clearotron 0.2.4 → 0.3.0-beta.1

package/mcp-server/http-server.mjs

@@ -27,7 +27,7 @@ import { envFileRead } from "../shared/env-local.mjs";   // side effect: apply t
 import { envFrom } from "../shared/env-aliases.mjs";   // — a refusal names the name in force
 import { accessAudience, audienceLabel } from "../shared/access-audience.mjs";   // — F54; jose-free on purpose
 import { doorPostureVerdict } from "./door-posture.mjs";   // — say when this door's mode came from another door's variables
-// The local key door (tracker issue 174): a second listener on a unix socket, so a scoped access key has
+// The local key door: a second listener on a unix socket, so a scoped access key has
 // a path that no tunnel can forward to and the TCP door never learns about keys.
 import { keyDoorRefusal, openKeyDoor, KEY_SOCKET_MODE } from "./key-socket.mjs";
 import { demoPostureLine } from "../driver/demo-posture.mjs";   // — the two mis-aimed warnings answer from one place
@@ -221,7 +221,7 @@ if (isMain) {
     }
   }
 
-  // ── THE KEY PATH, ON THE POSTURE SURFACE (tracker issue 174) ──────────────────────────────────────
+  // ── THE KEY PATH, ON THE POSTURE SURFACE ──────────────────────────────────────────────────────────
   //
   // An operator must be able to see that a local key path exists, and with what permissions, WITHOUT
   // reading a unit file — the acceptance asks for exactly that, and it is the same reasoning as the
@@ -318,7 +318,7 @@ if (isMain) {
     onReady: ({ port: bound }) => log(`listening on http://${HOST}:${bound}/mcp — READ-ONLY staff surface, firmDomains=[${ALLOWED_DOMAINS.join(", ")}], ${door}`),
   });
 
-  // ── THE SECOND DOOR: A LOCAL KEY PATH ON A UNIX SOCKET (tracker issue 174) ────────────────────────
+  // ── THE SECOND DOOR: A LOCAL KEY PATH ON A UNIX SOCKET ────────────────────────────────────────────
   //
   // One process, two transports, two handlers. The TCP door above is untouched and still never honours a
   // key; this one takes a scoped access key and cannot be reached from any network. A tunnel forwards to

package/mcp-server/key-socket.mjs

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // key-socket.mjs — the local key door, on a unix socket, beside the TCP door that takes a proxy identity
-// (tracker issue 174).
+//.
 //
 // ── THE PROBLEM, AND WHY THE OBVIOUS FIX IS NOT ONE ─────────────────────────────────────────────────
 //

package/mcp-server/lib/audit-view.mjs

@@ -2,7 +2,7 @@
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
 // lib/audit-view.mjs — the AUDIT CHAIN a client account may interrogate, projected.
 //
-// Owner ruling, 2026-08-27: "I don't see why we don't open it or just give it to clients. Ignore the call
+// Ruling, 2026-08-27: "I don't see why we don't open it or just give it to clients. Ignore the call
 // spend." shared/scope.mjs holds the line that ruling drew and which artifacts it opened; this file is the
 // half that decides what the four STRUCTURED reads hand over — get_run, trace, decision_timeline,
 // get_finding, and list_findings' raw block lists.
@@ -311,7 +311,7 @@ export function accountTimeline(result, { brandName = "The firm" } = {}) {
   };
 }
 
-// ---- WHAT-IF (owner ruling 2026-08-27) --------------------------------------------------------------
+// ---- WHAT-IF (ruling 2026-08-27) --------------------------------------------------------------
 //
 // The counterfactual is the second half of the same ruling, and it meets the same two seals. The PLAN
 // prints what the change would cost, drawn from the prior run's telemetry — which is precisely the model
@@ -324,7 +324,7 @@ export function accountTimeline(result, { brandName = "The firm" } = {}) {
 // those out and none is added here; this is the same cost/chain line the audit reads draw, applied to the
 // one tool that would otherwise walk straight through it.
 //
-// THE MEMO KIND ADDS THREE, AND LEAVING THEM OUT BROKE IT SILENTLY (tracker issue 132). This list is
+// THE MEMO KIND ADDS THREE, AND LEAVING THEM OUT BROKE IT SILENTLY. This list is
 // default-deny, so a plan kind whose fields nobody added here arrives stripped rather than refused. A
 // memo plan was composed correctly and reached a client missing `kind` (so it could not be told from a
 // stage plan), `assumption` (so it did not say what it was about) and `parentUntouched` (so it did not

package/mcp-server/lib/brief.mjs

@@ -13,7 +13,7 @@
 // fallback. That fallback survives — for archived runs published before report-data.json existed — and it
 // now says so in the brief instead of being indistinguishable from the real thing. The client-summary
 // branch is deleted, and with it the `**Recommendation:** …` line that only it emitted: the deliverable
-// carries prioritized facts and never advice (owner ruling 2026-07-28) — the recipient is a lawyer who
+// carries prioritized facts and never advice (ruling 2026-07-28) — the recipient is a lawyer who
 // layers advice on top. The line is gone by construction, not suppressed.
 //
 // THE PRODUCT NAME IS DERIVED, NEVER STORED AND NEVER HARDCODED. Every run used to announce itself as
@@ -135,8 +135,8 @@ export function buildBrief(run) {
         lines.push(`- **${m.name}** — ${band}.${d.url ? ` Report: ${d.url}` : ""}`);
         for (const f of (m.findings ?? [])) {
           const who = [f.name, f.owner].filter(Boolean).join(" — ");
-          // A PROMOTED REGISTER FILING SHOWS THE RATING AND THE READ THE SEARCH ACTUALLY MADE (tracker
-          // issue 274). This line used to print `net` alone, and for a register card `net` carried the
+          // A PROMOTED REGISTER FILING SHOWS THE RATING AND THE READ THE SEARCH ACTUALLY MADE. This
+          // line used to print `net` alone, and for a register card `net` carried the
           // stated "no rating of its own" — so the one hard legal right on a page was described here as
           // unrated even on runs where the assessment had written a full read of that exact filing and
           // the report was already printing it. The page and this briefing disagreed.

package/mcp-server/lib/driver.mjs

@@ -16,7 +16,7 @@ export {
 
 // The KNOCKOUT lane's own run-dir table. `paths` above is the CLEARANCE table and has no entry for any
 // file this lane writes, which is why every audit projection read a delivered knockout as a run with
-// nothing on disk (tracker issue 275). Re-exported rather than re-derived for the reason this whole file
+// nothing on disk. Re-exported rather than re-derived for the reason this whole file
 // exists: a second copy of a path table drifts, and the drift shows up as an artifact reported missing.
 export { koPaths } from "../../driver/stages-knockout.mjs";
 

package/mcp-server/lib/events.mjs

@@ -112,7 +112,7 @@ function classify(e, st, rat) {
     // was never written, or was blank — were indistinguishable on a lawyer's timeline from a genuinely
     // clean gate.
     //
-    // OWNER RULING (2026-08-18): when the screening safety-net could not actually inspect anything, the
+    // RULING (2026-08-18): when the screening safety-net could not actually inspect anything, the
     // client's progress view shows "Screening: incomplete — flagged for review". Clear wording appears
     // ONLY when the gate genuinely ran and found nothing. `CLIENT_INCOMPLETE` below is that string
     // VERBATIM and is not to be re-worded here — it is owner-approved client-visible text.

package/mcp-server/lib/http-handler.mjs

@@ -78,8 +78,8 @@ export function makeHttpHandler({ verify, limiter, opsLimiter = null, sessions,
   if (tokenOnly && verify) throw new Error("makeHttpHandler: tokenOnly is for a door with no auth proxy in front — pass verify:null");
   return async (req, res) => {
     try {
-      // THE BASE IS A CONSTANT, AND WHAT THE `Host` HEADER IS USED FOR HERE IS: NOTHING (tracker issue
-      // 1928). Only `pathname` and `searchParams` are read below, so the base exists purely so a bare
+      // THE BASE IS A CONSTANT, AND WHAT THE `Host` HEADER IS USED FOR HERE IS: NOTHING. Only
+      // `pathname` and `searchParams` are read below, so the base exists purely so a bare
       // `req.url` parses as a path. Interpolating the caller's `Host` bought a crash and no behaviour:
       // a value that is not a valid authority makes `new URL` throw, the outer catch answers 500 with a
       // stack in the log, and every bit of that happens ABOVE the `authenticate FIRST` block — so an

package/mcp-server/lib/instructions.mjs

@@ -44,7 +44,7 @@ import { fileURLToPath } from "node:url";
 const SKILLS = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "skills");
 const SKILL_DIR = Object.freeze({ client: "clearotron-client", account: "clearotron-account", ops: "clearotron-ops" });
 
-// ── A PACK MAY BE MORE THAN ONE FILE (tracker issue 148) ──────────────────────────────────────────
+// ── A PACK MAY BE MORE THAN ONE FILE ──────────────────────────────────────────────────────────────
 //
 // The ops SKILL.md tells the assistant twice that delivery "comes back to you as outbox events (see
 // COURIER.md)" — and this reader only ever opened SKILL.md, so from the assistant's side that document
@@ -105,7 +105,7 @@ function pack(audience) {
  * engineering tool set neither pack describes". That premise held while ops meant OUR agents, briefed
  * separately by the Claude Code plugin which installs the same packs as files.
  *
- * Owner ruling (2026-08-27, ruling 7): on a SELF-HOSTED install the customer IS ops. The person who owns
+ * Ruling (2026-08-27, ruling 7): on a SELF-HOSTED install the customer IS ops. The person who owns
  * the box connects over this same connector and is briefed with nothing, while
  * `skills/clearotron-ops/SKILL.md` sits shipped and undelivered — SKILL_DIR has mapped it the whole
  * time. So the premise is false for that deployment, and the exclusion went with it.

package/mcp-server/lib/knockout.mjs

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
-// lib/knockout.mjs — the KNOCKOUT lane, projected into the audit tools' own shapes (tracker issue 275).
+// lib/knockout.mjs — the KNOCKOUT lane, projected into the audit tools' own shapes.
 //
 // THE DEFECT THIS CLOSES, and it is worth stating plainly because the failure mode was a confident wrong
 // answer rather than an error. Every read-only tool whose job is to show HOW a search reached its answer

package/mcp-server/lib/ops.mjs

@@ -99,6 +99,9 @@ export function buildJob(args = {}, { scope } = {}) {
     profileKey: args.profileKey || undefined,
     // the project/engagement under the customer — its overlay rates the matter
     projectKey: args.projectKey || undefined,
+    // which organisation's Generic — `authorize` stamps it on a Generic job from the verified person, and
+    // an ops caller is trusted to route it. Dropped here, a Generic run lost the organisation it belongs to.
+    tenant: args.tenant || undefined,
     // per-run SCOPE — where the machinery points, as against the selectors above which choose WHICH
     // machinery runs. Passed through verbatim: validateJob owns the vocabulary (shape, caps, dedupe,
     // the bare-string normalization) so this door cannot drift from the CLI or the portal.
@@ -197,7 +200,7 @@ export const START_RUN_JOB_FIELDS = Object.freeze({
     // and "I said nothing" are two different searches and only a positive instruction can tell them apart.
     "geography",
     "product", "recipeKey", "nativeLanguage", "caseLaw", "searchLevel", "deliveryRoute", "parentRunId",
-    "customer", "profileKey", "projectKey", "customerUnknown",
+    "customer", "profileKey", "projectKey", "customerUnknown", "tenant",
     "upfrontInstructions", "brief", "rawRequest", "deliverableSpec", "commercialFlexibility",
     "priorUse", "campaignShape", "deadline",
     "dupOverride", "clientPrincipal", "enqueuedAt", "enqueuedVia",
@@ -208,7 +211,7 @@ export const START_RUN_JOB_FIELDS = Object.freeze({
   notCarried: Object.freeze({
     registerFixtures: "a run that reads canned register payloads instead of calling a register. This door "
       + "starts real work for staff and agents; a fixture round is composed as job files by the e2e harness, "
-      + "which writes the field directly rather than asking this tool for it (tracker issue 2038).",
+      + "which writes the field directly rather than asking this tool for it.",
     promptParts: "the requester's declaration that the prose rides as SIDECAR files. This door assembles from "
       + "structured tool input and writes no sidecars, so a job it built cannot be in that shape. Carrying it "
       + "would make the manifest claim an intake it did not use, and the manifest check would then report sidecars "
@@ -346,7 +349,7 @@ export function stopRun(args = {}, { scope } = {}) {
 
     // ── — IMMEDIATE MODE: SENTINEL FIRST, THEN THE SIGNAL ─────────────────────
     //
-    // Owner ruling, on his second encounter with the same wait: "a stop is a stop — maybe it should be
+    // Ruling, on his second encounter with the same wait: "a stop is a stop — maybe it should be
     // a 'stop immediately or at next boundary to preserve data' kind of question when you press it."
     // The boundary stop is unchanged and stays the default; this is the other half of the choice.
     //

package/mcp-server/lib/options.mjs

@@ -184,12 +184,20 @@ function accountKeyFor(args, scope) {
 function accountFor(key, { scope, now }) {
   if (!key) return null;
   let profile = null;
-  try { profile = loadProfiles().get(key) ?? null; } catch { return null; }   // unreadable roster ⇒ say nothing
+  // ON A MISS THE ROSTER IS READ AGAIN, the way start_run's check does it (driver/enqueue-schema.mjs).
+  // The cache behind `loadProfiles()` is filled once per process, so a company created in the portal
+  // after the door started was answered with no account at all. A hit costs nothing extra; a miss reads
+  // the store, and the new company's projects are then walked against that same fresh roster.
+  let fresh = null;
+  try {
+    profile = loadProfiles().get(key) ?? null;
+    if (!profile) { fresh = loadProfiles({ force: true }); profile = fresh.get(key) ?? null; }
+  } catch { return null; }   // unreadable roster ⇒ say nothing
   if (!profile || profile.key === "generic") return null;
 
   let projects = [];
   try {
-    for (const [, ov] of loadProjects()) {
+    for (const [, ov] of loadProjects(fresh ? { profiles: fresh, force: true } : {})) {
       if (ov.archived || ov.customerKey !== key) continue;
       projects.push({ key: ov.projectKey, name: ov.projectName });
     }
@@ -268,7 +276,9 @@ function allowanceFor(profile, { scope, now }) {
   // The queue dirs the runner drains — the ledger sits beside each of them (usage-ledger.mjs).
   try { usage = accountUsage({ queueDirs: config.queueDirs, account: profile.key, now }); } catch { usage = null; }
   const shared = {
-    capped: scope?.kind === "account",
+    // Capped means the daily allowance binds this session: an account session, except a person with
+    // access to everything, whose jobs are never stamped for the cap (shared/scope.mjs authorize).
+    capped: scope?.kind === "account" && scope?.everything !== true,
     dailyRuns,
     monthlyRuns: caps?.monthlyRuns ?? null,
     maxQueued: caps?.maxQueued ?? null,
@@ -311,7 +321,8 @@ export function describeOptions(args = {}, { scope, now = Date.now() } = {}) {
   const accountsGranted = !account && Array.isArray(granted) && granted.length
     ? granted.map((k) => {
       let name = null;
-      try { name = loadProfiles().get(k)?.name ?? null; } catch { /* roster unreadable ⇒ the key alone */ }
+      // a miss re-reads the store, as accountFor does — a company granted since the door started has a name
+      try { name = (loadProfiles().get(k) ?? loadProfiles({ force: true }).get(k))?.name ?? null; } catch { /* roster unreadable ⇒ the key alone */ }
       return { profileKey: k, name };
     })
     : null;

package/mcp-server/lib/plan.mjs

@@ -122,10 +122,11 @@ function allowanceFor(profile, { scope, now = Date.now() } = {}) {
     dailyRunsEffective: dailyRuns,
     monthlyRuns: caps?.monthlyRuns ?? null,
     maxQueued: caps?.maxQueued ?? null,
-    // Only a CLIENT principal is capped — the same positive-only rule the runner applies (checkRunCaps
-    // bites jobs stamped clientPrincipal:true, and only the account door stamps them). Staff previewing
-    // for this customer see the counts and are not blocked by them.
-    capped: scope?.kind === "account",
+    // Only a session whose jobs are stamped for the cap is capped — the same positive-only rule the runner
+    // applies (checkRunCaps bites jobs stamped clientPrincipal:true, and the account door stamps every job
+    // except a person's with access to everything). Anyone else previewing sees the counts and is not
+    // blocked by them.
+    capped: scope?.kind === "account" && scope?.everything !== true,
   };
   if (!usage?.complete) {
     return { ...shared, complete: false, today: null, thisMonth: null, queued: null, exhausted: false };
@@ -136,7 +137,7 @@ function allowanceFor(profile, { scope, now = Date.now() } = {}) {
     ...shared,
     complete: true,
     today: usage.today, thisMonth: usage.thisMonth, queued: usage.queued,
-    exhausted: scope?.kind === "account" && usage.today >= dailyRuns,
+    exhausted: scope?.kind === "account" && scope?.everything !== true && usage.today >= dailyRuns,
   };
 }
 
@@ -289,7 +290,7 @@ export function planRun(args = {}, { scope, now = Date.now() } = {}) {
   // ── — AND WHAT THE REGISTER CANNOT REACH, on the door that commits ──────
   //
   // The same argument the coverage arm above makes, one rung further along. A worldwide search is
-  // ORDERABLE on a partial register now (owner ruling 2026-08-31), so it stops being a blocker and
+  // ORDERABLE on a partial register now (ruling 2026-08-31), so it stops being a blocker and
   // becomes something a requester has to be TOLD before they confirm. The portal says it twice — at
   // the point of choosing and again in the review step — and `describe_options` says it on the menu.
   // Without it here, an assistant can walk a client through the one door that spends and never

package/mcp-server/lib/runs.mjs

@@ -190,3 +190,13 @@ export function runAccountKey(run) {
     return p.profileKey ?? p.key ?? null;
   } catch { return null; }
 }
+
+// A Generic run's organisation, from the same frozen sidecar. Null for a company's run, for one filed
+// before organisations existed, and for an unreadable sidecar — each of which the account gate treats as
+// visible only to a full-grant session.
+export function runOrganisation(run) {
+  try {
+    const p = JSON.parse(readFileSync(driverDir(run.runDir, "profile.json"), "utf8"));
+    return typeof p.organisation === "string" && p.organisation ? p.organisation : null;
+  } catch { return null; }
+}

package/mcp-server/lib/whatif.mjs

@@ -80,7 +80,7 @@ function completeness(stage) {
 /** whatIfPlan — pure dry-run. run = resolved Run ({runId, slug, codename, agent, runDir, P, status, location}). */
 export function whatIfPlan({ run, stage, axis = null, instructions = null, model = null, kind = "stage" }) {
   if (!run) throw new Error("whatIfPlan: run is required");
-  // ── PLANNING A MEMO (tracker issue 132) ────────────────────────────────────────────────────────
+  // ── PLANNING A MEMO ────────────────────────────────────────────────────────────────────────────
   //
   // Without this branch the memo capability is COMPOSED AND UNREACHABLE. whatif-memo.mjs composes one,
   // whatIfRefusal already admits `kind: "memo"` on a finished run, and decodeOp already validates a memo
@@ -179,7 +179,7 @@ export function decodeOp(confirmationToken, what = "whatIfRun") {
 }
 
 /**
- * whatIfEnqueue — the CLIENT path (owner ruling 2026-08-27). Queues the op for the worker instead of
+ * whatIfEnqueue — the CLIENT path (ruling 2026-08-27). Queues the op for the worker instead of
  * running it, because the remote surfaces never spawn the engine and this module's own lazy import of
  * driver/pipeline.mjs is what keeps that true. Nothing below reaches runExperiment.
  *
@@ -220,7 +220,7 @@ export async function whatIfRun({ confirmationToken } = {}, deps = {}) {
   const run = resolveRun(runId);
   if (!run) throw new Error(`whatIfRun: run "${runId}" not found.`);
 
-  // ── A MEMO IS NOT A STAGE RE-RUN, AND THIS IS THE DOOR IT WAS MISSING (tracker issue 132) ────────
+  // ── A MEMO IS NOT A STAGE RE-RUN, AND THIS IS THE DOOR IT WAS MISSING ────────────────────────────
   //
   // Every piece of the memo capability existed and nothing reached it. whatIfPlan mints the token,
   // decodeOp validates it on its own terms, whatIfEnqueue queues it and answers the client
@@ -230,7 +230,7 @@ export async function whatIfRun({ confirmationToken } = {}, deps = {}) {
   //   1. askArchivedRun (driver/whatif-memo-run.mjs, 323 lines with its own arms) was imported by
   //      nothing but its own test. Composed and completely unreachable.
   //   2. The refusal below was called WITHOUT `kind`, so it defaulted to "stage" and refused every
-  //      memo with "what-if runs on live runs only" — the exact sentence tracker issue 132 was filed
+  //      memo with "what-if runs on live runs only" — the exact sentence the fix was written
   //      to delete. whatIfEnqueue passes the kind (see its own note); this door did not.
   //
   // So a memo was accepted at the front door, PROMISED to the client, and killed in the worker where
@@ -273,7 +273,7 @@ export async function whatIfRun({ confirmationToken } = {}, deps = {}) {
   if (deriveSlug(job) !== run.slug)
     throw new Error(`whatIfRun: cannot reconstruct the job for ${runId} (derived slug "${deriveSlug(job)}" != "${run.slug}"). status.json lacks the original ref/markName.`);
 
-  // ── THE RATING AUTHORITY TRAVELS WITH THE JOB (tracker issue 135) ──────────────────────────────
+  // ── THE RATING AUTHORITY TRAVELS WITH THE JOB ──────────────────────────────────────────────────
   //
   // The reconstruction above carries six fields and resolveProfile keys on none of them. It reads
   // `job.profileKey` first, then falls back to `job.forwarderDomain`; the job has `forwarder` but not

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.2.4",
+  "version": "0.3.0-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/packs/README.md

@@ -7,7 +7,7 @@ the per-host connection recipes, and worked example prompts. Three audiences, th
 | Pack | Audience | Surface | Token |
 |---|---|---|---|
 | `client/` | report recipients (client legal teams) | plain-language read layer: `brief`, `list_findings`, `read_artifact` (the report — the only artifact a report link may read), one run | the run-scoped link embedded in their report ("Ask your AI") |
-| `account/` | a customer's own assistant, across all of that customer's searches | the client layer, the evidence reads (`list_evidence`, `list_searches`, `get_search_coverage`), the audit chain (`read_artifact` over the chain artifacts, `list_findings` raw, `get_finding`, `get_run`, `trace`, `decision_timeline` — owner ruling 2026-08-27), what-if as a QUEUED sandbox job (`what_if_plan`, `what_if_run`, `what_if_result`) and their own run lifecycle (`describe_options`, `plan_run`, `start_run`, `stop_run`) | their sign-in on the client surface, or an account API key (`mint-token.mjs --scope account`) — both refused unless that surface is started with `CLIENT_MCP_ACCOUNT_ACCESS=1` |
+| `account/` | a customer's own assistant, across all of that customer's searches | the client layer, the evidence reads (`list_evidence`, `list_searches`, `get_search_coverage`), the audit chain (`read_artifact` over the chain artifacts, `list_findings` raw, `get_finding`, `get_run`, `trace`, `decision_timeline` — ruling 2026-08-27), what-if as a QUEUED sandbox job (`what_if_plan`, `what_if_run`, `what_if_result`) and their own run lifecycle (`describe_options`, `plan_run`, `start_run`, `stop_run`) | their sign-in on the client surface, or an account API key (`mint-token.mjs --scope account`) — both refused unless that surface is started with `CLIENT_MCP_ACCOUNT_ACCESS=1` |
 | `ops/` | integrator/operator agents that run searches and courier deliveries | `start_run` / `feed_context` / `stop_run`, the outbox courier verbs, triage reads | a verb-scoped ops token (`mint-token.mjs`, docs/architecture/06-operations-runbook.md) |
 
 ## Where the prompt text lives

package/mcp-server/remote/client-mcp-apikey.service

@@ -51,7 +51,7 @@ RestartSec=10
 # Hardening: this process only reads run-dirs + serves HTTP on loopback (mirrors client-mcp.service).
 NoNewPrivileges=true
 ProtectSystem=strict
-# tracker issue 774 — the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
+# the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
 # by existence (providers/_shared/ledger-path.mjs, mcp-server/lib/audit.mjs): a box that already has
 # a ledger or an access log under the old path keeps appending to it and needs it writable, while a
 # fresh box writes to the new one. `-` on both so a missing directory does not fail the unit to

package/mcp-server/remote/client-mcp.service

@@ -30,7 +30,7 @@ Environment=CLIENT_MCP_HTTP_HOST=127.0.0.1
 # to avoid a port collision. The CF Tunnel route for clients-mcp.example.com must point at this port.
 #
 # ── AND ON A BOX THAT ALSO RUNS A TEST OR DEV INSTANCE, THE SECOND INSTANCE MUST NOT TAKE THIS. ────
-# Measured 2026-08-18 (tracker issue 1147): the deployment box had 18811 and 18812 held by production client faces
+# Measured 2026-08-18: the deployment box had 18811 and 18812 held by production client faces
 # and no client face for the test instance at all. `http-server-client.mjs` DEFAULTS to 18811, so a
 # second instance started without an explicit port does not merely collide — on a day production is
 # down it SUCCEEDS, binds the port production is about to want, and a CLIENT surface ends up pointed at
@@ -59,7 +59,7 @@ RestartSec=10
 # Hardening: this process only reads run-dirs + serves HTTP on loopback (mirrors trademark-artifacts-http).
 NoNewPrivileges=true
 ProtectSystem=strict
-# tracker issue 774 — the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
+# the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
 # by existence (providers/_shared/ledger-path.mjs, mcp-server/lib/audit.mjs): a box that already has
 # a ledger or an access log under the old path keeps appending to it and needs it writable, while a
 # fresh box writes to the new one. `-` on both so a missing directory does not fail the unit to

package/mcp-server/remote/trademark-artifacts-http.service

@@ -34,7 +34,7 @@ RestartSec=10
 # Hardening: this process only reads run-dirs + serves HTTP on loopback.
 NoNewPrivileges=true
 ProtectSystem=strict
-# tracker issue 774 — the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
+# the telemetry default moved to %h/trademark/telemetry. BOTH are listed because resolution is
 # by existence (providers/_shared/ledger-path.mjs, mcp-server/lib/audit.mjs): a box that already has
 # a ledger or an access log under the old path keeps appending to it and needs it writable, while a
 # fresh box writes to the new one. `-` on both so a missing directory does not fail the unit to

package/mcp-server/server.mjs

@@ -30,7 +30,7 @@ import { join, basename } from "node:path";
 import { driverDir } from "../shared/driver-dir.mjs";   //
 import { fileURLToPath } from "node:url";
 
-import { enumerateRuns, resolveRun, runAccountKey } from "./lib/runs.mjs";
+import { enumerateRuns, resolveRun, runAccountKey, runOrganisation } from "./lib/runs.mjs";
 import { ORDERABLE_PRODUCTS } from "../driver/search-policy.mjs";
 import { PRODUCTS } from "../driver/products.mjs";
 
@@ -48,7 +48,7 @@ import { readEvents, projectTimeline } from "./lib/events.mjs";
 import { tokenize, scoreLine } from "./lib/lexsearch.mjs";
 import { artifactToStage, listArtifactVersions, assertDiffRefsSafe } from "./lib/artifacts.mjs";
 import { authorize, visibleTools, USER_ARTIFACTS, ACCOUNT_ARTIFACTS, accountMayReadArtifact, assertAccountAccess, accountVisible, TOOL_SCOPES, readOnlyFor } from "./lib/scope.mjs";
-// The AUDIT-CHAIN projections (owner ruling 2026-08-27). Imported eagerly: it pulls only scrub.mjs, which
+// The AUDIT-CHAIN projections (ruling 2026-08-27). Imported eagerly: it pulls only scrub.mjs, which
 // this file already loads, so there is nothing here for a lazy import to save.
 import { accountRun, accountTrace, accountTimeline, accountFinding, accountFindingList,
   accountWhatIfPlan, accountWhatIfQueued, accountWhatIfResult, CLIENT_FAILURE_NOTE as clientFailureNote } from "./lib/audit-view.mjs";
@@ -56,7 +56,7 @@ import { scrubMarkdown, scrubBody, scrubFrontMatter, scrubCards } from "./lib/sc
 import { evidenceRecords, searchLog, coverageStatement } from "./lib/evidence.mjs";
 // The knockout lane's projections. Every audit tool below branches on `isKnockoutRun` because the
 // clearance projections read artifacts this product does not write, and returned empty rather than saying
-// so (tracker issue 275).
+// so.
 import {
   isKnockoutRun, knockoutDoc, knockoutArtifacts, knockoutArtifactPath, knockoutFindings,
   knockoutEvidence, knockoutSearches, knockoutCoverage, traceKnockout, notProducedOnThisProduct,
@@ -89,7 +89,7 @@ function mustRun(runId) {
 function artifactPath(run, name) {
   const { P, runDir } = run;
   if (name === "status.json") return join(runDir, "status.json");
-  // THE KNOCKOUT TABLE IS TERMINAL ON A KNOCKOUT, and both halves of that matter (tracker issue 275).
+  // THE KNOCKOUT TABLE IS TERMINAL ON A KNOCKOUT, and both halves of that matter.
   //
   // Resolving FIRST is what fixes `report`: a knockout's report.md is written to the POOL and never into
   // the run dir, so the clearance table returned the run dir's own `report` slot — a path that does not
@@ -214,9 +214,25 @@ const tools = {
     // Each customer carries its PROJECTS (engagements) so intake can resolve a projectKey too. A bad
     // project file must never blank the whole roster, so the project read is best-effort (its own loud failure
     // surfaces at run time via loadProjects in the driver).
+    //
+    // READ FRESH ON EVERY CALL. `loadProfiles()` and `loadProjects()` answer from module caches with no
+    // expiry, filled by this process's first read — the boot line's — so a company or project created in
+    // the portal after the door started was missing here until the door restarted, while start_run, which
+    // re-reads on a miss (driver/enqueue-schema.mjs), already accepted it. This is the list an assistant
+    // resolves a customer against: a company it cannot see is a company it cannot pick. One read of the
+    // roster, handed to the project walk, so the two cannot come from different moments.
+    //
+    // A COMPANY FILE THAT CANNOT BE READ must not take every other company off this list. Re-reading made
+    // that possible: a bad file added after the door started used to go unread, because the door answered
+    // from its boot read, and now it would fail every call until fixed. So a failed re-read keeps the
+    // roster this process last read, and the reply says so. With no earlier read there is nothing to keep,
+    // and the call fails as it always did.
+    let roster, storeError = null;
+    try { roster = loadProfiles({ force: true }); }
+    catch (e) { storeError = String(e?.message ?? e); roster = loadProfiles(); }
     let byCustomer = new Map();
     try {
-      for (const [fq, ov] of loadProjects()) {
+      for (const [fq, ov] of loadProjects({ profiles: roster, force: true })) {
         // An ARCHIVED project is not offered for new work: this list is what the intake AI resolves a
         // projectKey against, so a name it cannot see is a name it cannot pick. Already-queued and
         // finished runs are untouched — a run freezes its effective profile at admission.
@@ -226,7 +242,7 @@ const tools = {
         byCustomer.set(ov.customerKey, list);
       }
     } catch { byCustomer = new Map(); }
-    const clients = [...loadProfiles().values()]
+    const clients = [...roster.values()]
       .filter((p) => p.key !== "generic")
       .map((p) => ({ key: p.key, name: p.name, industry: p.industry ?? null,
         projects: (byCustomer.get(p.key) ?? []).sort((a, b) => a.key.localeCompare(b.key)) }))
@@ -235,6 +251,9 @@ const tools = {
       _note: "Customer roster for intake resolution. Resolve by JUDGMENT — an explicit name, a misspelling of one of the keys below, or an implicit reference (\"our functional-beverage client\") all map to a key. Set the job's profileKey to the chosen customer key; OMIT it for a new/unknown customer (⇒ the neutral generic profile). If the request names a specific PROJECT/engagement under that customer (listed in `projects[]`), also set projectKey to that project's key; OMIT projectKey when no project is meant (⇒ the customer profile). CLARIFY if you cannot tell either. Never pick a profile from the sender's email domain.",
       clients,
       genericFallback: "generic",
+      // Staff-only tool (TOOL_SCOPES), so the reason may name the file: no client door sees this reply.
+      ...(storeError ? { storeUnreadable: `The company store could not be re-read (${storeError}). This is the list as `
+        + "last read, so a company added or changed since may be missing until that file is fixed." } : {}),
     };
   },
   async describe_options(args, extra) {
@@ -482,7 +501,7 @@ const tools = {
     const run = mustRun(runId);
     const { whatIfPlan } = await import("./lib/whatif.mjs");
     // `kind` DEFAULTS TO "stage", so every existing caller is unchanged. A memo is the other kind
-    // (tracker issue 132): a bounded re-read of a DELIVERED run's archived evidence under a stated
+    //: a bounded re-read of a DELIVERED run's archived evidence under a stated
     // assumption, which re-runs no stage and therefore cannot carry one.
     const asked = kind === "memo" ? "memo" : "stage";
     // A STAGE PLAN WITH NO STAGE IS A REFUSAL, NOT A THROW. `stage` cannot be schema-required any more:
@@ -575,7 +594,7 @@ const TOOL_DEFS = [
   { name: "plan_run", description: "FREE PREVIEW — resolve what a search WOULD do and return it, spending nothing and queueing nothing. Takes the SAME arguments as start_run. Use this BEFORE start_run whenever the requester has not already confirmed the specifics: it reports the PRODUCT that resolves and WHERE it came from (their request, the account default, a saved search, or the territories themselves), the territories and marketplaces that would ACTUALLY be searched, the turnaround, and any blockers as questions to put back. Show the result to the requester; then call start_run with the SAME arguments to actually run it. Nothing here reserves or holds anything.", inputSchema: { type: "object", properties: { markName: { type: "string", description: "The mark (single-mark form). REQUIRED unless marks[] is given." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] } }, classes: { type: "array", items: { type: "number" } }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" } }, platforms: { type: "array", items: { type: "string" } }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles). REQUIRED for an accounts-scoped session (your grant names the keys — see describe_options)." }, projectKey: { type: "string" }, forwarder: { type: "string", description: "Requester/reply-routing key — same as start_run, so the preview describes the job that would actually be built. Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string" }, upfrontInstructions: { type: "string" }, deadline: { type: "string" }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op) — so the preview BLOCKS it here rather than describing a job start_run could not run." }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, customerUnknown: { type: "boolean" } }, required: ["forwarder"] } },
   // ---- OPS write-face (requires an ops token; never exposed to a user/internal session) ----
   { name: "start_run", description: "OPS-ONLY. Enqueue a NEW clearance/search run the driver will pick up. Provide markName (or marks[] for a batch) + forwarder (and ideally classes/goods/customer/profileKey/ref). Returns the queue id + slug; the runId/codename is assigned when the runner claims it — poll list_runs (by markName) or run_changes for progress. Spends real money once it runs.", inputSchema: { type: "object", properties: { agent: { type: "string", description: "Which agent workspace's queue. Omit for the deployment default (CLEAROTRON_QUEUE_DIR or the default agent's queue — docs/INTAKE.md)." }, markName: { type: "string", description: "The mark (single-mark form). Required unless marks[] is provided." }, marks: { type: "array", items: { type: "object", properties: { name: { type: "string" }, classes: { type: "array", items: { type: "number" } }, ref: { type: "string" } }, required: ["name"] }, description: "Batch form: EVERY name of the batch in ONE job. Only a knockout-search reads more than one name at a time; a clearance reads one, and more is refused rather than truncated." }, classes: { type: "array", items: { type: "number" }, description: "Nice classes — whole numbers 1–45 (1–34 goods, 35–45 services). classes OR goods; either suffices." }, goods: { type: "string" }, jurisdictions: { type: "array", items: { type: "string" }, description: "WHERE the search points — and, for a clearance, WHICH search it is: one country is a full-country-search, a region or two-or-more countries a multi-country-focus-search. AUTHORITATIVE (the matter frame is told not to widen past them). Omit ⇒ the project/customer default territories; send worldwide:true to search everywhere instead. Names or codes both read; max 20." }, platforms: { type: "array", items: { type: "string" }, description: "OPTIONAL per-run SCOPE: extra marketplaces to sweep, as bare store domains e.g. [\"gnc.com\"]. ADDED to the account's own marketplaces — additive only, never a replacement (a client's platform list is a mandate). Max 10; \"web\" is implicit and must not be listed." }, customer: { type: "string" }, profileKey: { type: "string", description: "The customer ACCOUNT key (see list_profiles) whose profile rates this run; omit for the neutral generic profile. REQUIRED for an accounts-scoped session (your grant names the keys — see describe_options)." }, forwarder: { type: "string", description: "Requester/reply-routing key — rides the delivery packet so the integrator knows who gets the report (docs/DELIVERY.md). Account sessions may omit it — it is stamped from your verified identity." }, forwarderEmail: { type: "string" }, ref: { type: "string" }, provider: { type: "string" }, brief: { type: "string" }, upfrontInstructions: { type: "string" }, projectKey: { type: "string", description: "OPTIONAL (spec 62): the PROJECT/engagement key UNDER profileKey (see that customer's projects[] in list_profiles) whose overlay rates this run; omit to run on the customer profile. An unknown key clarifies at intake." }, product: { type: "string", enum: ORDERABLE_PRODUCTS, description: PRODUCT_DESC }, nativeLanguage: { type: "boolean", description: "OPTIONAL, and only on a multi-country-focus-search: the native-language investigation. Send TRUE or omit the field — FALSE IS REFUSED, not honoured: the toggle only ever added, so there is nothing for false to switch off, and accepting it would let you believe you had removed a reading that runs anyway. It runs AUTOMATICALLY on a full-country-search and is not part of the other two, so asking for it there is refused rather than accepted and ignored. It routes on territory — the scope must name one it covers." }, worldwide: { type: "boolean", description: "Search EVERYWHERE, and refuse to be narrowed by the account's own default territories. This is not the same as omitting jurisdictions, which means \"whatever the account says\" — the two used to be indistinguishable on this wire, which is how a request that bought everywhere ran an account's seven countries. Never send \"Worldwide\" as a jurisdictions entry." }, recipeKey: { type: "string", description: "OPTIONAL alternative selector: a saved search (recipe) slug for this customer. Mutually exclusive with product — a saved search already carries one." }, deliveryRoute: { type: "string", enum: ["email", "portal"], description: "OPTIONAL: how the delivered packet leaves — email (default). \"portal\" is reserved for the portal delivery lane and CLARIFIES at admission until it ships (never a silent no-op)." }, parentRunId: { type: "string", description: "OPTIONAL escalation lineage: the runId this run escalates from (e.g. a knockout HIGH mark → this clearotron)." }, deliverableSpec: { type: "string" }, commercialFlexibility: { type: "string" }, priorUse: { type: "string" }, campaignShape: { type: "string", description: "Campaign-shape FACTS from the request/client — how the mark will be deployed: standalone brand vs flavour/sub-brand under a NAMED house mark; seasonal/limited vs permanent; launch scale. Verbatim facts only — the engine records them on the matter frame instead of inferring a launch shape." }, deadline: { type: "string", description: "ISO-8601 — drives the deadline envelope." }, customerUnknown: { type: "boolean" }, dupOverride: { type: "boolean", description: "Requester-confirmed force-run past matter dedup." }, clientPrincipal: { type: "boolean", description: "Set by the client portal only: this run was started by a CLIENT and consumes that account's runCaps.dailyRuns allowance. Omit for staff, agent and email-door runs — absence means uncapped, and setting it can only restrict the run that carries it." }, rawRequest: { type: "string" }, forwarderDomain: { type: "string" }, msgId: { type: "string" }, conversationId: { type: "string" }, id: { type: "string" } }, required: ["forwarder"] } },
-  { name: "stop_run", description: "OPS-ONLY. Cancel a run. Pass id to remove a not-yet-claimed queued job (a real cancel, no spend). Pass runId to file a cancel request on a started run. By default the cancel is COOPERATIVE — the sentinel is written and a turn already in flight is allowed to finish, which has no deadline: a reasoning turn can run for tens of minutes. Add immediate:true to also end that turn, so the run goes terminal in seconds.", inputSchema: { type: "object", properties: { agent: { type: "string" }, id: { type: "string", description: "A queued job id (from start_run) — dequeues before the runner claims it." }, runId: { type: "string", description: "A started run's runId — files a cancel sentinel." }, immediate: { type: "boolean", description: "Stop NOW instead of at the next step boundary (tracker issue 2076). The cancel sentinel is written FIRST and then the run's own recorded engine turn is ended, in that order — the sentinel is what makes the record clean, so the terminal names the stage, the actor and the request time instead of leaving a run that reads as still running. The step in flight is lost; everything already recorded is kept. Falls back to the boundary stop, and SAYS SO in the answer, when there is no live turn to end — a run between steps, or one whose turn has already exited. Never send this expecting a guaranteed instant stop: the answer states which of the two actually happened."}, onBehalfOf: { type: "string", description: "The identifier of a human this caller has itself verified (#1378). RECORDED BESIDE the token's own principal, never instead of it — a stop by the portal for alice@x is written `portal:alice@x`, so an asserted name is never mistaken for a proved one. Bare identifiers only; anything else is dropped." } } } },
+  { name: "stop_run", description: "OPS-ONLY. Cancel a run. Pass id to remove a not-yet-claimed queued job (a real cancel, no spend). Pass runId to file a cancel request on a started run. By default the cancel is COOPERATIVE — the sentinel is written and a turn already in flight is allowed to finish, which has no deadline: a reasoning turn can run for tens of minutes. Add immediate:true to also end that turn, so the run goes terminal in seconds.", inputSchema: { type: "object", properties: { agent: { type: "string" }, id: { type: "string", description: "A queued job id (from start_run) — dequeues before the runner claims it." }, runId: { type: "string", description: "A started run's runId — files a cancel sentinel." }, immediate: { type: "boolean", description: "Stop NOW instead of at the next step boundary. The cancel sentinel is written FIRST and then the run's own recorded engine turn is ended, in that order — the sentinel is what makes the record clean, so the terminal names the stage, the actor and the request time instead of leaving a run that reads as still running. The step in flight is lost; everything already recorded is kept. Falls back to the boundary stop, and SAYS SO in the answer, when there is no live turn to end — a run between steps, or one whose turn has already exited. Never send this expecting a guaranteed instant stop: the answer states which of the two actually happened."}, onBehalfOf: { type: "string", description: "The identifier of a human this caller has itself verified (#1378). RECORDED BESIDE the token's own principal, never instead of it — a stop by the portal for alice@x is written `portal:alice@x`, so an asserted name is never mistaken for a proved one. Bare identifiers only; anything else is dropped." } } } },
   { name: "server_info", description: "The AGPL §13 source offer: this server's name, version, licence, source repository and the COMMIT IT IS RUNNING. Callable by every session kind — the offer is owed to whoever interacts with the service. Reads no run and no account data.", inputSchema: { type: "object", properties: {} } },
   { name: "list_outbox_events", description: "Integrator discovery read (docs/DELIVERY.md): every pending outbox event — delivered markers plus the self-contained run-failed / intake-rejected / duplicate-skipped / late-bind-ack packets. Route each, then mark_sent (delivered) or ack_event (the rest).", inputSchema: { type: "object", properties: {} } },
   { name: "get_delivery_packet", description: "The run's send payload: _driver/delivery.json (subject, recipient routing, verbatim emailBodyHtml, whatsapp line) and/or failure.json, plus sendPending/.sent state. NOT exposed to client tokens.", inputSchema: { type: "object", properties: { runId: { type: "string" } }, required: ["runId"] } },
@@ -712,7 +731,7 @@ export function describeForAudience(def, kind) {
 }
 
 /**
- * Attach MCP tool annotations — tracker issue 148.
+ * Attach MCP tool annotations.
  *
  * No tool declared any, so a client could not tell `brief` from `start_run` and asked before every
  * call. `readOnlyHint` is DERIVED from the scope table's `write` flag (`readOnlyFor`) rather than
@@ -757,7 +776,7 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
     if (Array.isArray(scope?.accounts) && authedArgs?.runId != null) {
       try {
         const run = resolveRun(String(authedArgs.runId));
-        if (run) assertAccountAccess(scope, runAccountKey(run), `run "${authedArgs.runId}"`);
+        if (run) assertAccountAccess(scope, runAccountKey(run), `run "${authedArgs.runId}"`, runOrganisation(run));
       } catch (e) {
         log(`account deny ${name} [${scope.sub ?? scope.kind}]: ${e.message}`);
         return { isError: true, content: [{ type: "text", text: `FORBIDDEN (${name}): ${e.message}` }] };
@@ -789,13 +808,13 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
     const runs = scope.kind === "user"
       ? (() => { const r = scope.runId && resolveRun(scope.runId); return r ? [r] : []; })()
       : enumerateRuns()
-          .filter((r) => !Array.isArray(scope?.accounts) || accountVisible(scope, runAccountKey(r)))
+          .filter((r) => !Array.isArray(scope?.accounts) || accountVisible(scope, runAccountKey(r), runOrganisation(r)))
           .slice(0, 8).map((r) => ({ ...r, P: paths(r.runDir) }));
     // A user (report-link) token sees ONLY the report (one report — never a second version by another
     // name), never the internal KEY_ARTIFACTS (narrative/audit/run.jsonl/…) — the same gate authorize()
     // puts on read_artifact.
     //
-    // AND THE TWO CLIENT KINDS NO LONGER AGREE (owner ruling 2026-08-27). They did while both read only
+    // AND THE TWO CLIENT KINDS NO LONGER AGREE (ruling 2026-08-27). They did while both read only
     // the report; the account layer now reads the audit chain and the report link still does not. This
     // is keyed on the KIND rather than on CLIENT_KINDS for exactly that reason — leaving it collapsed
     // would have made the tool surface serve an account the audit chain while this door went on sealing
@@ -830,7 +849,7 @@ export function attachHandlers(server, { scope = { kind: "ops", runId: null }, l
       throw new Error("forbidden: a client may only read the report");
     const run = resolveRun(reqRunId);
     if (!run) throw new Error(`run not found: ${m[1]}`);
-    if (Array.isArray(scope?.accounts)) assertAccountAccess(scope, runAccountKey(run), `run "${reqRunId}"`);
+    if (Array.isArray(scope?.accounts)) assertAccountAccess(scope, runAccountKey(run), `run "${reqRunId}"`, runOrganisation(run));
     const path = artifactPath(run, reqArtifact);
     if (!path || !existsSync(path)) throw new Error(`artifact not found: ${m[2]}`);
     // CLIENT VIEW ( R1): the Resources surface is a second door to the same bytes — it applies the
@@ -875,7 +894,7 @@ export function presentForPrincipal(scope, name, result) {
   const declared = TOOL_SCOPES[name]?.present ?? null;
   if (declared === null) throw new UndeclaredPresentation(name);
 
-  // `project` — THE AUDIT CHAIN (owner ruling 2026-08-27). lib/audit-view.mjs holds the allowlist over
+  // `project` — THE AUDIT CHAIN (ruling 2026-08-27). lib/audit-view.mjs holds the allowlist over
   // each result's structure and the prose transform; nothing about what travels is decided here.
   //
   // The four tools are accountSafe and NOT clientSafe, so a `user` (report-link) token never reaches this
@@ -949,32 +968,27 @@ export function filterByAccounts(scope, name, result) {
   // one status-scan per call builds runId → account for the array filters
   const accountOf = () => {
     const map = new Map();
-    for (const r of enumerateRuns()) map.set(r.runId, runAccountKey(r));
+    for (const r of enumerateRuns()) map.set(r.runId, { account: runAccountKey(r), organisation: runOrganisation(r) });
     return map;
   };
+  const seen = (map, id) => { const o = id != null ? map.get(id) : null; return o != null && accountVisible(scope, o.account, o.organisation); };
   if (name === "list_profiles" && result && Array.isArray(result.clients))
     return { ...result, clients: result.clients.filter((c) => scope.accounts.includes(c.key)) };
   if ((name === "list_runs" || name === "search_runs") && Array.isArray(result)) {
     const map = accountOf();
-    return result.filter((r) => {
-      const id = r.runId ?? r.id ?? null;
-      return id != null && accountVisible(scope, map.get(id) ?? null);
-    });
+    return result.filter((r) => seen(map, r.runId ?? r.id ?? null));
   }
   // search_runs answers an OBJECT ({query, mode, scope, runsScanned, hits, truncated}) — the array
   // guard above never matched it, so scoped sessions saw EVERY hit — a real cross-account content
   // leak. Filter the hits by their run's account like the array shapes.
   if (name === "search_runs" && result && Array.isArray(result.hits)) {
     const map = accountOf();
-    const hits = result.hits.filter((h) => {
-      const id = h.runId ?? h.id ?? null;
-      return id != null && accountVisible(scope, map.get(id) ?? null);
-    });
+    const hits = result.hits.filter((h) => seen(map, h.runId ?? h.id ?? null));
     return { ...result, hits, ...(typeof result.count === "number" ? { count: hits.length } : {}) };
   }
   if (name === "list_outbox_events" && result && Array.isArray(result.events)) {
     const map = accountOf();
-    const events = result.events.filter((ev) => ev.runId != null && accountVisible(scope, map.get(ev.runId) ?? null));
+    const events = result.events.filter((ev) => seen(map, ev.runId ?? null));
     return { ...result, events, count: events.length };
   }
   return result;