clearotron 0.2.4 → 0.3.0-beta.1

package/portal-ui/dist/assets/{index-1ziUJX1E.css → index-KpytsmNH.css}

@@ -188,7 +188,7 @@ html.anon-on [data-anon='mark']:not(.anon-clear) {
   max-width: var(--screen-measure);
 }
 
-/* ── THE WIDTH VOCABULARY (tracker issue 2086) ────────────────────────────────────────────────────
+/* ── THE WIDTH VOCABULARY ─────────────────────────────────────────────────────────────────────────
    Owner, on his own screens: "we INCONSISTENTLY use screen width … consistency is important."
    Measured: seventeen inline maxWidth literals across seven screens, in nine different values — each
    its author's guess. Width is now a zone-type decision made HERE, once:
@@ -437,7 +437,7 @@ table.data td {
   vertical-align: top;
 }
 
-/* tracker issue 276 — THE GRID IS DECLARED, NOT EMERGENT.
+/* THE GRID IS DECLARED, NOT EMERGENT.
    Without `table-layout: fixed` a table's columns are sized by their content, so every cell in every row
    is a vote on where the columns sit. That is why opening a row on Clearances could re-flow the parent
    table and truncate the `Updated` header to `Upd`, and why the alignment of an expanded read was
@@ -449,7 +449,7 @@ table.data.fixed {
   table-layout: fixed;
 }
 
-/* tracker issue 280 — THE FIXED TABLE HAS NO FLOOR OF ITS OWN.
+/* THE FIXED TABLE HAS NO FLOOR OF ITS OWN.
    `table.data` sets `min-width: 760px` so a content-sized table cannot collapse into unreadable slivers.
    Under fixed layout that floor is not a safety net, it is the thing that overflows: the columns are
    already declared as percentages of the container, so the table has a shape at any width, and a floor
@@ -460,7 +460,7 @@ table.data.fixed {
   min-width: 0;
 }
 
-/* tracker issue 280 — THE HEADER MUST BE ALLOWED TO WRAP, or the font decides whether the table scrolls.
+/* THE HEADER MUST BE ALLOWED TO WRAP, or the font decides whether the table scrolls.
    `table.data th` sets `white-space: nowrap`, which is right for a content-sized table and wrong here:
    under fixed layout the cells can shrink (overflow-wrap: anywhere) but the header cannot, so the
    letterspaced caps alone set an unshrinkable floor. When the brand webfont is unavailable — no network,
@@ -509,7 +509,7 @@ table.data tr.read-row > td {
   background: var(--surface-sunken);
 }
 
-/* tracker issue 278 — the whole read row opens its report.
+/* the whole read row opens its report.
    The affordance is on the thing you can click, across the WHOLE row, which is the point: the only way
    in used to be a text button at the far right edge, furthest from the run title the reader has just
    read, on a row with `cursor: auto` and no hover state at all. People concluded there was no report.
@@ -548,7 +548,7 @@ table.data tr.row {
   cursor: pointer;
 }
 
-/* tracker issue 284 — the row disclosure is a real button.
+/* the row disclosure is a real button.
    It was a bare span with aria-hidden, inside a <tr onClick>: silent to a screen reader AND with no
    keyboard path to open a row at all. The button carries the name and the state; these rules make it
    look exactly as the span did, so the fix is behavioural rather than visual.
@@ -577,7 +577,7 @@ button.twisty:focus-visible {
   outline-offset: 1px;
 }
 
-/* tracker issue 281 — the grouping toggle. In the toolbar, beside the other view controls, so its state is visible
+/* the grouping toggle. In the toolbar, beside the other view controls, so its state is visible
    WITHOUT opening a menu: a toggle whose state you have to go looking for is a toggle that explains
    nothing about why the sort looked wrong. */
 .group-toggle {
@@ -595,7 +595,7 @@ table.data tr.row:hover td {
   background: var(--surface-sunken);
 }
 
-/* tracker issue 277 — A SECTION HEADER, not a decorative divider.
+/* A SECTION HEADER, not a decorative divider.
    Brand owner is the organising principle of the whole list, and a reader had to work it out: the name
    was set in the smallest, lowest-contrast, most letterspaced type on the page, which reads as a rule
    BETWEEN rows rather than as "everything below this belongs to Foxglade Interactive".
@@ -747,7 +747,7 @@ table.data tr.group-head ~ tr.row > td:first-child {
   border-left-color: var(--border-strong);
 }
 
-/* tracker issue 282 — A TRANSIENT SURFACE, which this codebase did not have one of.
+/* A TRANSIENT SURFACE, which this codebase did not have one of.
    The selection bar used `.notice`. That treatment is not a one-off: it is what the error and empty
    states on the same screen use — which is exactly why it was wrong here. A notice is a persistent
    thing you READ; a selection bar is a transient thing you ACT on, and it appears and vanishes as you
@@ -773,7 +773,7 @@ table.data tr.group-head ~ tr.row > td:first-child {
   box-shadow: 0 8px 28px rgba(0, 0, 0, 0.18);
 }
 
-/* tracker issue 282 — THE CHECKBOX, in the palette, in every state.
+/* THE CHECKBOX, in the palette, in every state.
    It rendered in the browser default blue: the only blue on an otherwise warm and maroon page, and the
    single clearest sign that a control had been dropped in and never dressed.
    `accent-color` handles unchecked and checked in one property. Focus and disabled are separate because
@@ -965,11 +965,11 @@ input.filter {
   font-style: italic;
 }
 
-/* tracker issue 2061 — three labelled rungs where there used to be one line. The requirement is that a
+/* three labelled rungs where there used to be one line. The requirement is that a
    reader can tell the legal read from the consequences AT A GLANCE, so the label is its own strong
    column rather than a lead-in sentence: three sentences run together in the old single-line cell would
    be more text and no more legible, which is the failure this replaces. */
-/* ONE grid for ALL rungs, not one per row (tracker issue 2085): each row being its own grid sized
+/* ONE grid for ALL rungs, not one per row: each row being its own grid sized
    its label column with max-content PER ROW, so the text column started at a different x on every
    line and a long qualifier ("(one or more)") deformed its own row's grid — the owner's screenshot.
    The rows become display:contents so every label shares a single column, sized to the longest label
@@ -998,7 +998,7 @@ input.filter {
 }
 
 .footer-demo-note {
-  max-width: 420px;   /* tracker issue 2086 — the note's width is the note's own, not its call site's */
+  max-width: 420px;   /* the note's width is the note's own, not its call site's */
 }
 
 /* The line beside the primary action: what happens next when it is available, and why it is not when
@@ -1168,7 +1168,7 @@ input.filter {
   max-height: 230px;
 }
 
-/* ── Refs tracker issue 2075 — a territory the wired register does not reach ────────────────────────
+/* ── a territory the wired register does not reach ────────────────────────
    Shown and selectable, never absent: an absent entry teaches a reader nothing, because they cannot
    tell an unsupported territory from one they mistyped. The marker is a statement, not a warning — the
    choice is legitimate and the report discloses it. */
@@ -1257,6 +1257,18 @@ input.filter {
   line-height: 1.5;
 }
 
+/* The house account, in the pick panel: first in the list and marked as the one you can always run
+   under. The wash rather than a chip or a badge — it is not a warning about the entry, it is the entry
+   a reader should land on when they have no reason to pick another. */
+.pick-generic {
+  background: var(--accent-wash);
+  border-color: var(--accent-ink);
+}
+
+.pick-generic .entry-title {
+  color: var(--text-accent);
+}
+
 .start-pill {
   padding: 8px 14px;
   border: 1px solid var(--border-strong);
@@ -1312,7 +1324,7 @@ input.filter {
 
 /* The column the wizard's steps live in. 720px, the design's measure for a form — NOT the footer's,
    which spans the screen. */
-/* ── Refs tracker issue 1937 §B — THE MEASURE MOVES OFF THE COLUMN AND ONTO ITS BLOCKS ─────────────
+/* ── §B — THE MEASURE MOVES OFF THE COLUMN AND ONTO ITS BLOCKS ────────────────────────────────────
    The owner: the New clearance page "is bound to an artificially narrow width; the table side-scrolls
    or wraps and looks worse than its content deserves. The top panel already fits the screen width."
    720px is the right measure for a COLUMN OF FIELDS and the wrong one for a five-column comparison. So
@@ -1340,7 +1352,7 @@ input.filter {
   max-width: none;
 }
 
-/* ── Refs tracker issue 1937 §B — "what this search includes", in or out at a glance ────────────────
+/* ── §B — "what this search includes", in or out at a glance ─────────────────────────────────────────
    The list read as three sentences of equal weight, and whether an axis ran at all was buried in the
    clause after the dash. The tick and the cross carry the answer; the colour is a reinforcement, never
    the only signal, because a marker distinguishable by hue alone is not a marker for every reader. */
@@ -1371,7 +1383,7 @@ input.filter {
 .carries-out .carries-mark { color: var(--text-faint); }
 .carries-out { color: var(--text-faint); }
 
-/* Refs tracker issue 2144 — THE SELECTOR'S DEPTH ICONS ARE GONE, by the owner's ruling of
+/* THE SELECTOR'S DEPTH ICONS ARE GONE, by the owner's ruling of
    2026-09-03: "in the summary things rescale and work great. in product selector … we can remove
    these next to the product description, tiny fixed icons. barely visible." The ladder they drew was
    correct and unreadable at the size the row gave it. The FINAL SUMMARY's effort bars stay exactly as
@@ -1442,7 +1454,7 @@ input.filter {
   background: var(--accent-wash);
 }
 
-/* ── Refs tracker issue 2075 — A ROW THAT CANNOT BE PICKED HAS TO LOOK LIKE ONE ─────────────────────
+/* ── A ROW THAT CANNOT BE PICKED HAS TO LOOK LIKE ONE ─────────────────────
    The class was applied by the component and NO RULE EXISTED for it, so a disabled row rendered
    identically to a live one: same border, same surface, same hover. That is exactly what the owner
    reported — "it doesnt appear disabled, no message etc - but i cant select it."
@@ -1481,7 +1493,7 @@ input.filter {
   color: var(--text-muted);
 }
 
-/* ── Refs tracker issue 2087 — a lane this search needs and this deployment does not have ───────────
+/* ── a lane this search needs and this deployment does not have ───────────
    Louder than the coverage note beside it: coverage narrows what a report covers, this removes a whole
    section of the reasoning. Still not a refusal — the search runs and the report states the gap. */
 .pick-row-capability {
@@ -1837,7 +1849,7 @@ input.filter {
   border-bottom: 1px solid var(--border-hairline);
 }
 
-/* ── Refs tracker issue 2076 — the two trades, side by side at the press ────────────────────────────
+/* ── the two trades, side by side at the press ────────────────────────────
    Each option is a BLOCK a reader can read before clicking, not a button with a word on it: the whole
    point of the question is that the two cost different things, and a row of verbs would hide that.
    The safe one is first and plain; "Stop now" is marked but not alarmed — the owner asked for it
@@ -2025,7 +2037,7 @@ input.filter {
   white-space: nowrap; cursor: pointer;
 }
 .home2-stop:hover, .home2-cancel:hover, .home2-ack:hover { border-color: var(--border-strong); color: var(--text-body); }
-/* tracker issue 1986 — the honest face of a Stop this deployment cannot serve. NOT home2-stop: the
+/* the honest face of a Stop this deployment cannot serve. NOT home2-stop: the
    browser check counts that class as a Stop that can act. */
 .home2-stop-unavailable {
   font-size: 12px;
@@ -2037,7 +2049,7 @@ input.filter {
   cursor: not-allowed;
 }
 
-/* tracker issue 2076 — the sentence that replaces the Stop button while a stop is in flight. */
+/* the sentence that replaces the Stop button while a stop is in flight. */
 .home2-stopping {
   font-size: 12px;
   color: var(--text-muted);
@@ -2045,7 +2057,7 @@ input.filter {
 }
 .home2-stop:disabled, .home2-cancel:disabled, .home2-ack:disabled { opacity: 0.55; cursor: default; }
 
-/* ── tracker issue 613: acknowledged, behind a count ──────────────────────────────────────────────────────────
+/* ── acknowledged, behind a count ──────────────────────────────────────────────────────────
    Quiet on purpose. These are runs the reader has already dealt with, and the whole point of the
    feature is that they stop competing with live work for attention — a panel styled like the queue
    would put them back in the fight it just took them out of. */
@@ -2158,7 +2170,7 @@ input.filter {
   .home2-qowner, .home2-qdepth { display: none; }
 }
 
-/* ── Refs tracker issue 2143 — THE USE-YOUR-AI PAGE ─────────────────────────────────────────────────
+/* ── THE USE-YOUR-AI PAGE ─────────────────────────────────────────────────
    The owner walked this page against the standing test — "I am a lawyer, only slightly technical" —
    and failed it. Four of the seven defects he listed were layout, and one of them was one word: the
    buttons carried `className="btn"`, and there is no `.btn` in this file. They rendered as bare
@@ -2170,7 +2182,7 @@ input.filter {
    the wrong one for a page of controls: the buttons stacked one per row down a 640px column with two
    thirds of the frame empty beside them. The text keeps a readable measure (`--screen-measure`, the
    vocabulary's own, not a ninth invented number) and the buttons take the frame and wrap. No new width
-   is declared here, deliberately — tracker issue 2086 rules that a new one needs its own reason, and
+   is declared here, deliberately — the width vocabulary rules that a new one needs its own reason, and
    this page did not need one, it needed to stop using the narrowest one for everything. */
 .ai-screen h2 {
   font-size: 17px;
@@ -2190,7 +2202,7 @@ input.filter {
 
 .ai-connect-head { margin-top: 28px; }
 
-/* ── ONE QUESTION, WHEN THE DEPLOYMENT LEAVES IT OPEN (tracker issue 147) ─────────────────────────── */
+/* ── ONE QUESTION, WHEN THE DEPLOYMENT LEAVES IT OPEN ─────────────────────────── */
 .ai-where { margin: 0 0 14px; max-width: var(--screen-measure); }
 
 .ai-where-q { margin: 0 0 8px; font-size: 15px; color: var(--text-strong); }
@@ -2333,3 +2345,44 @@ input.filter {
 .ai-help-body p { margin: 0 0 10px; }
 
 .ai-help-doc { font-size: 13px; }
+
+/* ── Give someone access: the points on the tree a new person can be given ─────────────────────────────
+   One row per point. A BUTTON, because choosing a point is an action and a keyboard has to reach it; the
+   resets below are what make a button read as a row. `.sub` indents a company under the organisation
+   it sits in. A row covered by a wider choice above it — everything, or its whole organisation — is
+   disabled and drawn on, never unticked on its own. */
+.attach-row {
+  display: flex;
+  align-items: center;
+  gap: 11px;
+  width: 100%;
+  padding: 9px 12px;
+  border: 1px solid var(--border-hairline);
+  border-radius: 8px;
+  background: var(--surface-raised);
+  color: inherit;
+  font: inherit;
+  font-size: 13.5px;
+  text-align: left;
+  cursor: pointer;
+}
+
+.attach-row.on {
+  border-color: var(--accent);
+  background: var(--accent-wash);
+}
+
+.attach-row.sub {
+  width: auto;
+  margin-left: 26px;
+}
+
+.attach-row:disabled {
+  cursor: default;
+}
+
+.attach-row .sub-t {
+  margin-left: auto;
+  color: var(--text-faint);
+  font-size: 12px;
+}

package/portal-ui/dist/index.html

@@ -49,8 +49,8 @@
     -->
     <link rel="preconnect" href="https://api.fontshare.com" crossorigin />
     <link href="https://api.fontshare.com/v2/css?f[]=satoshi@400,500,700,900&display=swap" rel="stylesheet" />
-    <script type="module" crossorigin src="/portal/assets/index-KFAHMgdT.js"></script>
-    <link rel="stylesheet" crossorigin href="/portal/assets/index-1ziUJX1E.css">
+    <script type="module" crossorigin src="/portal/assets/index-CWTHP0sH.js"></script>
+    <link rel="stylesheet" crossorigin href="/portal/assets/index-KpytsmNH.css">
   </head>
   <body>
     <div id="root"></div>

package/portal-ui/package.json

@@ -2,7 +2,7 @@
   "name": "portal-ui",
   "private": true,
   "type": "module",
-  "version": "0.2.4",
+  "version": "0.3.0-beta.1",
   "license": "AGPL-3.0-only",
   "description": "The unified trademark portal UI. One address, one login: who you are decides what you see. Built as a static bundle, served by driver/portal-service.mjs — the browser never reaches profile-service or recipe-service.",
   "engines": {

package/providers/_shared/lane-probe.mjs

@@ -27,8 +27,8 @@
 //
 // `proven` · `failed` (with the provider's own reason) · `cannot-prove` (with why).
 //
-// Reporting a provider that CANNOT be probed as `failed` is the could-not-look defect that tracker
-// issues 1864 and 1874 both closed this week — a check that could not run reported as a check that
+// Reporting a provider that CANNOT be probed as `failed` is the could-not-look defect that two
+// separate filings closed this week — a check that could not run reported as a check that
 // found something wrong. The count kernel beside this file sets the precedent: it returns `total: null`
 // with a reason rather than a zero it did not count.
 //
@@ -42,6 +42,9 @@
 // call — so it gets no arm in CI, and ships with a green that means nothing. Which is precisely the
 // class of instrument this issue exists to complain about.
 
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+
 // The marks are DATA, overridable, and each says why it was chosen. A control that stops returning hits
 // turns this probe into a permanent false alarm, so the reason has to survive for whoever re-picks it.
 export const DEFAULT_CONTROLS = Object.freeze({
@@ -79,7 +82,10 @@ export function probeSpend(capabilities) {
 export async function loadProviderCapabilities(repoRoot, providerId, importer = (u) => import(u)) {
   if (!providerId) return null;
   try {
-    const m = await importer(new URL(`file://${repoRoot}/providers/${providerId}/src/capabilities.js`).href);
+    // pathToFileURL, not a hand-built `file://${repoRoot}/…`: a URL reads everything after a # as a
+    // fragment and decodes a literal %xx, so under such a folder this read the wrong file and the lane's
+    // cost came back UNKNOWN. On Windows the hand-built form held only by the URL parser's leniency.
+    const m = await importer(pathToFileURL(join(repoRoot, "providers", providerId, "src", "capabilities.js")).href);
     return m?.CAPABILITIES ?? m?.default ?? null;
   } catch { return null; }
 }

package/providers/jx-subclass/lookup.mjs

@@ -41,7 +41,7 @@ export function subclassesFor(db, { country, term, niceClass }) {
   //
   // ── — THE 13TH EDITION GOVERNS THE CODE. CNIPA'S OWN WORDING STILL FINDS THE GOOD. ──────────
   //
-  // Owner ruling, 2026-08-20: "13th edition. done." — option 2, accepting that the 12th's assignments
+  // Ruling, 2026-08-20: "13th edition. done." — option 2, accepting that the 12th's assignments
   // lose authority WHEREVER THE EDITIONS DISAGREE. That last clause is the whole design: disagreement is
   // the case being decided, and it is not the same case as "the 13th has never heard of this good".
   //

package/providers/oauth-mcp-bridge/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-oauth-mcp-bridge
 
+## 0.3.0-beta.1
+
+No changes in this release.
+
 ## 0.2.4
 
 ## 0.2.3

package/providers/oauth-mcp-bridge/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-oauth-mcp-bridge",
-  "version": "0.2.4",
+  "version": "0.3.0-beta.1",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "OAuth 2.1 MCP stdio bridge used by the engine's case-law gather stage (courtlistener / legaldatahunter).",

package/providers/oauth-mcp-bridge/systemd/courtlistener-mcp.service

@@ -7,7 +7,7 @@ Wants=network-online.target
 [Service]
 # Reads the OAuth cache at ~/.config/clawdi/oauth-mcp/courtlistener.json (no ~/.env needed).
 Environment=PATH=/usr/local/bin:/usr/bin:/bin
-# ── RESOLVED AT INSTALL (tracker issue 1876 option B) ────────────────────────────────────────
+# ── RESOLVED AT INSTALL (option B) ───────────────────────────────────────────────────────────
 # `@CLEAROTRON_CHECKOUT_DIR@` is substituted by render-units.mjs when it writes the resolved copy.
 # This unit deliberately loads no EnvironmentFile — one would let ~/.env override the PATH set above —
 # so it cannot use the `${CLEAROTRON_CHECKOUT_DIR}` form the lane services use.

package/scripts/citation-drift-report.mjs

@@ -193,7 +193,7 @@ if (isEntrypoint(import.meta.url)) {
   const rows = driftRows(citationsIntoChanged(corpus, byBase, changed, (pth) => trackedSet.has(pth)), changed);
 
   if (argv.includes("--json")) { console.log(JSON.stringify({ range, changed: [...changed.keys()], rows }, null, 2)); process.exit(0); }
-  console.log(`citation-drift-report (tracker issue 1950): ${range}  (base ${base.slice(0, 8)})`);
+  console.log(`citation-drift-report: ${range}  (base ${base.slice(0, 8)})`);
   console.log(`  ${changed.size} modified file(s); ${rows.length} citation(s) affected`);
   if (!rows.length) {
     console.log("  ✓ no citation on the base points below a net insertion in a file this change touches.");

package/scripts/citation-line-check.mjs

@@ -232,7 +232,7 @@ export function decidableHits(citations, lineCountOf, ships = sourceCrossesTheCu
 }
 
 /**
- * A FLOOR UNDER THE POPULATION, RELATIVE TO THIS TREE — owner ruling 2026-09-02, his words: "keep the
+ * A FLOOR UNDER THE POPULATION, RELATIVE TO THIS TREE — ruling 2026-09-02, his words: "keep the
  * verifier, kill the magic."
  *
  * The reason for a floor is unchanged and it is a good one: if the extractor breaks, every count goes to
@@ -633,7 +633,7 @@ const CALLS = /^\s*\(/;
 const OWN_NUMBER = /^\s*(?:at\s+\d|:\d)/;
 
 /** The symbol-shaped tokens adjoining a citation, in BOTH grammars: `cite SYM` and `SYM (cite)`. PURE. */
-// ── THE RATCHET: A NEWLY ADDED CITATION CARRIES A SYMBOL (tracker issue 125) ────────────────────────
+// ── THE RATCHET: A NEWLY ADDED CITATION CARRIES A SYMBOL ────────────────────────────────────────────
 //
 // The blindness above is not closeable on the existing corpus. Of the line citations in this tree only a
 // minority name a symbol beside the number, and the rest are checked for EXISTENCE and nothing more — a

package/scripts/drive-env-check.mjs

@@ -8,7 +8,7 @@
 //
 // A test that drives a real command and expects that command's `.env` to configure it gets the BUILT-IN
 // DEFAULTS instead, silently, including default PORTS. Two independent mechanisms produce it and a drive
-// has to defeat both (tracker issue 204):
+// has to defeat both:
 //
 //   1. `scripts/test-run.mjs` sets `CLEAROTRON_NO_ENV_FILE=1` for every child of the suite. Correct on
 //      its own terms — no test should be configured by a file on the developer's box.

package/scripts/e2e.mjs

@@ -1353,7 +1353,7 @@ function evalAssertion(a, runDir) {
     // carries no runId, and this assertion is reading that exact status.json.
     // ── — THIS IS A DELIVERY CONTRACT, AND A RUN THAT DID NOT DELIVER NEVER ENTERED IT ────────
     //
-    // Owner ruling, 2026-08-22, verbatim: "clean up the failed runs. they owe the client nothing."
+    // Ruling, 2026-08-22, verbatim: "clean up the failed runs. they owe the client nothing."
     // (Recorded here because the rule this line encodes is a product
     // decision, not a harness preference.)
     //
@@ -1373,7 +1373,7 @@ function evalAssertion(a, runDir) {
     //
     // ── 2026-08-24, AND THIS SCOPE SURVIVED IT ────────────────────────────────────────────────────
     //
-    // A second owner ruling that day ordered failed runs' notification packets onto the same re-drop
+    // A second ruling that day ordered failed runs' notification packets onto the same re-drop
     // cover as delivered ones, and `driver/outbox-backoff.mjs`'s `owedANotification` now says so. That
     // is NOT a reversal of the line below and the two must not be read as one rule: what a failed run
     // owes the CLIENT is still nothing, which is this assertion's subject; what it owes the REQUESTER
@@ -1502,7 +1502,7 @@ function evalAssertion(a, runDir) {
 //
 // Three states, not two: "cannot tell" is reported as itself rather than as breakage, because
 // systemctl --user needs XDG_RUNTIME_DIR and a plain `sudo -u <user> node …` does not set it.
-// ── IT ASKS ABOUT THE WORKER FIRST, BECAUSE THE WORKER IS THE DRAIN (tracker issue 181) ────────────
+// ── IT ASKS ABOUT THE WORKER FIRST, BECAUSE THE WORKER IS THE DRAIN ────────────────────────────────
 //
 // This function knew only about `prelim-driver.timer` and `prelim-driver.path` — the two RETIRED units.
 // On a deployment drained by `clearotron-worker.service` it therefore found neither, concluded nothing
@@ -1908,7 +1908,7 @@ async function cmdRun(id) {
   console.log(`\n${queuedIds.length} job(s) queued across ${doors.length} door(s)${
     queuedIds.some((x) => !x) ? ` — ${queuedIds.filter((x) => !x).length} did not report an id` : ""
   }. The QUEUE is the source of truth for what is in flight; watch it, not this list.`);
-  // THE COMMAND IS PRINTED ONLY WHEN NO DRAINER HOLDS THIS QUEUE (tracker issue 181), and the unit it
+  // THE COMMAND IS PRINTED ONLY WHEN NO DRAINER HOLDS THIS QUEUE, and the unit it
   // names is the one this deployment actually uses. It used to be printed on the strength of two RETIRED
   // units being inactive, which on a worker-drained box meant telling the operator to start a second
   // drainer beside a running one. Suggesting a second drainer is the failure here, not the absence of a
@@ -2200,7 +2200,7 @@ function queueOutcomes(ref, queueDir = QUEUE_DIR, knownRuns = []) {
   return out;
 }
 
-// ── tracker issue 514 · HAS THIS ROUND FINISHED, AND IS THAT KNOWN? ───────────────────────────────────────────────
+// ── HAS THIS ROUND FINISHED, AND IS THAT KNOWN? ───────────────────────────────────────────────────────────────────
 //
 // THE ONLY PLACE SETTLEDNESS IS DECIDED. Both the launch pre-flight and `report`'s stamp call this, so
 // they can never disagree about whether the previous round is done — which is the disagreement that

package/scripts/env-audit.mjs

@@ -244,7 +244,19 @@ export const SYSTEM_OWNED = new Set([
   // pushed back is right to have made this an explicit decision rather than an omission: they ARE read
   // by product code, and the only honest answers were a row or this list.
   "NO_COLOR", "FORCE_COLOR",
-  // ── THE GITHUB ACTIONS RUNTIME (tracker issue 213) ──────────────────────────────────────────────
+  // ── WINDOWS SUBSYSTEM FOR LINUX ─────────────────────────────────────────────────────────────────
+  //
+  // Set by WSL itself on every session inside it, which is what makes them worth reading: `isWsl()` in
+  // bin/onboard.mjs tests both, because under WSL a Windows binary on PATH is not the engine and the
+  // installer has to say so. Nobody configures a Clearotron install by setting them, and an
+  // .env.example row would invite somebody to try — the same argument NO_COLOR gets above, and TERM
+  // before it.
+  //
+  // The alternative was a governance row, and it would have been a false claim about a document: the
+  // row would describe a decision this product does not make. Excluded rather than documented, which
+  // is what this list is for.
+  "WSL_DISTRO_NAME", "WSL_INTEROP",
+  // ── THE GITHUB ACTIONS RUNTIME ──────────────────────────────────────────────────────────────────
   //
   // `CI` above is already here for exactly this reason; these two arrived with the release scripts and
   // want the same answer. GitHub sets both INSIDE a workflow run — `GITHUB_OUTPUT` is the step-output

package/scripts/headless-page.mjs

@@ -3,9 +3,9 @@
 //
 // headless-page.mjs — did the browser open the page we asked for, or something of its own?
 //
-// (and, since tracker issue 227 criteria 3-4, whether this box can draw what that page says)
+// (and, since criteria 3-4, whether this box can draw what that page says)
 //
-// ── WHY THIS EXISTS (tracker issue 227) ─────────────────────────────────────────────────────────────
+// ── WHY THIS EXISTS ─────────────────────────────────────────────────────────────────────────────────
 //
 // Seven scripts drive headless Chrome and none of them asked. They cannot ask the obvious way: Chrome is
 // launched with the file URL as a COMMAND-LINE ARGUMENT, so there is no navigation call whose response
@@ -80,7 +80,7 @@ export function pageVerdict({ href = "", expected = "", marker = null, markerNam
         + "captured is Chrome's interstitial, not the artefact — and that page carries an `<h1>`, a "
         + "`<title>` and a body, so a content check alone reads it as a success." };
   }
-  // ── THE BROWSER'S START PAGE IS NOT A WRONG DOCUMENT (tracker issue 273) ────────────────────────
+  // ── THE BROWSER'S START PAGE IS NOT A WRONG DOCUMENT ────────────────────────────────────────────
   //
   // `about:blank` is what Chrome shows before it has navigated anywhere. Reaching the check below, it
   // compares unequal to the expected URL and was reported as `wrong-document` — "a redirect, a stale tab
@@ -131,7 +131,7 @@ export function pageVerdict({ href = "", expected = "", marker = null, markerNam
 export async function assertPageLoaded(evaluate, { expected, marker = null, markerName = "the page's own content", what = "this page", errorText = null,
   graceMs = NAVIGATION_GRACE_MS, pollMs = NAVIGATION_POLL_MS,
   sleep = (ms) => new Promise((r) => setTimeout(r, ms)), now = () => Date.now() } = {}) {
-  // ── WAIT FOR THE BROWSER TO LEAVE ITS START PAGE, THEN JUDGE (tracker issue 273) ─────────────────
+  // ── WAIT FOR THE BROWSER TO LEAVE ITS START PAGE, THEN JUDGE ─────────────────────────────────────
   //
   // Three of these scripts launch Chrome with the URL as an argument and get no response to wait on, so
   // the first read of `location.href` can land before the browser has moved. On an idle box it never
@@ -204,7 +204,7 @@ export function chromeErrorPage(dom = "") {
     || /jstcache=|<body[^>]*\bid="?neterror"?/.test(t);
 }
 
-// ── CAN THIS BOX DRAW WHAT THE PAGE SAYS? (tracker issue 227, criteria 3 and 4) ──────────────────────
+// ── CAN THIS BOX DRAW WHAT THE PAGE SAYS? (criteria 3 and 4) ─────────────────────────────────────────
 //
 // The default demo product is a full-country search, and its report carries the mark's native-script
 // renderings — ベンクリ, ベンコリ, ヴェンコリ. They are LOAD-BEARING: the verdict sentence reads "A live

package/scripts/live-surface-check.mjs

@@ -85,6 +85,7 @@ import { mcpToolCall } from "../driver/portal-mcp-client.mjs";
 import { readFlagSnapshot, builtFor, isStale, postureDelta, PRODUCTION_POSTURE } from "../driver/flag-snapshot.mjs";
 import { policyFor, productAvailability, ORDERABLE_PRODUCTS } from "../driver/search-policy.mjs";
 import { rosterVerdict } from "../driver/roster-verdict.mjs";
+import { triggerCapGap, triggerCapWarning } from "../driver/trigger-cap.mjs";   // the portal's own sentence about a key's gap
 import { bundledDemoKeys } from "../driver/bundled-demos.mjs";
 import { unitsActiveVerdict } from "../driver/unit-state-verdict.mjs";
 import { deploymentBox } from "../shared/deployment-box.mjs";   // — extracted; one allowlist, two readers
@@ -517,10 +518,33 @@ try {
   try { bundledDemos = bundledDemoKeys({ profilesDir: BUNDLED_PROFILES_DIR }); }
   catch (e) { fail("roster resolves", `the bundled roster could not be derived, so #83 cannot be ruled out: ${e.message}`); }
 
+  // THE DOOR ANSWERED FOR THIS KEY, so the comparison is made within this key's cap. Its claims are read
+  // the way doctor and the brand-owner command read them. A key that cannot be read leaves the verdict
+  // unable to tell a narrowing from a fault, and it says so rather than guessing either way.
+  let caller = { readable: false, accounts: null };
+  try { caller = (await import("../driver/portal-service.mjs")).opsTokenPosture(OPS_TOKEN); }
+  catch { /* stays unreadable — the verdict reports what it could not compare */ }
   if (bundledDemos) {
-    const { state, message } = rosterVerdict({ keys, onDisk, bundledDemos, expectDemos: process.env.CLEAROTRON_E2E_EXPECT_DEMO_ROSTER === "1" });
+    const { state, message } = rosterVerdict({ keys, onDisk, bundledDemos, caller,
+      expectDemos: process.env.CLEAROTRON_E2E_EXPECT_DEMO_ROSTER === "1" });
     ({ pass, fail, skip })[state]("roster resolves", message);
   }
+  // A COMPANY IN THE STORE THAT THIS KEY CANNOT START is its own finding, not a roster disagreement. A
+  // warning, not a failure: the portal re-takes its credential at the start of every call, so a Start for
+  // it is refused only when that re-mint fails. The sentence is the portal's own.
+  if (onDisk) {
+    if (!caller.readable)
+      skip("trigger key covers the roster", OPS_TOKEN
+        ? "the key's claims could not be read, so its cap was NOT compared with the store"
+        : "no trigger key was found, so there is no cap to compare — see \"trigger lane wired\"");
+    else {
+      const gap = triggerCapGap({ accounts: caller.accounts, roster: onDisk });
+      if (gap.uncovered.length) record("trigger key covers the roster", "warn", triggerCapWarning(gap));
+      else pass("trigger key covers the roster", gap.capped
+        ? `every company in the store (${onDisk.length}) is within the key's cap`
+        : "the key carries no account cap, so it covers every company");
+    }
+  }
 } catch (e) {
   fail("roster resolves", `list_profiles failed: ${e.message}`);
 }
@@ -562,7 +586,7 @@ try {
   fail("ops-MCP reachable", `${MCP_URL}: ${e.message}`);
 }
 
-// ── 3b. THE TRIGGER LANE, AS ITS OWN SURFACE (tracker issue 112) ─────────────────────────────────────
+// ── 3b. THE TRIGGER LANE, AS ITS OWN SURFACE ─────────────────────────────────────────────────────────
 //
 // The lane the portal's Start button calls is `PORTAL_MCP_URL` + `PORTAL_OPS_TOKEN`, and NOTHING on
 // this box exercised it. On 2026-09-02 the owner could not start a run: every surface here was green,