answer to
+        // "which accounts may this identity learn about" rather than two that can drift apart. A `"*"`
+        // identity gets {} here exactly as it does for names and keeps reading the staff-only roster.
         let accountNames = {};
-        if (Array.isArray(principal.accounts) && principal.accounts.length) {
+        let accountFacts = {};
+        // GENERIC IS NAMED TOO when the person sees an organisation's Generic. It is not a company, so it is
+        // never in `accounts`, and without a name here the switcher printed the raw key at everyone below
+        // everything. An organisation with no company yet is the case with an empty `accounts`, so the
+        // guard is on the names to look up, not on the company list.
+        const named = Array.isArray(principal.accounts)
+          ? [...principal.accounts, ...(principal.genericOrgs?.length ? ["generic"] : [])] : [];
+        if (named.length) {
           try {
+            const { companyFactsOf } = await import("./profiles.mjs");
             const profiles = await loadProfilesImpl();
-            for (const key of principal.accounts) {
-              const name = profiles.get(key)?.name;
+            for (const key of named) {
+              const profile = profiles.get(key);
+              const name = profile?.name;
               if (typeof name === "string" && name) accountNames[key] = name;
+              if (profile) accountFacts[key] = companyFactsOf(profile);
             }
           } catch {
             // A name is a nicety; the door is not. An unreadable profile store must not lock a user
             // out of the portal, so this degrades to the keys the UI already falls back to.
             accountNames = {};
+            accountFacts = {};
           }
         }
         // HOW MANY RUNS THIS DEPLOYMENT EXECUTES AT ONCE. Deployment-wide, not account-scoped, which is
@@ -1434,8 +1508,9 @@ export function makePortalService({
         // READ ONCE. The payload names it and the program reading below is gated on it; two calls to
         // `flagView` here would be two reads of the same file that could disagree with each other.
         const meEngineMode = flagView(poolRoot).engineMode;
-        return { status: 200, json: { role: principal.role, email: principal.email, accounts: principal.accounts, accountNames,
-          concurrentRuns: concurrentRunsCap(), brand: BRAND.name, engineMode: meEngineMode,
+        return { status: 200, json: { email: principal.email, ...principalView(principal, grantsHere, accountNames),
+          accounts: principal.accounts, accountNames, accountFacts,
+          concurrentRuns: concurrentRunsCap(), brand: ORGANISATION_NAME, engineMode: meEngineMode,
           // WHETHER THE PROGRAM IS ON THIS BOX WHILE THE ENGINE CANNOT SEE IT — true, false, or null
           // for "this could not be checked". The screen above renders one of three remedies from it,
           // and they are different remedies: install the CLI, restart the service that cannot see it,
@@ -1451,7 +1526,7 @@ export function makePortalService({
           // — a button that always fails must not render as available. The reason is
           // operator-shaped and staff-only; a client reads the generic sentence the button carries.
           controls: { stop: { available: stopControl.available !== false,
-            reason: principal.role === "staff" ? (stopControl.reason ?? null) : null } } } };
+            reason: seesEverything(principal) ? (stopControl.reason ?? null) : null } } } };
       }
       // /portal/api/about — the AGPL §13 source offer ()
       //
@@ -1471,7 +1546,7 @@ export function makePortalService({
       // /portal/api/searches
       if (parts[1] === "api" && parts[2] === "searches" && method === "GET") {
         const account = assertPrincipal(principal, { account: query.account ?? null });
-        if (!account) return { status: 400, json: { error: "name an account (?account=) — staff must pick who they act for" } };
+        if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
         return { status: 200, json: { account, ...searchesFor(account) } };
       }
       // /portal/api/compose/read — turn a pasted brief into a filled-in composer.
@@ -1616,7 +1691,7 @@ export function makePortalService({
        * later. The two can disagree by a run under concurrency; the wall is the one that decides, and
        * it refuses by CLARIFYING rather than dropping, so nothing is ever lost to the gap.
        *
-       * Staff are never checked: role is decided by the principal, here, where it is authoritative.
+       * A person who sees everything is never checked; the cap binds everyone else, decided here from the principal.
        */
       // WHICH PRODUCT IS THIS, AND WHERE WOULD IT POINT — asked ONCE, and everything the plan says
       // derives from that one answer: the availability gate, the name, the scope shown at review, and the
@@ -1639,12 +1714,17 @@ export function makePortalService({
         try { return quoteForJob({ job, profile, searchPolicy: resolved }); } catch { return null; }
       };
 
-      const quotaRefusal = async (account) => {
-        if (principal.role !== "client" || !upstream) return null;
+      const quotaRefusal = async (account, organisation = null) => {
+        if (seesEverything(principal) || !upstream) return null;
         let caps = null, capsRead = false;
         try {
-          const r = await upstream.getProfile(principal, account);
-          if (r.status === 200) { caps = r.json?.readOnly?.runCaps ?? null; capsRead = true; }
+          // Generic's caps are the neutral profile's — one file, every organisation's lane — so they are
+          // read from the store rather than through the settings wall, which answers per company.
+          if (account === "generic") { caps = (await loadProfilesImpl()).get("generic")?.runCaps ?? null; capsRead = true; }
+          else {
+            const r = await upstream.getProfile(principal, account);
+            if (r.status === 200) { caps = r.json?.readOnly?.runCaps ?? null; capsRead = true; }
+          }
         } catch { return null; }   // cannot read the cap ⇒ do not invent one; the wall still holds
         // The same DEFAULT the wall applies (runner.mjs DEFAULT_CLIENT_DAILY_RUNS): a profile READ
         // successfully with no dailyRuns is capped, not uncapped. Mirrored rather than imported because
@@ -1654,7 +1734,7 @@ export function makePortalService({
         if (!capsRead) return null;
         const limit = Number.isInteger(caps?.dailyRuns) ? caps.dailyRuns : DEFAULT_CLIENT_DAILY_RUNS;
         if (!Number.isInteger(limit)) return null;
-        const used = accountUsage({ queueDirs: queueDirs(), account });
+        const used = accountUsage({ queueDirs: queueDirs(), account, organisation });
         // A COUNT WE COULD NOT TAKE IS NOT A ZERO. `complete: false` means no ledger was reachable, and
         // 0 would then mean "nothing recorded" and "nothing readable" at once — the exact confusion that
         // made this refusal unreachable for as long as the path was wrong. Same call the branch
@@ -1680,12 +1760,13 @@ export function makePortalService({
 
       // /portal/api/run/plan — the confirmation gate (no spend)
       if (parts[1] === "api" && parts[2] === "run" && parts[3] === "plan" && method === "POST") {
-        const account = assertPrincipal(principal, { account: body.account ?? query.account ?? null });
-        if (!account) return { status: 400, json: { error: "name an account — staff must pick who they act for" } };
-        const job = jobFor({ principal, account, body });
+        const tenant = body.tenant ?? query.tenant ?? null;
+        const account = assertPrincipal(principal, { account: body.account ?? query.account ?? null, tenant, run: true });
+        if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
+        const job = jobFor({ principal, account, tenant, body });
         const gates = planGates(job);
         if (gates.fail) return gates.fail;
-        const overQuota = await quotaRefusal(account);
+        const overQuota = await quotaRefusal(account, job.tenant ?? null);
         if (overQuota) return overQuota;
         // ONE resolution, and the name, the stage, the turnaround and the effort all come off it.
         const { profile: planProfile, resolved: planResolved, scope: planScope } = resolveFor(job);
@@ -1731,14 +1812,14 @@ export function makePortalService({
       }
       // /portal/api/run — verify + trigger (the ONLY spend path)
       if (parts[1] === "api" && parts[2] === "run" && parts.length === 3 && method === "POST") {
-        const account = assertPrincipal(principal, { account: body.account ?? null });
+        const account = assertPrincipal(principal, { account: body.account ?? null, tenant: body.tenant ?? null, run: true });
         if (!account) return { status: 400, json: { error: "name an account" } };
-        const job = jobFor({ principal, account, body });
+        const job = jobFor({ principal, account, tenant: body.tenant ?? null, body });
         const gates = planGates(job);   // re-gated: the token is necessary, never sufficient
         if (gates.fail) return gates.fail;
         // re-checked for the same reason the gates are: a token minted while the account still had
         // allowance must not spend it after another tab has used the last one.
-        const overQuota = await quotaRefusal(account);
+        const overQuota = await quotaRefusal(account, job.tenant ?? null);
         if (overQuota) return overQuota;
         sweepJtis();
         const bad = verifyConfirmation({ secret, token: body.confirmationToken, account, email: principal.email,
@@ -1747,7 +1828,7 @@ export function makePortalService({
         const selector = selectorOf(body);
         // ── — A DEMO WALKS THE REAL FLOW AND LANDS ON A FINISHED RUN ─────────
         //
-        // Owner ruling, 2026-08-31, revising his own ruling of an hour earlier: "i think its OK for
+        // Ruling, 2026-08-31, revising his own ruling of an hour earlier: "i think its OK for
         // someone to be able to press New Clearance in demo mode and see it work and get the static
         // results, right?" — so the form is real, the plan is real, the confirmation is real, and the
         // only thing that is not real is the dispatch.
@@ -1828,10 +1909,10 @@ export function makePortalService({
           r = await trigger({
             ...job,
             profileKey: account,
-            // The daily-allowance stamp. Set ONLY here, and only on a genuine client principal —
-            // this is the one place in the system where that role is authoritative. See checkRunCaps
-            // for why the polarity is positive-only and why every inferred alternative fails unsafely.
-            ...(principal.role === "client" ? { clientPrincipal: true } : {}),
+            // The daily-allowance stamp. Set ONLY here, on everyone but a person who sees everything —
+            // this is the one place in the system where that is decided. See checkRunCaps for why the
+            // polarity is positive-only and why every inferred alternative fails unsafely.
+            ...(!seesEverything(principal) ? { clientPrincipal: true } : {}),
             ...(demoRunFlag ? { demoRun: true } : {}),
           });
         } catch (e) {
@@ -1842,7 +1923,7 @@ export function makePortalService({
           // for operators and name infrastructure: the unwired-trigger case reads "PORTAL_MCP_URL /
           // PORTAL_OPS_TOKEN unset", which is an internal variable name rendered in a client's browser.
           // Staff get it verbatim because they are the ones who can act on it; a client gets the fact.
-          const staff = principal.role === "staff";
+          const staff = seesEverything(principal);
           // One cause is worth distinguishing even for staff: an instance with no engine attached is not
           // a failure, it is an instance that was never finished. Saying "could not be queued" invites
           // someone to retry, re-read logs and file a bug against a working system.
@@ -1867,7 +1948,7 @@ export function makePortalService({
       //
       // /portal/api/run/<runId>/stop — end a run that has already started.
       if (parts[1] === "api" && parts[2] === "run" && parts[3] && parts[4] === "stop" && method === "POST") {
-        const account = assertPrincipal(principal, { account: query.account ?? null });
+        const account = assertPrincipal(principal, { account: query.account ?? null, tenant: query.tenant ?? null, run: true });
         if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
         const runId = decodeURIComponent(parts[3]);
         // OWNERSHIP FIRST, and off the run list rather than off the request: the engine's own account
@@ -1880,7 +1961,7 @@ export function makePortalService({
           return { status: 409, json: { ok: false, error: "This run has already finished.", state: mine.state } };
         // ── — WHICH STOP THE READER ASKED FOR ────────────────────────────────
         //
-        // Owner ruling, on his second encounter with the same wait: "a stop is a stop — maybe it should
+        // Ruling, on his second encounter with the same wait: "a stop is a stop — maybe it should
         // be a 'stop immediately or at next boundary to preserve data' kind of question when you press
         // it." The driver half landed the mode; this carries the reader's answer to it.
         //
@@ -1903,7 +1984,7 @@ export function makePortalService({
           // for operators while telling the user only that it did not happen.
           const unwired = /not wired|verb|scope/i.test(detail);
           return { status: 502, json: { ok: false, unwired,
-            error: principal.role === "staff" ? detail : `The run could not be stopped just now. It is still running, and ${BRAND.name} can see what happened.` } };
+            error: seesEverything(principal) ? detail : `The run could not be stopped just now. It is still running, and ${BRAND.name} can see what happened.` } };
         }
         // ── — WHICH STOP IS ACTUALLY IN PROGRESS, AND NOTHING ELSE ──────────
         //
@@ -1933,7 +2014,7 @@ export function makePortalService({
       // A knockout over several names has no combined document, so its assessment — the one piece of
       // prose that reads the names against each other — is written to `report.md` and, until this route,
       // reached nobody: `meta.reports` lists the per-mark HTMLs only, and the pool path is not one the
-      // edge serves. Owner ruling 2026-08-26: the grouped page carries it.
+      // edge serves. Ruling 2026-08-26: the grouped page carries it.
       //
       // ITS OWN ROUTE RATHER THAN A FIELD ON THE RUN ROW. The row is what /portal/api/runs returns for
       // every run the caller owns, and it is fetched by every screen that lists runs — where this prose
@@ -1951,8 +2032,7 @@ export function makePortalService({
         const dir = join(poolRoot, runId);
         let meta; try { meta = JSON.parse(readFileSync(join(dir, "meta.json"), "utf8")); } catch { return { status: 404, json: { error: "not_found" } }; }
         const owner = meta.customerKey || "generic";
-        if (owner === "generic" && principal.role !== "staff") return { status: 404, json: { error: "not_found" } };
-        try { assertPrincipal(principal, { account: owner }); } catch { return { status: 404, json: { error: "not_found" } }; }
+        if (!mayReadRun(principal, { owner, organisation: meta.organisation ?? null })) return { status: 404, json: { error: "not_found" } };
         // ANSWERED FOR EVERY RUN THAT HAS ONE, grouped or not. A gate to grouped runs only stood here
         // and was wrong in the way this file keeps guarding against: a single-document run HAS this
         // prose — `report.md` is written on every run — so 404 would have said "there is none" about
@@ -1975,7 +2055,7 @@ export function makePortalService({
       // /portal/api/queue/<id>/cancel — drop a job that has not started. No spend has happened, so
       // there is nothing to account for and no row is left behind.
       if (parts[1] === "api" && parts[2] === "queue" && parts[3] && parts[4] === "cancel" && method === "POST") {
-        const account = assertPrincipal(principal, { account: query.account ?? null });
+        const account = assertPrincipal(principal, { account: query.account ?? null, tenant: query.tenant ?? null, run: true });
         if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
         const id = decodeURIComponent(parts[3]);
         const mine = scanAccountRuns({ poolRoot, workspaceRoot, account, queueDirs: queueDirs() }).find((r) => r.runId === id && r.state === "queued");
@@ -1987,7 +2067,7 @@ export function makePortalService({
           const detail = String(e?.message ?? e);
           audit({ event: "queue-cancel", by: principal.email, account, id, ok: false, error: detail });
           return { status: 502, json: { ok: false, unwired: /not wired|verb|scope/i.test(detail),
-            error: principal.role === "staff" ? detail : "It could not be cancelled just now. Nothing has been charged." } };
+            error: seesEverything(principal) ? detail : "It could not be cancelled just now. Nothing has been charged." } };
         }
         audit({ event: "queue-cancel", by: principal.email, account, id, ok: Boolean(r?.ok), action: r?.action ?? null });
         // ALREADY-CLAIMED IS A RACE, NOT AN ERROR. The runner picked it up between the click and the
@@ -2006,7 +2086,7 @@ export function makePortalService({
       // for no gain. The tenancy wall is the same one every other route uses — the caller's resolved
       // account — applied per id.
       if (parts[1] === "api" && parts[2] === "queue" && parts[3] === "order" && method === "POST") {
-        const account = assertPrincipal(principal, { account: query.account ?? null });
+        const account = assertPrincipal(principal, { account: query.account ?? null, tenant: query.tenant ?? null, run: true });
         if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
         const asked = Array.isArray(body?.order) ? body.order.filter((s) => typeof s === "string" && s) : null;
         if (!asked) return { status: 400, json: { error: "send { order: [id, …] }" } };
@@ -2083,6 +2163,22 @@ export function makePortalService({
           }
           return r;
         }
+        // /portal/api/config/companies — CREATE. No account segment, because there is no account yet.
+        //
+        // It does not hang off `profile` for a reason worth stating: every route under that word acts on
+        // ONE company, resolved from the caller, and this one is the act of there not being one. Reusing
+        // the noun would put "the company you are in" and "the company you are making" behind the same
+        // path, which is the conflation the pick panel exists to remove.
+        //
+        // The audit row is written upstream by the create route itself, in the same commit as the file,
+        // so there is none here. An audit call copied from its neighbours would also be wrong twice: it
+        // would test `status === 200` against a 201, and file nothing.
+        if (parts[3] === "companies") {
+          if (parts.length === 4 && method === "POST") return await upstream.createCompany(principal, body);
+          // 404 for a wrong verb, as the profile branch above explains at length: 405 would make this
+          // endpoint distinguishable from one that does not exist.
+          return { status: 404, json: { error: "not_found" } };
+        }
         // /portal/api/config/projects[/:project[/{validate,save}]]
         if (parts[3] === "projects") {
           if (parts.length === 4 && method === "GET") return await upstream.listProjects(principal, acct);
@@ -2119,16 +2215,21 @@ export function makePortalService({
       // per-identity: a staff member acting for three clients has three different answers, and one of
       // them is never "yours". Cheap enough to fetch beside the composer and the run list.
       if (parts[1] === "api" && parts[2] === "usage" && method === "GET") {
-        const account = assertPrincipal(principal, { account: query.account ?? null });
-        if (!account) return { status: 400, json: { error: "name an account (?account=) — staff must pick who they act for" } };
+        const account = assertPrincipal(principal, { account: query.account ?? null, tenant: query.tenant ?? null });
+        if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
+        // Generic is counted per organisation — the lane the wall caps (runner.mjs checkRunCaps).
+        const organisation = account === "generic" ? genericOrgOf(principal, query.tenant ?? null) : null;
         // Caps live on the customer profile and are code-owned (never client-editable). A deployment
         // with no config surface still answers, with counts and no caps — "we cannot tell you your
         // limit" is a better answer than a fabricated one.
         let caps = null, capsRead = false;
         if (upstream) {
           try {
-            const r = await upstream.getProfile(principal, account);
-            if (r.status === 200) { caps = r.json?.readOnly?.runCaps ?? null; capsRead = true; }
+            if (account === "generic") { caps = (await loadProfilesImpl()).get("generic")?.runCaps ?? null; capsRead = true; }
+            else {
+              const r = await upstream.getProfile(principal, account);
+              if (r.status === 200) { caps = r.json?.readOnly?.runCaps ?? null; capsRead = true; }
+            }
           } catch { /* a settings surface fault must not take the counter down */ }
         }
         // `complete` rides out with the counts (see usage-ledger.mjs): false means no ledger was read and
@@ -2138,17 +2239,17 @@ export function makePortalService({
         // `basis` is dropped here on purpose. What a client is owed is "we could not count", which
         // `complete` says; WHICH kind of nothing it was is an operator's diagnosis of our deployment and
         // belongs in the audit trail, where the quota pre-check puts it.
-        const { basis: _basis, ...used } = accountUsage({ queueDirs: queueDirs(), account });
-        return { status: 200, json: { account, ...used,
+        const { basis: _basis, ...used } = accountUsage({ queueDirs: queueDirs(), account, organisation });
+        return { status: 200, json: { account, ...(account === "generic" ? { tenant: organisation } : {}), ...used,
           // The EFFECTIVE daily allowance: the profile's value, else the default the wall applies — a
           // client reading "—" while the wall enforces 2 is the same lie as a wrong count. But a profile
           // we could NOT read still reports null: "we cannot tell you your limit" is a different
           // statement from "your limit is 2", and only one of them is honest when settings are down.
           dailyRuns: Number.isInteger(caps?.dailyRuns) ? caps.dailyRuns : (capsRead ? DEFAULT_CLIENT_DAILY_RUNS : null),
           monthlyRuns: caps?.monthlyRuns ?? null, maxQueued: caps?.maxQueued ?? null,
-          // Staff are not capped, and the UI needs to know that to avoid showing a client's allowance
-          // to someone it does not bind. See checkRunCaps for why role is decided here and nowhere else.
-          capped: principal.role === "client" } };
+          // A person who sees everything is not capped, and the UI needs to know that to avoid showing an
+          // allowance to someone it does not bind. See checkRunCaps for why it is decided here and nowhere else.
+          capped: !seesEverything(principal) } };
       }
 
       // /portal/api/mcp-access — the connection details for driving the engine from your own assistant.
@@ -2198,7 +2299,7 @@ export function makePortalService({
         //
         // COMPOSED IN ONE PLACE and handed over as a string. The browser cannot know this install's
         // path, so the three surfaces stating this route cannot drift apart even if someone tries.
-        const stdio = principal.role === "staff"
+        const stdio = seesEverything(principal)
           ? stdioConnectOffer({ workDir: process.env.CLEAROTRON_WORK_DIR || null })
           : null;
 
@@ -2292,10 +2393,9 @@ export function makePortalService({
         if (!url) return { status: 409, json: { error: "no_connector" } };
         const identity = principal.email ?? null;
         if (!identity) return { status: 403, json: { error: "no_identity" } };
-        const granted = accountsForEmail(identity, loadGrants());
-        if (Array.isArray(granted) && granted.length === 0) {
-          return { status: 403, json: { error: "not_enrolled" } };
-        }
+        // Enrolled means a principal exists: the door check above has already refused an address with no
+        // access anywhere. Asking for a company list here instead read a person whose only reach is their
+        // organisation's Generic as not enrolled.
         let key;
         try { key = mintToken({ scope: "account", sub: identity, ttlSec: 90 * 24 * 3600 }); }
         catch { return { status: 503, json: { error: "cannot_issue" } }; }
@@ -2346,13 +2446,13 @@ export function makePortalService({
         // reader put down". Every branch below goes through it — a route that stamped only the scope=mine
         // path would leave the same run acknowledged on one screen and not on another.
         const mine = (runs) => withAcks(runs, readAcks(poolRoot, principal?.email));
-        // "All brand owners". STAFF ONLY, and it is a distinct code path rather than a wildcard passed
-        // to assertPrincipal — a client must never reach a branch that skips the account resolution,
-        // even by accident. A client who asks for it gets the same 404 as any account not theirs.
+        // "All brand owners". ONLY FOR A PERSON WHO SEES EVERYTHING, and it is a distinct code path rather
+        // than a wildcard passed to assertPrincipal — nobody else may reach a branch that skips the account
+        // resolution, even by accident. Anyone else who asks for it gets the same 404 as any account not theirs.
         if (query.account === "*") {
-          // THE DOOR FIRST. This branch read `principal.role` directly, and `principal` is null for any
-          // identity that is neither staff nor granted anything — the exact caller this route most needs
-          // to refuse. Reading `.role` off null threw a TypeError, which is not a PortalDeny, so the
+          // THE DOOR FIRST. This branch once read a field off `principal` directly, and `principal` is null
+          // for an identity with no access anywhere — the exact caller this route most needs to refuse.
+          // Reading a field off null threw a TypeError, which is not a PortalDeny, so the
           // catch at the bottom of route() rethrew it and the handler answered 500 "internal". An
           // unenrolled prober therefore got a SERVER ERROR from the one route that lists every customer,
           // while every other surface refused them cleanly — and a 500 is both the wrong answer and a
@@ -2363,7 +2463,7 @@ export function makePortalService({
           // account (portal-access.mjs), so the staff-only rule below is untouched: a client still gets
           // the plain 404 on the line after this one.
           assertPrincipal(principal, { door: true });
-          if (principal.role !== "staff") return { status: 404, json: { error: "not_found" } };
+          if (!seesEverything(principal)) return { status: 404, json: { error: "not_found" } };
           // One pass over the pool, not one request per account. The alternative — the browser fanning
           // out across the roster — would spend a roster-sized chunk of the 120/min rate limit on every
           // poll, which is exactly what the limiter is there to stop.
@@ -2387,7 +2487,7 @@ export function makePortalService({
         // has to ask who is looking, which is the whole point — there is no staff layout.
         if (parts[1] === "api" && parts[2] === "runs" && method === "GET" && query.scope === "mine") {
           assertPrincipal(principal, { door: true });
-          if (principal.role === "staff") {
+          if (seesEverything(principal)) {
             return { status: 200, json: { account: "*", runs: mine(forRole(scanAllRuns({ poolRoot, workspaceRoot, queueDirs: queueDirs() }), principal)) } };
           }
           // Resolved from `principal.accounts`, NEVER from the query — this is the same set
@@ -2396,17 +2496,25 @@ export function makePortalService({
           // `accounts === "*"` is the grants-file-absent posture (enforcement OFF). That is a
           // SENTINEL, NOT A LIST: expanding it here would turn a missing config file into a
           // cross-tenant read, so it falls through to the same refusal as holding nothing.
-          if (Array.isArray(principal.accounts) && principal.accounts.length) {
-            const own = principal.accounts.filter((a) => a !== "generic");   // the house account is staff-only, everywhere
-            if (own.length) return { status: 200, json: { account: "*", runs: mine(forRole(scanAccountRuns({ poolRoot, workspaceRoot, account: own, queueDirs: queueDirs() }), principal)) } };
+          // Their companies, and the Generic of each organisation they hold whole.
+          if (Array.isArray(principal.accounts) && (principal.accounts.length || principal.genericOrgs?.length)) {
+            return { status: 200, json: { account: "*", runs: mine(forRole(scanAccountRuns({ poolRoot, workspaceRoot, account: principal.accounts,
+              generic: { orgs: principal.genericOrgs ?? [] }, queueDirs: queueDirs() }), principal)) } };
           }
           return { status: 404, json: { error: "not_found" } };
         }
-        const account = assertPrincipal(principal, { account: query.account ?? null });
+        const account = assertPrincipal(principal, { account: query.account ?? null, tenant: query.tenant ?? null });
         if (!account) return { status: 400, json: { error: "name an account (?account=)" } };
-        // untagged/generic runs are STAFF-only, matching the MCP face + the LEAK-#9 rule (a client
-        // surface never lists generic — review 2026-07-18: the two boundaries disagreed)
-        if (account === "generic" && principal.role !== "staff") return { status: 404, json: { error: "not_found" } };
+        // GENERIC IS LISTED PER ORGANISATION. assertPrincipal has already refused an organisation whose
+        // Generic this person does not see. A named or implied organisation lists its own Generic runs,
+        // and a person who sees everything also gets the ones filed under none — on a one-organisation
+        // install those are that organisation's. Unnamed, with several organisations, a person who sees
+        // everything lists every Generic run, which is what they saw before organisations existed.
+        if (account === "generic") {
+          const org = genericOrgOf(principal, query.tenant ?? null);
+          const generic = org == null ? { all: true } : { orgs: [org], unfiled: seesEverything(principal) };
+          return { status: 200, json: { account, tenant: org, runs: mine(forRole(scanAccountRuns({ poolRoot, workspaceRoot, account: [], generic, queueDirs: queueDirs() }), principal)) } };
+        }
         return { status: 200, json: { account, runs: mine(forRole(scanAccountRuns({ poolRoot, workspaceRoot, account, queueDirs: queueDirs() }), principal)) } };
       }
       // ── /portal/api/ack — "I have seen that one" ─────────────────────────────────────────────
@@ -2467,8 +2575,7 @@ export function makePortalService({
         const dir = join(poolRoot, runId);
         let meta; try { meta = JSON.parse(readFileSync(join(dir, "meta.json"), "utf8")); } catch { return { status: 404, json: { error: "not_found" } }; }
         const owner = meta.customerKey || "generic";
-        if (owner === "generic" && principal.role !== "staff") return { status: 404, json: { error: "not_found" } };
-        try { assertPrincipal(principal, { account: owner }); } catch { return { status: 404, json: { error: "not_found" } }; }
+        if (!mayReadRun(principal, { owner, organisation: meta.organisation ?? null })) return { status: 404, json: { error: "not_found" } };
         // NOT staff-only any more. This route used to 404 a client on role alone — "the workbook is the
         // working paper behind the opinion, not the opinion" — with the note that widening it was a
         // disclosure decision and not one to make in passing. The owner made it on 2026-07-27, in the same
@@ -2504,8 +2611,8 @@ export function makePortalService({
         const dir = join(poolRoot, runId);
         let meta; try { meta = JSON.parse(readFileSync(join(dir, "meta.json"), "utf8")); } catch { return { status: 404, json: { error: "not_found" } }; }
         const owner = meta.customerKey || "generic";
-        if (owner === "generic" && principal.role !== "staff") return { status: 404, json: { error: "not_found" } };   // generic = staff-only (LEAK-#9 alignment)
-        try { assertPrincipal(principal, { account: owner }); } catch { return { status: 404, json: { error: "not_found" } }; }   // foreign = 404, never 403
+        // Foreign is 404, never 403, and a Generic run is its organisation's — the same question the connector asks (LEAK-#9 alignment).
+        if (!mayReadRun(principal, { owner, organisation: meta.organisation ?? null })) return { status: 404, json: { error: "not_found" } };
         // ONE REPORT PER MARK: `/portal/report/<runId>/` serves a run that has one document, and
         // `/portal/report/<runId>/<slug>/` serves one name's document out of a batch. A batch has no
         // run-level document at all — resolveReportFile returns null and this 404s — because serving mark
@@ -2533,7 +2640,7 @@ export function makePortalService({
         // The injection stays where it is (portal-report.mjs's FEEDBACK_CSS/FEEDBACK_JS, still exercised
         // by portal-report.test.mjs's `feedback: true` arms). The owner ruled disable, not delete, so
         // re-enabling the document half is this argument coming back.
-        return { status: 200, html: readReport(dir, { log: auditLog, staff: principal.role === "staff", poolRoot, file: reportFile }) };
+        return { status: 200, html: readReport(dir, { log: auditLog, staff: seesEverything(principal), poolRoot, file: reportFile }) };
       }
       // POST /portal/api/feedback — a lawyer flags one finding on a delivered report.
       //
@@ -2573,10 +2680,9 @@ export function makePortalService({
         const dir = join(poolRoot, runId);
         let meta; try { meta = JSON.parse(readFileSync(join(dir, "meta.json"), "utf8")); } catch { return { status: 404, json: { error: "not_found" } }; }
         // Ownership, exactly as GET /portal/report/<id> checks it — foreign is 404, never 403, and
-        // `generic` is staff-only. A reader who cannot READ the report cannot flag it either.
+        // a Generic run is its organisation's. A reader who cannot READ the report cannot flag it either.
         const owner = meta.customerKey || "generic";
-        if (owner === "generic" && principal.role !== "staff") return { status: 404, json: { error: "not_found" } };
-        try { assertPrincipal(principal, { account: owner }); } catch { return { status: 404, json: { error: "not_found" } }; }
+        if (!mayReadRun(principal, { owner, organisation: meta.organisation ?? null })) return { status: 404, json: { error: "not_found" } };
 
         const verdict = typeof body?.verdict === "string" ? body.verdict : "";
         if (!VERDICTS.has(verdict))
@@ -2700,9 +2806,11 @@ export function makePortalService({
         });
         return { status: 201, json: { id: rec.id } };
       }
-      // /portal/admin/* — staff-only surfaces (clients get 404: the surface does not exist for them)
+      // /portal/admin/* — the install-wide surfaces, for a person who sees everything, and People, for a
+      // person with Manage. Everyone else gets 404: the surface does not exist for them.
       if (parts[1] === "admin") {
-        assertPrincipal(principal, { staffOnly: true });
+        assertPrincipal(principal, parts[2] === "access" || parts[2] === "people"
+          ? { door: true, manage: true } : { door: true, everything: true });
         if (parts[2] === "roster" && method === "GET") {
           const profiles = await loadProfilesImpl();
           // `generic` IS in the roster — this route is staff-only (asserted above), and untagged runs
@@ -2710,7 +2818,13 @@ export function makePortalService({
           // by typing ?account=generic but invisible in the switcher, which is how they stop being
           // looked at. The client-facing boundary is unchanged: /portal/api/runs and the report route
           // both 404 `generic` for a non-staff principal.
-          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name })) } };
+          // THE FACTS RIDE WITH THE NAME. The pick panel tells companies apart by industry, marketplace
+          // count and territories, and it renders for staff from here and for a client from /me. Shaping
+          // both through `companyFactsOf` is what stops the same company reading two ways depending on
+          // who signed in. Dynamic import deliberately: `profiles.mjs` captures the store directory at
+          // MODULE LOAD (see this file's note above), so it is never pulled in at our own load time.
+          const { companyFactsOf } = await import("./profiles.mjs");
+          return { status: 200, json: { customers: [...profiles.values()].map((p) => ({ key: p.key, name: p.name, ...companyFactsOf(p) })) } };
         }
         // /portal/admin/config — what this deployment actually has switched on. Read from the SNAPSHOT,
         // never from process.env: this process has no engine environment, so asking its own env would
@@ -2727,7 +2841,7 @@ export function makePortalService({
           // below, so it is the authoritative source. Fed from process.env at the seam rather than
           // inside authView, so the one process entitled to answer is visibly the one reading.
           //
-          // AND THE ENVIRONMENT IS READ ONCE MORE, FOR ONE PURPOSE (tracker issue 170): to say whether
+          // AND THE ENVIRONMENT IS READ ONCE MORE, FOR ONE PURPOSE: to say whether
           // the capture still DESCRIBES this box, never to supply a value. A deployment being
           // configured runs nothing, so its capture cannot age into a warning while its contents drift
           // — the disagreement is the signal the age never was. Degraded rather than fatal: a page that
@@ -2871,7 +2985,7 @@ export function makePortalService({
         // /portal/admin/access — who is granted what, and where an enrolment is half done.
         if (parts[2] === "access" && method === "GET") {
           const { loadProfiles } = await import("./profiles.mjs");
-          const knownAccounts = [...loadProfiles({ force: true }).keys()];
+          const companies = Object.fromEntries([...loadProfiles({ force: true }).values()].map((p) => [p.key, p.name ?? p.key]));
           // Where to go to change this. The stat is done HERE rather than inside accessView because
           // that function is pure and its tests call it with no filesystem at all; giving it IO would
           // cost that for a filename and a date.
@@ -2884,7 +2998,46 @@ export function makePortalService({
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsNow(), staffDomains, knownAccounts, grantsFile, staffRule }) };
+          return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn }) };
+        }
+        // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
+        //
+        // THE ADDER'S OWN REACH BOUNDS WHAT THEY GIVE. A point outside it is a 404, exactly as asking to
+        // see it would be. Switches belong to the person, not to a point, so they are set only when the
+        // person's whole access sits inside the adder's; otherwise the points are added, the switches stay
+        // as they were, and the answer says which happened. Nobody sets their own switches, and nobody
+        // gives Run without holding it.
+        if (parts[2] === "people" && parts.length === 3 && method === "POST") {
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
+          const email = String(body?.email ?? "").trim().toLowerCase();
+          if (!email || email.indexOf("@") <= 0 || email.indexOf("@") !== email.lastIndexOf("@"))
+            return { status: 400, json: { error: "Enter one email address." } };
+          const points = [];
+          for (const a of Array.isArray(body?.access) ? body.access : []) {
+            const key = typeof a?.key === "string" ? a.key : "";
+            if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) points.push({ tenant: key });
+            else if (a?.kind === "company" && principal.accountOrgs?.[key]) points.push({ tenant: principal.accountOrgs[key], account: key });
+            else return { status: 404, json: { error: "not_found" } };
+          }
+          if (!points.length) return { status: 400, json: { error: "Choose at least one organisation or company this person may see." } };
+          const want = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true };
+          if (want.run && !mayRun(principal)) return { status: 400, json: { error: "You cannot give Run clearances without holding it yourself." } };
+          const existing = resolvePerson(email, grantsHere);
+          const setSwitches = email !== principal.email && (!existing || reachCovers(principal, existing));
+          let next;
+          try { next = withPerson(grantsHere, { email, points, switches: want, setSwitches }); }
+          catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
+          try { await writeGrants(next); }
+          catch (e) {
+            audit({ event: "person-add", by: principal.email, person: email, ok: false, error: String(e?.message ?? e).slice(0, 200) });
+            return { status: 500, json: { error: "The guest list could not be written, so nobody was added." } };
+          }
+          audit({ event: "person-add", by: principal.email, person: email, points: points.length, switchesApplied: setSwitches, ok: true, status: 201 });
+          const { loadProfiles } = await import("./profiles.mjs");
+          const companies = Object.fromEntries([...loadProfiles({ force: true }).values()].map((p) => [p.key, p.name ?? p.key]));
+          const person = accessView({ grants: next, viewer: principal, companies }).people.find((p) => p.email === email) ?? null;
+          return { status: 201, json: { person, switchesApplied: setSwitches } };
         }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
@@ -2988,7 +3141,7 @@ export function makePortalService({
  * "a comment asserting a wall that is not built is worse than no comment: it is the reason nobody goes
  * to look". Nobody went to look, for the same reason.
  *
- * The portal is now an issuance path ON PURPOSE — `/portal/api/connect-key`, owner ruling 2026-08-31 —
+ * The portal is now an issuance path ON PURPOSE — `/portal/api/connect-key`, ruling 2026-08-31 —
  * minting an account key for the CALLER and for nobody else. What it still cannot do is mint for another
  * identity: `sub` comes from the authenticated principal and never from the request. What it CAN also do
  * is read the credential it was
@@ -3037,7 +3190,7 @@ export function bundleFreshnessCached(present, { now = Date.now(), ttl = BUNDLE_
 /**
  * How to re-mint the trigger token WITH an accounts cap, and without changing anything else about it.
  *
- * ── tracker issue 107 ────────────────────────────────────────────────────────────────────────────
+ * ── THE RE-MINT COMMAND ──────────────────────────────────────────────────────────────────────────
  *
  * This used to be a fixed string in the warning itself: `--sub portal --verbs start_run,stop_run`. An
  * operator whose token carries a third verb, or a different subject, was told to re-mint as something
@@ -3528,7 +3681,7 @@ export function makeHttpHandler({ verify, limiter, service, log = () => {}, devI
         // Null when unset or unrecognised, which is an absence and reads as one. No inference from the
         // account or the path: a guessed box is worse than an unknown one, because it answers wrongly
         // instead of leaving the question open.
-        // ── IS THE BUNDLE THE ONE ITS SOURCES WOULD BUILD? (tracker issue 160) ──────────────────────
+        // ── IS THE BUNDLE THE ONE ITS SOURCES WOULD BUILD? ──────────────────────────────────────────
         //
         // `ui` had two states, present and absent, and no third for *present and older than the sources
         // it was built from*. On the source route `git pull` can never update `portal-ui/dist` — it is
@@ -3872,7 +4025,7 @@ const PORT = PORT_CHOICE.port;
     // guards — a boot that is going to refuse for a missing grants file must not write a passphrase
     // first and tell somebody to keep it.
     if (!LOCAL_USER) {
-      log("FATAL: PORTAL_AUTH_MODE=local names no user — set PORTAL_LOCAL_USER to the one email address that signs in here, and enrol that same address in the grants file (" + "CLEAROTRON_ACCESS_FILE" + ") or on a staff domain (PORTAL_STAFF_DOMAINS). Refusing to start.");
+      log("FATAL: PORTAL_AUTH_MODE=local names no user — set PORTAL_LOCAL_USER to the one email address that signs in here, and give that same address an entry in the grants file (" + "CLEAROTRON_ACCESS_FILE" + "). Refusing to start.");
       process.exit(1);
     }
     if (!LOCAL_USER.includes("@") || LOCAL_USER.indexOf("@") !== LOCAL_USER.lastIndexOf("@")) {
@@ -3939,12 +4092,11 @@ const PORT = PORT_CHOICE.port;
   // the difference is the point.
   //
   // shared/scope.mjs, first line of accountsForEmail: `if (!grants) return "*"`. With CLEAROTRON_ACCESS_FILE
-  // unset, EVERY identity this portal admits resolves to accounts:"*". makePrincipal hands back
-  // { role: "client", accounts: "*" } (portal-access.mjs — the "*" branch is honoured, only the ROLE
-  // stays client), assertPrincipal then approves whatever ?account= is asked for, and one signed-in
-  // customer reads every other customer's runs, held reports and configuration. Nothing throws, nothing
-  // 403s, nothing appears in a log: it is a silent read-all across the whole book of business, and the
-  // only outward sign is that the account picker offers names its owner has never heard of.
+  // unset, that flat view answers "every customer" for every identity. The portal no longer reads it that
+  // way — `makePrincipal` resolves nobody without a grants file — but other readers of the same function
+  // did, and a portal running with no file would be an install nobody can enter and nothing explains.
+  // Before the access model this was a silent read-all across the whole book of business, and the guard
+  // is kept for the reason it was written: the absence of the one file that decides must stop the start.
   //
   // UNCONDITIONAL, unlike the MCP's. There the guard sits inside the auth-disabled branch, because with
   // auth ON a caller has proven a firm email domain and read-all is what firm staff are supposed to
@@ -3953,12 +4105,8 @@ const PORT = PORT_CHOICE.port;
   // "auth is ON" says nothing whatever about whether the caller may see everything. In both modes the
   // grants file is the only thing that decides, so in both modes it is required.
   //
-  // The check further down — `!staffDomains.length && !grants()` — does NOT cover this and never did.
-  // It is satisfied by PORTAL_STAFF_DOMAINS alone, which is set on every real deployment, so it stays
-  // green while the read-all is live. It answers "could anybody sign in?", not "is anybody bounded?".
-  //
-  // An empty roster is a legitimate answer: a file containing only {"tenants":{}} admits staff by domain
-  // and grants no client anything, which is the correct starting state for a fresh instance. What is not
+  // An empty roster is a legitimate answer: a file containing only {"tenants":{}} admits nobody yet, which
+  // is where a fresh instance starts before setup writes its first person. What is not
   // legitimate is having no file, because that is indistinguishable from "not configured yet" and means
   // the opposite of what it looks like.
   if (!envFrom(process.env, "CLEAROTRON_ACCESS_FILE")) {
@@ -3975,16 +4123,12 @@ const PORT = PORT_CHOICE.port;
   // throws when set-but-unreadable), never a silent fallback.
   try { loadGrants({}); } catch (e) { log(`FATAL: grants file unreadable: ${e.message}`); process.exit(1); }
   const grants = () => loadGrants({});
-  const staffDomains = (process.env.PORTAL_STAFF_DOMAINS || "").split(",").map((s) => s.trim()).filter(Boolean);
-  if (!staffDomains.length && !grants()) { log(`FATAL: neither PORTAL_STAFF_DOMAINS nor CLEAROTRON_ACCESS_FILE configured — nobody could ever sign in (fail-closed).`); process.exit(1); }
-  // WHERE THAT RULE IS WRITTEN, resolved once at boot and handed to the service. `loaded` is this
-  // process's own report of which file configured it — never a path composed here, which would answer
-  // for a process that read nothing (see `envFileRead`'s note in shared/env-local.mjs).
-  const { loaded, unitEnvPath, envLocalPath } = await import("../shared/env-local.mjs");
-  const staffRule = staffRuleSource({
-    value: process.env.PORTAL_STAFF_DOMAINS, envLoad: loaded,
-    unitEnvFile: unitEnvPath(), cliEnvFile: envLocalPath(),
-  });
+  // How the People page and company creation write the grants file: atomically, so the per-request
+  // reader sees the old file or the new one and never half of either.
+  const writeGrants = async (g) => {
+    const { atomicWrite } = await import("./progress.mjs");
+    atomicWrite(envFrom(process.env, "CLEAROTRON_ACCESS_FILE"), `${JSON.stringify(g, null, 2)}\n`);
+  };
 
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
@@ -4059,7 +4203,7 @@ const PORT = PORT_CHOICE.port;
       + "`clearotron start` derives PORTAL_MCP_URL from its resolved ports; a box that launches this "
       + "service directly must set it to the engine door's own ORIGIN (no /mcp — the client appends it).");
   }
-  // ── AND WHETHER THE DOOR WILL TAKE IT (tracker issue 174) ────────────────────────────────────────
+  // ── AND WHETHER THE DOOR WILL TAKE IT ────────────────────────────────────────────────────────────
   //
   // Every line in this block describes the PORTAL'S HALF — the token, its verbs, its accounts, its
   // expiry — and not one of them asks whether the door it is pointed at will accept a caller shaped
@@ -4104,7 +4248,7 @@ const PORT = PORT_CHOICE.port;
       // than judged — with the mechanism, so a reader knows what to look at. Claiming more than was
       // measured is how a check starts refusing deployments that work.
       if (lane.state === "fail") log(`WARNING: trigger lane — ${lane.message}`);
-      // NOT `WARNING:` (tracker issue 222). A connection nothing answered at boot is a startup race far
+      // NOT `WARNING:`. A connection nothing answered at boot is a startup race far
       // more often than an outage — the units carry no ordering, so the portal routinely binds first —
       // and the old text stated an outage in the present tense with a 502 attached to it. It printed on
       // every reboot, on boxes that were fine. Reserving `WARNING:` for what did answer wrongly is what
@@ -4123,13 +4267,29 @@ const PORT = PORT_CHOICE.port;
     }
   }
 
+  // ── A RETIRED SETTING STILL SET IS SAID HERE, BESIDE THE OTHER GAPS ─────────────────────────────────
+  //
+  // Who may use the portal used to follow PORTAL_STAFF_DOMAINS: everyone at a listed email domain was
+  // staff. That rule is deleted and nothing configures from the setting, so a deployment that still sets
+  // it starts normally and admits nobody by domain — and the setting is the first place an operator looks
+  // when people cannot sign in. Named in this table and looked up, never read as a setting, because it
+  // decides nothing any more.
+  const RETIRED_PORTAL_SETTINGS = {
+    PORTAL_STAFF_DOMAINS: "who may use the portal is each person's own entry in the grants file "
+      + "(CLEAROTRON_ACCESS_FILE), with \"everything\": true under \"people\" for anyone who should see every "
+      + "company. No email domain admits anyone.",
+  };
+  for (const [name, now] of Object.entries(RETIRED_PORTAL_SETTINGS)) {
+    if (process.env[name]) log(`WARNING: ${name} is set and ignored — ${now}`);
+  }
+
   if (OPS_TOKEN) {
     const expiry = posture.expiresAt ? ` expires=${posture.expiresAt.slice(0, 10)} (${posture.daysLeft}d)` : " expires=UNKNOWN";
     // PREFIXED WHEN THE LANE IS DEAD, so this line cannot be read on its own as evidence of a working
     // lane — a journal is skimmed by grepping one phrase, and the phrase people grep is this one.
     log(`trigger lane${laneWired ? "" : " (NOT WIRED — see above)"}: ops token sub=${posture.sub ?? "-"} verbs=${posture.verbs?.join(",") ?? "(full ops)"} accounts=${posture.accounts?.join(",") ?? "UNCAPPED (every account)"}${expiry}${posture.readable ? "" : " — token payload unreadable, posture unknown"}`);
     if (!posture.accountCapped) {
-      // ── THE PRINTED COMMAND IS DERIVED FROM THE TOKEN IN HAND (tracker issue 107) ──────────────────
+      // ── THE PRINTED COMMAND IS DERIVED FROM THE TOKEN IN HAND ──────────────────────────────────────
       //
       // It used to be a fixed string: `--sub portal --verbs start_run,stop_run`. An operator whose
       // token carries a third verb, or a different subject, is told to re-mint as something NARROWER
@@ -4200,13 +4360,48 @@ const PORT = PORT_CHOICE.port;
     }
   }
   const { mcpToolCall } = await import("./portal-mcp-client.mjs");
+  // ── the trigger credential is stamped WHEN A SEARCH STARTS, not when the portal booted ────────────
+  //
+  // `bin/start.mjs` mints PORTAL_OPS_TOKEN capped to the roster as it stood at boot. That cap is a real
+  // second wall and it stays. What was wrong is its AGE: a company created afterwards is not in it, so
+  // the portal offered the clearance and the engine door refused it —
+  //
+  //     FORBIDDEN (start_run): your grant [generic] does not include account "<key>"
+  //
+  // — which is the first thing a person meets after being told to set a company up. `brandowner add`
+  // detects it and prints NOT YET STARTABLE with a remedy, deliberately reporting rather than
+  // re-minting, because a create COMMAND holding the signing secret would be a larger surprise than the
+  // bug. That boundary is about the command, and it is untouched: this process is not a create command,
+  // it already holds the secret, and it already mints account credentials with it for the connector.
+  //
+  // So the cap is re-taken against the roster as it stands, for the length of one call.
+  //
+  // FALLS BACK TO THE BOOT TOKEN, never to an uncapped one. If the secret is unreadable or the store
+  // cannot be listed, this returns exactly what it returned before — a stale cap that refuses a new
+  // company at the door — rather than widening the wall to get the call through. The failure direction
+  // matters more than the feature: "the newest company cannot search yet" is the bug being fixed, and
+  // "any account can be started" is not a worse version of it, it is a different and larger one.
+  const currentOpsToken = async () => {
+    let roster = [];
+    try {
+      const { loadProfiles } = await import("./profiles.mjs");
+      roster = [...loadProfiles({ force: true }).keys()];
+    } catch (e) {
+      // Same rule one layer out: the roster could not be read at all, so there is nothing to re-mint
+      // against. Narrow and said out loud, rather than narrow and silent.
+      console.error(`[portal] could not read the company roster to re-mint the engine credential `
+        + `(${String(e?.message ?? e)}) — falling back to the credential minted at boot`);
+      return OPS_TOKEN;
+    }
+    return opsTokenFor({ bootToken: OPS_TOKEN, roster, mint: mintToken });
+  };
   const trigger = async (args) => {
     if (!MCP_URL || !OPS_TOKEN) throw new Error("PORTAL_MCP_URL / PORTAL_OPS_TOKEN unset — the trigger lane is not wired on this instance");
-    return mcpToolCall({ url: MCP_URL, token: OPS_TOKEN, tool: "start_run", args });
+    return mcpToolCall({ url: MCP_URL, token: await currentOpsToken(), tool: "start_run", args });
   };
   const stopRun = async (args) => {
     if (!MCP_URL || !OPS_TOKEN) throw new Error("PORTAL_MCP_URL / PORTAL_OPS_TOKEN unset — the stop lane is not wired on this instance");
-    return mcpToolCall({ url: MCP_URL, token: OPS_TOKEN, tool: "stop_run", args });
+    return mcpToolCall({ url: MCP_URL, token: await currentOpsToken(), tool: "stop_run", args });
   };
 
   // The config surface. profile-service is constructed IN-PROCESS rather than called over HTTP: it
@@ -4331,6 +4526,11 @@ const PORT = PORT_CHOICE.port;
       // directory. The engine refuses that fallback for the same reason; so does this.
       const recipesDir = process.env.CLEAROTRON_RECIPES_DIR || "";
       let callRecipes = null;
+      // WHY THE FEATURE IS OFF, kept rather than only logged. The boot log already carried the exact
+      // diagnosis and the screen carried "try again shortly" — a permanent, already-understood
+      // configuration state rendered as a transient fault, with advice that can never work. The reason
+      // travels with the refusal now so the surface can say what the log knows.
+      let recipesOff = null;
       // — the recipe store's own reachability, decided BEFORE the branch so an unreachable one turns
       // saved searches off rather than throwing. A throw here would land in the catch below and take the
       // PROFILE surface down with it, and the two stores are configured independently: `recipeRepoRoot`
@@ -4345,6 +4545,7 @@ const PORT = PORT_CHOICE.port;
         log(`saved searches OFF — ${storeOutsideRepoMessage({ storeVar: "CLEAROTRON_RECIPES_DIR", storeDir: recipeReach.store, repoVar: "RECIPE_REPO_ROOT", repoRoot: recipeReach.repo })} `
           + `The repo root came from ${recipeResolved.from} (tried ${recipeResolved.tried.join(", ")} in that order). `
           + "Routes answer 404 rather than accepting a save that would orphan its file.");
+        recipesOff = { code: "store_outside_repo", detail: storeOutsideRepoMessage({ storeVar: "CLEAROTRON_RECIPES_DIR", storeDir: recipeReach.store, repoVar: "RECIPE_REPO_ROOT", repoRoot: recipeReach.repo }) };
       } else if (recipesDir) {
         const { makeRecipeService } = await import("./recipe-service.mjs");
         const recipeRepoRoot = recipeResolved.root;
@@ -4357,11 +4558,17 @@ const PORT = PORT_CHOICE.port;
         log(`saved searches ON — store=${recipesDir} repo=${recipeRepoRoot}`);
       } else {
         log("saved searches OFF — CLEAROTRON_RECIPES_DIR unset, so /portal/api/config/searches answers 404");
+        recipesOff = { code: "not_configured", detail: "CLEAROTRON_RECIPES_DIR is not set on this deployment, so there is no store for saved searches." };
       }
 
       return makeUpstream({
         callUpstream: (method, path, body, identity) => profiles.route(method, path, { email: identity?.email }, body ?? {}),
         callRecipes,
+        recipesOff,
+        // A company created from the portal is filed under its organisation in the same breath, so the
+        // person who made it can use it: access is decided by the grants file, and the create writes only
+        // the company's own file, which decides nothing about who sees it.
+        fileCompany: async ({ tenant, account }) => writeGrants(withCompany(loadGrants({}), { tenant, account })),
       });
     } catch (e) {
       // A settings surface that cannot start must not take the whole portal down — clearances and
@@ -4426,7 +4633,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, staffDomains, staffRule, grants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, grants, localSignIn: LOCAL_MODE, writeGrants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a
@@ -4515,8 +4722,8 @@ const PORT = PORT_CHOICE.port;
     // exactly as it would for a Cloudflare-verified stranger. Warned at boot because the symptom
     // otherwise arrives as "I signed in and got refused", which reads as a broken login.
     try {
-      if (!makePrincipal({ email: LOCAL_USER, grants: grants(), staffDomains }))
-        log(`WARNING: ${LOCAL_USER} can sign in but holds no portal access — it is on no staff domain (PORTAL_STAFF_DOMAINS) and in no grants row (CLEAROTRON_ACCESS_FILE), so every page will refuse it at the door. Add it to one of them.`);
+      if (!makePrincipal({ email: LOCAL_USER, grants: grants() }))
+        log(`WARNING: ${LOCAL_USER} can sign in but holds no portal access — it has no entry in the grants file (CLEAROTRON_ACCESS_FILE), so every page will refuse it at the door. Give it one.`);
     } catch (e) {
       // A WARNING must never be the thing that takes the service down. The grants file was already
       // read successfully by the mandatory guard above; anything that fails here is a race with
@@ -4542,7 +4749,7 @@ const PORT = PORT_CHOICE.port;
   // on the route: on a PACKAGED install the bundle ships inside the tarball, so absent means a broken
   // package; on a SOURCE checkout it has simply never been built, which is the ordinary first-run
   // state and why the message names the build command. The freshness verdict twenty lines below
-  // (tracker issue 160) has always had this right.
+  // has always had this right.
   //
   // Not fatal on purpose: the API is independently useful (the MCP face, the connector, a debugging
   // curl), and taking the whole service down over a UI asset would turn a cosmetic failure into an