clearotron 0.3.1-beta.2 → 0.3.1-beta.3

package/bin/grant.mjs

@@ -64,7 +64,7 @@
 import "../shared/env-local.mjs";
 import { readFileSync, existsSync } from "node:fs";
 import { assertGrantsShape } from "../shared/scope.mjs";   // — one shape check, not a second opinion
-import { withPerson, withOrganisation, withCompany } from "../shared/grants-edit.mjs";   // — the People page's own editors
+import { withPerson, withoutPerson, personPoints, withOrganisation, withCompany } from "../shared/grants-edit.mjs";   // — the People page's own editors
 import { basename } from "node:path";
 import { atomicWrite } from "../driver/progress.mjs";
 import { accessView } from "../driver/portal-config-view.mjs";
@@ -287,27 +287,26 @@ if (cmd === "remove") {
   const email = String(argv[1] ?? "").trim().toLowerCase();
   const only = flag("tenant");
   if (!email) usage();
-  let removed = 0;
-  for (const [name, t] of Object.entries(grants.tenants)) {
-    if (only && name !== only) continue;
-    if (t?.users && email in t.users) { delete t.users[email]; removed++; }
-    // AN EMPTY `users` MAP IS NOT A DELETED TENANT, and this writes the former deliberately: the tenant
-    // still exists and still holds its accounts, it simply has nobody on its guest list. Deleting the
-    // tenant here would destroy configuration the operator never asked to remove, and it round-trips —
-    // `remove-tenant` is the other verb, and it is explicit.
-  }
-  // AND THE PERSON'S OWN ENTRY, when they are removed from everywhere. Their permissions and their access
-  // to everything live under `people`, not in any tenant, so a removal that left that entry would leave a
-  // person who sees everything still seeing everything. Removed from one tenant, they may still hold
-  // access elsewhere, and their entry stays.
-  const peopleKey = only ? undefined : Object.keys(grants.people ?? {}).find((k) => k.toLowerCase() === email);
-  if (peopleKey !== undefined) delete grants.people[peopleKey];
-  if (!removed && peopleKey === undefined) die(`${email} is not on the guest list${only ? ` for "${only}"` : ""}. Nothing written.`);
-  atomicWrite(FILE, JSON.stringify(grants, null, 2) + "\n");
-  out(`Removed ${email} from ${removed} tenant(s)${peopleKey !== undefined ? ", and their permissions under people" : ""}. Written to ${basename(FILE)}.`);
-  const kept = Object.entries(grants.people ?? {}).find(([k]) => k.toLowerCase() === email)?.[1];
-  if (kept?.everything === true)
-    out(`${email} still has access to everything through their entry under people. \`grant remove ${email}\` without --tenant takes that away too.`);
+  // THROUGH THE SAME EDITOR THE PORTAL USES. This command used to delete the keys itself, and the two
+  // paths had drifted: `people` was matched without regard to case here and the tenant guest lists were
+  // matched exactly, so a hand-edited file holding `Dana@x` under an organisation kept that row through a
+  // removal that reported success. One function now answers for both faces.
+  const held = personPoints(grants, email);
+  const points = only ? held.points.filter((p) => p.tenant === only) : [];
+  if (!held.listed && !held.points.length)
+    die(`${email} is not on the guest list. Nothing written.`);
+  if (only && !points.length)
+    die(`${email} is not on the guest list for "${only}". Nothing written.`);
+  let after;
+  // A TENANT-SCOPED REMOVAL OF SOMEBODY WHO HOLDS EVERYTHING IS REFUSED, where it used to be done and
+  // then warned about. Access to everything lives under `people` and in no organisation, so striking one
+  // organisation's row changed nothing the person could see — and the sentence saying they had been
+  // removed was printed first, with the correction below it.
+  try { after = withoutPerson(grants, { email, points, all: !only }); }
+  catch (e) { die(`${String(e?.message ?? e)} Nothing written.`); }
+  const orgs = only ? 1 : new Set(held.points.map((p) => p.tenant)).size;
+  atomicWrite(FILE, JSON.stringify(after, null, 2) + "\n");
+  out(`Removed ${email} from ${orgs} tenant(s)${only ? "" : held.listed ? ", and their permissions under people" : ""}. Written to ${basename(FILE)}.`);
   process.exit(0);
 }
 

package/build-info.json

@@ -1,4 +1,4 @@
 {
-  "commit": "3e6266f5960e7990e767edbdb95ca50831156b55",
-  "version": "0.3.1-beta.2"
+  "commit": "7a1d63ae392a94c5f35609699ff9c52660586a5d",
+  "version": "0.3.1-beta.3"
 }

package/driver/CHANGELOG.md

@@ -1,5 +1,30 @@
 # clearotron-driver
 
+## 0.3.1-beta.3
+
+### Patch Changes
+
+- d0d42f7: Fixed: A name in a knockout batch is no longer rated above every conflict found against it. Its rating now follows from the conflicts on its own page.
+  
+  Fixed: Before, a rule forced any name made of everyday words off the lowest band, whatever the search found. That rule is gone for every client.
+- 56a760f: Fixed: Giving somebody access to everything on the installation now works from the access form. It used to refuse. The message it refused with said you can only give access to what you hold yourself, which was not true of the person seeing it.
+- 8c3bc3b: New: Ask AI on a report now opens Claude or ChatGPT with a question about that report already typed in. One press, in a new tab, and nothing is sent until you send it.
+  
+  The button used to hand over a connector address and a question carrying the run's internal code, with no indication of which one you needed. The address belongs on the Use your own AI page, where you set the connector up once. It is no longer shown on reports at all.
+  
+  If you have not connected an assistant yet, the button explains that in a line and offers to take you there.
+  
+  For operators: the report's own "Ask your AI" band is gone, so there is one Ask AI control rather than two. Reports rendered before this upgrade keep the band in their own file, and it is hidden when the portal serves them.
+- 56a760f: Fixed: `clearotron grant remove --tenant` now refuses when the person has access to everything on the installation. It used to remove the organisation and then warn that nothing they could see had changed.
+  
+  Fixed: Removing somebody whose address is spelled with different capitalisation in different parts of the access file now removes all of them. Half of the entry used to survive, and the command reported success.
+- 56a760f: New: Access can now be narrowed and taken away, not only added to. Somebody who manages one organisation removes that organisation alone. Somebody who can see all of a person removes their access to the installation, and withdraws the keys their AI assistant was using.
+  
+  Fixed: A removal now says plainly when the connector cannot be told about it yet, instead of implying the assistant lost access too.
+- f1c5925: Fixed: Where a search covers two ratified forms of a name, the report now reasons each form and says which conflicts differ between them.
+  
+  Fixed: Before, both forms were searched but one combined read came back. When the forms read alike the report now says so, rather than leaving it unsaid.
+
 ## 0.3.1-beta.2
 
 ### Patch Changes

package/driver/package.json

@@ -2,7 +2,7 @@
   "name": "clearotron-driver",
   "private": true,
   "type": "module",
-  "version": "0.3.1-beta.2",
+  "version": "0.3.1-beta.3",
   "license": "AGPL-3.0-only",
   "description": "Deterministic driver for the trademark clearance workflow: orchestration in code (fan-out, fan-in barrier, gating, retries); the model does judgment leaves only, through a reasoning CLI spawned per stage.",
   "engines": {

package/driver/portal-config-view.mjs

@@ -43,6 +43,7 @@
 
 import { statSync, openSync, readSync, closeSync } from "node:fs";
 import { namedPoint } from "./portal-access.mjs";
+import { recordedKeysFor } from "../shared/client-door.mjs";   // — how many issued keys a person holds, counted by the module that revokes them
 
 import { readFlagSnapshot, engineFor, providersFor, postureDisagreement } from "./flag-snapshot.mjs";
 // `isStale` is deliberately NOT imported any more: the age banner is retired (ruling,
@@ -282,7 +283,8 @@ export function authView({ mode = "", oidcIssuer = "", team = "", jwksUrl = "",
  * `companies` maps each company key the profile store holds to its name. `localSignIn` says this install
  * cannot hold a second person at all, which is what disables Add.
  */
-export function accessView({ grants, viewer = null, companies = {}, grantsFile = null, localSignIn = false }) {
+export function accessView({ grants, viewer = null, companies = {}, grantsFile = null, localSignIn = false,
+  keysRevocable = false }) {
   const tenants = grants?.tenants ?? {};
   const everything = viewer?.everything === true;
   const viewerOrgs = viewer?.genericOrgs ?? [];
@@ -330,6 +332,23 @@ export function accessView({ grants, viewer = null, companies = {}, grantsFile =
       // whose permissions were considered and set to none.
       listed: key !== undefined,
       access: shown.map((p) => namedPoint(p, grants, companies)),
+      // WHETHER THIS ROW IS THE WHOLE OF THIS PERSON, from where the viewer stands. Every other field
+      // here is narrowed silently — a manager of one organisation sees that organisation's half of
+      // somebody and nothing says it is a half — and that was serviceable while the page could only
+      // ADD. It is not serviceable for a page that changes and removes: permissions belong to the
+      // person and not to a point, so a narrowed viewer must be told they cannot change them, and a
+      // removal they order must say it takes away their organisation rather than the install.
+      //
+      // The same test the write routes apply (`reachCovers`), computed here from the same `inside`
+      // that narrowed the list, so the sentence the page draws and the refusal the server would give
+      // cannot disagree.
+      covered: everything || all.every(inside),
+      // HOW MANY ISSUED KEYS THIS PERSON HOLDS — counted by the module that revokes them rather than by
+      // reading `connectKeys` here, so the count and the revocation cannot come to different answers
+      // about who a key belongs to. The removal confirmation needs it BEFORE the press: what happens to
+      // somebody's assistant is part of what the reader is agreeing to, and a page that found out
+      // afterwards would be telling them about it too late to matter.
+      keys: recordedKeysFor(grants, email).length,
       dangling: r.dangling,
     });
   }
@@ -339,6 +358,12 @@ export function accessView({ grants, viewer = null, companies = {}, grantsFile =
     // Add is offered to a manager, and never where local sign-in holds the install to one person.
     canAdd: viewer?.permissions?.manage === true && !localSignIn,
     localSignIn,
+    // Can an issued key be withdrawn on this installation at all? A connector started without a
+    // revocation list never loaded one, so a key minted through it cannot be called back and dies at its
+    // own expiry — `disablePlan` calls that state `lateArm` and refuses to strike the record for it.
+    // Stated here so the confirmation can say which of the two removals this would be before it happens,
+    // rather than correcting itself in the answer.
+    keysRevocable,
     // Companies named in grants that no profile matches — the other typo direction. Install-wide, so it
     // is shown to a person who sees everything and to nobody else.
     unknownAccounts: everything ? [...unknownAccounts].sort() : [],

package/driver/portal-report.mjs

@@ -799,14 +799,28 @@ export function prepareReportForEmbed(html, { staff = false, poolRoot = null, fe
   let ratedUnderDropped = 0;
   out = out.replace(RATED_UNDER_RE, () => { ratedUnderDropped += 1; return ""; });
 
-  // Staff keep their own connector block; a client must not see the staff host it points at.
+  // ── THE ASK-AI BAND COMES OUT FOR EVERY READER ──────────────────────────────────────────────────
+  //
+  // It used to come out for clients only, on the ground that the band names the STAFF host and staff may
+  // see it. That left two Ask-AI controls on one staff screen — this band with the staff address and its
+  // setup steps, and the shell's own header button — and the owner ruled on 2026-09-15 that there is one.
+  // The renderer stopped drawing it in that same change.
+  //
+  // SO THIS STRIP IS NOT DEAD CODE, AND THAT IS THE REASON IT RUNS UNCONDITIONALLY. Every report
+  // rendered before that commit is served from its baked bytes and still carries a band naming the staff
+  // host. Removing the strip on the argument that nothing emits one any more would put that host back in
+  // front of whoever opens an archived run, staff and client alike, and the archive is where most of the
+  // reports are.
   let mcpLeaks = 0;
   let internalTailsDropped = 0;
   let reviewerCodesDropped = 0;
+  out = stripBalanced(out, ASKAI_RE, "details", note).html;
   if (!staff) {
-    out = stripBalanced(out, ASKAI_RE, "details", note).html;
     // Assert, do not assume. `.askband` markup is nested, so a non-greedy match could stop early and
     // leave the host behind in a sibling node. Anything surviving is redacted and counted.
+    //
+    // CLIENT-ONLY, and deliberately: this catches an MCP host anywhere in the document, not only inside
+    // the band, and the staff bytes elsewhere in a report are the designed rendering rather than a leak.
     out = out.replace(MCP_HOST_RE, () => {
       mcpLeaks += 1;
       return "";

package/driver/portal-service.mjs

@@ -89,7 +89,7 @@ export function opsTokenFor({ bootToken, roster, mint }) {
 // has held the signing secret on both start paths for as long as both have existed. The comment has been
 // corrected in place rather than left to be trusted.
 import { mintToken, loadGrants, resolvePerson, addressesInGrants } from "../shared/scope.mjs";
-import { withPerson, withCompany } from "../shared/grants-edit.mjs";
+import { withPerson, withoutPerson, personPoints, withCompany } from "../shared/grants-edit.mjs";
 import { resolvePort } from "../shared/listen.mjs";   // — the port SOURCE, decided once
 import { fileURLToPath } from "node:url";
 
@@ -1082,6 +1082,59 @@ function outcomeRow({ event = "request-refused", method, path, email = null, sta
   return row;
 }
 
+/**
+ * Revoking the connector keys a removed person holds — composed here, exported so it can be driven.
+ *
+ * It is the portal's half of an act `clearotron disconnect` also performs, through the same module, so
+ * one author decides what revoking means. What differs is WHERE each runs, and the difference decides
+ * what each may do: `disconnect` runs on the box beside the door, and this runs in a web request in a
+ * different service with a different environment.
+ */
+export function makeConnectorKeyRevoker({ env = process.env, home = null } = {}) {
+  return async ({ email, grants: g }) => {
+    const { recordedKeysFor, disablePlan, applyDisablePlan, denylistPathFor } = await import("../shared/client-door.mjs");
+    const { homedir } = await import("node:os");
+    const { existsSync, mkdirSync, writeFileSync, appendFileSync } = await import("node:fs");
+    const { join, dirname } = await import("node:path");
+    const base = home ?? homedir();
+    const recorded = recordedKeysFor(g, email);
+    const plan = disablePlan({ env, unitDir: join(base, ".config", "systemd", "user"), exists: existsSync,
+      identity: email, recorded, denylistPath: denylistPathFor(env, base) });
+    if (!plan.possible) return { grants: g, revoked: 0, jtis: [], lateArm: false, says: plan.says };
+    if (plan.lateArm) return { grants: g, revoked: 0, jtis: plan.jtis, lateArm: true, says: plan.says ?? [] };
+    // THE RECORD IS NEVER STRUCK FROM HERE, and the ledger step is dropped rather than no-opped.
+    //
+    // `disablePlan` decides `lateArm` from the environment it is handed, and the environment this
+    // process has is the PORTAL's. The connector is a different unit with its own `EnvironmentFile`, so
+    // a box where the portal names a revocation list and the door was started without one reads as
+    // `lateArm: false` here — and the plan would then write the list AND strike the record, for a key
+    // that still works. A record removed while its key works is the only trace of that key, gone: the
+    // failure `client-door.mjs` states its ordering rule to prevent.
+    //
+    // So this process does the half it can vouch for. Writing the list is safe in both configurations —
+    // it is the right act where the door reads it and a file nobody opens where it does not. Leaving the
+    // record is safe in both too: `connectKeyReport` already judges a record valid, expired or revoked,
+    // so a record of a revoked key is an accurate one, and `clearotron doctor` is where an operator sees
+    // which. `clearotron disconnect` runs on the box, beside the door, and still strikes.
+    //
+    // The seam THROWS rather than doing nothing, so that a future change putting the ledger step back
+    // fails here instead of quietly striking again.
+    const revokeOnly = { ...plan, steps: plan.steps.filter((step) => step.id === "revoke") };
+    applyDisablePlan(revokeOnly, {
+      appendDenylist: (path, jtis) => {
+        mkdirSync(dirname(path), { recursive: true });
+        if (!existsSync(path)) writeFileSync(path, "# Revoked key ids, one jti per line. Read on every key check.\n", { mode: 0o600 });
+        appendFileSync(path, jtis.map((j) => `${j}\n`).join(""));
+      },
+      strikeRecords: () => {
+        throw new Error("the portal must not strike a key record: it cannot see the connector's environment, "
+          + "so it cannot know whether the revocation list it just wrote is the one that door loaded");
+      },
+    });
+    return { grants: g, revoked: plan.jtis.length, jtis: plan.jtis, lateArm: false, recordKept: true };
+  };
+}
+
 export function makePortalService({
   poolRoot, workspaceRoot, recipesDir = undefined, secret,
   grants = null,
@@ -1094,6 +1147,14 @@ export function makePortalService({
   // CLEAROTRON_ACCESS_FILE. Null means this service cannot write the file, and the routes that would
   // need to say so rather than pretend.
   writeGrants = null,
+  // Revoking the connector keys a removed person holds. INJECTED for the reason `writeGrants` is: this
+  // constructor stays pure over its inputs, an arm can watch the revocation without a denylist file on
+  // disk, and boot is where the paths live. It takes the grants object the removal produced and returns
+  // it with the struck records gone, so one write lands both facts.
+  //
+  // Null means this service cannot revoke, and the answer SAYS so — a removal that quietly left a live
+  // key would be the exact failure the page's own sentence promises against.
+  revokeConnectorKeys = null,
   // The queue directories the RUNNER drains — the same list it hands checkRunCaps. The allowance counter
   // and the quota pre-check read their ledger beside these, so they count what the wall counts (:
   // they used to reconstruct a workspace-relative path that resolved to nothing once the queue moved out
@@ -2316,6 +2377,52 @@ export function makePortalService({
 // cache, and a failure that answers `null` rather than throwing — a page that cannot read its door says
 // so, which is the honest half of this change.
 let doorKindCache = { at: 0, url: null, kind: null };
+// ── WHETHER A READER HAS AN ASSISTANT ON THIS INSTALLATION ────────────────────────────────────────
+//
+// The only evidence either process holds is the connector's own access log: enrolment says a person MAY
+// connect, never that they did. `readConnections` is the connector's reader, imported rather than
+// rebuilt here — the path this log lives at is the connector's fact, and a portal deriving it from its
+// own environment is how a live key's record nearly got struck on a split install.
+//
+// TWO INSTALLATION SHAPES, AND THE SPLIT IS THE ONE THE ROUTE ALREADY MAKES. A hosted install has a
+// published client door and many signed-in people, so the question is answered per person: is this
+// email in the log. A local install has no client door, one reader, and a connector that cannot know
+// who it is serving — so the local route's own record answers for the only person who could be asking.
+// Reading a local record as an answer on a HOSTED install would mark every reader connected the moment
+// one member of staff ran the server by hand, which is why it is gated on there being no client door.
+//
+// Returns null, never false, when there was nothing to read. See the route for why that matters.
+//
+// CACHED FOR A MINUTE, the same as the door probe above and for the same reason: this is a page load,
+// not a check. It runs on every report a reader opens, and reading the tail of a log each time to
+// answer a question whose answer changes once, ever, would be paid on the client-facing screen.
+// KEYED ON THE FILES IT READ, not on time alone. The log's location is configuration and does not move
+// under a running service — but a cache that ignored it would answer about the wrong file for a minute
+// after it did, and it is what makes this cache testable at the route rather than only at the helper.
+let connectionsCache = { at: 0, key: null, seen: null };
+const CONNECTIONS_TTL_MS = 60_000;
+
+async function readerHasConnectedAi(principal) {
+  const email = String(principal?.email ?? "").trim().toLowerCase();
+  let seen = null;
+  // Imported here rather than at the top, the way every other reach into mcp-server/lib from this file
+  // is: the driver does not depend on the connector, and the import-cycle walk is what keeps it so.
+  let audit = null;
+  try { audit = await import("../mcp-server/lib/audit.mjs"); }
+  catch { return null; }                                            // best-effort: never fail a page load
+  const key = audit.auditPaths().join("\u0000");
+  if (connectionsCache.seen && connectionsCache.key === key && Date.now() - connectionsCache.at < CONNECTIONS_TTL_MS) {
+    seen = connectionsCache.seen;
+  } else {
+    try { seen = audit.readConnections(); } catch { return null; }
+    connectionsCache = { at: Date.now(), key, seen };
+  }
+  if (!seen.available) return null;
+  if (email && seen.emails.has(email)) return true;
+  if (!process.env.CLEAROTRON_CLIENT_MCP_URL && seen.local) return true;
+  return false;
+}
+
 const DOOR_KIND_TTL_MS = 60_000;
 async function connectorDoorKind(url) {
   if (!url) return null;
@@ -2402,6 +2509,18 @@ async function connectorDoorKind(url) {
           email: principal.email ?? null,        // the identity to sign in with — what they already use
           enabled: !!url,
           stdio,                                 // the local route, or null for a client
+          // ── HAS THIS READER ALREADY CONNECTED AN ASSISTANT? ──────────────────────────────────────
+          //
+          // Folded into this route rather than given its own, because the Ask-AI control on a report
+          // already loads it and a second request per report open buys nothing.
+          //
+          // `null` IS A THIRD STATE AND THE SCREEN HAS TO DRAW IT. True, false and "no log to read" are
+          // different facts: an installation whose access log has not been written yet, or cannot be
+          // read, has not told us this reader never connected — it has told us nothing. The control
+          // treats null the way it treats false, because offering the menu to somebody with no
+          // assistant reproduces the defect this is fixing, and because the panel carries its own way
+          // past ("Already connected? Ask anyway"). What it must not do is claim the measurement.
+          aiConnected: await readerHasConnectedAi(principal),
           // Every client, already resolved: served or not, with what it needs or why it cannot be.
           //
           // ── `steps` COMES BACK, on the owner's 2026-09-03 ruling ─────────
@@ -3060,7 +3179,16 @@ async function connectorDoorKind(url) {
             const p = envFrom(process.env, "CLEAROTRON_ACCESS_FILE");
             if (p) grantsFile = { name: basename(p), modifiedAt: new Date(statSync(p).mtimeMs).toISOString() };
           } catch { /* reported as unknown; a failed stat must not take down the page that explains access */ }
-          return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn }) };
+          // WHETHER AN ISSUED KEY CAN BE WITHDRAWN AT ALL, read the same way `disablePlan` reads it: the
+          // door loaded a revocation list at start, or it did not and never will for the keys already
+          // out. The variable's PRESENCE is the whole question — its value is a path, and this route
+          // must not say where.
+          // WHETHER A REVOCATION LIST IS NAMED FOR THIS PROCESS AT ALL — which is not the same question
+          // as whether the connector loaded one, and the page's words are careful about the difference.
+          // The connector is a separate unit with its own environment; this answers only for here.
+          const keysRevocable = Boolean(revokeConnectorKeys)
+            && String(process.env.TRADEMARK_MCP_TOKEN_DENYLIST ?? "").trim() !== "";
+          return { status: 200, json: accessView({ grants: grantsHere, viewer: principal, companies, grantsFile, localSignIn, keysRevocable }) };
         }
         // /portal/admin/people — give someone access. Manage-gated above; everything else is decided here.
         //
@@ -3075,18 +3203,32 @@ async function connectorDoorKind(url) {
           const email = String(body?.email ?? "").trim().toLowerCase();
           if (!email || email.indexOf("@") <= 0 || email.indexOf("@") !== email.lastIndexOf("@"))
             return { status: 400, json: { error: "Enter one email address." } };
+          // ACCESS TO EVERYTHING IS NOT A POINT, and the handler used to treat it as one. The form draws
+          // "Everything on this Clearotron" only to somebody who holds it, and sent it as
+          // `{kind:"everything"}` alongside the organisation and company points; nothing here matched
+          // that kind, so it fell to the 404 below and the page rendered the refusal it keeps for a
+          // point outside the adder's reach — "You can only give access to what you have access to
+          // yourself" — to the one person on the install for whom that is false. The control had never
+          // worked. It lives under `people` as a switch, not in any organisation, so it is read as one.
           const points = [];
+          let wantsEverything = false;
           for (const a of Array.isArray(body?.access) ? body.access : []) {
             const key = typeof a?.key === "string" ? a.key : "";
-            if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) points.push({ tenant: key });
+            if (a?.kind === "everything" && seesEverything(principal)) wantsEverything = true;
+            else if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) points.push({ tenant: key });
             else if (a?.kind === "company" && principal.accountOrgs?.[key]) points.push({ tenant: principal.accountOrgs[key], account: key });
             else return { status: 404, json: { error: "not_found" } };
           }
-          if (!points.length) return { status: 400, json: { error: "Choose at least one organisation or company this person may see." } };
-          const want = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true };
+          if (!points.length && !wantsEverything) return { status: 400, json: { error: "Choose at least one organisation or company this person may see." } };
+          const want = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true, everything: wantsEverything };
           if (want.run && !mayRun(principal)) return { status: 400, json: { error: "You cannot give Run clearances without holding it yourself." } };
           const existing = resolvePerson(email, grantsHere);
           const setSwitches = email !== principal.email && (!existing || reachCovers(principal, existing));
+          // THE SWITCHES ARE WHERE ACCESS TO EVERYTHING IS WRITTEN, so a grant of it that cannot write
+          // them writes nothing at all — and `withPerson` would return unchanged grants and this route a
+          // 201 naming a person who gained nothing. Said instead of returned.
+          if (wantsEverything && !setSwitches)
+            return { status: 400, json: { error: "Access to everything is part of what a person may do, and that cannot be set from here for this address. Nothing was saved." } };
           let next;
           try { next = withPerson(grantsHere, { email, points, switches: want, setSwitches }); }
           catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
@@ -3101,6 +3243,132 @@ async function connectorDoorKind(url) {
           const person = accessView({ grants: next, viewer: principal, companies }).people.find((p) => p.email === email) ?? null;
           return { status: 201, json: { person, switchesApplied: setSwitches } };
         }
+
+        // /portal/admin/people/change — change what somebody may do and see.
+        //
+        // THE DIFF IS COMPUTED HERE, FROM THE FILE, and never taken from the request. The page sends the
+        // state it wants; this reads what the file holds right now, narrows that to the part of the
+        // person the caller can see, and works out what to add and what to take away between the two. A
+        // page that had been open while somebody else was edited would otherwise write its own stale
+        // copy back over them — and the half it would overwrite is the half outside its own view, which
+        // nobody looking at either screen could see happen.
+        //
+        // NOBODY CHANGES THEMSELVES. The Add form already refuses to set the adder's own switches; this
+        // refuses the whole act, because a manager who can take their own Manage away can lock the
+        // install's last manager out of it with one press, and the way back is a text editor on the box.
+        if (parts[2] === "people" && parts[3] === "change" && parts.length === 4 && method === "POST") {
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
+          const email = String(body?.email ?? "").trim().toLowerCase();
+          if (email === principal.email) return { status: 400, json: { error: "You cannot change your own access. Somebody else who manages this install can." } };
+          const existing = resolvePerson(email, grantsHere);
+          const held = personPoints(grantsHere, email);
+          if (!existing && !held.listed && !held.points.length) return { status: 404, json: { error: "not_found" } };
+
+          // What the caller can see of this person, and what they asked for — both in the same shape, so
+          // the difference between them is the change.
+          const inReach = (pt) => pt.account == null
+            ? (principal.genericOrgs ?? []).includes(pt.tenant)
+            : principal.accountOrgs?.[pt.account] === pt.tenant;
+          const mine = held.points.filter(inReach);
+          const want = [];
+          for (const a of Array.isArray(body?.access) ? body.access : []) {
+            const key = typeof a?.key === "string" ? a.key : "";
+            if (a?.kind === "organisation" && (principal.genericOrgs ?? []).includes(key)) want.push({ tenant: key, account: null });
+            else if (a?.kind === "company" && principal.accountOrgs?.[key]) want.push({ tenant: principal.accountOrgs[key], account: key });
+            else return { status: 404, json: { error: "not_found" } };
+          }
+          const id = (pt) => `${pt.tenant}/${pt.account ?? "*"}`;
+          const wanted = new Set(want.map(id));
+          const kept = new Set(mine.map(id));
+          const drop = mine.filter((pt) => !wanted.has(id(pt)));
+          const add = want.filter((pt) => !kept.has(id(pt)));
+          // TAKING THE WHOLE OF SOMEBODY'S VISIBLE ACCESS AWAY IS REMOVAL, and it has its own route, its
+          // own confirmation and its own revocation. Reaching it by unticking every row would do half of
+          // that act under the word "save".
+          if (!want.length) return { status: 400, json: { error: "Leave them at least one organisation or company, or remove them instead." } };
+
+          const switches = { run: body?.permissions?.run === true, manage: body?.permissions?.manage === true,
+            everything: held.switches.everything };
+          if (switches.run && !held.switches.run && !mayRun(principal))
+            return { status: 400, json: { error: "You cannot give Run clearances without holding it yourself." } };
+          // Switches belong to the person and not to a point, so they are set only when the whole of this
+          // person sits inside the caller's reach. Otherwise the points move and the switches stay, and
+          // the answer says which happened — the same contract adding already has.
+          const setSwitches = reachCovers(principal, existing);
+          let next;
+          try {
+            next = drop.length ? withoutPerson(grantsHere, { email, points: drop }) : grantsHere;
+            next = withPerson(next, { email, points: add, switches, setSwitches });
+          } catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
+          try { await writeGrants(next); }
+          catch (e) {
+            audit({ event: "person-change", by: principal.email, person: email, ok: false, error: String(e?.message ?? e).slice(0, 200) });
+            return { status: 500, json: { error: "The guest list could not be written, so nothing was changed." } };
+          }
+          audit({ event: "person-change", by: principal.email, person: email, added: add.length, removed: drop.length,
+            switchesApplied: setSwitches, ok: true, status: 200 });
+          const { loadProfiles } = await import("./profiles.mjs");
+          const companies = Object.fromEntries([...loadProfiles({ force: true }).values()].map((p) => [p.key, p.name ?? p.key]));
+          const person = accessView({ grants: next, viewer: principal, companies }).people.find((p) => p.email.toLowerCase() === email) ?? null;
+          return { status: 200, json: { person, switchesApplied: setSwitches, added: add.length, removed: drop.length } };
+        }
+
+        // /portal/admin/people/remove — take their access away.
+        //
+        // HOW FAR IT REACHES IS THE SERVER'S ANSWER, NOT THE REQUEST'S. A caller who can see the whole of
+        // this person removes them from the install; a caller who can see one organisation's worth of
+        // them takes away that organisation and nothing else. The page draws a different button for each
+        // — it reads the same `covered` the view computes — but the request carries no scope to get
+        // wrong, so a stale page cannot ask for more than the person pressing it can see.
+        if (parts[2] === "people" && parts[3] === "remove" && parts.length === 4 && method === "POST") {
+          if (localSignIn) return { status: 409, json: { error: "local_sign_in" } };
+          if (!writeGrants) return { status: 503, json: { error: "cannot_write_grants" } };
+          const email = String(body?.email ?? "").trim().toLowerCase();
+          if (email === principal.email) return { status: 400, json: { error: "You cannot remove your own access. Somebody else who manages this install can." } };
+          const existing = resolvePerson(email, grantsHere);
+          const held = personPoints(grantsHere, email);
+          if (!existing && !held.listed && !held.points.length) return { status: 404, json: { error: "not_found" } };
+          const whole = reachCovers(principal, existing);
+          const inReach = (pt) => pt.account == null
+            ? (principal.genericOrgs ?? []).includes(pt.tenant)
+            : principal.accountOrgs?.[pt.account] === pt.tenant;
+          const mine = held.points.filter(inReach);
+          if (!whole && !mine.length) return { status: 404, json: { error: "not_found" } };
+
+          let next;
+          try { next = withoutPerson(grantsHere, whole ? { email, all: true } : { email, points: mine }); }
+          catch (e) { return { status: 400, json: { error: String(e?.message ?? e).slice(0, 300) } }; }
+
+          // THE KEYS, AND ONLY ON A WHOLE REMOVAL. A narrowing leaves the person on the install with
+          // access somewhere else, and their connector key is how they reach that.
+          let keys = { checked: false };
+          if (whole) {
+            if (!revokeConnectorKeys) keys = { checked: false, note: "this installation cannot revoke issued keys from here" };
+            else {
+              try {
+                const { grants: written, ...said } = await revokeConnectorKeys({ email, grants: next });
+                next = written ?? next;
+                keys = { checked: true, ...said };
+              }
+              // A REVOCATION THAT FAILED MUST NOT LOOK LIKE ONE THAT HAPPENED, and it must not take the
+              // removal with it either: the access record is the gate every surface reads, and leaving
+              // it in place because a key file could not be appended would be the larger failure.
+              catch (e) { keys = { checked: true, failed: true, note: String(e?.message ?? e).slice(0, 200) }; }
+            }
+          }
+
+          try { await writeGrants(next); }
+          catch (e) {
+            audit({ event: "person-remove", by: principal.email, person: email, ok: false, error: String(e?.message ?? e).slice(0, 200) });
+            return { status: 500, json: { error: "The guest list could not be written, so nothing was changed." } };
+          }
+          audit({ event: "person-remove", by: principal.email, person: email, scope: whole ? "install" : "organisations",
+            organisations: whole ? null : [...new Set(mine.map((pt) => pt.tenant))].length,
+            keysRevoked: keys.revoked ?? 0, keysUnrevokable: keys.lateArm ? (keys.jtis?.length ?? 0) : 0, ok: true, status: 200 });
+          return { status: 200, json: { removed: whole ? "install" : "organisations",
+            organisations: whole ? [] : [...new Set(mine.map((pt) => pt.tenant))], keys } };
+        }
         // /portal/admin/observed — who has actually USED this instance lately, from the audit log.
         //
         // ALWAYS 200, even when the log is missing or unreadable, with an `available` boolean — the
@@ -4302,6 +4570,18 @@ const PORT = PORT_CHOICE.port;
     atomicWrite(envFrom(process.env, "CLEAROTRON_ACCESS_FILE"), `${JSON.stringify(g, null, 2)}\n`);
   };
 
+  // Revoking a removed person's connector keys, from the same module `clearotron disconnect` revokes
+  // through — one author for what revoking means, and one place the ordering rule lives: the id reaches
+  // the denylist before its record is struck, because a record removed first leaves a live key with no
+  // trace it ever existed.
+  //
+  // IT NEVER NAMES THE LIST IN `.env`. `applyDisablePlan` will do that when a plan is `lateArm` — the
+  // door was started without a revocation list, so the running process never loaded one — and that step
+  // belongs to an operator at a terminal, not to a web request rewriting the install's environment. So
+  // a lateArm plan is NOT applied: nothing is written, and the answer says the keys stay live until they
+  // expire. Striking the records instead would delete the only record of a working key.
+  const revokeConnectorKeys = makeConnectorKeyRevoker({ env: process.env });
+
   const { config } = await import("./driver.config.mjs");
   const { appendFileSync: append } = await import("node:fs");
   const auditPath = process.env.PORTAL_AUDIT || join(HERE, "..", "portal-audit.log");
@@ -4805,7 +5085,7 @@ const PORT = PORT_CHOICE.port;
   const service = makePortalService({ poolRoot: config.poolRoot, workspaceRoot: config.workspaceRoot,
     // Re-read per request (a getter that rescans), so a workspace created after boot is counted.
     queueDirs: () => config.queueDirs,
-    secret, grants, localSignIn: LOCAL_MODE, writeGrants, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
+    secret, grants, localSignIn: LOCAL_MODE, writeGrants, revokeConnectorKeys, trigger, stopRun, audit, auditPath, upstream, composeRead, stopControl,
     // — the ONLY place the environment is read for this. `bin/start.mjs` is the
     // only thing that sets it, and it sets it explicitly rather than passing the operator's inherited
     // environment through, so a stray `.env` can neither put a live install into demo mode nor take a