clearotron 0.2.4 → 0.3.0-beta.1

package/driver/synthesis-record.mjs

@@ -14,7 +14,7 @@
 // values; what changes is that it arrives through the call instead of being authored as a file, which
 // is what lets the joins below run at write time.
 //
-// ── WHAT THIS DOES *NOT* CONVERT, AND IT IS AN OWNER RULING, NOT AN OVERSIGHT ──────────────────────
+// ── WHAT THIS DOES *NOT* CONVERT, AND IT IS A RULING, NOT AN OVERSIGHT ──────────────────────
 //
 // The per-finding write-ups are NOT rendered from `findings.json`. `stages.mjs`' contract element for
 // them classes the second authoring `mechanical:code-rendered` and its `why` records ruling D3 on
@@ -465,7 +465,7 @@ export function driverReadsFor(runDir) {
  * THE STATE THAT ENUMERATION MISSED is the corrective pass. `prepareDeclinationSpec` runs AGAIN before
  * it, and the surface can have grown in between, so the corrective pass is ordered against a LARGER owed
  * set than the main pass answered. If that call is refused, `rollbackCorrectivePass` restores the
- * pre-corrective `findings.json` and — by T3b's owner ruling, deliberately — THE RUN DELIVERS. The
+ * pre-corrective `findings.json` and — by T3b's ruling, deliberately — THE RUN DELIVERS. The
  * document that ships satisfied the OLD owed set; the records added since are unaccounted, and no
  * acceptance boundary ever saw a call about them, because the only call that was ordered against them
  * was the one that got refused.

package/driver/systemd/clearotron-client-mcp.service

@@ -1,6 +1,6 @@
 # GENERIC UNIT — safe to sync verbatim on deploy: no deployment-specific value lives here.
 #
-# ── INSTALLED WITH THE PRODUCT (owner ruling 2026-09-03, tracker issue 2148, settled point 2) ───────
+# ── INSTALLED WITH THE PRODUCT (ruling 2026-09-03, settled point 2) ───────────────────────────
 #
 # This is the CLIENT door: the only surface that accepts a key acting for a brand owner's account. It is
 # a SEPARATE PROCESS from the engine door (clearotron-mcp-face.service), which refuses an account key
@@ -45,7 +45,7 @@ Type=simple
 EnvironmentFile=%h/.env
 Environment=PATH=%h/.local/bin:%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
 Environment=CLEAROTRON_NO_ENV_FILE=1
-# ── NO PORT, NO HOST, NO ALLOW-LIST HERE (tracker issue 191) ─────────────────────────────────────────
+# ── NO PORT, NO HOST, NO ALLOW-LIST HERE ─────────────────────────────────────────────────────────────
 #
 # This unit used to carry three Environment= lines pinning the host, the port and the allow-list, and it
 # was the ONLY one of the four that pinned anything a box can legitimately differ on. `Environment=` is
@@ -55,7 +55,7 @@ Environment=CLEAROTRON_NO_ENV_FILE=1
 # It took a running door down on a shared box: two installs, two ports, one baked value, and the
 # reinstall pointed the second install's door at the first's port. Worse, the allow-list travelled with
 # it — pinned to 18811 whatever port the door actually bound — which is the `Invalid Host header`
-# failure of tracker issue 130 one layer down, produced by our own unit rather than by a tunnel.
+# failure of the missing session bus one layer down, produced by our own unit rather than by a tunnel.
 #
 # The values live in %h/.env, which BOTH install paths write through one authority (`enablePlan`), and
 # the code's own defaults are the same 127.0.0.1 and 18811 these lines carried — so a box that has

package/driver/systemd/clearotron-deploy.service

@@ -15,9 +15,9 @@ Environment=CLEAROTRON_NO_ENV_FILE=1
 
 # `clearotron update` is the whole mechanism, and it already owns both refusals:
 #
-#   1. it refuses over a configuration store kept INSIDE the checkout (tracker issue 1723) — an upgrade there is a
+#   1. it refuses over a configuration store kept INSIDE the checkout — an upgrade there is a
 #      merge conflict at best and a silent overwrite of the operator's own doctrine at worst;
-#   2. it refuses while a run is queued, claimed or in flight (tracker issue 1883) — `npm ci` rebuilds node_modules
+#   2. it refuses while a run is queued, claimed or in flight — `npm ci` rebuilds node_modules
 #      under whatever is running, and a clearance assembled from halves of two builds does not fail, it
 #      answers wrongly and says nothing.
 #

package/driver/systemd/clearotron-mcp-face.service

@@ -1,6 +1,6 @@
 # GENERIC UNIT — safe to sync verbatim on deploy: no deployment-specific value lives here. See
 # clearotron-portal.service for why this unit exists and why it takes an EnvironmentFile rather than
-# explicit Environment= lines (tracker issue 1925, owner ruling 2026-08-26).
+# explicit Environment= lines (ruling 2026-08-26).
 #
 # This is the engine door the portal's Start button calls over real MCP. It is the OTHER of the two
 # children bin/start.mjs supervises, and the other one that had no unit.

package/driver/systemd/clearotron-portal.service

@@ -2,14 +2,14 @@
 # listener and every hostname come from EnvironmentFile=%h/.env, which is where a SERVER's configuration
 # lives (INSTALL.md §3; render-units.mjs defaults --env to the same file).
 #
-# ── WHY THIS UNIT EXISTS (tracker issue 1925) ─────────────────────────────────────────────────────────
+# ── WHY THIS UNIT EXISTS ──────────────────────────────────────────────────────────────────────────────
 #
 # It did not, and that was the gap under the whole issue. `bin/start.mjs` supervises exactly two children
 # — this process and the MCP face — and NOTHING ran either under systemd. So the two processes the door
 # configures had no service to attach to, a hosted deployment kept them alive with a hand launcher, and
 # `clearotron start`'s refusal had nothing to point at.
 #
-# ── ONE CONFIGURATION PER SERVER BOX (owner ruling, 2026-08-26) ───────────────────────────────────────
+# ── ONE CONFIGURATION PER SERVER BOX (ruling, 2026-08-26) ───────────────────────────────────────
 #
 # `EnvironmentFile=%h/.env`, like prelim-driver.service, and the CF Access audience lives there. The
 # alternative — explicit `Environment=` lines carrying the audience, as profile-service.service used to —
@@ -21,7 +21,7 @@ Description=Clearotron portal — the UI, the API, the sign-in and the config su
 Documentation=https://github.com/CordilleraSarl/Clearotron/blob/main/docs/architecture/02-architecture.md
 After=network-online.target
 Wants=network-online.target
-# ── THE ENGINE DOOR FIRST, WHERE THERE IS ONE (tracker issue 222) ─────────────────────────────────────
+# ── THE ENGINE DOOR FIRST, WHERE THERE IS ONE ─────────────────────────────────────────────────────────
 #
 # The units carried no ordering between them, so a simultaneous restart of the set started this process
 # before the door it calls. Its boot probe then logged an outage — in the present tense, with "a

package/driver/systemd/clearotron-worker.service

@@ -5,7 +5,7 @@
 # queue and credential comes from EnvironmentFile=%h/.env, which is where a SERVER's configuration lives
 # (INSTALL.md §3; render-units.mjs defaults --env to the same file).
 #
-# ── WHY THIS UNIT EXISTS (tracker issue 1863) ────────────────────────────────────────────────────────
+# ── WHY THIS UNIT EXISTS ─────────────────────────────────────────────────────────────────────────────
 #
 # It did not, and its absence was the one that cost a report rather than a restart. `bin/start.mjs`
 # supervises THREE children — the portal, the engine door, and this worker (`:904`). Units shipped for
@@ -18,7 +18,7 @@
 # box reports healthy while no client ever receives a report. That is the failure the retired `.path`
 # unit's own header warned about, arriving through the other door.
 #
-# ── WHY ExecStart IS THE ENTRYPOINT AND NOT `clearotron start` (owner ruling, 2026-08-31) ────────────
+# ── WHY ExecStart IS THE ENTRYPOINT AND NOT `clearotron start` (ruling, 2026-08-31) ────────────
 #
 # "The simple shape wins, implemented the standard way." Per standard service practice the unit invokes
 # the server entrypoint directly under its own EnvironmentFile; it does not shell through the
@@ -28,7 +28,7 @@
 #
 # ── ONE DRAINER, AND THE LOCK IS WHAT ENFORCES IT ────────────────────────────────────────────────────
 #
-# A second claimant on one queue is this lane's recurring defect (tracker issue 1883). This unit takes no
+# A second claimant on one queue is this lane's recurring defect. This unit takes no
 # special precaution against it because none would work: the guarantee is CLEAROTRON_RUN_LOCK_DIR, which
 # this worker and a hand-started `node driver/runner.mjs` already share, so the cap holds across both.
 # What this unit must not do is run beside a FOREGROUND `clearotron start`, which supervises its own
@@ -48,7 +48,7 @@ EnvironmentFile=%h/.env
 Environment=PATH=%h/.local/bin:%h/.npm-global/bin:/usr/local/bin:/usr/bin:/bin
 Environment=CLEAROTRON_NO_ENV_FILE=1
 ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/runner.mjs --watch
-# ── REFRESH THE CAPABILITY PAGE'S CAPTURE AT EVERY START (tracker issue 170) ─────────────────────────
+# ── REFRESH THE CAPABILITY PAGE'S CAPTURE AT EVERY START ─────────────────────────────────────────────
 # The capability page renders `pool/_state/prelim-flag-snapshot.json`, and until this line its only
 # writers were a RUN and the `clearotron start` launcher. A hosted box runs neither: these units are the
 # entrypoint, and a deployment being CONFIGURED runs nothing by definition. So the page reported the old
@@ -57,7 +57,7 @@ ExecStart=/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/runner.mjs --watch
 # every service restarted, and the page still said Signa.
 #
 # This unit can write it because it carries `EnvironmentFile=%h/.env` — one configuration per server box,
-# owner ruling 2026-08-26, which removed the second source of truth rather than defending against it.
+# ruling 2026-08-26, which removed the second source of truth rather than defending against it.
 # `-` prefix: a snapshot is a diagnostic surface, and failing to write one must never fail the service.
 ExecStartPost=-/usr/bin/node ${CLEAROTRON_CHECKOUT_DIR}/driver/flag-snapshot.mjs
 #

package/driver/systemd/install-census.mjs

@@ -4,7 +4,7 @@
 //
 // ── why this exists ─────────────────────────────────────────────────────────────
 //
-// Tracker issue 122 named a family rather than a bug: four values this product needs are each written
+// This names a family rather than a bug: four values this product needs are each written
 // by exactly one command, and for three of them that command is not the documented install. A box built
 // strictly from the document therefore came up with correct units, correct code, and a value nothing
 // ever set — and each one failed as something else. A 502 on submit. An empty screen. A door that would

package/driver/systemd/render-units.mjs

@@ -4,7 +4,7 @@
 //
 // render-units.mjs — RESOLVE THE UNITS CONFIGURATION CANNOT REACH, AND WRITE THE RESOLVED COPIES.
 //
-// Owner ruling 2026-08-25 (option B): the installer writes resolved unit copies into
+// Ruling 2026-08-25 (option B): the installer writes resolved unit copies into
 // ~/.config/systemd/user/, and the tracked units stay generic.
 //
 // WHY THIS EXISTS AT ALL. Most shipped units take what differs per box from `EnvironmentFile=%h/.env`
@@ -231,7 +231,7 @@ if (isEntrypoint(import.meta.url)) {
   }
   if (APPLY) {
     if (laneNote) console.log(laneNote);
-    // ── AND WHAT THIS INSTALL STILL HAS NOT GOT (tracker issue 133) ─────────────────────────────────
+    // ── AND WHAT THIS INSTALL STILL HAS NOT GOT ─────────────────────────────────────────────────────
     //
     // The nine values above are the ones this command RESOLVES. They are not the values the units
     // refuse to start over, and the gap between those two lists is how a documented install produced a
@@ -301,7 +301,7 @@ export async function writeInstallEnv(envFile) {
   // change, and the reader meets it in the output of the command that does it rather than discovering
   // it in a file.
   const fresh = signingSecretIfAbsent(fileEnv.TRADEMARK_MCP_TOKEN_SECRET ?? process.env.TRADEMARK_MCP_TOKEN_SECRET, { randomBytes });
-  // ── HELD, NOT PRINTED (tracker issue 194) ─────────────────────────────────────────────────────────
+  // ── HELD, NOT PRINTED ─────────────────────────────────────────────────────────────────────────────
   //
   // These lines used to print here, and the refusal below exits before anything reaches disk — so a
   // refused run announced "Written to the env file at mode 600" about two files it never wrote. That
@@ -321,7 +321,7 @@ export async function writeInstallEnv(envFile) {
       "  file at mode 600, and never printed.");
   }
 
-  // ── AND THE PORTAL'S SECRET, WHICH THE SAME ARGUMENT ALWAYS COVERED (tracker issue 122) ───────────
+  // ── AND THE PORTAL'S SECRET, WHICH THE SAME ARGUMENT ALWAYS COVERED ───────────────────────────────
   //
   // The block above was written for the signing secret alone, and `PORTAL_SECRET` is the identical case
   // one door along: 32 random bytes, minted by `bin/start.mjs` and by nothing else, with no value a
@@ -329,7 +329,7 @@ export async function writeInstallEnv(envFile) {
   // strictly from the document got a portal unit that exited at boot, and the only route to a working
   // one was running the local-install command the instructions say a server does not need.
   //
-  // That is the family tracker issue 122 is about: a value whose sole writer is a command outside the
+  // That is the family this is about: a value whose sole writer is a command outside the
   // documented install. Naming the variable in a warning does not help, because there is no action
   // behind the name — the reader cannot invent 32 random bytes that the portal will accept.
   //
@@ -392,10 +392,10 @@ export async function writeInstallEnv(envFile) {
   }
   for (const [k, v] of Object.entries(doorPlan.settings)) want[k] = v;
 
-  // ── THE SECRETS ARE ON DISK'S SIDE OF THE REFUSAL NOW (tracker issue 194) ─────────────────────────
+  // ── THE SECRETS ARE ON DISK'S SIDE OF THE REFUSAL NOW ─────────────────────────────────────────────
   for (const line of announcements) console.log(line);
 
-  // ── A DERIVED VALUE MAY NOT GO STALE (tracker issue 197) ──────────────────────────────────────────
+  // ── A DERIVED VALUE MAY NOT GO STALE ──────────────────────────────────────────────────────────────
   //
   // Driven on a greenfield install: `--apply`, then an operator edits `CLIENT_MCP_HTTP_PORT` by hand
   // and runs `--apply` again. The door binds the new port; the allow-list still names the old one;
@@ -413,13 +413,13 @@ export async function writeInstallEnv(envFile) {
   //
   // `CLEAROTRON_CHECKOUT_DIR` is deliberately not here either, for the same reason one issue over.
   //
-  // ── BOTH DOORS, NOT ONE (tracker issue 192) ───────────────────────────────────────────────────────
+  // ── BOTH DOORS, NOT ONE ───────────────────────────────────────────────────────────────────────────
   //
   // This block used to name the client door alone. The engine door's allow-list is the same derivable
   // `host:port` shape, refuses to start without a value in the same words, and was composed by NOTHING
   // on a hosted install — `bin/start.mjs` injects one into its own children's environment, which no
   // systemd unit inherits. So the documented install asked an operator for a value while writing the
-  // identical one next to it. That asymmetry was found by the census tracker issue 122 asked for, on
+  // identical one next to it. That asymmetry was found by the census that called for it, on
   // its first run, which is what that check is for.
   //
   // The pair is DATA now (`DOOR_ALLOW_LISTS`), and the composition is one function taking the public

package/driver/terminal-clamp.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // terminal-clamp.mjs — WHAT A TERMINAL GUARD DOES WHEN IT FINDS THE REPORT INCOMPLETE.
 //
-// Owner ruling, 2026-08-27, verbatim intent: **reports always ship**. When a terminal guard finds the
+// Ruling, 2026-08-27, verbatim intent: **reports always ship**. When a terminal guard finds the
 // report incomplete at delivery, the engine sends it with the gap patched conservatively and the defect
 // named in the run record. It never withholds.
 //

package/driver/trigger-cap.mjs

@@ -55,12 +55,28 @@ export function triggerCapGap({ accounts = null, roster = [] } = {}) {
 /**
  * The one sentence every surface says about a gap, so three of them cannot say three different things.
  *
+ * IT WAS TWO UNTIL THE THIRD WAS WIRED. This function's own comment claimed three call sites and there
+ * were two — the create command and the portal's boot log. `doctor`, the command whose whole job is to
+ * report what a machine is configured for, said nothing at all about a cap that decides which companies
+ * can be started. The claim was aspirational and is now accurate.
+ *
  * The wording is the portal boot check's, kept deliberately: it was measured to be the thing that would
  * have saved the owner an afternoon, and rewording it per surface is how the good half of a defect gets
  * lost while the fix ships.
+ *
+ * IT SAID THE RUNS WOULD BE REFUSED, AND THAT STOPPED BEING TRUE. The portal now re-takes its engine
+ * credential against the roster as it stands at the start of every call, so a stale cap no longer
+ * refuses anything on the ordinary path. The gap is still worth saying — the portal falls back to this
+ * token when it cannot re-mint, and then the refusal is real — but the sentence has to describe the
+ * fallback rather than the normal case, or it sends an operator to re-mint a credential for a failure
+ * that will not happen. Changed HERE rather than at the three call sites, which is the whole reason
+ * this function exists.
  */
 export function triggerCapWarning({ uncovered, union }) {
-  return `the roster contains account(s) the trigger token cannot start: ${uncovered.join(", ")}. `
-    + `Runs for them will be refused at the engine door. Re-mint with --accounts ${union.join(",")} `
+  return `the roster contains account(s) this token cannot start: ${uncovered.join(", ")}. `
+    + `The portal re-takes its engine credential at the start of every call, so runs for them are not `
+    + `normally refused; they are refused when it CANNOT re-mint — an unreadable signing secret, or a `
+    + `store it cannot list — because it then falls back to this token rather than widening the cap. `
+    + `Re-mint with --accounts ${union.join(",")} `
     + `(union of the current cap and the roster — check it before using it).`;
 }

package/driver/unit-inventory.mjs

@@ -75,7 +75,7 @@
 /** Where a unit is expected to be installed. "none" is a claim, not an absence — see ORPHANED below. */
 export const BOXES = Object.freeze(["prod", "test", "dev"]);
 
-// ── RESOLVED UNITS (owner ruling 2026-08-25 — option B) ──────────────────────
+// ── RESOLVED UNITS (ruling 2026-08-25 — option B) ──────────────────────
 //
 // `resolved: [...]` names tracked files the INSTALLER rewrites before installing. Three units carry
 // `@NAME@` placeholders because configuration cannot reach them: a `.path` unit reads no environment at
@@ -88,7 +88,7 @@ export const BOXES = Object.freeze(["prod", "test", "dev"]);
 // everything declared here really carries one. A one-way check would let a new placeholder ship
 // undeclared, which is the same shape as the undeclared units this file was written to make impossible.
 
-// ── RETIRED UNITS (; owner ruling 2026-08-26, restated 2026-08-31) ────────────
+// ── RETIRED UNITS (; ruling 2026-08-26, restated 2026-08-31) ────────────
 //
 // `retired: { ruled, filesStayUntil, why }` says a unit's posture has been ruled away while its tracked
 // files are still in the tree. It is a FACT about a decision, not a pointer at a replacement — the
@@ -99,12 +99,12 @@ export const BOXES = Object.freeze(["prod", "test", "dev"]);
 // `filesStayUntil` is a BOX, and it is the whole reason the files are still here. Deleting a tracked
 // file whose unit that box is running today removes the only tracked description of a live service —
 // the mistake this file's own header records being caught once already, for `profile-service` and
-// `prelim-outbox`. Production is on pre-sweep code and is rebuilt rather than migrated (owner ruling
+// `prelim-outbox`. Production is on pre-sweep code and is rebuilt rather than migrated (ruling
 // 2026-08-26), so the rebuild is the event that releases the files, and until then entry and tree
 // disagree ON PURPOSE.
 //
 // THE REBUILD HAPPENED, and the first two entries this field ever carried have gone with their files.
-// Measured on the production install 2026-09-07 (tracker issue 265): seven units, all under the current
+// Measured on the production install 2026-09-07: seven units, all under the current
 // names, none of the retired ones, with a clearance delivered end to end. `prelim-driver.*` and
 // `prelim-outbox.*` left the tree in the same change that removed their entries. Read the paragraph
 // above as the rule and this one as the event that discharged it — without this line a reader concludes
@@ -141,7 +141,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // held deliberately, a check that says so for as long as the hold lasts is the behaviour to want.
   },
   {
-    // ── `tracked` WAS A CLAIM ABOUT A FILE THAT HAS NEVER EXISTED (tracker issue 175) ──────────────
+    // ── `tracked` WAS A CLAIM ABOUT A FILE THAT HAS NEVER EXISTED ──────────────────────────────────
     //
     // This entry named `profile-service.service` as tracked. `git log --all` on that path is empty: it is
     // not in the tree, not in the tarball, and has never been in this repository's history. So
@@ -170,7 +170,7 @@ export const UNIT_INVENTORY = Object.freeze([
     // calls the sanctioned way to say the repo does not carry one.
     //
     // ONE THING THIS DOES NOT SETTLE, left visible rather than decided quietly. The note calls the unit
-    // "generic since tracker issue 1925" — an argument that a placeholder COULD now ship and be compared,
+    // "generic since the placeholder ruling" — an argument that a placeholder COULD now ship and be compared,
     // because the reason its siblings cannot (real CF Access values inline) may no longer hold here. That
     // is a change which ADDS a file, measured against the deployed copy, and it is not this one. Two
     // prose references in driver/systemd/render-units.mjs also describe this file as though it were in
@@ -247,7 +247,7 @@ export const UNIT_INVENTORY = Object.freeze([
     //
     // Until then it was an orphan BY DESIGN: `clearotron connect` installed and started it on demand,
     // because starting it turned on client-account access and a unit that came up with everything else
-    // would have made that consent meaningless (; owner ruling 2026-08-31, "On demand
+    // would have made that consent meaningless (; ruling 2026-08-31, "On demand
     // is fine"). He superseded that knowingly — the door auto-starts and the per-account key is the
     // gate, not whether a process runs.
     //
@@ -278,7 +278,7 @@ export const UNIT_INVENTORY = Object.freeze([
       + "directly (owner ruling 2026-08-31). Ships tracked, runs nowhere yet — production takes it at "
       + "its rebuild, which is the same event that lets the retired units' files leave the tree.",
     orphanReason: "AWAITING A BOX, not an orphan by design. It is the hosted posture's drainer, and the "
-      + "hosted posture is an opt-in step no install performs (tracker issue 1888). It must NOT be "
+      + "hosted posture is an opt-in step no install performs. It must NOT be "
       + "started beside `clearotron start`, which supervises its own worker — the two postures are "
       + "alternatives, and running both puts a second claimant on one queue.",
   },

package/driver/usage-ledger.mjs

@@ -98,7 +98,9 @@ export function matterLedgerPath(qdir) { return join(dirname(qdir), ".matter-led
  * No paths in the return value: it is spread into client-facing JSON by both the portal and the MCP
  * preview, and server paths are not a client's business.
  */
-export function accountUsage({ queueDirs, account, now = Date.now() }) {
+export function accountUsage({ queueDirs, account, organisation = null, now = Date.now() }) {
+  // A Generic run counts in the lane of the organisation it was filed under, as checkRunCaps counts it.
+  const inLane = (key, org) => (key ?? null) === account && (account !== "generic" || (org ?? null) === organisation);
   const dayKey = new Date(now).toISOString().slice(0, 10);
   const monthKey = new Date(now).toISOString().slice(0, 7);
   let today = 0, thisMonth = 0, queued = 0;
@@ -113,7 +115,7 @@ export function accountUsage({ queueDirs, account, now = Date.now() }) {
       read = true;
       for (const line of rows) {
         let e; try { e = JSON.parse(line); } catch { continue; }
-        if (e.profileKey !== account || typeof e.ts !== "number") continue;
+        if (!inLane(e.profileKey, e.organisation) || typeof e.ts !== "number") continue;
         const stamp = new Date(e.ts).toISOString();
         if (stamp.slice(0, 7) === monthKey) thisMonth++;
         // `today` must count exactly what the WALL counts, or the screen lies. checkRunCaps skips failed
@@ -132,7 +134,7 @@ export function accountUsage({ queueDirs, account, now = Date.now() }) {
     // which the old inline regex here missed (isLiveQueueMarker is the one definition;).
     try {
       for (const f of readdirSync(qdir).filter(isLiveQueueMarker)) {
-        try { if ((JSON.parse(readFileSync(join(qdir, f), "utf8")).profileKey ?? null) === account) queued++; }
+        try { const j = JSON.parse(readFileSync(join(qdir, f), "utf8")); if (inLane(j.profileKey, j.tenant)) queued++; }
         catch { /* mid-rename — skip */ }
       }
     } catch { /* no queue dir */ }

package/driver/verify-knockout.mjs

@@ -117,7 +117,7 @@ export function knockoutReceipts(runDir, marks) {
   return { ok: failures.length === 0, failures, checked };
 }
 
-// ── ratingQualifier: the closed SECOND axis (owner ruling, 2026-08-06) ────────────────────────
+// ── ratingQualifier: the closed SECOND axis (ruling, 2026-08-06) ────────────────────────
 //
 // The band is the rating; the qualifier is the only sub-gradation the doctrine allows, and until now it
 // was free text on the mark row — validated by nothing, rendered verbatim on the client page
@@ -163,9 +163,9 @@ export const READ_FIELDS = Object.freeze(["basis", "factors", "counterFactors",
 export const REGISTER_CLAIM_RE =
   /\b(?:register|registry|registers|trademark office)\s+(?:overlay\s+|search(?:es)?\s+|check(?:s)?\s+|count(?:s)?\s+|data\s+)?(?:has|have|was|were|is|are)\s+(?:not\s+|n't\s+|yet\s+)?(?:been\s+)?(?:run|searched|checked|counted|performed|conducted|reviewed|carried out)\b/i;
 
-// ── THE SUMMARY'S SHAPE (tracker issues 1934, 2056) ──────────────────────────────────────────────────
+// ── THE SUMMARY'S SHAPE ──────────────────────────────────────────────────
 //
-// Owner ruling 2026-08-31: "keep the length, add the structure, so long as length is consistent more or
+// Ruling 2026-08-31: "keep the length, add the structure, so long as length is consistent more or
 // less." Two rules follow, and they are deliberately unlike each other.
 //
 // 1. AN H1 IS A CORRECTNESS DEFECT, refused outright. `# ` opens a SECTION of the delivered report:
@@ -360,7 +360,7 @@ export const validators = {
       if (!rating) return { ok: false, reason: `mark "${m.name}": rating is required` };
       if (ladder.length && bandIdx(ladder, rating) < 0)
         return { ok: false, reason: `knockout_band_unknown:${m.name}: rating "${rating}" is not in the frozen ladder (${ladder.join(" / ")}) — rate in the framework's own vocabulary` };
-      // the second axis, closed here because this is where the first one is closed ( owner ruling)
+      // the second axis, closed here because this is where the first one is closed ( ruling)
       if (m.ratingQualifier != null && !normalizeKnockoutQualifier(m.ratingQualifier))
         return { ok: false, reason: `knockout_qualifier_unknown:${m.name}: ratingQualifier "${m.ratingQualifier}" is not one of ${KNOCKOUT_RATING_QUALIFIERS.join(" / ")} — the qualifier is a closed sub-gradation that can only cap a band, and anything else belongs in the band word itself` };
       if (!Array.isArray(m.bullets) || m.bullets.length < 1 || m.bullets.length > 5)
@@ -419,7 +419,7 @@ export const validators = {
       // paragraph names every mark, so publish blanked it rather than put other clients' marks on this
       // client's page, and nothing owed a replacement.
       //
-      // Owner ruling: every mark's own report opens with a model-authored paragraph about that mark.
+      // Ruling: every mark's own report opens with a model-authored paragraph about that mark.
       // Required rather than optional, because the failure it replaces was a page that opened with
       // NOTHING and looked deliberate — publish blanked the batch paragraph on a per-mark document (it
       // names other clients' marks) and no one field owed a replacement.
@@ -540,8 +540,8 @@ export function registerSurfacedFilings(recordsPath, { read = readFileSync } = {
 /**
  * The survivor sentence's signature, and the engine's own caveats.
  *
- * MOVED HERE FROM pipeline-knockout SO THERE IS ONE DERIVATION, for the identical reason tracker issue
- * 1926 moved `registerSurfacedFilings`: the producer and the verifier were asking different questions of
+ * MOVED HERE FROM pipeline-knockout SO THERE IS ONE DERIVATION, for the identical reason an earlier
+ * change moved `registerSurfacedFilings`: the producer and the verifier were asking different questions of
  * the same array, and two predicates that must agree forever is how they stop agreeing.
  *
  * `pipeline-knockout.mjs` re-exports `SURVIVOR_BOUNDARY_RE` so its existing importers are untouched; the

package/driver/verify.mjs

@@ -144,7 +144,7 @@ function nonEmpty(content, min = MIN) {
  * ── WHY THE LABEL STAYS AND THE MEMBER IS APPENDED ──────────────────────────────────────────────────
  *
  * The obvious fix — emit the failing marker INSTEAD of the label — silently breaks the corrective hints.
- * `correctionHint` branches on the label text (`gateway.mjs:2181` on `findings+ledger`, `:2188` on
+ * `correctionHint` in gateway.mjs branches on the label text (its `findings+ledger` arm, and the arm on
  * `negative-results|coverage-ledger|audit-trail|findings-heading`), so a renamed token would fall through
  * to a generic hint. That comment records that arm being removed once already on a reading that was
  * true for only one lane, and put back. Appending keeps every existing matcher matching — they all test
@@ -166,7 +166,7 @@ function needs(content, markers, label, names = []) {
   }
   return ok();
 }
-// ── THE STRUCTURAL SECTION CONTRACT (tracker issue 129) ────────────────────────────────────────────
+// ── THE STRUCTURAL SECTION CONTRACT ────────────────────────────────────────────────────────────────
 //
 // THE CLASS. Every gate below keys on prose the MODEL composes, so each is one phrasing drift away
 // from killing a run that produced the section perfectly. Measured across three runs and two engines:
@@ -192,7 +192,7 @@ function needs(content, markers, label, names = []) {
 // nothing else. Once seats emit anchors reliably, the fallback can be measured and retired; that is a
 // later decision needing evidence, not this change.
 //
-// The label is unchanged on purpose: `correctionHint` (gateway.mjs:2181, :2188) branches on the label
+// The label is unchanged on purpose: `correctionHint` in gateway.mjs branches on the label
 // TEXT, so renaming a token here silently downgrades the seat's corrective hint to a generic one.
 const SECTION_ANCHOR_RE = (name) =>
   new RegExp(`<!--\\s*clearotron:section\\s*=\\s*${name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*-->`, "i");
@@ -1571,7 +1571,7 @@ export const validators = {
     //
     // The frame is rendered by the driver now, from a typed `record_matter_frame` call. Two of the checks
     // below would become the driver comparing its own render against its own input — a guard that CANNOT
-    // FAIL, which reads as coverage and is worse than no guard (owner ruling, 2026-08-17). So each one is
+    // FAIL, which reads as coverage and is worse than no guard (ruling, 2026-08-17). So each one is
     // stated here, by token, with what happened to it:
     //
     //   `meaning_angles_missing`  — DELETED on the recorded path. `acceptMatterFrame` refuses a call that
@@ -1867,7 +1867,7 @@ export const validators = {
   // artifact passing, and a fresh dispatch under this code is held to the new floor. A sibling that
   // EXISTS is parsed strictly regardless of vintage (present-and-malformed is always a defect).
   placement: (p, c) => {
-    // THE LAST PROSE-KEYED GATE ON A SEAT-WRITTEN ARTIFACT (tracker issue 129).
+    // THE LAST PROSE-KEYED GATE ON A SEAT-WRITTEN ARTIFACT.
     //
     // 129 named three sites and all three had stopped being members before it was filed: conversions 5
     // and 11 moved report-cards/<ord>.md and register-findings.md to driver renders, and audit.md was

package/driver/whatif-memo-run.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// whatif-memo-run.mjs — the door onto the memo composer (tracker issue 132).
+// whatif-memo-run.mjs — the door onto the memo composer.
 //
 // WHY THIS FILE EXISTS. Everything a memo needs was already in the tree and nothing could reach it:
 // whatif-memo.mjs composes one, whatIfRefusal admits `kind: "memo"` on a finished run, decodeOp

package/driver/whatif-queue.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // whatif-queue.mjs — the RUN-LOCAL queue a client's what-if waits in.
 //
-// Owner ruling 2026-08-27 opened what-if to clients. The remote surfaces cannot run it directly and that
+// Ruling 2026-08-27 opened what-if to clients. The remote surfaces cannot run it directly and that
 // is a configuration fact rather than a policy: http-server.mjs states in its own header that they "NEVER
 // shell", and lib/whatif.mjs imports driver/pipeline.mjs LAZILY so the read-only face never loads the
 // engine at all. The only thing that runs the engine remotely is the queue, through the worker. So a
@@ -124,13 +124,13 @@ function pathFor(runDir, id, suffix) { return join(whatIfQueueDir(runDir), `${id
  */
 export function enqueueWhatIf(runDir, { op, requestedBy = null, account = null, now = Date.now() }) {
   if (!op || typeof op !== "object" || !op.runId) throw new Error("enqueueWhatIf: op must carry runId and stage");
-  // ── A MEMO CARRIES NO STAGE, AND THIS GUARD USED TO REQUIRE ONE (tracker issue 132) ──────────────
+  // ── A MEMO CARRIES NO STAGE, AND THIS GUARD USED TO REQUIRE ONE ──────────────────────────────────
   //
   // Two consecutive guards, mutually exclusive for a memo. decodeOp refuses a memo token that CARRIES
   // a stage — "a memo re-runs no stage, so a token carrying one was not planned as a memo" — and this
   // line refused one that did not. So every memo minted by whatIfPlan was admitted by whatIfEnqueue's
   // kind-aware refusal and then thrown out by the very next call, on the one non-test path there is
-  // (mcp-server/lib/whatif.mjs:202, reached from the live tool handler at server.mjs:443).
+  // (`whatIfEnqueue()` in `mcp-server/lib/whatif.mjs`, reached from the live `what_if_run` handler in `mcp-server/server.mjs`).
   //
   // WHY IT SURVIVED A FIX THAT WAS ABOUT EXACTLY THIS. The earlier repair opened whatIfRun's memo
   // branch and was proved by arms that INJECT the composer — routing coverage. A routing arm cannot

package/driver/whatif-worker.mjs

@@ -50,7 +50,7 @@ export const WHATIF_MAX_CONCURRENT = Math.max(1, Number(process.env.CLEAROTRON_W
 // list of markers kept here. This file used to carry its own list, and it included `.failed` where the
 // MCP door's copy did not — so a failed run was planned, enqueued and then refused here. See the
 // declaration for what that cost and why `failed` is now eligible.
-// ── THE MARKERS ARE KIND-INDEPENDENT; THE VERDICT IS NOT (tracker issue 132) ────────────────────────
+// ── THE MARKERS ARE KIND-INDEPENDENT; THE VERDICT IS NOT ────────────────────────────────────────────
 //
 // This used to render the verdict here, calling whatIfRefusal with NO `kind` — so it defaulted to
 // "stage" and refused every memo on a delivered run with "what-if runs on live runs only", the third
@@ -136,7 +136,7 @@ async function settleOne(entry, exec) {
     const result = await exec({ confirmationToken });
     // A memo carries no stage — it re-runs none — so the old form logged a literal "undefined" for
     // every memo the worker settled. The kind is what distinguishes the two here, and an operator
-    // reading the drain log needs to know which of them just ran (tracker issue 132).
+    // reading the drain log needs to know which of them just ran.
     const what = job.op?.kind === "memo" ? "memo" : `${job.op.stage}${job.op.axis ? `:${job.op.axis}` : ""}`;
     note(`[whatif] ${id} ${result?.ok === false ? "failed" : "done"} (${what})`);
     return finishWhatIf(runDir, id, { ok: result?.ok !== false, op: job.op, result, error: result?.ok === false ? (result.fail ?? "the experiment did not complete") : null });

package/examples/README.md

@@ -5,7 +5,7 @@ The two input files you copy. Nothing here needs a credential and nothing here c
 | Path | What it is |
 |---|---|
 | `job.euipo.json` | the whole input contract for one clearance — 14 fields, ready to copy and edit |
-| `grants.example.json` | who may read which account's runs: three tenants, three grant shapes |
+| `grants.example.json` | who may see and do what: two organisations, and one of each kind of person |
 
 ## The finished runs moved to `demo/`
 

package/examples/grants.example.json

@@ -1,40 +1,41 @@
 {
   "tenants": {
-    "the-firm": {
-      "accounts": "*",
-      "users": {
-        "principal@firm.example": "*",
-        "associate@firm.example": [
-          "demo-brand-owner"
-        ]
-      }
-    },
-    "brand-owner-direct": {
+    "demo-org": {
+      "name": "Demo Org",
       "accounts": [
         "demo-brand-owner"
       ],
       "users": {
-        "*@brand-owner.example": "*"
+        "*@demo-org.example": "*",
+        "consultant@outside.example": [
+          "demo-brand-owner"
+        ]
       }
     },
     "evaluation": {
-      "accounts": [
-        "demo-brand-owner"
-      ],
+      "name": "Evaluation",
+      "accounts": [],
       "users": {
         "reviewer@partner.example": "*",
-        "observer@partner.example": [
-          "demo-brand-owner"
-        ]
+        "observer@partner.example": "*"
       }
+    }
+  },
+  "people": {
+    "you@install.example": {
+      "run": true,
+      "manage": true,
+      "everything": true
     },
-    "demo-org": {
-      "accounts": [
-        "demo-brand-owner"
-      ],
-      "users": {
-        "*@demo-org.example": "*"
-      }
+    "*@demo-org.example": {
+      "run": true
+    },
+    "consultant@outside.example": {
+      "run": true
+    },
+    "reviewer@partner.example": {
+      "run": true,
+      "manage": true
     }
   }
 }

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,15 @@
 # trademark-artifacts-mcp
 
+## 0.3.0-beta.1
+
+### Patch Changes
+
+- b8ec213: Fixed: a company you create in the browser now appears in your assistant's list of companies straight away.
+  
+  It used to appear only after the service restarted, although a search could already be started for it. Its projects were missing from the list in the same way, and so was its account in the search options.
+  
+  The live surface check no longer reports a company outside the portal's trigger key as the service and the store disagreeing. It names the key's gap on a line of its own, with the command to widen the key.
+
 ## 0.2.4
 
 ## 0.2.3