clearotron 0.3.2-beta.8 → 0.3.2-beta.9

package/mcp-server/CHANGELOG.md

@@ -1,5 +1,9 @@
 # trademark-artifacts-mcp
 
+## 0.3.2-beta.9
+
+No changes in this release.
+
 ## 0.3.2-beta.8
 
 No changes in this release.

package/mcp-server/README.md

@@ -73,7 +73,7 @@ whether the stage makes **billed** external calls, **what downstream is NOT reco
   report downstream are **not** recomputed (a finished-report answer would need a full cascade, which is out of
   scope for v1 — see Future).
 
-`what_if_run` takes the `confirmationToken` and re-runs the one stage in `_experiments/…` under a `prelim-exp-…`
+`what_if_run` takes the `confirmationToken` and re-runs the one stage in `_experiments/…` under a `clearance-exp-…`
 session key (canonical bytes untouched, its billed calls keyed off-run), then diffs it against canonical.
 **Live (undelivered) runs only.** Express the change with `instructions` (e.g. *"treat ACME's mark as
 expired"*) and/or `model`.

package/mcp-server/lib/README.md

@@ -20,7 +20,7 @@ Change behaviour in these files, never in a tool handler.
 - `ops.mjs` — the write verbs: `start_run`, `stop_run`, `feed_context`, plus the delivery seam
   (`list_outbox_events`, `get_delivery_packet`, `ack_event`, `mark_sent`). Writes in an agent's own queue and run
   dirs *and* clears `.pending` markers in the one shared outbox (`CLEAROTRON_OUTBOX_DIR`, default
-  `<workspaceRoot>/prelim-outbox`), which is why `ack_event` is account-gated; shells nothing. **`start_run`
+  `<workspaceRoot>/clearance-outbox`), which is why `ack_event` is account-gated; shells nothing. **`start_run`
   enqueues a job that spends real money.**
 - `whatif.mjs` — the approval-gated counterfactual. `whatIfPlan()` never spends and returns the cost prior, what
   downstream will *not* be recomputed, a completeness verdict and a `confirmationToken`; `whatIfRun(token)` re-runs

package/mcp-server/lib/options.mjs

@@ -34,7 +34,7 @@
 // It is a DESCRIPTION and never an order: plan_run is still the free preview of a specific request, and
 // start_run is still the only thing that spends.
 
-import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, productAvailability, gateCause, UNAVAILABLE_NOTE, coverageDisclosure, loadRecipes } from "../../driver/search-policy.mjs";
+import { ORDERABLE_PRODUCTS, PRODUCT_POLICIES, productAvailability, gateCause, UNAVAILABLE_NOTE, loadRecipes } from "../../driver/search-policy.mjs";
 import { productRow } from "../../driver/product-rows.mjs";
 import { PRODUCTS, productName } from "../../driver/products.mjs";
 import { readFlagSnapshot, builtFor, registerCanCountFor, registerTerritoriesFor } from "../../driver/flag-snapshot.mjs";
@@ -152,12 +152,13 @@ function products(built, registerCanCount = null, registerTerritories = undefine
       // The CAUSE never travels; only its sentence does. This is the structural reason no CLEAROTRON_* name
       // can reach a client's assistant from here.
       unavailableNote: cause ? UNAVAILABLE_NOTE[cause] : null,
-      // — the same disclosure the browser gets, on the same product, from the
-      // same composer. A worldwide search is orderable on a partial register now; what that register
-      // does not reach is a sentence beside a live product rather than the reason a dead one refuses.
-      // Two doors, one answer: an assistant driving this must not be able to tell a client something
-      // the screen does not say.
-      coverageNote: coverageDisclosure(row.geography, registerTerritories)?.note ?? null,
+      // NO COVERAGE SENTENCE ON A PRODUCT ROW, AND THIS DOOR GOES WITH THE OTHER ONE. The rule that put
+      // a disclosure here was "two doors, one answer: an assistant driving this must not be able to tell
+      // a client something the screen does not say." That rule is why this line is now null rather than
+      // why it exists — the owner took the paragraph off the screen on 2026-09-18, and an assistant that
+      // kept reading it out would be the same defect through the other door. The reason it went is in
+      // portal-service.mjs beside its twin: it promises to defer a territory the engine now refuses.
+      coverageNote: null,
     };
   });
 }

package/mcp-server/lib/plan.mjs

@@ -26,6 +26,7 @@
 
 import { validateJob, wantsPortalRoute, PORTAL_ROUTE_UNAVAILABLE } from "../../driver/enqueue-schema.mjs";
 import { resolveEffectiveProfile, recipeProseGuard } from "../../driver/profiles.mjs";
+import { demoRunAgreement } from "../../driver/demo-run-agreement.mjs";   // the claim's own demo decision, consulted not copied
 import { gateCause, UNAVAILABLE_NOTE, coverageDisclosure, policyFor, loadRecipes, countJobMarks } from "../../driver/search-policy.mjs";
 import { productRow, baseTurnaroundFor } from "../../driver/product-rows.mjs";
 import { resolveRequest } from "../../driver/resolve-request.mjs";
@@ -199,7 +200,14 @@ export function planRun(args = {}, { scope, now = Date.now() } = {}) {
   let profile = null, projectKey = null, origins = null;
   // Profile resolution reads the roster off disk; infra trouble must degrade the PREVIEW, never throw —
   // the same fail-open posture validateJob takes for the roster checks.
-  try { ({ profile, projectKey, origins } = resolveEffectiveProfile(job)); } catch { /* previewed without it */ }
+  // …EXCEPT the one refusal the claim itself makes on this read. With a company file unreadable, an order that
+  // names no company cannot be told apart from an order for that company, and the claim refuses it rather
+  // than rate it under `generic`. A preview that swallowed that answered wouldRun:true about a job the queue
+  // will refuse, so it travels as a blocker in the claim's own words. Only an unkeyed order reaches it, and
+  // only a staff session sends one unkeyed: a session scoped to accounts has its key stamped above.
+  let rosterRefusal = null;
+  try { ({ profile, projectKey, origins } = resolveEffectiveProfile(job)); }
+  catch (e) { if (e?.code === "profile_roster_incomplete") rosterRefusal = String(e.message); /* anything else: previewed without it */ }
 
   let resolved = null, eff = null, unavailable = null, snapshotForCoverage = null;
   try {
@@ -315,6 +323,14 @@ export function planRun(args = {}, { scope, now = Date.now() } = {}) {
   // plan_run itself invites. Read off `job` (post-buildJob, post-validateJob) with the wall's own
   // predicate and the wall's own sentence, so the two doors cannot drift apart.
   const routeBlocker = wantsPortalRoute(job) ? PORTAL_ROUTE_UNAVAILABLE : null;
+  // THE DEMO-DATA AGREEMENT, asked as the claim asks it. A demo account with an ordinary order, or a real
+  // account with a demo order, is refused at the claim in `demoRunAgreement`'s own words; a preview that did
+  // not ask answered wouldRun:true about an order the queue refuses. Same function, same inputs, same
+  // precedence as the wall: only once the request resolves, never ahead of a clarify.
+  const demoAdmission = profile && !resolved?.clarify
+    ? demoRunAgreement({ demoRun: job?.demoRun === true, demoData: profile?.demoData === true, who: job?.account ?? job?.profileKey ?? "this account" })
+    : null;
+  const demoBlocker = demoAdmission && !demoAdmission.ok ? demoAdmission.reject : null;
   // DEDUPED, and this door is the only one that needs it. The other four SHORT-CIRCUIT — they refuse on
   // validateJob and never reach the resolved-product fold — while a preview's whole job is to list every
   // blocker at once, so it sees both. Some sentences are legitimately produced twice for one request: a
@@ -322,7 +338,7 @@ export function planRun(args = {}, { scope, now = Date.now() } = {}) {
   // the fold against what it RESOLVES TO, and when the two are the same product they are the same
   // sentence. Read aloud to a requester, "this request names 2 countries" twice is a defect; deduping
   // where they are joined keeps every source honest and says it once.
-  const blocking = [...new Set([...(v.classify === "reject" || !v.ok ? v.errors : []), ...gates.errors, ...(unavailable ? [unavailable] : []), ...(quotaBlocker ? [quotaBlocker] : []), ...(routeBlocker ? [routeBlocker] : [])])];
+  const blocking = [...new Set([...(rosterRefusal ? [rosterRefusal] : []), ...(v.classify === "reject" || !v.ok ? v.errors : []), ...gates.errors, ...(unavailable ? [unavailable] : []), ...(quotaBlocker ? [quotaBlocker] : []), ...(routeBlocker ? [routeBlocker] : []), ...(demoBlocker ? [demoBlocker] : [])])];
 
   // ONE lookup, and the fields below come off it — the same shape portal-service's plan door was fixed
   // into. productRow computes a turnaround on every call; asking twice for one answer is how two answers

package/mcp-server/lib/runs.mjs

@@ -25,7 +25,7 @@ function findStatusFiles(root, depth, acc) {
   }
 }
 
-// Every workspace-<agent>/studio/prelim-search root under the live workspace root.
+// Every workspace-<agent>/studio/clearance-search root under the live workspace root.
 export function studioRoots() {
   const out = [];
   let names = [];

package/mcp-server/lib/usage.mjs

@@ -10,9 +10,9 @@
 
 import { tallyRegisterCalls, DEFAULT_LEDGER_PATH } from "./driver.mjs";
 
-// The driver tags every billed call's gateway session-key `prelim-<slug>-<codename>-<stage>…`. Our server is
-// named "trademark-artifacts", but the RUNS were produced by the prelim-driver, so the prefix stays `prelim-`.
-export function runPrefix(run) { return `prelim-${run.slug}-${run.codename}-`; }
+// The driver tags every billed call's gateway session-key `clearance-<slug>-<codename>-<stage>…`. Our server is
+// named "trademark-artifacts", but the RUNS were produced by the prelim-driver, so the prefix stays `clearance-`.
+export function runPrefix(run) { return `clearance-${run.slug}-${run.codename}-`; }
 
 // — the compared key set is DERIVED from the two tallies, not restated here.
 //

package/mcp-server/lib/whatif.mjs

@@ -54,7 +54,7 @@ export const WHAT_IF_NOTE =
 
 // Stages that hit billed external APIs (so the cost gate is honest about more than tokens).
 const BILLED_EXTERNAL = new Set(["common-law", "register-unit", "case-law"]);
-const MAYBE_EXTERNAL = new Set(["prelim-variants"]); // may make a few Perplexity famous-mark calls
+const MAYBE_EXTERNAL = new Set(["clearance-variants"]); // may make a few Perplexity famous-mark calls
 
 function encodeToken(op) { return Buffer.from(JSON.stringify(op)).toString("base64url"); }
 function decodeToken(token) { try { return JSON.parse(Buffer.from(String(token), "base64url").toString("utf8")); } catch { return null; } }

package/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trademark-artifacts-mcp",
-  "version": "0.3.2-beta.8",
+  "version": "0.3.2-beta.9",
   "license": "AGPL-3.0-only",
   "private": true,
   "description": "MCP server to interrogate clearotron trademark-clearance runs — list/read artifacts, trace the full decision flow, telemetry/cost, coverage, single-run search, and a gated single-step what-if. Imports the clearotron-driver read-only; touches no driver/template/deploy files.",

package/mcp-server/server.mjs

@@ -316,6 +316,9 @@ const tools = {
       // Staff-only tool (TOOL_SCOPES), so the reason may name the file: no client door sees this reply.
       ...(storeError ? { storeUnreadable: `The company store could not be re-read (${storeError}). This is the list as `
         + "last read, so a company added or changed since may be missing until that file is fixed." } : {}),
+      // A company whose own file would not load is left off `clients` and named here with the reason, so a
+      // missing company reads as a fault to fix rather than as a company that does not exist.
+      ...(roster?.unreadable?.length ? { unreadable: roster.unreadable.map((u) => ({ key: u.key, reason: u.reason })) } : {}),
     };
   },
   async describe_options(args, extra) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "clearotron",
   "type": "module",
-  "version": "0.3.2-beta.8",
+  "version": "0.3.2-beta.9",
   "license": "AGPL-3.0-only",
   "repository": {
     "type": "git",
@@ -107,21 +107,22 @@
     "!driver/profiles/projects/*/",
     "driver/profiles/projects/demo-brand-owner/",
     "!driver/recipes/*/",
-    "!driver/skills/prelim-search/risk-framework-*",
-    "driver/skills/prelim-search/risk-framework.md",
-    "driver/skills/prelim-search/risk-framework.manifest.json",
-    "driver/skills/prelim-search/risk-framework-demo.md",
-    "driver/skills/prelim-search/risk-framework-demo.manifest.json",
-    "driver/skills/prelim-search/risk-framework-triage.md",
-    "driver/skills/prelim-search/risk-framework-triage.manifest.json",
-    "!driver/skills/prelim-search/worked-examples-*",
-    "driver/skills/prelim-search/worked-examples.md",
-    "driver/skills/prelim-search/worked-examples-demo.md",
+    "!driver/skills/clearance-search/risk-framework-*",
+    "driver/skills/clearance-search/risk-framework.md",
+    "driver/skills/clearance-search/risk-framework.manifest.json",
+    "driver/skills/clearance-search/risk-framework-demo.md",
+    "driver/skills/clearance-search/risk-framework-demo.manifest.json",
+    "driver/skills/clearance-search/risk-framework-triage.md",
+    "driver/skills/clearance-search/risk-framework-triage.manifest.json",
+    "!driver/skills/clearance-search/worked-examples-*",
+    "driver/skills/clearance-search/worked-examples.md",
+    "driver/skills/clearance-search/worked-examples-demo.md",
     "!scripts/home-render-check.mjs",
     "!scripts/ai-page-render-check.mjs",
     "!scripts/composer-render-check.mjs",
     "!scripts/clearances-render-check.mjs",
     "!scripts/portal-lifecycle-check.mjs",
+    "!scripts/portal-strings.mjs",
     "!scripts/test-account-names.mjs",
     "!scripts/no-test-account-reaches-the-package.mjs",
     "!**/test/",

package/portal-ui/dist/assets/{index-CVOIvdhc.css → index-CtvwLCti.css}

@@ -254,6 +254,32 @@ html.anon-on [data-anon='mark']:not(.anon-clear) {
   border-bottom: 1px solid var(--border-hairline);
 }
 
+/* THE HEADER'S SECOND ROW: which read you are in, then where you are inside it.
+   The Reads strip used to sit BELOW this box and the report's own section breadcrumb inside the frame,
+   so neither stayed on screen — the frame is sized to its content, which leaves a `position:sticky` bar
+   in there pinned to nothing. Both are rows of the pinned header now (owner, 2026-09-18).
+   It scrolls sideways rather than wrapping to a third line: a header that grows taller with the number of
+   sections is a header that eats the document it is heading. */
+.report-nav {
+  display: flex; align-items: center; gap: 10px; margin-top: 9px;
+  overflow-x: auto; scrollbar-width: none;
+}
+.report-nav::-webkit-scrollbar { display: none; }
+.report-nav-sep { flex: none; width: 1px; align-self: stretch; background: var(--border-hairline); }
+.report-sections { display: flex; align-items: center; gap: 2px; }
+.report-section {
+  flex: none; display: inline-flex; align-items: center; gap: 7px; white-space: nowrap;
+  font: inherit; font-size: 12.5px; font-weight: 600; letter-spacing: .01em;
+  padding: 5px 10px; border: 1px solid transparent; border-radius: 999px;
+  background: transparent; color: var(--text-muted); cursor: pointer;
+}
+.report-section:hover, .report-section:focus-visible { color: var(--text-strong); background: var(--surface-sunken); }
+.report-section-dot {
+  width: 8px; height: 8px; border-radius: 50%; border: 1.5px solid currentColor; box-sizing: border-box;
+}
+.report-section[aria-current='true'] { color: var(--text-strong); background: var(--surface-sunken); }
+.report-section[aria-current='true'] .report-section-dot { border-color: var(--accent); border-width: 3px; }
+
 /* The breadcrumb above it: one step back as a quiet button, then where the reader is. Compound selectors
    throughout this block, because the button and row rules they adjust are declared later in the file. */
 .report-crumbs { display: flex; align-items: center; gap: 8px; margin-bottom: 10px; }
@@ -271,6 +297,36 @@ html.anon-on [data-anon='mark']:not(.anon-clear) {
 .btn-ghost.ask-ai-btn.is-quiet { border-color: transparent; color: var(--text-muted); }
 .btn-ghost.ask-ai-btn.is-quiet:hover { border-color: var(--border-hairline); color: var(--text-strong); }
 .ask-ai-float { position: absolute; right: 0; top: calc(100% + 6px); z-index: 50; }
+
+/* THE PANEL BELONGS TO THE BUTTON THAT OPENED IT, and a reader has to be able to see that it does. It was
+   anchored already — the rule above hangs it off `.ask-ai`, which is positioned — but it is 360px wide and
+   right-aligned, so it reaches back under the header's other chrome and reads as something floating over
+   the page rather than as this button's panel (owner, on test, 2026-09-18). Two triangles rather than one:
+   the outer carries the panel's own hairline and the inner covers it in the panel's surface, so the caret
+   is the panel's edge continuing rather than a shape drawn near it. Both grounds, from the same tokens. */
+.ask-ai-float::before,
+.ask-ai-float::after {
+  content: '';
+  position: absolute;
+  right: 16px;
+  width: 0;
+  height: 0;
+  border-left: 7px solid transparent;
+  border-right: 7px solid transparent;
+}
+.ask-ai-float::before { top: -7px; border-bottom: 7px solid var(--border-strong); }
+.ask-ai-float::after { top: -6px; border-bottom: 7px solid var(--surface-float); }
+
+/* AND THE BUTTON SAYS IT IS THE OPEN ONE. `aria-expanded` is already on it for a reader using a screen
+   reader; this is the same fact for the reader looking at it, drawn the way every other open-or-current
+   control in this file is (accent wash, accent border). One class stronger than the quiet variant, whose
+   transparent border would otherwise win. */
+.btn-ghost.ask-ai-btn[aria-expanded='true'],
+.btn-ghost.ask-ai-btn.is-quiet[aria-expanded='true'] {
+  background: var(--accent-wash);
+  border-color: var(--accent);
+  color: var(--text-accent);
+}
 .ask-ai-panel { width: 360px; max-width: calc(100vw - 32px); padding: 12px; display: grid; gap: 10px; text-align: left; }
 .ask-ai-head { font-size: 12.5px; line-height: 1.45; color: var(--text-muted); }
 .ask-ai-when { white-space: nowrap; }
@@ -313,6 +369,11 @@ html.anon-on [data-anon='mark']:not(.anon-clear) {
   padding: 0 10px;
 }
 
+/* The board's own box for Connect your AI: between the list that scrolls and the foot. */
+.sidebar-pinned {
+  padding: 0 10px 2px;
+}
+
 .sidebar-foot {
   padding: 10px;
   border-top: 1px solid var(--border-hairline);
@@ -462,6 +523,65 @@ html.anon-on [data-anon='mark']:not(.anon-clear) {
   overflow-x: auto;
 }
 
+/* A TABLE THAT CONTINUES PAST THIS WRAPPER'S RIGHT EDGE SHOWS THAT IT DOES. The note further down makes
+   half the argument — a table a reader drags sideways is readable, one printed through itself is not —
+   and this is the other half: a reader has to be able to see that it drags. Ruled 2026-09-17, a
+   scrollbar, always visible, no text.
+
+   THE TWO WAYS OF ASKING FOR ONE CANNOT SIT TOGETHER, and nothing about reading this file would tell
+   you. Putting the standard `scrollbar-width` on the rule above, beside these pseudo-elements, makes the
+   engine take the standard path and IGNORE them — and on the engine these pages render in, that path
+   draws an overlay bar with no layout height at all. Measured on a delivered report at 390px, reading
+   the height the bar takes out of the panel:
+
+       both together          0px
+       pseudo-elements alone  9px
+       standard alone         0px
+
+   So the standard properties sit behind a support query that the engines carrying the pseudo-elements
+   never enter, and each engine gets exactly one instruction. Merging these two blocks back together is
+   the tidy-up that deletes the scrollbar with every check still green, which is why this is written here
+   and pinned by an arm rather than left to be re-derived.
+
+   `--border-strong` is the line the table already sits inside, and it has a real value on both grounds. */
+.table-wrap::-webkit-scrollbar { height: 9px; -webkit-appearance: none; }
+.table-wrap::-webkit-scrollbar-track { background: transparent; }
+.table-wrap::-webkit-scrollbar-thumb { background: var(--border-strong); border-radius: 5px; }
+@supports not selector(::-webkit-scrollbar) {
+  .table-wrap { scrollbar-width: thin; scrollbar-color: var(--border-strong) transparent; }
+}
+
+/* THE BAR, PINNED to the bottom of the screen while its table is in view (components/PinnedScrollbar.tsx).
+   Drawn, not native: a phone's own bar is an overlay that takes no room and shows only while moving. The
+   track and thumb take the colours the desktop bar above uses, on the page's own surface so rows do not
+   show through, and sticky, so the bar settles under the table at the table's foot. */
+.pinned-bar {
+  position: sticky;
+  bottom: 0;
+  z-index: 2;
+  padding: 4px 0;
+  background: var(--surface-page);
+}
+.pinned-track {
+  position: relative;
+  height: 9px;
+  border-radius: 5px;
+  touch-action: none;
+}
+.table-wrap.has-pinned-bar::-webkit-scrollbar { height: 0; }
+@supports not selector(::-webkit-scrollbar) {
+  .table-wrap.has-pinned-bar { scrollbar-width: none; }
+}
+.pinned-thumb {
+  position: absolute;
+  top: 0;
+  height: 100%;
+  min-width: 24px;
+  border-radius: 5px;
+  background: var(--border-strong);
+  touch-action: none;
+}
+
 table.data {
   width: 100%;
   min-width: 760px;
@@ -724,6 +844,29 @@ table.data td.nest-2 {
      panel opened from a row near the bottom of the list was cut off at the table's edge. */
   overflow: visible;
 }
+
+/* ── AND BELOW THE BREAKPOINT IT SCROLLS AFTER ALL, AND CONTAINS WHAT IT SCROLLS ────────────────────
+ *
+ * The rule above is right at desktop widths and wrong below 560px, where `table.data.fixed` stops
+ * dividing and becomes an ordinary content-sized table with its 860px floor restored. The note on that
+ * breakpoint says "its wrapper, which has always had `overflow-x: auto`, does the scrolling" — true of
+ * `.table-wrap`, and NOT true of this wrapper, which turns it off two rules later for the Ask AI panel.
+ * Two rules describing the same box disagreed, the later one won, and the table pushed the page sideways
+ * instead. Measured at 400px: table 860px, page scrolling by 396px, every column still present.
+ *
+ * `position: relative` IS LOAD-BEARING and does not look it. Scrolling alone leaves the page scrolling,
+ * because the sort button's visually-hidden label (", sorted descending") is absolutely positioned and
+ * this wrapper was not a containing block — so it resolved against the body, landed at x=568 with the
+ * header cell it belongs to, and extended the document on its own. One pixel wide. Both halves were
+ * planted at 400, 500 and 560: remove either and the page scrolls again.
+ *
+ * WHAT THIS COSTS, said plainly: a scroll container clips both axes, so below 560px an Ask AI panel
+ * opened from a row near the bottom is clipped again — the thing the rule above exists to prevent. That
+ * is the trade the phone width forces, and the page scrolling sideways is the worse of the two for a
+ * client reading on a phone. Above 560px nothing changes and the panel is unclipped as before. */
+@media (max-width: 560px) {
+  .names-wrap { overflow-x: auto; position: relative; }
+}
 /* Eight pixels either side instead of twelve, on every column but the two narrow ones at the left: the
    actions column takes a quarter of the table, and the text columns keep their words on one line by
    giving up padding rather than width. The date and the actions give up a little more. */
@@ -750,6 +893,37 @@ table.data td.nest-2 {
 .status-count {
   white-space: nowrap;
 }
+/* One line wherever a risk word is drawn — in the stylesheet rather than inline, so the table below can
+   let it wrap. */
+.risk-dot {
+  white-space: nowrap;
+}
+/* A risk word wraps the same way, and for the same reason: "No rated conflicts" in a column of fixed
+   width ran on under the date beside it instead of taking a second line. */
+.names-wrap table.data.fixed td .risk-dot {
+  white-space: normal;
+  align-items: flex-start;
+}
+.names-wrap table.data.fixed td .risk-dot .dot {
+  flex: none;
+  margin-top: 0.42em;
+}
+/* AND NEVER INSIDE A WORD. At 700px the column holds 84px and "Manageable" is 85: beside its dot it broke
+   into "Managea" over "ble". The cell gives up padding the way the date's does, the dot and the word may
+   part so a word too long to sit beside its dot takes the next line whole, and the word itself breaks only
+   when it cannot fit even on a line of its own — `break-word`, which unlike `anywhere` does not shrink the
+   word's minimum width, so the parting happens first. */
+.names-wrap table.data.fixed td:has(.risk-dot) {
+  padding-left: 6px;
+  padding-right: 6px;
+}
+.names-wrap table.data.fixed td .risk-dot {
+  flex-wrap: wrap;
+  row-gap: 2px;
+}
+.names-wrap table.data.fixed td .risk-dot > span:last-child {
+  overflow-wrap: break-word;
+}
 /* A date is one word to a reader. A line may break before it, never at its hyphens: "2026-09-" over "02"
    read as a different date on the line below. */
 .names-wrap table.data.fixed td .sub.report-line {
@@ -766,9 +940,15 @@ table.data td.nest-2 {
      and red in CI on the same commit. 13.5em is the local measurement plus about a fifth, which is
      more than the spread between the font stacks the two see. */
   --row-open-w: 13.5em;
-  --row-ask-w: 6.5em;
+  /* Ask AI measured 89px at this size, so 6.5em (81px) ran the button into the menu beside it. */
+  --row-ask-w: 7.25em;
   display: grid;
-  grid-template-columns: var(--row-open-w) auto;
+  /* MINMAX, BECAUSE THE TRACK IS A CEILING HERE AND NOT A FLOOR. A bare `var(--row-open-w)` is a fixed
+     13.5em track that cannot shrink, so in a narrow container the row's controls were wider than the
+     column they were given: measured at 700px, the "more" button sat at x=697 with the wrapper's right
+     edge at 682, and the cell overflowed the table and then the page by 25px. The wide form below
+     restores the fixed track, where it fits and the one-width rule matters. */
+  grid-template-columns: minmax(0, var(--row-open-w)) auto;
   grid-template-areas: 'open more' 'ask more';
   justify-content: start;
   align-items: start;
@@ -789,7 +969,15 @@ table.data td.nest-2 {
 .row-actions-ask:empty {
   display: none;
 }
-@container (min-width: 1000px) {
+/* SIDE BY SIDE ONLY WHERE THE CELL HOLDS IT. This asked the whole table's width, and the actions column is
+   a fifth of it: at 1440px the table was 1060px, the query said "wide", and three fixed tracks needing
+   about 300px were laid into a cell of about 200 — every row's menu past the table's edge, the page
+   scrolling sideways. The cell itself is the container now, so the wide form appears exactly when its
+   tracks fit and the stacked form, which shrinks, holds every other width. */
+.row-actions-box {
+  container: rowactions / inline-size;
+}
+@container rowactions (min-width: 300px) {
   .row-actions {
     grid-template-columns: var(--row-open-w) var(--row-ask-w) auto;
     grid-template-areas: 'open ask more';
@@ -812,6 +1000,22 @@ button.row-open {
   white-space: nowrap;
   cursor: pointer;
 }
+/* AND ITS LABEL WRAPS, in the narrow form only. Ruled 2026-09-18: the row controls collapse at this
+   width.
+   THIS LINE DOES NOT RED WHEN IT IS REMOVED, and it is kept anyway — said out loud because the next
+   person to plant it will find the same thing. With `nowrap` and the shrunken track, the longest label
+   measures 121px inside a 120px button on this box: it does not overflow here, so the check passes, and
+   it is one pixel from clipping. The comment on `--row-open-w` above records this exact failure
+   happening — green on a developer machine, red on the CI runner, whose default font is wider, on the
+   same commit. Wrapping removes the dependency on which font measured it rather than betting a pixel
+   on it. Nothing in this check can see the difference, which is why this note is here instead. */
+@container (max-width: 999px) {
+  button.row-open {
+    min-width: 0;
+    white-space: normal;
+  }
+}
+
 button.row-open:hover {
   border-color: var(--text-muted);
 }