clearotron 0.3.2-beta.7 → 0.3.2-beta.9

package/scripts/release-note-required.mjs

@@ -67,6 +67,23 @@
 // the releases page is built from `.changeset/*.md`, and a line in a commit message reaches no reader. A
 // line may instead NAME the note that answers for it, `Release-note: .changeset/<name>.md`, and that is read
 // as an answer, provided the range adds that note.
+//
+// ── A NOTE THE RANGE WITHDRAWS, AND SAYS WHY, IS AN ANSWER ────────────────────────────────────────────
+//
+// A ruling took a beta-only change back out, and the commit that removed it removed the note that
+// announced it too, so the stable changelog would not promise a ceiling the stable release does not have.
+// That deletion is right, and it left two earlier commits naming a note the range no longer carries:
+// refused, and unfixable, because the only fix the check offered was editing commits already pushed.
+//
+// So a note that a LATER commit in the same range DELETES counts as consumed for the commits that added
+// or named it — provided the deleting commit says why, in its own `Release-note: none — <reason>` or in a
+// note of its own. The reason is asked of the DELETING commit because it is the newest of the two, the
+// only one that can still be amended, and the one that knows why the reader now hears nothing. Said, not
+// silent: every commit excused this way is printed with the sha that withdrew its note and that reason.
+//
+// A deletion that gives no reason still refuses, and names the deleting commit as where the reason goes.
+// The move a pre-release makes — `.changeset/<name>.md` deleted and `.changeset/pre/<name>.md` added in
+// one commit — is not a withdrawal: the note still reaches a reader, and a version commit is that shape.
 import { execFileSync } from "node:child_process";
 import { readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
@@ -143,12 +160,14 @@ const shipped = (paths, files) => paths.filter((p) => !NEVER_A_NOTE.some((re) =>
  * PURE. What each commit in a range owes, decided per commit (see the header).
  *
  * @param {object} o
- * @param {Array<{sha:string, subject:string, message:string, paths:string[], added?:string[]}>} o.commits  non-merge,
- *   oldest first; `added` is the paths the commit adds, when the caller read them
+ * @param {Array<{sha:string, subject:string, message:string, paths:string[], added?:string[], deleted?:string[]}>} o.commits
+ *   non-merge, oldest first; `added` and `deleted` are the paths the commit adds and removes, when the caller read them
  * @param {string[]} o.files  the package's own `files` list
  * @param {string[]|null} [o.atHead]  every path the head carries under `.changeset/`, when the caller read it
  * @returns {{visible:string[], notes:string[], declined:Array<{sha:string, subject:string, reason:string}>,
- *   owed:Array<{sha:string, subject:string, why:"no-note"|"prose"|"bare-none"|"names-a-missing-note", paths?:string[], text?:string}>}}
+ *   withdrawals:Array<{sha:string, subject:string, note:string, by:string, reason:string}>,
+ *   owed:Array<{sha:string, subject:string, why:"no-note"|"prose"|"bare-none"|"names-a-missing-note"|"note-withdrawn-unsaid",
+ *   paths?:string[], text?:string, by?:string}>}}
  */
 export function commitVerdicts({ commits = [], files = [], atHead = null } = {}) {
   // `added` and `atHead` are what the command reads from git; a caller that passes neither keeps the older
@@ -172,8 +191,34 @@ export function commitVerdicts({ commits = [], files = [], atHead = null } = {})
   const notes = [...new Set(commits.flatMap(notesOf))];
   const noteNames = new Set(notes.map((p) => p.split("/").pop()));
   const visible = [...new Set(commits.flatMap((c) => shipped(c.paths, files)))];
-  const declined = [], owed = [];
-  for (const c of commits) {
+  const nameOf = (p) => p.split("/").pop();
+  // WHICH NOTES THIS RANGE TAKES BACK, AND WHETHER IT SAYS WHY. A commit that deletes a note path and
+  // adds one of the same name is MOVING it — what a pre-release cut does to every note it consumes — and
+  // a move is not a withdrawal. A name the head still carries was never withdrawn at all.
+  //
+  // THE DELETION THAT ANSWERS IS THE LAST ONE, because a note can go and come back. This note was
+  // written, consumed into `.changeset/pre/` by a beta cut, brought back at its old path by a merge of a
+  // main the cut had already taken it from, dropped again as a duplicate, and only then removed under the
+  // ruling. Taking the first deletion would have printed the duplicate sweep's reason — "removes
+  // duplicates of notes that already shipped" — against a commit the ruling is what excuses. Measured on
+  // the range, 2026-09-18.
+  const withdrawn = new Map();
+  commits.forEach((c, at) => {
+    const readded = new Set((c.added ?? []).filter(isNotePath).map(nameOf));
+    for (const p of (c.deleted ?? []).filter(isNotePath)) {
+      const name = nameOf(p);
+      if (readded.has(name)) continue;
+      const own = notesOf(c).map(nameOf);
+      const reason = NO_NOTE.exec(String(c.message ?? ""))?.groups?.reason
+        ?? (own.length ? `the note ${own[0]} it wrote in its place` : null);
+      withdrawn.set(name, { sha: c.sha, subject: c.subject, reason, at });
+    }
+    for (const name of readded) withdrawn.delete(name);   // a later copy puts the note back in the range
+  });
+  // AND A NAME THE HEAD STILL CARRIES WAS NEVER WITHDRAWN AT ALL: the release assembles what the head has.
+  if (presentNames) for (const name of [...withdrawn.keys()]) if (presentNames.has(name)) withdrawn.delete(name);
+  const declined = [], owed = [], withdrawals = [];
+  for (const [i, c] of commits.entries()) {
     const ships = shipped(c.paths, files);
     if (!ships.length) continue;                              // nothing a reader could see in this commit
     const addsNote = notesOf(c).length > 0;
@@ -189,13 +234,24 @@ export function commitVerdicts({ commits = [], files = [], atHead = null } = {})
       continue;
     }
     if (addsNote) continue;                                   // it carries its own note
+    // THE NOTE THIS COMMIT ANSWERED WITH, TAKEN BACK BY A LATER ONE. Only a later commit: a name deleted
+    // before this commit named it was never this commit's answer.
+    const addedNames = [...new Set((c.added ?? c.paths).filter(isNotePath).map(nameOf))];
+    const takenBack = [...new Set([...addedNames, ...named])]
+      .map((n) => [n, withdrawn.get(n)]).filter(([, w]) => w && w.at > i);
+    const said = takenBack.find(([, w]) => w.reason);
+    if (said) { withdrawals.push({ ...at, note: said[0], by: said[1].sha, reason: said[1].reason }); continue; }
+    if (takenBack.length) {
+      owed.push({ ...at, why: "note-withdrawn-unsaid", text: takenBack[0][0], by: takenBack[0][1].sha });
+      continue;
+    }
     const missing = named.filter((n) => !noteNames.has(n));
     if (missing.length) { owed.push({ ...at, why: "names-a-missing-note", text: missing[0] }); continue; }
     if (named.length) continue;                               // it names a note the range adds
     if (notes.length) continue;                               // a note in the range answers for it
     owed.push({ ...at, why: "no-note", paths: ships });
   }
-  return { visible, notes, declined, owed };
+  return { visible, notes, declined, withdrawals, owed };
 }
 
 const argAfter = (flag) => {
@@ -232,6 +288,7 @@ function main() {
       message: git("log", "-1", "--format=%B", sha),
       paths: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", sha).split("\n").filter(Boolean),
       added: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", "--diff-filter=A", sha).split("\n").filter(Boolean),
+      deleted: git("diff-tree", "--no-commit-id", "--name-only", "-r", "--root", "--diff-filter=D", sha).split("\n").filter(Boolean),
     }));
     atHead = git("ls-tree", "-r", "--name-only", head, "--", ".changeset/").split("\n").filter(Boolean);
   } catch (e) {
@@ -245,13 +302,19 @@ function main() {
   catch (e) { console.error(`release-note-required: cannot read the shipped file list: ${e.message}`); process.exit(2); }
   if (!files.length) { console.error("release-note-required: package.json names no shipped files, so this cannot look"); process.exit(2); }
 
-  const { visible, notes, declined, owed } = commitVerdicts({ commits, files, atHead });
+  const { visible, notes, declined, withdrawals, owed } = commitVerdicts({ commits, files, atHead });
   console.log(`release-note-required: ${changed.length} changed file(s) against ${base}`
     + `${head === "HEAD" ? "" : ` (head ${head})`}; `
-    + `${visible.length} ship as code; ${notes.length} release note(s) in the range; ${commits.length} commit(s) read`);
+    + `${visible.length} ship as code; ${notes.length} release note(s) in the range; ${commits.length} commit(s) read`
+    + `${withdrawals.length ? `; ${withdrawals.length} answered by a note the range withdrew` : ""}`);
   // PER COMMIT, SAID AS PER COMMIT. "no note, declared on purpose" read as a verdict on the range, and beside
   // a range that carries a note it told a reader skimming the output that none went out. Found in review.
   for (const d of declined) console.log(`  ${d.sha.slice(0, 7)} declines a note of its own, on purpose: ${d.reason}`);
+  // AN EXCUSED COMMIT IS PRINTED, WITH THE SHA THAT EXCUSED IT. A pass this check reached by reading
+  // another commit's decision is one a person may want to disagree with, and they cannot if it is silent.
+  for (const w of withdrawals) {
+    console.log(`  ${w.sha.slice(0, 7)} answered with ${w.note}, which ${w.by.slice(0, 7)} withdrew: ${w.reason}`);
+  }
   if (!owed.length) return;
 
   console.error(`\n${owed.length} commit(s) that ship as code owe a release note:\n`);
@@ -267,6 +330,11 @@ function main() {
     } else if (o.why === "bare-none") {
       console.error("      says `Release-note: none` and gives no reason. The reason is the whole point of the"
         + "\n      line — it is what a later reader uses to tell a considered decision from a skipped step.");
+    } else if (o.why === "note-withdrawn-unsaid") {
+      console.error(`      answered with ${o.text}, which ${o.by.slice(0, 7)} deletes in this range without saying why.`
+        + "\n      A note the head does not carry reaches no reader. If the change it described went out of the"
+        + "\n      release too, say that in THAT commit — `Release-note: none — <why>` — which is the newest of"
+        + "\n      the two and the one that can still be amended.");
     } else {
       console.error(`      names ${o.text} as its note, and this range adds no note by that name.`);
     }

package/scripts/report-header-render-check.mjs

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+// Copyright 2026 Cordillera Sàrl. Additional terms under section 7 of the AGPL-3.0 apply — see ADDITIONAL-TERMS.md
+// report-header-render-check.mjs — the delivered document's own header, measured in a browser.
+//
+//   node scripts/report-header-render-check.mjs [--keep]
+//
+// Two properties, both of which a reader met as defects on 2026-09-18 and neither of which any unit test
+// can see, because every one of them asserts on the HTML STRING and both of these are layout:
+//
+//   1. ONE HEADER. The section breadcrumb is a row INSIDE `.rep-stickyhead`, and when the page is
+//      scrolled the header is still at the top of the viewport with the breadcrumb inside it. It used to
+//      be a sibling pinned at `top:var(--tb-h,52px)` — a variable this product sets nowhere — so it sat
+//      at a guessed offset, showed content through the slit between the two bars, and slid under the
+//      header whenever the guess was wrong.
+//   2. THE BAND PILL CLEARS ITS HEADING. The pill hangs above the ladder and the heading sits above the
+//      pill, and at the LEFTMOST band the pill is drawn flush left — directly under "Overall risk". They
+//      overlapped, which is what a reader meets on a knockout whose band is the bottom rung.
+//
+// Driven at every rung of the ladder, not only the one a fixture happens to carry: the overlap is a
+// property of the leftmost position, so a check that renders one band proves nothing about the band the
+// next report lands on.
+import { spawn } from 'node:child_process'
+import { createServer } from 'node:http'
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs'
+import { join } from 'node:path'
+import { tmpdir } from 'node:os'
+import { reapOnExit } from '../shared/reap-on-exit.mjs'
+import { browserRun } from '../shared/browser-temp-root.mjs'
+import { renderKnockoutHtml } from '../driver/publish/render-knockout.mjs'
+
+const keep = process.argv.includes('--keep')
+const WIDTH = 1280
+
+// The ladder the house triage framework ships, so the rungs are the product's own and not invented here.
+const FRAMEWORK = {
+  framework_key: 'house-triage',
+  title: 'House triage',
+  bands: [{ label: 'Blocking', tone: 'severe' }, { label: 'Medium', tone: 'medium' },
+    { label: 'Manageable', tone: 'low' }, { label: 'Low', tone: 'minimal' }],
+}
+const BANDS = FRAMEWORK.bands.map((b) => b.label)
+
+// A mark with the STRUCTURE the gauge card needs — a basis and factors are what make `readBlock` draw the
+// card at all. The words are fixture words; nothing here is a finding.
+const markAt = (band) => ({
+  name: 'EXAMPLEMARK',
+  rating: band,
+  classes: [9],
+  basis: 'One identical name in the same trade, and two that contain it.',
+  factors: ['An identical name is registered in class 9.', 'The trade is the same.'],
+  counterFactors: ['The register counts do not say who is using what.'],
+  mitigation: 'A narrower specification would move this.',
+  assessment: '## What the screen found\n\nOne identical name.\n\n## What happens next\n\nTake it to clearance.',
+  findings: [],
+})
+
+const docFor = (band) => renderKnockoutHtml(
+  { marks: [markAt(band)], batch: { executiveSummary: 'One name screened.' } },
+  FRAMEWORK,
+  { runId: 'fixture', overall: band, identity: { identity: 'Knockout search' }, issuedDate: '2026-09-18' },
+)
+
+const dir = mkdtempSync(join(tmpdir(), 'report-header-check-'))
+for (const band of BANDS) writeFileSync(join(dir, `${band.toLowerCase()}.html`), docFor(band))
+
+const server = createServer((req, res) => {
+  const name = decodeURIComponent((req.url ?? '/').split('?')[0]).replace(/^\//, '')
+  try {
+    res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' })
+    res.end(docFor(BANDS.find((b) => b.toLowerCase() === name.replace(/\.html$/, '')) ?? BANDS[0]))
+  } catch { res.writeHead(404); res.end('no') }
+})
+await new Promise((r) => server.listen(0, '127.0.0.1', r))
+const origin = `http://127.0.0.1:${server.address().port}`
+
+const { profile, env: chromeEnv, keep: keepRoot } = browserRun('report-header-check-')
+if (keep) keepRoot()
+const chrome = spawn('google-chrome', [
+  '--headless=new', '--disable-gpu', '--no-sandbox', '--hide-scrollbars',
+  '--host-resolver-rules=MAP * ~NOTFOUND, EXCLUDE 127.0.0.1',
+  `--user-data-dir=${profile}`, `--window-size=${WIDTH},900`, '--remote-debugging-port=0', 'about:blank',
+], { stdio: ['ignore', 'ignore', 'pipe'], detached: true, env: chromeEnv })
+reapOnExit(chrome)
+
+const wsUrl = await new Promise((resolve, reject) => {
+  let devtools = ''
+  const t = setTimeout(() => reject(new Error(`chrome reported no devtools endpoint in 60s:\n${devtools || '(nothing)'}`)), 60000)
+  chrome.stderr.on('data', (c) => { devtools += c; const m = devtools.match(/ws:\/\/[^\s]+/); if (m) { clearTimeout(t); resolve(m[0]) } })
+})
+const ws = new WebSocket(wsUrl)
+let id = 0
+const pending = new Map()
+ws.addEventListener('message', (e) => { const m = JSON.parse(e.data); if (m.id && pending.has(m.id)) { pending.get(m.id)(m); pending.delete(m.id) } })
+await new Promise((r) => ws.addEventListener('open', r))
+const send = (method, params = {}) => new Promise((r) => { const i = ++id; pending.set(i, r); ws.send(JSON.stringify({ id: i, method, params })) })
+const { result: targets } = await send('Target.getTargets')
+const page = targets.targetInfos.find((t) => t.type === 'page')
+const { result: sess } = await send('Target.attachToTarget', { targetId: page.targetId, flatten: true })
+const sessionId = sess.sessionId
+const cmd = (method, params) => new Promise((r) => { const i = ++id; pending.set(i, r); ws.send(JSON.stringify({ id: i, sessionId, method, params })) })
+const value = async (expr) => (await cmd('Runtime.evaluate', { expression: expr, awaitPromise: true, returnByValue: true })).result?.result?.value ?? null
+
+// MEASURED OFF RECTANGLES, never off a class name: a rule that is present and overridden and a rule that
+// works look identical to a selector, and the whole subject here is which one is true.
+const PROBE = `(async () => {
+  const sleep = (ms) => new Promise(r => setTimeout(r, ms));
+  window.scrollTo(0, 0); await sleep(60);
+  const head = document.querySelector('.rep-stickyhead');
+  const strip = document.querySelector('nav.strip');
+  const label = document.querySelector('.ko-gauge .label');
+  const pill = document.querySelector('.kpill');
+  if (!head || !strip) return { drawn: false, head: !!head, strip: !!strip };
+  const r = (el) => { const b = el.getBoundingClientRect(); return { top: b.top, bottom: b.bottom, left: b.left, height: b.height }; };
+  const out = {
+    drawn: true,
+    inside: head.contains(strip),
+    labelled: (strip.textContent || '').replace(/\\s+/g, ' ').trim(),
+    pill: pill ? r(pill) : null,
+    label: label ? r(label) : null,
+    pillText: pill ? (pill.textContent || '').trim() : null,
+  };
+  // Scroll well past the header and read again: what stays is what a reader keeps.
+  window.scrollTo(0, 1200); await sleep(120);
+  out.scrolled = { head: r(head), strip: r(strip), scrollY: window.scrollY };
+  return out;
+})()`
+
+const fail = []
+const ok = []
+for (const band of BANDS) {
+  await cmd('Page.navigate', { url: `${origin}/${band.toLowerCase()}.html` })
+  await new Promise((r) => setTimeout(r, 700))
+  const m = await value(PROBE)
+  const where = `band ${band}`
+  if (!m || !m.drawn) { fail.push(`${where}: the document drew no header or no breadcrumb (${JSON.stringify(m)})`); continue }
+
+  // 1 — one header
+  if (!m.inside) fail.push(`${where}: the breadcrumb is not inside .rep-stickyhead`)
+  else ok.push(`${where}: breadcrumb inside the header — "${m.labelled}"`)
+
+  const s = m.scrolled
+  if (!(s.scrollY > 300)) fail.push(`${where}: the page did not scroll (scrollY ${s.scrollY}) — the pin was not tested`)
+  else if (Math.abs(s.head.top) > 1) fail.push(`${where}: the header did not pin (top ${s.head.top.toFixed(1)} at scrollY ${s.scrollY})`)
+  else if (s.strip.top < s.head.top - 1 || s.strip.bottom > s.head.bottom + 1)
+    fail.push(`${where}: the breadcrumb left the header under scroll (strip ${s.strip.top.toFixed(1)}–${s.strip.bottom.toFixed(1)}, header ${s.head.top.toFixed(1)}–${s.head.bottom.toFixed(1)})`)
+  else ok.push(`${where}: header pinned at 0 with the breadcrumb inside it at scrollY ${s.scrollY}`)
+
+  // 2 — the band pill clears its heading
+  if (!m.pill || !m.label) fail.push(`${where}: the band card drew no pill or no heading`)
+  else if (m.pill.top < m.label.bottom)
+    fail.push(`${where}: the "${m.pillText}" pill overlaps the heading by ${(m.label.bottom - m.pill.top).toFixed(1)}px`)
+  else ok.push(`${where}: the "${m.pillText}" pill clears the heading by ${(m.pill.top - m.label.bottom).toFixed(1)}px`)
+}
+
+for (const line of ok) console.log(`  ok   ${line}`)
+for (const line of fail) console.log(`  FAIL ${line}`)
+try { ws.close() } catch { /* the browser is going anyway */ }
+try { process.kill(-chrome.pid, 'SIGKILL') } catch { /* already gone */ }
+server.close()
+if (!keep) rmSync(dir, { recursive: true, force: true })
+console.log(fail.length
+  ? `\nreport-header-render-check: ${fail.length} measurement(s) failed.`
+  : `\nreport-header-render-check: ${ok.length} measurements, all clear.`)
+process.exit(fail.length ? 1 : 0)

package/scripts/settings-render-check.mjs

@@ -89,6 +89,20 @@ const server = createServer((req, res) => {
   if (path === '/portal/admin/config' && !wantsPage) return json(adminConfig)
   if (path === '/portal/api/about') return json(about)
   if (path === '/portal/admin/roster' && !wantsPage) return json({ customers: [{ key: 'northwind', name: 'Northwind Foods' }] })
+  // THE PEOPLE SCREEN'S OWN DATA. Rows with real-length values on purpose: the defect this screen was
+  // filed for is a second column cut off at a phone's right edge, and a table of empty rows cannot show
+  // it. The permission phrases are the product's own words, the longest of them included.
+  if (path === '/portal/admin/access' && !wantsPage) {
+    return json({
+      note: '',
+      unknownAccounts: [],
+      people: [
+        { email: 'rosa.venn@northwind.example', permissions: { run: true, manage: true }, accounts: '*', listed: true },
+        { email: 'imani.oduya@northwind.example', permissions: { run: true, manage: false }, accounts: ['northwind'], listed: true },
+        { email: 'peter.halvorsen@northwind.example', permissions: { run: false, manage: false }, accounts: ['northwind'], listed: true },
+      ],
+    })
+  }
   if (path === '/portal/login') {
     res.writeHead(200, { 'content-type': 'text/html' })
     return res.end(loginPage({ email: EMAIL, resetCommand: state.reset }))
@@ -176,11 +190,16 @@ async function setTheme(theme) {
 
 // A FULL-HEIGHT VIEWPORT, not a beyond-viewport capture: a beyond-viewport capture paints the sticky rail
 // and top bar where the 900px viewport put them.
-async function capture(name) {
+async function capture(name, width = 1280) {
   if (!shotDir) return
   await evalIn('window.scrollTo(0, 0)')
+  // THE WIDTH IS APPLIED BEFORE THE HEIGHT IS MEASURED. A narrow viewport reflows the page taller, and
+  // measuring first captures a page cut off at the fold — which is how a phone-width check ends up
+  // producing a picture that looks fine and shows half the screen.
+  await cmd('Emulation.setDeviceMetricsOverride', { width, height: 900, deviceScaleFactor: 1, mobile: width < 700 })
+  await sleep(250)
   const h = await evalIn('Math.max(document.documentElement.scrollHeight, document.body.scrollHeight)') ?? 900
-  await cmd('Emulation.setDeviceMetricsOverride', { width: 1280, height: Math.max(900, h), deviceScaleFactor: 1, mobile: false })
+  await cmd('Emulation.setDeviceMetricsOverride', { width, height: Math.max(900, h), deviceScaleFactor: 1, mobile: width < 700 })
   await sleep(400)
   const shot = await cmd('Page.captureScreenshot', { format: 'png' })
   await cmd('Emulation.clearDeviceMetricsOverride', {})
@@ -544,6 +563,60 @@ for (const theme of ['light', 'dark']) {
   state.reset = null
 }
 
+// ── People, at a desktop width and a phone's ────────────────────────────────────────────────────────
+//
+// THE SCREEN NOTHING COULD DRAW. It was reported as clipping its Permissions column at 400px "with no
+// horizontal scroll offered", and the reading could not be settled from the source: the table sits in a
+// wrapper set to scroll and carries a 760px floor, and both were already true at the sha the report was
+// measured against. So either the scrollbar is an overlay one — real, invisible, and invisible in a
+// capture — or something else clipped it and has since changed. No check reached this screen, so nobody
+// could look. This is the looking.
+//
+// The rows carry real-length values deliberately. A table of empty rows cannot show a column being cut.
+console.log('\nPeople, at 1280 and at 400:')
+if (await open('/portal/people', "document.querySelector('table.data tbody tr')", 'People drew its table')) {
+  const peopleProbe = `(() => {
+    const wrap = document.querySelector('.table-wrap');
+    const table = document.querySelector('table.data');
+    const head = [...document.querySelectorAll('table.data thead th')].map((th) => th.innerText.trim());
+    const perm = [...document.querySelectorAll('table.data tbody tr')].map((tr) => tr.children[1]?.innerText.trim() ?? '');
+    return {
+      rows: document.querySelectorAll('table.data tbody tr').length,
+      head, perm,
+      // Does the wrapper actually have somewhere to scroll TO, and does it allow it?
+      scrollable: wrap ? wrap.scrollWidth > wrap.clientWidth + 1 : null,
+      overflowX: wrap ? getComputedStyle(wrap).overflowX : null,
+      wrapW: wrap ? Math.round(wrap.clientWidth) : null,
+      tableW: table ? Math.round(table.scrollWidth) : null,
+      // The page itself must NOT scroll sideways — that is the failure the clearances fix was about.
+      pageScrollsSideways: document.documentElement.scrollWidth > document.documentElement.clientWidth + 1,
+    };
+  })()`
+
+  for (const [label, width] of [['desktop', 1280], ['phone', 400]]) {
+    await cmd('Emulation.setDeviceMetricsOverride', { width, height: 900, deviceScaleFactor: 1, mobile: width < 700 })
+    await sleep(350)
+    const p = (await evalIn(peopleProbe)) ?? {}
+    ok(p.rows === 3, `${label}: the three people are drawn (saw ${p.rows})`)
+    // The heading is upper-cased by CSS, so innerText returns it that way — compare the word, not the casing.
+    ok(p.head?.[1]?.toLowerCase() === 'permissions', `${label}: the second column is still the permissions one (saw ${JSON.stringify(p.head)})`)
+    ok(p.perm?.every((t) => t.length > 0), `${label}: every row states an access (saw ${JSON.stringify(p.perm)})`)
+    // THE PROPERTY, not the pixel. A column wider than its wrapper is fine as long as the wrapper
+    // scrolls; it is a defect only when the overflow has nowhere to go, or when the PAGE takes it.
+    ok(p.overflowX === 'auto' || p.overflowX === 'scroll',
+      `${label}: the table's wrapper can scroll sideways (overflow-x: ${p.overflowX})`)
+    ok(p.pageScrollsSideways === false,
+      `${label}: the page itself does not scroll sideways — the table's overflow stays in the table`)
+    console.log(`    ${label}: wrapper ${p.wrapW}px, table ${p.tableW}px, wrapper scrollable: ${p.scrollable}`)
+    await cmd('Emulation.clearDeviceMetricsOverride', {})
+    for (const theme of ['light', 'dark']) {
+      await setTheme(theme)
+      await capture(`people-${label}-${theme}`, width)
+    }
+    await setTheme('light')
+  }
+}
+
 // ── a browser whose storage refuses ──────────────────────────────────────────────────────────────────
 //
 // localStorage throws outright in a null-origin or locked-down document. The page must still draw, the

package/scripts/test-full.mjs

@@ -166,10 +166,89 @@ export function plan(root = ROOT, { providerFiles } = {}) {
   return { corpora, faults };
 }
 
+/**
+ * ── SHARDING, AND WHY IT CANNOT SILENTLY DROP A FILE ──────────────────────────────────────────────
+ *
+ * The offline suite was the whole wall clock of CI: 12.8 minutes against 4.3 for the portal bundle and
+ * under one each for the other two jobs, which run beside it. Nearly all of that is `driver`, 925 of the
+ * ~980 test files in the tree, executed in one serial job. Agents write faster than that gate opens, so
+ * the gate — not the work — set the pace of the day.
+ *
+ * A shard is a SLICE OF THE SORTED FILE LIST TAKEN BY INDEX: shard i of n takes every file whose
+ * position satisfies `index % n === i - 1`. That is exhaustive and disjoint by construction — every
+ * index lands in exactly one shard, for any n — so the union of the shards is the whole list as a
+ * property of the arithmetic, not as something a check has to confirm afterwards. Round-robin rather
+ * than contiguous blocks because neighbouring files in a sorted list tend to be the same subsystem and
+ * to cost the same; interleaving spreads the slow ones.
+ *
+ * WHAT IS NOT SHARDED, and why that is stated rather than assumed. Only a corpus whose own test script
+ * is the plain `node --test test/*.test.mjs` shape can be expressed as an explicit file list and cut up
+ * this way. `portal-ui` runs a typecheck first and drives `.test.ts` through `--experimental-strip-types`,
+ * so it is not that shape: it runs WHOLE, on shard 1, and says so on every other shard rather than
+ * disappearing from them. Anything else that stops matching the shape falls into the same branch and is
+ * reported, never quietly skipped.
+ */
+const PLAIN_GLOB = /^node \.\.\/scripts\/test-run\.mjs node --test test\/\*\.test\.mjs$/;
+
+export function shardSlice(list, i, n) {
+  return list.filter((_, idx) => idx % n === i - 1);
+}
+
+function workspaceTestFiles(root, ws) {
+  const dir = join(root, ws, "test");
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir).filter((f) => f.endsWith(".test.mjs")).sort().map((f) => `${ws}/test/${f}`);
+}
+
+/** Is this workspace's `test:full` the plain shape we can express as a file list? */
+function isShardable(root, ws) {
+  try {
+    const scripts = JSON.parse(readFileSync(join(root, ws, "package.json"), "utf8")).scripts ?? {};
+    let cmd = scripts["test:full"] ?? "";
+    // `test:full` is often just `npm run test`; follow that one hop.
+    const hop = cmd.match(/^npm run (\S+)$/);
+    if (hop) cmd = scripts[hop[1]] ?? "";
+    return PLAIN_GLOB.test(cmd.trim());
+  } catch { return false; }
+}
+
+/**
+ * Rewrite the plan for one shard. Every corpus stays in the list and is reported; what changes is how
+ * many of its files THIS shard runs.
+ */
+export function applyShard(corpora, { i, n }, root = ROOT) {
+  return corpora.map((c) => {
+    if (c.kind === "covered") return c;
+    if (c.kind === "files") {
+      const mine = shardSlice(c.files, i, n);
+      return { ...c, files: mine, total: c.files.length,
+               argv: ["node", "scripts/test-run.mjs", "node", "--test", ...mine] };
+    }
+    if (c.kind === "workspace" && isShardable(root, c.name)) {
+      const all = workspaceTestFiles(root, c.name);
+      const mine = shardSlice(all, i, n);
+      return { ...c, kind: "files", files: mine, total: all.length,
+               argv: ["node", "scripts/test-run.mjs", "node", "--test", ...mine] };
+    }
+    // Not expressible as a file list: run it whole, once, on shard 1.
+    return { ...c, wholeOnShard: 1, skippedHere: i !== 1 };
+  });
+}
+
 function main() {
   const only = (() => { const i = process.argv.indexOf("--only"); return i === -1 ? null : process.argv[i + 1]; })();
   const listOnly = process.argv.includes("--list");
-  const { corpora, faults } = plan();
+  const shard = (() => {
+    const i = process.argv.indexOf("--shard");
+    if (i === -1) return null;
+    const m = String(process.argv[i + 1] ?? "").match(/^(\d+)\/(\d+)$/);
+    if (!m) { console.error("test-full: --shard wants i/n, e.g. --shard 2/4"); process.exit(2); }
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    if (a < 1 || b < 1 || a > b) { console.error(`test-full: --shard ${a}/${b} is not a shard of anything`); process.exit(2); }
+    return { i: a, n: b };
+  })();
+  const { corpora: full, faults } = plan();
+  const corpora = shard ? applyShard(full, shard, ROOT) : full;
 
   // FAULTS BEFORE ANYTHING RUNS. A missing corpus discovered after a green suite reads as an
   // afterthought; discovered first, it is the answer.
@@ -195,9 +274,13 @@ function main() {
     return;
   }
 
+  if (shard) console.log(`\ntest-full: shard ${shard.i} of ${shard.n} — slices are taken by index from the sorted file list, so the shards are disjoint and their union is the whole list.`);
+
   const ran = [];
   for (const c of chosen) {
     if (c.kind === "covered") { ran.push({ ...c, status: "covered" }); continue; }
+    if (c.skippedHere) { ran.push({ ...c, status: "elsewhere" }); continue; }
+    if (c.kind === "files" && c.files.length === 0) { ran.push({ ...c, status: "empty" }); continue; }
     console.log(`\n──── ${c.name} ────`);
     // STDIO INHERITED, NOT CAPTURED. CI reads the child stream for the corpus-guard markers, and a
     // runner that buffered its children would take those markers out of the log the check greps.
@@ -213,13 +296,23 @@ function main() {
   for (const c of ran) {
     if (c.status === "covered") {
       console.log(`  covered  ${c.name} — ${c.hasTests} file(s), run by the ${c.cover.corpus} corpus: ${c.cover.why}`);
+    } else if (c.status === "elsewhere") {
+      console.log(`  shard ${c.wholeOnShard}  ${c.name} — not expressible as a file list, so it runs WHOLE on shard ${c.wholeOnShard}, not here. It is not missing from this run; it is somewhere else in it.`);
+    } else if (c.status === "empty") {
+      console.log(`  none     ${c.name} — 0 of ${c.total} file(s) fell in this shard. Not an absence: the other shards hold them.`);
     } else {
-      const n = c.kind === "files" ? `${c.files.length} file(s)` : "workspace suite";
+      const n = c.kind === "files"
+        ? `${c.files.length}${c.total != null ? ` of ${c.total}` : ""} file(s)`
+        : "workspace suite";
       console.log(`  ${c.status === "ok" ? "ran    " : "FAILED "}  ${c.name} — ${n}${c.code ? ` (exit ${c.code})` : ""}`);
     }
   }
   const bad = ran.filter((c) => c.status === "FAILED");
-  console.log(bad.length ? `\n${bad.length} corpus/corpora failed.` : `\nEvery corpus above was run or accounted for.`);
+  console.log(bad.length
+    ? `\n${bad.length} corpus/corpora failed.`
+    : shard
+      ? `\nEvery corpus above was run, accounted for, or named as belonging to another shard. This shard alone is not the suite: the gate is every shard green.`
+      : `\nEvery corpus above was run or accounted for.`);
   if (bad.length) process.exit(1);
 }
 

package/scripts/test-run.mjs

@@ -644,6 +644,16 @@ if (String(process.env[REAL_ENGINE_OVERRIDE] ?? "").trim()) {
     catch { copyFileSync(ENGINE_STUB, p); chmodSync(p, 0o755); }
   }
   process.env.PATH = shimDir + delimiter + (process.env.PATH ?? "");
+  // AND THE COPY CLEAROTRON INSTALLED, which no PATH can close. The resolver's last step
+  // (driver.config.mjs resolveEngineProgram) reads the engines folder under the home directory, where
+  // setup installs `@anthropic-ai/claude-code` or `@openai/codex`, never PATH, and on a developer's machine
+  // that folder can hold a REAL program. The shim above answers every child that keeps this PATH, because
+  // PATH is asked first; a child that composes its own PATH would fall straight through to a real binary.
+  // So the folder is pointed at an EMPTY directory for the whole suite: the suite keeps the no-installed-
+  // copy world it was written for, and an arm about the installed copy plants its own folder and names it.
+  const noEngines = join(root, "no-installed-engines");
+  mkdirSync(noEngines, { recursive: true });
+  process.env.CLEAROTRON_ENGINES_DIR = noEngines;
   // Names, never values — this line is read by whoever is wondering why a credential-reading test skipped.
   const withheld = Object.keys(process.env)
     .filter((n) => CREDENTIAL_RE.test(n) || CREDENTIAL_NAMES.includes(n))

package/shared/brand.mjs

@@ -174,6 +174,33 @@ export const ADMINISTRATOR_CONTACT = administratorContact(process.env.CLEAROTRON
 // at all. Absent still means the default, never nothing.
 export const CONF_DEFAULT = 'Privileged & Confidential';
 
+/**
+ * THE APPROVED BOARDS' SECTION STRIP, filtered against the document it will sit in.
+ *
+ * Both report renderers draw one and each has its own board: the clearance kinds five entries, the
+ * knockout four, and the knockout's third points at the filings section while reading "Also considered".
+ * So the ENTRIES belong to each board and the RULE belongs here, because the rule is the part that is
+ * easy to get wrong the same way twice.
+ *
+ * The rule: a board is a specimen where every section exists, and a renderer draws several of them only
+ * when there is something to draw. A strip emitted whole would point a reader at anchors that resolve to
+ * nothing, which is worse than the missing strip it replaces. So it is composed from the FINISHED html by
+ * asking which anchors are in it — the document decides, and a section that stops being drawn takes its
+ * own entry with it without anyone remembering to.
+ *
+ * ONE ENTRY IS NOT A NAVIGATION. A strip pointing only at the top of the page is a control that does
+ * nothing, so below two entries it is not drawn at all.
+ *
+ * @param {string} html the assembled document
+ * @param {ReadonlyArray<readonly [string, string]>} entries [anchor id, label], in the board's order
+ */
+export function sectionStrip(html, entries) {
+  const live = (entries ?? []).filter(([id]) => String(html).includes(`id="${id}"`));
+  if (live.length < 2) return '';
+  return `<nav class="strip no-print">${live.map(([id, label], i) =>
+    `<a href="#${id}" data-sec="${id}"${i === 0 ? ' class="now"' : ''}><i></i>${label}</a>`).join('')}</nav>`;
+}
+
 export function confPosture(delivery) {
   const p = delivery == null ? null : delivery.privileged;
   return p === false ? '' : CONF_DEFAULT;