From 3bb008b8ec04056e826b3c67a51b2aecb629b4f1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 04:04:45 -0400
Subject: [PATCH 01/79] docs: document the global --allow-t3

Document the global --allow-t3 flag (before the command) in SKILL.md
(synopsis, Command Reference, co-owner sign-off paragraph and the
refusal sentence), the Unreleased CHANGELOG, and the org and projects
references. The flag applies to every repository command, generator,
doctor, lint and the org and project groups. It lifts only the T3
refusal for one invocation; excluded and HOLD owners stay refused.

Add tests/test_allow_t3_docs.py to check the synopsis, the refusal
text, the CHANGELOG entry and the --help output. No behaviour change;
scripts, the shared package validator and its contract test are untouched.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                |  1 +
 SKILL.md                    |  6 +++--
 references/org.md           |  2 +-
 references/projects.md      |  2 +-
 tests/test_allow_t3_docs.py | 49 +++++++++++++++++++++++++++++++++++++
 5 files changed, 56 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_allow_t3_docs.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46719ce..4fc64a5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
 - Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
 - `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`); excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ## 1.0.0 — 2026-10-26
 
diff --git a/SKILL.md b/SKILL.md
index e76ae1c..a2a196c 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -55,7 +55,7 @@ Every surface uses one **dark** design on both GitHub themes (decision 21): navy
 | A set must be reviewed the way GitHub shows it | `contact-sheet` |
 | Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
 
-Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2.
+Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
 
 ## Boundaries
 
@@ -111,6 +111,8 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. With it, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused; the flag lifts only the T3 refusal. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+
 ## Orgs, Projects, the Enterprise and Content
 
 CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
@@ -163,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/org.md b/references/org.md
index 99f0a98..78e2371 100644
--- a/references/org.md
+++ b/references/org.md
@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines).
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|
diff --git a/references/projects.md b/references/projects.md
index 32dc731..55bbedc 100644
--- a/references/projects.md
+++ b/references/projects.md
@@ -36,7 +36,7 @@ python3 $S project estate-plan [--copied after-copy.json] [--user-id ID] [--jobs
 | `readme` | Fills the §13.7 README template for a copied board (view numbers from the post-copy capture). The same privacy gate as `copy-plan`: a board that is public (as captured) or may go public (an org board with an approved visibility item) gets no repository in its Links line, from `--repos` or the capture (`readme-links:repositories-omitted (the board may go public)`). The Fields table and the Workflow line document the board's own options (a kept scale such as P0/P1/P2, its workstreams, its Status flow), and in `copy-plan` the options the plan's jobs leave; emoji in option text are dropped from the README (`readme-emoji-stripped:<field>/<option>`). A missing view number is `needs-input:view-numbers` (exit 4); no brace may remain, and `TODO`/`TBD` are placeholders only in capitals (`Todo` is GitHub's default Status option). | `--out` |
 | `estate-plan` | The private cross-org "CompleteTech — Estate" board on CompleteDotTech: the copy, the Org, Stream kind, Workstream (text) and Health fields (in-scope T1, T2 and T2-R orgs; T3 only after sign-off; never HOLD or excluded), the Estate views, the read that lists labelled items, and a browser check that it stays private. | `--jobs` |
 
-Common flags: `--registry` and `--approved` (display names and approvals, through the shared resolver, so renamed orgs keep resolving), `--display-name`, `--title`, `--allow-t3`, `--no-status-update`, `--reviewed DATE`, `--out-of-scope TEXT`, `--user-id ID` (user-owned view paths).
+Common flags: `--registry` and `--approved` (display names and approvals, through the shared resolver, so renamed orgs keep resolving), `--display-name`, `--title`, `--allow-t3`, `--no-status-update`, `--reviewed DATE`, `--out-of-scope TEXT`, `--user-id ID` (user-owned view paths). The global `--allow-t3` (before the command) is equivalent.
 
 ## Source board and stages
 
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
new file mode 100644
index 0000000..e27217a
--- /dev/null
+++ b/tests/test_allow_t3_docs.py
@@ -0,0 +1,49 @@
+"""Docs for the global `--allow-t3` flag: SKILL.md, CHANGELOG.md and `--help` must describe the same behaviour.
+
+Synthetic checks only: no network, no registry, and no shared package files are touched.
+"""
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+MARKER = "**Co-owner sign-off (`--allow-t3`).**"
+
+
+def _read(name: str) -> str:
+    return (ROOT / name).read_text(encoding="utf-8")
+
+
+def test_skill_synopsis_lists_global_flag():
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert "[--allow-t3]" in synopsis, synopsis
+    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>"), synopsis
+
+
+def test_skill_documents_refusals():
+    skill = _read("SKILL.md")
+    assert MARKER in skill
+    assert "t3-signoff" in skill
+    window = skill[skill.index(MARKER):][:1200]
+    assert "excluded" in window, window
+    assert "HOLD" in window, window
+
+
+def test_changelog_unreleased_lists_flag():
+    changelog = _read("CHANGELOG.md")
+    start = changelog.index("## Unreleased")
+    end = changelog.index("\n## ", start + 1)
+    assert "--allow-t3" in changelog[start:end]
+
+
+def test_help_text_matches_docs():
+    result = subprocess.run(
+        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+        capture_output=True, encoding="utf-8",
+    )
+    assert result.returncode == 0, result.stderr
+    assert "--allow-t3" in result.stdout

From 852dc9e4aaf219663c70e79eb7c5df9dc9b5cbd7 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 04:11:16 -0400
Subject: [PATCH 02/79] docs: document the global --allow-t3

Document the global --allow-t3 flag (before the command) in SKILL.md:
the command synopsis, the refusal sentence, and a co-owner sign-off
paragraph. The flag applies to every repository command, generator,
doctor, lint and the org and project groups, and meta, org and project
also accept it after the command name. It lifts only the T3 refusal for
one invocation; excluded and HOLD owners stay refused, and it is never
read from a config file or environment.

Add the flag to the Unreleased Added list in CHANGELOG.md and note that
the global flag is equivalent in references/org.md and
references/projects.md.

Add tests/test_allow_t3_docs.py to check the synopsis, the refusal text,
the CHANGELOG entry and the --help output. No behaviour change; scripts,
the shared package validator and its contract test are untouched.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                |  1 +
 SKILL.md                    |  6 +++--
 references/org.md           |  2 +-
 references/projects.md      |  2 +-
 tests/test_allow_t3_docs.py | 45 +++++++++++++++++++++++++++++++++++++
 5 files changed, 52 insertions(+), 4 deletions(-)
 create mode 100644 tests/test_allow_t3_docs.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46719ce..a5b9bb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 ### Added
 
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`); excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
diff --git a/SKILL.md b/SKILL.md
index e76ae1c..e3983c2 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -55,7 +55,7 @@ Every surface uses one **dark** design on both GitHub themes (decision 21): navy
 | A set must be reviewed the way GitHub shows it | `contact-sheet` |
 | Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
 
-Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2.
+Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
 
 ## Boundaries
 
@@ -111,6 +111,8 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it, a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. With it, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused; the flag lifts only the T3 refusal. It holds for that one invocation and is off again afterwards; it is never read from a config file or environment.
+
 ## Orgs, Projects, the Enterprise and Content
 
 CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
@@ -163,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/org.md b/references/org.md
index 99f0a98..78e2371 100644
--- a/references/org.md
+++ b/references/org.md
@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines).
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|
diff --git a/references/projects.md b/references/projects.md
index 32dc731..55bbedc 100644
--- a/references/projects.md
+++ b/references/projects.md
@@ -36,7 +36,7 @@ python3 $S project estate-plan [--copied after-copy.json] [--user-id ID] [--jobs
 | `readme` | Fills the §13.7 README template for a copied board (view numbers from the post-copy capture). The same privacy gate as `copy-plan`: a board that is public (as captured) or may go public (an org board with an approved visibility item) gets no repository in its Links line, from `--repos` or the capture (`readme-links:repositories-omitted (the board may go public)`). The Fields table and the Workflow line document the board's own options (a kept scale such as P0/P1/P2, its workstreams, its Status flow), and in `copy-plan` the options the plan's jobs leave; emoji in option text are dropped from the README (`readme-emoji-stripped:<field>/<option>`). A missing view number is `needs-input:view-numbers` (exit 4); no brace may remain, and `TODO`/`TBD` are placeholders only in capitals (`Todo` is GitHub's default Status option). | `--out` |
 | `estate-plan` | The private cross-org "CompleteTech — Estate" board on CompleteDotTech: the copy, the Org, Stream kind, Workstream (text) and Health fields (in-scope T1, T2 and T2-R orgs; T3 only after sign-off; never HOLD or excluded), the Estate views, the read that lists labelled items, and a browser check that it stays private. | `--jobs` |
 
-Common flags: `--registry` and `--approved` (display names and approvals, through the shared resolver, so renamed orgs keep resolving), `--display-name`, `--title`, `--allow-t3`, `--no-status-update`, `--reviewed DATE`, `--out-of-scope TEXT`, `--user-id ID` (user-owned view paths).
+Common flags: `--registry` and `--approved` (display names and approvals, through the shared resolver, so renamed orgs keep resolving), `--display-name`, `--title`, `--allow-t3`, `--no-status-update`, `--reviewed DATE`, `--out-of-scope TEXT`, `--user-id ID` (user-owned view paths). The global `--allow-t3` (before the command) is equivalent.
 
 ## Source board and stages
 
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
new file mode 100644
index 0000000..55bb3d7
--- /dev/null
+++ b/tests/test_allow_t3_docs.py
@@ -0,0 +1,45 @@
+"""Docs: the global --allow-t3 is documented in SKILL.md, the CHANGELOG and --help.
+
+Synthetic checks only: no network, no registry. Documentation text, not behaviour.
+"""
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SKILL = (ROOT / "SKILL.md").read_text(encoding="utf-8")
+CHANGELOG = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
+SIGNOFF_MARKER = "**Co-owner sign-off (`--allow-t3`).**"
+
+
+def test_skill_synopsis_lists_global_flag():
+    lines = SKILL.splitlines()
+    start = lines.index("## Command Reference")
+    synopsis = next(line for line in lines[start:] if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert "[--allow-t3]" in synopsis
+    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>")
+
+
+def test_skill_documents_refusals():
+    assert SIGNOFF_MARKER in SKILL
+    assert "t3-signoff" in SKILL
+    window = SKILL[SKILL.index(SIGNOFF_MARKER):][:1200]
+    assert "excluded" in window
+    assert "HOLD" in window
+
+
+def test_changelog_unreleased_lists_flag():
+    start = CHANGELOG.index("## Unreleased")
+    end = CHANGELOG.index("\n## ", start + 1)
+    assert "--allow-t3" in CHANGELOG[start:end]
+
+
+def test_help_text_matches_docs():
+    result = subprocess.run(
+        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+        capture_output=True, encoding="utf-8",
+    )
+    assert result.returncode == 0
+    assert "--allow-t3" in result.stdout

From 33f0b3ebb31af3ba9251d69b944390ba9b94b8bc Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 04:17:14 -0400
Subject: [PATCH 03/79] docs: document the global --allow-t3

Move the Unreleased changelog entry from Fixed into the Added list.

Note that HOLD is refused only for repository commands and generators.
The org about, pins, health and doctor actions pass allow_hold, so they
admit a HOLD org with or without the flag.

Make test_help_text_matches_docs cross-check the --help usage line
against the SKILL.md synopsis, so it fails on a base without the doc
change. Also check the changelog entry sits in the Unreleased Added list.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                |  2 +-
 SKILL.md                    |  2 +-
 tests/test_allow_t3_docs.py | 19 +++++++++++++++++--
 3 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4fc64a5..a5b9bb9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 ### Added
 
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`); excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
@@ -27,7 +28,6 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
 - Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
 - `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`); excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ## 1.0.0 — 2026-10-26
 
diff --git a/SKILL.md b/SKILL.md
index a2a196c..aedca12 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. With it, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused; the flag lifts only the T3 refusal. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. With it, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index e27217a..4b393b1 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -4,6 +4,7 @@
 """
 from __future__ import annotations
 
+import os
 import subprocess
 import sys
 from pathlib import Path
@@ -37,13 +38,27 @@ def test_changelog_unreleased_lists_flag():
     changelog = _read("CHANGELOG.md")
     start = changelog.index("## Unreleased")
     end = changelog.index("\n## ", start + 1)
-    assert "--allow-t3" in changelog[start:end]
+    unreleased = changelog[start:end]
+    # the entry belongs in the Added list of Unreleased, not in Fixed or a dated section
+    added = unreleased[unreleased.index("### Added"):unreleased.index("### Fixed")]
+    assert "--allow-t3" in added
 
 
+# Regression guard for the CLI help. The help text already names the flag on the base commit, so the
+# assertions below pass there too; the cross-check against SKILL.md's synopsis is the part that fails
+# on a base that lacks the doc change.
 def test_help_text_matches_docs():
+    env = dict(os.environ, COLUMNS="200")  # keep argparse from wrapping the usage line
     result = subprocess.run(
         [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
-        capture_output=True, encoding="utf-8",
+        capture_output=True, encoding="utf-8", env=env,
     )
     assert result.returncode == 0, result.stderr
     assert "--allow-t3" in result.stdout
+    fragment = "[--quiet] [--allow-t3] [--version]"
+    help_usage = " ".join(result.stdout.split())
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert fragment in help_usage, help_usage
+    assert fragment in " ".join(synopsis.split()), synopsis

From 81307fbbf68fed6ea4e9dc814ad1c4e2322071e7 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 04:43:29 -0400
Subject: [PATCH 04/79] docs: scope --allow-t3 refusal contract; repository
 doctor never refuses T3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 2 +-
 SKILL.md     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a5b9bb9..1f669ef 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 ### Added
 
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`); excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor`, which always reports them without refusing; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
diff --git a/SKILL.md b/SKILL.md
index aedca12..16c15a4 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `doctor`, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. With it, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Repository `doctor` is the exception: it always admits T3 owners (the code passes `allow_t3=True`) and reports their coverage, with the R7 cell `hold`, instead of refusing, with or without the flag. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
 
 ## Orgs, Projects, the Enterprise and Content
 

From 72cb45e53c39d894df4a2a1d7b1c39d8af01decb Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 04:55:38 -0400
Subject: [PATCH 05/79] docs: correct --allow-t3 doctor R7 wording and note
 meta/fingerprint exceptions

doctor forces R7=hold only without the flag; local meta and fingerprint
do not check owner eligibility. Pinned by a docs test. No behaviour change.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                | 178 +++++-----
 SKILL.md                    | 672 ++++++++++++++++++------------------
 tests/test_allow_t3_docs.py | 138 ++++----
 3 files changed, 499 insertions(+), 489 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1f669ef..d4466fe 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,89 +1,89 @@
-# Changelog
-
-All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
-
-## Unreleased
-
-### Added
-
-- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor`, which always reports them without refusing; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
-
-### Fixed
-
-- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
-- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
-- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
-
-- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
-- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
-- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
-- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
-- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
-
-- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
-- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
-- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
-- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
-- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
-- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
-- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
-
-## 1.0.0 — 2026-10-26
-
-First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
-
-### Added
-
-- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
-- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
-- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
-- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
-- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
-
-### Security
-
-- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
-- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
-- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
-- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
-- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
-- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
-- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
-- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
-- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
-- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
-- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
-- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
-- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
-
-### Fixed
-
-- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
-- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
-- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
-- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
-- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
-- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
-- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
-- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
-- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
-- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
-- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
-- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
-- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
-- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
-- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
-- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
-- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
-- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
-- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
-- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
-- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
-- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
-- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
-- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
-- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
-- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
-- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
-- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
+# Changelog
+
+All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
+
+## Unreleased
+
+### Added
+
+- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits them; R7 is `hold` only without the flag), local `meta` normalization and `fingerprint`, which do not check eligibility; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+
+### Fixed
+
+- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
+- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
+- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
+
+- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
+- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
+- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
+- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
+- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
+
+- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
+- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
+- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
+- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
+- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
+- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
+- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
+
+## 1.0.0 — 2026-10-26
+
+First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
+
+### Added
+
+- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
+- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
+- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
+- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
+- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
+
+### Security
+
+- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
+- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
+- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
+- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
+- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
+- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
+- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
+- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
+- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
+- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
+- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
+- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
+- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
+
+### Fixed
+
+- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
+- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
+- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
+- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
+- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
+- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
+- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
+- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
+- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
+- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
+- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
+- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
+- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
+- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
+- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
+- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
+- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
+- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
+- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
+- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
+- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
+- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
+- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
+- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
+- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
+- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
+- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
+- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
diff --git a/SKILL.md b/SKILL.md
index 16c15a4..18aa652 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -1,336 +1,336 @@
----
-name: github-showcase-skill
-description: >-
-  Generate CompleteTech LLC README hero banners, repo cards, social previews, repo icons, org tiles, profile intros
-  and footers; audit repos against the CompleteTech GitHub estate standard (About description, topics, labels, README
-  variants, links, language bar, Actions, images, About sidebar, SVG rules); render org profile READMEs and plan org
-  About fields, pins, star lists, labels and health files; capture, lint and copy GitHub Projects boards from the
-  estate template; and snapshot, check and plan the CompleteTech Enterprise. Read-only toward GitHub: it emits files,
-  JSON plans and gh/writer jobs. Use when creating, polishing or auditing any CompleteTech, AI Ascension, Jev
-  Engineering, jevplay-games, LibreEvolve or TouchedByAnAgent repo, README, org, org profile, GitHub Project or the
-  Enterprise so it matches the rest of the estate.
-version: 1.0.0
-metadata:
-  openclaw:
-    skillKey: github-showcase-skill
-    homepage: https://github.com/CompleteTech-Skills/github-showcase-skill
-    requires:
-      bins:
-        - python3
-    install:
-      - kind: uv
-        package: fonttools==4.67.0
-      - kind: uv
-        package: uharfbuzz==0.57.0
-      - kind: uv
-        package: pillow==13.0.0
-      - kind: uv
-        package: pyyaml==6.0.3
----
-
-# GitHub Showcase Skill
-
-## At a Glance
-
-| What it creates | Best for | Output |
-|---|---|---|
-| README hero banners, repo cards, social previews, repo icons, org banners and tiles, profile intros, the estate footer, README scaffolds, org profile READMEs, standard checks, and plans for orgs, GitHub Projects, the Enterprise and repository content | Making any CompleteTech-family repository, README, org, org profile, project board, the Enterprise or the profile page match the estate, and keeping it that way | `docs/images/banner.png` (1280×360 or 2560×720), `docs/images/card.svg`, `assets/social-preview.png` (1280×640), `assets/icon.png` (1024×1024), org banner JPG (1600×400), tile and intro SVGs, README marker blocks, `profile/README.md` and `profile/data.json`, JSON check results and plans, change records, `scripts/writer.py` jobs (JSON lines), coverage rows |
-
-Every surface uses one **dark** design on both GitHub themes (decision 21): navy grid canvas, a card for the repo icon (or the org's Neon Night mark), a sky-blue eyebrow, the repo slug in monospace, two to four fact chips and an accent bar. All text is typeset from the bundled OFL fonts with HarfBuzz and outlined to paths, so outputs are deterministic and never depend on a web font or an image model. One CLI, `scripts/showcase.py`, does every generation, check and plan: the repository commands below, and four command groups, `org`, `project`, `enterprise` and `content`, for orgs, GitHub Projects, the Enterprise and repository content.
-
-## Use When
-
-| Situation | Start with |
-|---|---|
-| A repository needs its README hero banner or repo card | `banner`, then `card` (and `content social` for R10) |
-| A README must be scaffolded or upgraded to its standard variant, with the footer | `readme` (dry run), then `readme --write`, then `footer --check` |
-| A description, topic set or label set must be checked before a write is queued | `describe`, `topics`, `labels --plan` |
-| An org profile or the personal profile needs cards, tiles, a banner or the animated intro | `card`, `org-tile`, `org-banner`, `intro` and [references/profile-readmes.md](references/profile-readmes.md) |
-| An org needs its profile README, About fields, pins and star List, labels or `.github` health files, or an org must be verified as done | `org profile`, `org about`, `org pins`, `org labels`, `org health`, `org doctor` ([references/org.md](references/org.md)) |
-| An org needs its GitHub Project board from the estate template, or a board must be checked | `project capture-query`, `normalize`, `copy-plan`, `readme`, `lint`, `estate-plan` ([references/projects.md](references/projects.md)) |
-| The CompleteTech Enterprise must be captured, checked or planned | `enterprise snapshot-query` or `snapshot`, then `enterprise doctor`, `seat-check`, `plan` ([references/enterprise.md](references/enterprise.md)) |
-| A repository's links, language bar, Actions, README images, About sidebar, icon or social preview must be checked or produced | `content links`, `linguist`, `actions`, `images`, `sidebar`, `icon`, `social` ([references/content.md](references/content.md)) |
-| A new repository is created from `completetech-repo-template` | `new OWNER/NAME --type T` (the create job, then `adopt`), then the composite Action in `action.yml` (runs `readme --bootstrap`) |
-| A repository exists but never went through the standard (created by an agent, a pipeline or a transfer) | `adopt OWNER/REPO`; for the whole estate, `doctor --estate` (intake proposals and template drift) |
-| A set must be reviewed the way GitHub shows it | `contact-sheet` |
-| Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
-
-Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
-
-## Boundaries
-
-| This skill does | This skill does not |
-|---|---|
-| Render banners, cards, tiles, intros and contact sheets from metadata and committed brand files. | Draw illustrations, or let an image model draw text, logos or marks. |
-| Lint descriptions, topics, labels, READMEs, SVGs and banner PNGs against `ct-std-v1` and the user decisions. | Compose a new description sentence, an org description or a tagline; it returns `needs-writer` with the template. |
-| Propose GitHub changes as diffs, `gh` command lines, change records and `scripts/writer.py` jobs (`browser` jobs with exact click paths for UI-only steps) for a serialized writer. | Perform GitHub writes on its own. The only write is the Action committing into its own repository; label plans leave as `gh` argv and writer jobs (`labels --plan`). |
-| Write only the paths given by `--out`, `--out-dir`, `--jobs`, `--report` or `--records`, or README marker blocks and `docs/images/*` with `--write`. | Delete text from a README, crop or recolour a mark, or truncate text with an ellipsis. |
-| Read metadata from a JSON file or with read-only `gh api` GETs, and read the private estate registry without copying it. | Read credentials, persist state, schedule jobs, change repository settings, or copy the registry's private data into a repository. |
-
-## Core Workflow
-
-Run every command **from inside the target repository's checkout**, with the skill's script by path: `python3 <skill-dir>/scripts/showcase.py ...`. With `--meta`, the checkout must be the repository the metadata describes (its `origin` is compared); otherwise pass `--repo-dir DIR` or `--no-repo-dir`. A missing `--repo-dir` exits 2, and default outputs (`docs/images/...`) are always written inside the target checkout, never into the current directory or the skill.
-
-| Step | Command | Gate |
-|---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
-| 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
-| 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
-| 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
-| 5 | `banner`, then `card` (and `content social`) | `art-fail` (exit 3) writes nothing. `needs-input` (exit 4) names the missing fact, including fewer than two fact chips (`needs-input:banner-chips`; add `chips:` to `.github/showcase.yml` or pass `--key-chip`/`--chip`). |
-| 6 | `readme`, then `readme --write` | Dry run prints a unified diff first. `readme-shrink` (exit 1) writes nothing. |
-| 7 | `footer --check README.md`, `lint all` | Every applicable check passes; `incomplete` is allowed for logged `needs-input` omissions. |
-| 8 | `doctor --header` | One coverage row. `done` only when every applicable cell is `pass`, `warn`, `incomplete` or `n/a`, and the banner has two to four chips. |
-| 9 | `contact-sheet` | A human (or an independent verifier) views the set on both GitHub page colours before rollout. Pass PNGs: `card --png`, `org-tile --png` previews, or install the optional `resvg_py` (`requirements-preview.txt`) so SVG inputs (the intro's static frame) render too; otherwise an SVG input exits 2. |
-
-**Who applies GitHub changes.** Under the estate orchestrator, every proposal (description, topics, labels, README) goes to its single writer queue as change records. Used standalone, with no orchestrator: show the user the `--gh` command lines (or the `argv` of `labels --plan`) and the README diff; the user runs them after approving that repository's changes. The skill itself never runs a write.
-
-**Install.** System Python on Ubuntu 24.04, Debian 12 and Homebrew refuses `pip install` ("externally managed environment"). Use a virtual environment (or `uv`):
-
-```bash
-python3 -m venv .venv && . .venv/bin/activate      # or: uv venv && . .venv/bin/activate
-python -m pip install -r <skill-dir>/requirements.txt  # or: uv pip install -r <skill-dir>/requirements.txt
-```
-
-```bash
-cd ../agentic-email-skill                               # the target checkout
-S=<skill-dir>/scripts/showcase.py
-python3 $S meta --from-gh CompleteTech-Skills/agentic-email-skill --out /tmp/meta.json
-python3 $S --meta /tmp/meta.json describe
-python3 $S --meta /tmp/meta.json banner                 # writes docs/images/banner.png in this checkout
-python3 $S --meta /tmp/meta.json doctor --header
-```
-
-| Exit | Meaning |
-|---|---|
-| 0 | ok, including `warn`, `incomplete` and `n/a` |
-| 1 | a check failed |
-| 2 | usage or config error, or an excluded, hold or T3 owner |
-| 3 | `art-fail`: text does not fit the fixed size ladder, or the PNG budget cannot be met |
-| 4 | `needs-input` blocks a generator (for example an empty description) |
-
-Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
-
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Repository `doctor` is the exception: it always admits T3 owners (the code passes `allow_t3=True`) and reports their coverage, with the R7 cell `hold`, instead of refusing, with or without the flag. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
-
-## Orgs, Projects, the Enterprise and Content
-
-CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
-JSON, help and errors. Decode captured CLI output as UTF-8; JSON keeps Unicode characters
-without ASCII escaping. Existing stream error handlers are preserved, so diagnostics
-can still escape undecodable filenames. No `PYTHONIOENCODING` workaround is needed.
-The Action summary and quality validator also decode CLI results as UTF-8.
-
-Contributor tests also decode CLI captures and Markdown fixtures as UTF-8. Action
-shell tests use Git Bash on Windows and an explicit `requires_bash` dependency marker;
-see [Windows test portability](references/windows-testing.md) for setup and the individual failure triage.
-
-The four command groups follow the same rules as the repository commands: read-only toward GitHub, one JSON object on stdout (`command`, `action`, `owner`, `result`, `logs[]`), the same exit codes, and refusals for excluded, HOLD and T3 owners. What they add:
-
-**Command-name contract.** The orchestrator, the standard and other workstreams call these names, so they are fixed: the repository commands in the Command Reference; the top-level generators `banner`, `card`, `org-banner`, `org-tile`, `intro` and `contact-sheet`; and the groups `org {profile,about,pins,labels,health,doctor}`, `project {capture-query,normalize,copy-plan,readme,lint,estate-plan}`, `enterprise {snapshot-query,discover,snapshot,doctor,seat-check,diff,plan}` and `content {social,icon,links,linguist,actions,images,sidebar}`. The social preview is `content social`; the old top-level `social-preview` still parses as a hidden, deprecated alias (same options, same file, logged `deprecated:social-preview`) and is not documented as a command.
-
-- **Writer jobs.** Every planned GitHub change is a `scripts/writer.py` job `{id, phase, kind, repo|org, approval_id?, group?, argv, note}`; `--jobs FILE` appends them as JSON lines. Label jobs carry `group: labels:OWNER/REPO` for the writer's half-completed-group reconciliation unless the orchestrator passes its own group. UI-only steps are `kind: "browser"` jobs with `url`, `ui_action` and the exact click path in `steps`. A job that needs an approval carries the id `scripts/writer.py` looks up in `decisions/APPROVED_ACTIONS.yaml` (`ent-001`/`ent-002` for the Enterprise, `q41.orgs`/`q41.estate` for a project copy, the ids you pass with `--approval-id` or `--approval`). Mutations are always inline in `argv`; only read queries load from a file. The skill never runs a job: the orchestrator's writer does, after its guard and approval checks, or, used standalone, the user does after approving it.
-- **One org resolver (CQ-03).** Every org lookup (in `enterprise doctor` too) goes through `scripts/ctshowcase/resolver.py`, which maps old and new logins from `former_slugs` in `brand.yaml` or the registry, the registry's `placeholders`, and approved `org-rename`/`org-merge` items; repository slugs the registry writes after a pending `rename` or `transfer` resolve to today's slug the same way. After an approved rename (for example `CompleTetech-Security` to `CompleteTech-Security`) the brand row, the registry row, the watching-org exemption and every refusal still resolve, and jobs name the new login.
-- **The estate registry is private.** `org` reads `registry/estate.yaml` (`--registry FILE`, or the bundle beside the skill, or `$SHOWCASE_ESTATE_ROOT`) and renders public pages only from its public slice. Never copy the registry into a repository. Without it, `org health` checks a supplied `.github` checkout or captured files, and `org doctor` runs the checks supported by its snapshot, checkout and avatar; registry-dependent coverage is reported as `needs-input:registry`, with `done: no`. `org labels ORG --repos-from-gh` instead discovers accessible repositories with paginated read-only GitHub GETs and uses the committed brand identity without reading the registry or estate decisions. Remaining registry-backed `org` actions exit 4 without a registry; `project`, `enterprise` and `content` run on their input files alone. `examples/estate/` is a synthetic Northwind registry for trying every `org` action offline. See [the coverage table](references/org.md#registry-free-health-and-doctor) for partial O2/O3 checks.
-
-| Group | Typical sequence | Reference |
-|---|---|---|
-| `org` | `org about ORG --jobs J`, `org labels ORG --meta-dir M --jobs J` (or `org labels ORG --repos-from-gh --jobs J` without a registry), `org profile ORG --meta-dir M --out-dir <ORG/.github checkout>`, `org pins ORG --jobs J`, then `org doctor ORG --snapshot S` | [references/org.md](references/org.md) |
-| `project` | `project capture-query` (reference board), `normalize`, `copy-plan --target ORG` (stage 1), re-capture, `copy-plan --copied FILE --files-dir DIR --jobs J` (stage 2), `readme`, `lint` | [references/projects.md](references/projects.md) |
-| `enterprise` | `enterprise snapshot-query --slug S` or `snapshot --slug S --out F`, then `doctor`, `seat-check`, `plan --jobs J`; `diff` after the run | [references/enterprise.md](references/enterprise.md) |
-| `content` | `content links --base-ref origin/main`, `linguist`, `actions`, `images`, `sidebar --facts F`, `icon prompt`, `icon normalize`, `icon check`, `social --job` | [references/content.md](references/content.md) |
-
-`content icon` defaults to the installed skill's `references/art-direction.md`,
-including a repository glyph template for option A and the illustration template
-for option B. Palette values come from `references/brand.yaml`; documented family
-seeds are used when available, otherwise the prompt uses the tool's default seed. Use
-`--art-direction FILE` to select another file; relative paths use the current
-directory, and missing files report `needs-input:art-direction` with the selected path.
-Older custom configs without `icon_ink`/`icon_spark` keep normalization and checks
-available (family-ink QA is skipped with `needs-input:icon-palette`). The bundled
-option A glyph prompt names the missing tokens with exit 4; add them or pass an
-explicit palette through `--art-direction`. Option B illustration prompts do not
-require these glyph tokens.
-
-```bash
-S=<skill-dir>/scripts/showcase.py
-SHOWCASE_ESTATE_ROOT=<skill-dir>/examples/estate python3 $S org profile Northwind-Trading-Co --meta-dir <skill-dir>/examples/estate/meta
-python3 $S project copy-plan --target CompleteTech-Skills --source CompleteTech-LLC/7 --jobs jobs.jsonl
-python3 $S enterprise plan --snapshot registry/enterprise.snapshot.json --jobs jobs.jsonl
-python3 $S --meta meta.json content links --base-ref origin/main --diff     # inside the target checkout
-```
-
-**Registry-free labels.** Run `org labels ORG --repos-from-gh --jobs jobs.jsonl` to list all repositories visible to the authenticated GitHub account and capture their labels and file trees. It emits plans only. Rewrite the org `.github` default issue forms first, plan/apply that repository's label changes through the approved writer, then re-plan member repositories. Use `--checkouts DIR --dot-github DIR/ORG/.github` with verified GitHub-origin checkouts stored as `DIR/ORG/REPO` to release safe renames after those content changes; missing checkouts or unknown reference files keep renames held. Git-index and captured reference files must be present before a checkout is trusted, so sparse exclusions and local deletions cannot bypass the guard. Held renames make the plan `incomplete`; affected repository rows report `needs-input`, retain the held operation, and include `rewrite_first` file/line details when references must change. Forks, archived repositories and disabled-Issues members retain their existing exemptions. Do not combine this mode with registry, metadata or decision inputs. See [references/org.md](references/org.md) for the ordered workflow.
-
-## Command Reference
-
-```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
-
-meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
-fingerprint [--out-dir docs/images] [--github-output]
-fonts [--check | --fetch]
-config [--write-lock] [--crop]
-describe [--text TEXT] [--type TYPE] [--records FILE]
-topics [--records FILE] [--gh] [--also-in ORG[,ORG] | --registry [FILE]]
-labels --emit-yml
-labels --plan [--references] [--records FILE] [--gh] [--jobs FILE] [--allow-hold]
-banner [--out docs/images/banner.png] [--scale 2] [--icon PATH] [--subtitle TEXT]
-       [--key-chip TEXT]... [--chip TEXT]... [--category TEXT] [--allow-unmeasured] [--allow-hold]
-       [--allow-few-chips] [--png-budget 300000]
-card [--out docs/images/card.svg] [--png PATH] [--icon PATH] [--allow-unmeasured] [--allow-hold]
-org-banner --org OWNER --out PATH [--illustration PATH]
-org-tile --org OWNER [--avatar PATH] [--illustration PATH] [--out PATH] [--png PATH]
-intro (--profile CompleteDotTech | --org OWNER) [--name TEXT] [--eyebrow TEXT] [--tagline TEXT]
-      [--chip key:TEXT] [--chip attr:TEXT]... [--mark PATH] [--height 320|360] [--static] [--out assets/intro.svg]
-footer [--check README.md [--online]] [--org OWNER] [--raw]
-readme [--mode auto|scaffold|upgrade|header] [--variant auto|A|B|C|D|E|F|G|H|I|J]
-       [--write] [--diff] [--records FILE] [--bootstrap]
-lint svg --kind intro|card|tile|plate|divider FILE...
-lint readme [README.md] [--variant auto]
-lint banner [docs/images/banner.png]
-lint all
-lint public-leak FILE... [--meta-dir DIR] [--registry FILE] [--decisions FILE] [--org ORG[,ORG]]
-lint prose [FILE...] [--text TEXT]... [--prose-kind text|description|tagline] [--preserved] [--allow WORD]...
-contact-sheet INPUT... --out PATH [--mode grid|stack|avatar] [--tile W] [--cols N] [--gap 24]
-              [--widths 1012,390] [--mask none|circle|rounded] [--labels] [--title TEXT]
-contact-sheet --org OWNER --cross-surface --out PATH [--avatar PNG] [--banner PNG] [--card SVG|PNG] [--social PNG]
-              [--org-banner JPG]
-doctor [--format tsv|json|md] [--header]
-doctor --estate --meta-dir DIR [--registry FILE] [--template-dir DIR --checkouts DIR] [--out NEW_PROPOSALS.yaml]
-new OWNER/NAME --type TYPE [--description TEXT] [--template OWNER/REPO] [--records FILE] [--jobs FILE] [--approval-id ID]
-adopt OWNER/REPO [--records FILE] [--jobs FILE] [--approval-id ID]
-enterprise snapshot-query --slug SLUG
-enterprise discover
-enterprise snapshot --slug SLUG [--out registry/enterprise.snapshot.json]
-enterprise doctor|seat-check|plan --snapshot FILE [--baseline FILE] [--user LOGIN] [--records FILE] [--jobs FILE]
-    doctor: [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
-enterprise diff --baseline OLD --snapshot NEW
-
-org profile|about|pins|labels|health|doctor ORG [--registry FILE] [--meta-dir DIR] [--decisions FILE]
-    [--approved FILE] [--approved-yaml FILE] [--actions FILE] [--allow-t3] [--jobs FILE]
-    profile: [--out-dir DIR] [--render] [--banner PATH] [--lists FILE] [--email-approved] [--allow-unmeasured]
-    pins: [--lists FILE] [--repo-ids FILE]      health/doctor: [--dot-github DIR]
-    labels: [--repos-from-gh] [--checkouts DIR] [--dot-github DIR]
-    doctor: [--snapshot FILE] [--avatar PATH] [--doctor-format tsv|json|md] [--header]
-org profile --user CompleteDotTech [--registry FILE] [--meta-dir DIR] [--out-dir DIR] [--render] [--allow-t3]
-project capture-query --owner OWNER --number N
-project normalize --capture FILE [--rest-fields FILE] [--out FILE]
-project lint --capture FILE --owner OWNER [--role org|template|estate] [--display-name TEXT]
-project copy-plan --target ORG|@me [--role org|template|estate] [--source OWNER/N] [--copied FILE]
-    [--workstreams FILE] [--repos OWNER/REPO,...] [--approval-id ID] [--files-dir DIR] [--no-status-update] [--jobs FILE]
-    (stage 2 with --jobs needs --files-dir: the REST view bodies the jobs' --input names)
-project readme --capture FILE --owner OWNER [--out FILE]
-project estate-plan [--copied FILE] [--user-id ID] [--source OWNER/N] [--jobs FILE]
-content social [--out PATH] [--title TEXT] [--icon PATH] [--job] [--allow-unmeasured] [--allow-hold]
-content icon prompt|normalize|check [--option A|B] [--glyph FILE] [--art-direction FILE] [--in PNG]
-    [--ground auto|transparent|keep] [--out PATH] [--preview PATH]
-content links [FILE...] [--readme-path PATH] [--base-ref REF] [--online] [--cache FILE] [--strict] [--diff]
-content linguist [--min-share 0.02] [--language NAME]
-content actions [--runs FILE] [--workflows FILE] [--pages FILE] [--changed PATH...] [--approval WORKFLOW=ID]
-content images [FILE...] [--base-ref REF] [--approval-id ID] [--out-dir DIR] [--online]
-content sidebar --facts FILE [--packages FILE]... [--current FILE] [--repo OWNER/REPO]
-    every content action: [--report FILE] [--jobs FILE] [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
-```
-
-| Command | What it does | Writes |
-|---|---|---|
-| `meta` | Normalizes repository metadata from read-only `gh api` GETs and adds the detected type, variant and family. Stdlib only. A `--meta` file keeps every key a later check reads ([references/meta.schema.json](references/meta.schema.json)): `has_pages`, `size`, `template_repository` (the full_name GitHub records for a repository generated from a template) and `template_taglines` (that template's README tagline when the repository was generated and today, read by `--from-gh`), the About sidebar counts (`releases`, `deployments`, `packages`, `environments`), and the R10 evidence `uses_custom_og_image` (the captured GraphQL `usesCustomOpenGraphImage` is mapped to it; only a boolean counts, and two spellings that disagree leave R10 `unknown`). `--from-gh` makes no GraphQL call, so add the flag from the social preview job's read-only check. | `--out` |
-| `fingerprint` | Hashes description, topics, visibility, license, language, icon, override file, skill version and brand config; reports `changed` against `docs/images/.showcase.json`. Stdlib only. | `$GITHUB_OUTPUT` with `--github-output` |
-| `config` | Validates `references/brand.yaml` against its schema and checks the stdlib lock copy; `--write-lock` regenerates `references/brand.lock.json` after an edit. | `references/brand.lock.json` with `--write-lock` |
-| `fonts` | `--check` verifies `assets/fonts/FONTS.json` sha256; `--fetch` downloads the pinned OFL fonts (ClawHub installs). | `assets/fonts/` with `--fetch` |
-| `describe` | Runs D1–D8, V1, P1, B1 and X1 and answers `keep`, `edit` or `needs-writer`. | `--records` |
-| `topics` | Runs the closed-vocabulary merge algorithm (brand, family, org membership, type, domain, tech; 10 public, 8 private). `--also-in ORG[,ORG]` (or `--registry`, which reads the repository's `also_in` from the private registry, read only, or an `also_in` list in the metadata) adds one org membership topic per cross-listing org from `org_topics` (never the home org's own). | `--records` |
-| `labels` | Emits `labels.yml`, or plans renames before creates (never `--force`, never a delete) from the metadata's labels or, without them, a read-only GET of the live labels. `--plan` prints the `gh` argv and the `scripts/writer.py` jobs (the writer re-reads the live labels before applying); standalone users run the printed argv themselves after approving it. A rename is planned only after §6.4 rule 0: in the `--repo-dir` checkout, or, without one, when the metadata's complete file tree (`files_complete: true`) lists no file rule 0 reads; a repository without issue forms of its own is also checked against the owner's `.github` default forms (`--org-defaults` takes a checkout or its metadata JSON). Otherwise it is held (`needs-input:label-references`, `needs_checkout`; [references/labels.md](references/labels.md)). `--references` is a no-op kept for compatibility. The `org labels` gates apply: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off; AI-Ascension gets only the `dependencies` create or patch; `has_issues: false` repositories (except `.github`), forks, archived repositories, T2-R and romgenie answer `n/a`. With `--plan`, `--jobs`, `--records` or `--gh`, metadata without labels is never planned against: the live labels are read first (exit 4, `needs-input:gh`, when they cannot be). Job ids come from the operation, never its position. | `--records`, `--jobs` |
-| `banner` | Renders the golden-layout hero PNG: navy grid canvas, icon card, eyebrow, slug, one-line subtitle, 2–4 chips, accent bar. Fewer than two chips exits 4 unless `--allow-few-chips` (result `incomplete`). | `--out`, sidecar under `docs/images/` |
-| `card` | Renders the 400×160 repo card SVG (no `<text>`, lint must pass first) and an optional PNG preview; same eyebrow and chip order as the banner. | `--out`, `--png` |
-| `org-banner` | Renders the 1600×400 org profile banner JPG (STANDARD §9.5). | `--out` |
-| `org-tile` | Renders the 400×160 org tile for profile directories. | `--out`, `--png` |
-| `intro` | Renders the profile intro (animated only for the personal profile and T1 flagship orgs; `.still` reduced-motion frame). | `--out` |
-| `footer` | Prints the decision 18 footer between `showcase:footer` markers, or checks that the README ends with it; `--check --online` also HEADs both raw logo URLs and fails (`fail:offline`) unless both return 200 (the Phase 4.0 hard gate). `--org OWNER` answers `exempt`, `exempt:footer` or `hold` for an org outside the footer's scope; for the watching org, `--check` still reads the README (its `.github` gets the footer, and `--org` cannot tell it from a fork). | stdout |
-| `readme` | Scaffolds, upgrades or refreshes the header marker blocks; never drops a line (multiset check). `--bootstrap` fills a template body only while its marker's sha256 still matches (a person's edit makes the block theirs). | `README.md` with `--write`; `CONTRIBUTING.md` with `--bootstrap` |
-| `lint` | SVG rules, README rules (R7 plus decisions 13 and 18) and banner PNG checks; `public-leak` checks any public file the run writes against the estate's private set (private slugs and names under every login of the owner, members-only pins, internal notes from the org rows, the registry's top-level notes and judge_changes and the profile's internal keys; OPS-03), reading the private registry and `--meta-dir` only; `prose` runs the CQ-17 checks on text the run writes (§1.2 brand strings, no emoji, no placeholders, the §4.1 formula for descriptions and taglines, typos when the optional `codespell` is installed; `--preserved` text only warns). | nothing |
-| `contact-sheet` | Lays outputs out the way GitHub shows them, on `#0d1117` and `#ffffff` (proofing surfaces, not asset variants). `--org ORG --cross-surface` is the G4 gate: the org avatar at 32 px, a hero banner, a repo card, the social preview and the org banner on one labelled sheet; a missing surface is logged `needs-input:cross-surface:<surface>` (result `incomplete`). | `PATH.on-github-dark.png`, `PATH.on-github-light.png` |
-| `doctor` | Prints the definition-of-done row: `R1`–`R11`, `banner`, `icon`, `card`, `footer`, `done`. No network. `--estate` classifies every repository in `--meta-dir` that `registry/estate.yaml` does not list with `decisions/POLICY.md` (`keep`, `move`, `archive`, `delete`, `merge`, `rename`, `rename-default-branch`; never acted on) and diffs the template-managed files of template-born checkouts against the current template (bump PRs are proposals). | `--out` (merges its own entries into `NEW_PROPOSALS.yaml`; others stay) |
-| `new` | Plans a repository from the template: the `gh repo create OWNER/NAME --template CompleteTech-LLC/completetech-repo-template --private` writer job, then `adopt` on it (naming N1–N4 and the §5.4 type are checked first; the watching org, placeholder orgs and refused owners exit 2). | `--records`, `--jobs` |
-| `adopt` | What "Use this template" does not carry, as Phase 3 change records and writer jobs: the §10.1 settings (wiki, Projects and Discussions only after their reads), the §5.6 topics, the §6 label passes, private vulnerability reporting and Dependabot alerts on public non-forks, plus a UI checklist (social preview upload job, About sidebar). An archived capture plans no jobs or change records, only a `pending` entry: re-capture the metadata inside the approved unarchive window, then adopt again. Metadata from `--meta`, else read-only `gh api` GETs. A family on hold (`hold: true`) is refused (exit 2). | `--records`, `--jobs` |
-| `enterprise` | Decision 24: `snapshot-query` prints the validated read queries; `discover` and `snapshot` run read-only GraphQL queries; `doctor` (E1–E14), `seat-check`, `diff` and `plan` (change records and writer jobs) work offline on snapshots against `references/enterprise.yaml`. | `--out`, `--records`, `--jobs` |
-| `org` | Decisions 5, 8, 9, 14, 15, 18, 20 and 23: the org profile README from the registry's public slice (leak-checked), the personal CompleteDotTech README with `profile --user` (kit order, leak-checked against the whole estate), About payload, pin and star List plan, label jobs for every repository homed in the org, `.github` health cells, and the O-check row. | `--out-dir` (profile only, after the leak check; an existing hand-made profile also needs a `profile-retemplate` approval), `--jobs` |
-| `project` | Decision 23, STANDARD §13: capture query, template spec, board lint (O10), two-stage copy plan (structure only, nothing deleted, mutations inline), board README, and the private Estate board. | `--out`, `--files-dir`, `--jobs` |
-| `content` | Audit gaps CQ-04, RP-09 (links), RP-07, CQ-08 (language bar), RP-06, RP-01, CQ-13 (Actions), RP-03, RP-10 (images), RP-05 (sidebar), RT-04 (repo icon) and R10 (`content social`: the 1280×640 repository social preview, STANDARD §9.5, in the same family design, plus with `--job` its browser upload job). | `--report`, `--jobs`, `--out`, `--out-dir`, `--preview`, `--cache` |
-
-`--type` replaces type detection with a §5.4 type (logged `type-override:<type>`); use it only when neither a checkout nor a captured file tree is available, for example with registry metadata. Without a tree, the type is provisional (`needs-input:file-tree`); a README link to a root `SKILL.md` still counts as rule 5.
-
-`lint readme` and `lint all` refuse excluded, hold and T3 owners like every other repository command. `lint all` fails an applicable banner or card that is missing; an exempt one is linted only if it exists. Forks outside the watching org, backups, archived and `.github` repositories need the banner (they have no card); a preserve-list README is exempt from the banner only when review q57 `pres` is "Leave them unchanged".
-
-Banner refusals: a watching-org fork returns `exempt` and writes nothing; the watching org's `.github` gets the banner and icon like any `.github`; another watching-org repository that is not a fork is refused (exit 2, `hold:watching-non-fork`) until decided, then `--allow-hold`; `CompleteDotTech/CompleteDotTech` (it opens with the intro) and a placeholder org's `.github` return `exempt:*`. Every other repository gets the hero banner (decisions 12, 13 and 18): forks outside the watching org (G), backups and archived repositories (H) and `.github` repositories (J) included, while `card` returns `exempt:no-card` for forks, backups and `.github`. AI-Ascension (`banner: keep-existing`) gets the hero in its own palette above its existing banner (q57 `aia` and `pres` defaults) and returns `exempt:keep-existing` only when `readme.preserve_banner` is `unchanged`; TouchedByAnAgent (`hold: true`) needs `--allow-hold`; families marked `measured: false` need `--allow-unmeasured` (otherwise exit 4, `needs-input:palette-v1.1`).
-
-## Decisions That Override the Standard
-
-These user decisions outrank `STANDARD.md` (`ct-std-v1`). Full text: [references/decisions.md](references/decisions.md).
-
-| Decision | Effect on this skill |
-|---|---|
-| 12 | Every in-scope repository gets its own icon at `assets/icon.png`; until then the banner uses the org's Neon Night mark (every T1 org but CompleteTech-LLC), then the CompleteTech logo (CompleteTech-LLC) or, in every other family, the family's typeset wordmark on its dark plate, and logs `needs-input:repo-icon`. |
-| 13 | Every README opens with the hero banner in the php2shell-check layout, then the nav line (q57 `nav` default), then the title, badge row and bold description; forks outside the watching org, backups, archived and `.github` repositories included. |
-| 18 | Every README ends with the exact CompleteTech LLC footer. It is the only `<picture>` the skill emits. |
-| 19 | The dark logo master is configurable (`brand_assets.dark_master` is `current` or `candidate`); generators never crop a mark at runtime. |
-| 21 | One dark design per surface (banner, card, tile, intro) on both GitHub themes. No light variants, no `-dark`/`-light` sibling files. |
-| 22 | This skill and `completetech-repo-template` make the standard repeatable; the template's Action calls `action.yml`. |
-| 23 | Orgs and GitHub Projects are covered: project boards are copied from the captured golden template, never deleted. |
-| 24 | The CompleteTech Enterprise is covered read-only: snapshot, E-checks, the romgenie seat check and printed change records; policies stay proposals. |
-
-## Brand and Family Data
-
-- `references/brand.yaml` is the single place for colours, fonts, logo paths, eyebrows, company labels, footer strings and per-org rows. A hex colour literal in `scripts/` fails the quality gate.
-- Precedence: schema defaults, then `families.<family>`, then `orgs.<Org>`, then the repository's `.github/showcase.yml`, then CLI flags. Repository files and flags change **content** only (icon, subtitle, chips, category, variant); colours and fonts are never overridable.
-- Icon on the banner card and the card tile, first match wins: `--icon`, `.github/showcase.yml` `icon`, then `assets/icon.png`, then the org mark (`assets/orgs/<Org>/mark.png`), then a family fallback: the light CompleteTech logo for CompleteTech orgs (its cloud-and-bulb crop, `mark_light`, in icon boxes under 200 px), and for every other family (AI-Ascension, Jev-Engineering, jevplay-games, LibreEvolve, TouchedByAnAgent, romgenie, T3) its display name typeset in the family font on the family plate. A T2 surface never carries the CompleteTech logo.
-- An icon that brings its own opaque ground (four corners alike) fills the card with that ground and is drawn full-bleed, so there is never a plate inside a plate; dark plates get a 2 px accent edge. jevplay-games icons are scaled nearest-neighbour at an integer factor.
-- `.github/showcase.yml` may carry `type:` (a §5.4 type for a repository whose code has not landed) and `for: OWNER/REPO` (any login of the org, the name in any case, or the slug an approved rename or transfer gives it; the overrides apply only to that repository, so a template's own chips and subtitle never reach the repositories created from it).
-- Navy surfaces (intro, org tile) use the selected dark master or `mark-dark.png` when committed. Marks are never cropped, masked or recoloured.
-- `readme:` holds the review-page answers that shape README scaffolding, at their defaults: `nav_first: false` (q57 `nav`: hero banner, then nav line), `preserve_banner: above` (q57 `pres`: the hero goes above a preserve-list README's own banner; `unchanged` leaves those READMEs without one) and `fork_readme: note` (q27: forks outside the watching org keep the upstream README under the hero banner and the §7.4 G note; `full` gives them their §5.4 variant). Change a value only after the user's answer, then `config --write-lock`.
-
-## Resource Guide
-
-| Resource | Role |
-|---|---|
-| [references/estate-standard.md](references/estate-standard.md) | Tiers, brand strings, golden rules, org identity table, repo naming. |
-| [references/descriptions.md](references/descriptions.md) | Description checks D1–D8, V1, P1, B1, X1, keep-or-edit order, templates by type. |
-| [references/topics.md](references/topics.md) | Topic layers, type detection rules 1–25, vocabulary, aliases, merge algorithm, safety. |
-| [references/labels.md](references/labels.md) | The 23-label set, migration map, apply algorithm and `labels.yml`. |
-| [references/readme-variants.md](references/readme-variants.md) | Header block with banner and footer, variants A–J, H2 order, license rows, preserve list. |
-| [references/banner-layout.md](references/banner-layout.md) | Banner and card geometry measured from the golden, chip rules, eyebrow rules. |
-| [references/art-direction.md](references/art-direction.md) | Family palettes, motifs, asset sizes, prompt template for illustrations, art QA. |
-| [references/svg-rules.md](references/svg-rules.md) | GitHub-safe SVG rules with decision 21 applied, and what `lint svg` checks. |
-| [references/profile-readmes.md](references/profile-readmes.md) | Org and personal profile README structure, cards, intros and what to skip. |
-| [references/orgs-and-projects.md](references/orgs-and-projects.md) | Org About fields, O-checks, org `.github` contents, profile rules and the GitHub Projects rules. |
-| [references/org.md](references/org.md) | The `org` command group: inputs (with or without the estate bundle), the public slice and leak check, the org resolver (CQ-03), writer jobs and refusals. |
-| [references/projects.md](references/projects.md) | The `project` command group: capture, normalize, lint, the two-stage copy plan, README and the Estate board. |
-| [references/content.md](references/content.md) | The `content` command group: links, language bar, Actions, images, sidebar, repo icon and the social preview. |
-| [references/enterprise.md](references/enterprise.md) | The enterprise module: commands, writer jobs, `enterprise.yaml` desired state, E-checks and guardrails (decision 24). |
-| [references/constraints.md](references/constraints.md) | Platform limits, write discipline, approval-gated actions, change records. |
-| [references/definition-of-done.md](references/definition-of-done.md) | Checks R1–R12 and O1–O11 mapped to `doctor` and `lint` cells. |
-| [references/decisions.md](references/decisions.md) | The user decisions this skill implements, verbatim. |
-| `references/brand.yaml`, `references/brand.schema.json`, `references/repo-config.schema.json`, `references/meta.schema.json` | Brand data and the schemas for it, for `.github/showcase.yml` and for metadata. |
-| `references/standard/` | Machine-readable standard: topics, types, labels, descriptions, README variants, naming. |
-| `examples/` | Synthetic Northwind Trading Co. metadata, small fixture checkouts, an example `.github/showcase.yml`, a synthetic estate (`examples/estate/`: registry and metadata for the `org` commands), and `render_examples.sh`, which regenerates every committed preview. |
-| `action.yml` | Composite GitHub Action that regenerates the banner and card when inputs change. |
-
-## Runtime Permissions
-
-| Area | Runtime behavior |
-|---|---|
-| Execution | Runs the local Python entry point `scripts/showcase.py` (and `scripts/action_commit.sh`, `scripts/action_prepare.py` inside the Action only). |
-| Reads | The target repository directory (`--repo-dir`), a metadata JSON (`--meta`) or directory (`--meta-dir`), `references/` and `assets/`; for the `org`, `project` and `content` groups also the estate registry and the approval files (`--registry`, `--approved`, `--approved-yaml`, `--actions`, `--decisions`, or the bundle beside the skill), read only and never copied. |
-| Writes | Only paths given by `--out`, `--png`, `--records`, `--jobs`, `--report`, `--out-dir`, `--files-dir`, `--preview` or `--cache`; with `--write`, the README marker blocks and `docs/images/*`; with `--bootstrap`, `CONTRIBUTING.md` owner tokens; `content icon normalize` defaults to `assets/icon.png` in the target checkout. |
-| Network | None by default. `meta --from-gh`, `labels --plan` and `adopt` without metadata, and opt-in `org labels --repos-from-gh` run read-only `gh api` GETs; `enterprise discover` and `enterprise snapshot` run read-only `gh api graphql` queries; `content links --online` and `content images --online` make cached, rate-limited HEAD/GET requests to the hosts the files link to and read-only `gh api` GETs; `fonts --fetch` downloads the pinned fonts over HTTPS; `footer --check --online` sends one HEAD to each of the two decision 18 logo URLs on raw.githubusercontent.com. `org` without `--repos-from-gh`, `project`, `enterprise snapshot-query`, `plan` and every other command only print the commands they plan. |
-
-| Not Included | Boundary |
-|---|---|
-| GitHub writes | None: no `gh` write verbs, no `git push`, no settings, labels, topics or description changes. Proposals go to the orchestrator's single writer queue as change records and writer jobs, or, used standalone, to the user, who runs the printed argv after approving it. |
-| Credentials | Does not read tokens, browser sessions or secrets; `gh` uses its own authentication. |
-| System changes | No persistence, schedules, privilege escalation or deletes. |
-
-## Network Boundary
-
-Generation, checking and planning are local. The only network calls are the read-only `gh api` GETs of `meta --from-gh`, `labels --plan`, `adopt` and opt-in `org labels ORG --repos-from-gh` (paginated repository and label discovery, plus repository file trees), the read-only GraphQL queries of `enterprise discover` and `enterprise snapshot` (api.github.com), the opt-in link and image checks of `content links --online` and `content images --online` (the hosts the checked files link to, cached and rate-limited), the font download of `fonts --fetch`, and the two read-only HEAD requests of `footer --check --online` (raw.githubusercontent.com), each run only when asked. The skill posts no metadata or run data anywhere else. The composite Action is the only component that pushes, and only into the repository it runs in.
+---
+name: github-showcase-skill
+description: >-
+  Generate CompleteTech LLC README hero banners, repo cards, social previews, repo icons, org tiles, profile intros
+  and footers; audit repos against the CompleteTech GitHub estate standard (About description, topics, labels, README
+  variants, links, language bar, Actions, images, About sidebar, SVG rules); render org profile READMEs and plan org
+  About fields, pins, star lists, labels and health files; capture, lint and copy GitHub Projects boards from the
+  estate template; and snapshot, check and plan the CompleteTech Enterprise. Read-only toward GitHub: it emits files,
+  JSON plans and gh/writer jobs. Use when creating, polishing or auditing any CompleteTech, AI Ascension, Jev
+  Engineering, jevplay-games, LibreEvolve or TouchedByAnAgent repo, README, org, org profile, GitHub Project or the
+  Enterprise so it matches the rest of the estate.
+version: 1.0.0
+metadata:
+  openclaw:
+    skillKey: github-showcase-skill
+    homepage: https://github.com/CompleteTech-Skills/github-showcase-skill
+    requires:
+      bins:
+        - python3
+    install:
+      - kind: uv
+        package: fonttools==4.67.0
+      - kind: uv
+        package: uharfbuzz==0.57.0
+      - kind: uv
+        package: pillow==13.0.0
+      - kind: uv
+        package: pyyaml==6.0.3
+---
+
+# GitHub Showcase Skill
+
+## At a Glance
+
+| What it creates | Best for | Output |
+|---|---|---|
+| README hero banners, repo cards, social previews, repo icons, org banners and tiles, profile intros, the estate footer, README scaffolds, org profile READMEs, standard checks, and plans for orgs, GitHub Projects, the Enterprise and repository content | Making any CompleteTech-family repository, README, org, org profile, project board, the Enterprise or the profile page match the estate, and keeping it that way | `docs/images/banner.png` (1280×360 or 2560×720), `docs/images/card.svg`, `assets/social-preview.png` (1280×640), `assets/icon.png` (1024×1024), org banner JPG (1600×400), tile and intro SVGs, README marker blocks, `profile/README.md` and `profile/data.json`, JSON check results and plans, change records, `scripts/writer.py` jobs (JSON lines), coverage rows |
+
+Every surface uses one **dark** design on both GitHub themes (decision 21): navy grid canvas, a card for the repo icon (or the org's Neon Night mark), a sky-blue eyebrow, the repo slug in monospace, two to four fact chips and an accent bar. All text is typeset from the bundled OFL fonts with HarfBuzz and outlined to paths, so outputs are deterministic and never depend on a web font or an image model. One CLI, `scripts/showcase.py`, does every generation, check and plan: the repository commands below, and four command groups, `org`, `project`, `enterprise` and `content`, for orgs, GitHub Projects, the Enterprise and repository content.
+
+## Use When
+
+| Situation | Start with |
+|---|---|
+| A repository needs its README hero banner or repo card | `banner`, then `card` (and `content social` for R10) |
+| A README must be scaffolded or upgraded to its standard variant, with the footer | `readme` (dry run), then `readme --write`, then `footer --check` |
+| A description, topic set or label set must be checked before a write is queued | `describe`, `topics`, `labels --plan` |
+| An org profile or the personal profile needs cards, tiles, a banner or the animated intro | `card`, `org-tile`, `org-banner`, `intro` and [references/profile-readmes.md](references/profile-readmes.md) |
+| An org needs its profile README, About fields, pins and star List, labels or `.github` health files, or an org must be verified as done | `org profile`, `org about`, `org pins`, `org labels`, `org health`, `org doctor` ([references/org.md](references/org.md)) |
+| An org needs its GitHub Project board from the estate template, or a board must be checked | `project capture-query`, `normalize`, `copy-plan`, `readme`, `lint`, `estate-plan` ([references/projects.md](references/projects.md)) |
+| The CompleteTech Enterprise must be captured, checked or planned | `enterprise snapshot-query` or `snapshot`, then `enterprise doctor`, `seat-check`, `plan` ([references/enterprise.md](references/enterprise.md)) |
+| A repository's links, language bar, Actions, README images, About sidebar, icon or social preview must be checked or produced | `content links`, `linguist`, `actions`, `images`, `sidebar`, `icon`, `social` ([references/content.md](references/content.md)) |
+| A new repository is created from `completetech-repo-template` | `new OWNER/NAME --type T` (the create job, then `adopt`), then the composite Action in `action.yml` (runs `readme --bootstrap`) |
+| A repository exists but never went through the standard (created by an agent, a pipeline or a transfer) | `adopt OWNER/REPO`; for the whole estate, `doctor --estate` (intake proposals and template drift) |
+| A set must be reviewed the way GitHub shows it | `contact-sheet` |
+| Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
+
+Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
+
+## Boundaries
+
+| This skill does | This skill does not |
+|---|---|
+| Render banners, cards, tiles, intros and contact sheets from metadata and committed brand files. | Draw illustrations, or let an image model draw text, logos or marks. |
+| Lint descriptions, topics, labels, READMEs, SVGs and banner PNGs against `ct-std-v1` and the user decisions. | Compose a new description sentence, an org description or a tagline; it returns `needs-writer` with the template. |
+| Propose GitHub changes as diffs, `gh` command lines, change records and `scripts/writer.py` jobs (`browser` jobs with exact click paths for UI-only steps) for a serialized writer. | Perform GitHub writes on its own. The only write is the Action committing into its own repository; label plans leave as `gh` argv and writer jobs (`labels --plan`). |
+| Write only the paths given by `--out`, `--out-dir`, `--jobs`, `--report` or `--records`, or README marker blocks and `docs/images/*` with `--write`. | Delete text from a README, crop or recolour a mark, or truncate text with an ellipsis. |
+| Read metadata from a JSON file or with read-only `gh api` GETs, and read the private estate registry without copying it. | Read credentials, persist state, schedule jobs, change repository settings, or copy the registry's private data into a repository. |
+
+## Core Workflow
+
+Run every command **from inside the target repository's checkout**, with the skill's script by path: `python3 <skill-dir>/scripts/showcase.py ...`. With `--meta`, the checkout must be the repository the metadata describes (its `origin` is compared); otherwise pass `--repo-dir DIR` or `--no-repo-dir`. A missing `--repo-dir` exits 2, and default outputs (`docs/images/...`) are always written inside the target checkout, never into the current directory or the skill.
+
+| Step | Command | Gate |
+|---|---|---|
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
+| 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
+| 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
+| 5 | `banner`, then `card` (and `content social`) | `art-fail` (exit 3) writes nothing. `needs-input` (exit 4) names the missing fact, including fewer than two fact chips (`needs-input:banner-chips`; add `chips:` to `.github/showcase.yml` or pass `--key-chip`/`--chip`). |
+| 6 | `readme`, then `readme --write` | Dry run prints a unified diff first. `readme-shrink` (exit 1) writes nothing. |
+| 7 | `footer --check README.md`, `lint all` | Every applicable check passes; `incomplete` is allowed for logged `needs-input` omissions. |
+| 8 | `doctor --header` | One coverage row. `done` only when every applicable cell is `pass`, `warn`, `incomplete` or `n/a`, and the banner has two to four chips. |
+| 9 | `contact-sheet` | A human (or an independent verifier) views the set on both GitHub page colours before rollout. Pass PNGs: `card --png`, `org-tile --png` previews, or install the optional `resvg_py` (`requirements-preview.txt`) so SVG inputs (the intro's static frame) render too; otherwise an SVG input exits 2. |
+
+**Who applies GitHub changes.** Under the estate orchestrator, every proposal (description, topics, labels, README) goes to its single writer queue as change records. Used standalone, with no orchestrator: show the user the `--gh` command lines (or the `argv` of `labels --plan`) and the README diff; the user runs them after approving that repository's changes. The skill itself never runs a write.
+
+**Install.** System Python on Ubuntu 24.04, Debian 12 and Homebrew refuses `pip install` ("externally managed environment"). Use a virtual environment (or `uv`):
+
+```bash
+python3 -m venv .venv && . .venv/bin/activate      # or: uv venv && . .venv/bin/activate
+python -m pip install -r <skill-dir>/requirements.txt  # or: uv pip install -r <skill-dir>/requirements.txt
+```
+
+```bash
+cd ../agentic-email-skill                               # the target checkout
+S=<skill-dir>/scripts/showcase.py
+python3 $S meta --from-gh CompleteTech-Skills/agentic-email-skill --out /tmp/meta.json
+python3 $S --meta /tmp/meta.json describe
+python3 $S --meta /tmp/meta.json banner                 # writes docs/images/banner.png in this checkout
+python3 $S --meta /tmp/meta.json doctor --header
+```
+
+| Exit | Meaning |
+|---|---|
+| 0 | ok, including `warn`, `incomplete` and `n/a` |
+| 1 | a check failed |
+| 2 | usage or config error, or an excluded, hold or T3 owner |
+| 3 | `art-fail`: text does not fit the fixed size ladder, or the PNG budget cannot be met |
+| 4 | `needs-input` blocks a generator (for example an empty description) |
+
+Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
+
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands do not enforce owner eligibility, so they are exceptions that never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+
+## Orgs, Projects, the Enterprise and Content
+
+CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
+JSON, help and errors. Decode captured CLI output as UTF-8; JSON keeps Unicode characters
+without ASCII escaping. Existing stream error handlers are preserved, so diagnostics
+can still escape undecodable filenames. No `PYTHONIOENCODING` workaround is needed.
+The Action summary and quality validator also decode CLI results as UTF-8.
+
+Contributor tests also decode CLI captures and Markdown fixtures as UTF-8. Action
+shell tests use Git Bash on Windows and an explicit `requires_bash` dependency marker;
+see [Windows test portability](references/windows-testing.md) for setup and the individual failure triage.
+
+The four command groups follow the same rules as the repository commands: read-only toward GitHub, one JSON object on stdout (`command`, `action`, `owner`, `result`, `logs[]`), the same exit codes, and refusals for excluded, HOLD and T3 owners. What they add:
+
+**Command-name contract.** The orchestrator, the standard and other workstreams call these names, so they are fixed: the repository commands in the Command Reference; the top-level generators `banner`, `card`, `org-banner`, `org-tile`, `intro` and `contact-sheet`; and the groups `org {profile,about,pins,labels,health,doctor}`, `project {capture-query,normalize,copy-plan,readme,lint,estate-plan}`, `enterprise {snapshot-query,discover,snapshot,doctor,seat-check,diff,plan}` and `content {social,icon,links,linguist,actions,images,sidebar}`. The social preview is `content social`; the old top-level `social-preview` still parses as a hidden, deprecated alias (same options, same file, logged `deprecated:social-preview`) and is not documented as a command.
+
+- **Writer jobs.** Every planned GitHub change is a `scripts/writer.py` job `{id, phase, kind, repo|org, approval_id?, group?, argv, note}`; `--jobs FILE` appends them as JSON lines. Label jobs carry `group: labels:OWNER/REPO` for the writer's half-completed-group reconciliation unless the orchestrator passes its own group. UI-only steps are `kind: "browser"` jobs with `url`, `ui_action` and the exact click path in `steps`. A job that needs an approval carries the id `scripts/writer.py` looks up in `decisions/APPROVED_ACTIONS.yaml` (`ent-001`/`ent-002` for the Enterprise, `q41.orgs`/`q41.estate` for a project copy, the ids you pass with `--approval-id` or `--approval`). Mutations are always inline in `argv`; only read queries load from a file. The skill never runs a job: the orchestrator's writer does, after its guard and approval checks, or, used standalone, the user does after approving it.
+- **One org resolver (CQ-03).** Every org lookup (in `enterprise doctor` too) goes through `scripts/ctshowcase/resolver.py`, which maps old and new logins from `former_slugs` in `brand.yaml` or the registry, the registry's `placeholders`, and approved `org-rename`/`org-merge` items; repository slugs the registry writes after a pending `rename` or `transfer` resolve to today's slug the same way. After an approved rename (for example `CompleTetech-Security` to `CompleteTech-Security`) the brand row, the registry row, the watching-org exemption and every refusal still resolve, and jobs name the new login.
+- **The estate registry is private.** `org` reads `registry/estate.yaml` (`--registry FILE`, or the bundle beside the skill, or `$SHOWCASE_ESTATE_ROOT`) and renders public pages only from its public slice. Never copy the registry into a repository. Without it, `org health` checks a supplied `.github` checkout or captured files, and `org doctor` runs the checks supported by its snapshot, checkout and avatar; registry-dependent coverage is reported as `needs-input:registry`, with `done: no`. `org labels ORG --repos-from-gh` instead discovers accessible repositories with paginated read-only GitHub GETs and uses the committed brand identity without reading the registry or estate decisions. Remaining registry-backed `org` actions exit 4 without a registry; `project`, `enterprise` and `content` run on their input files alone. `examples/estate/` is a synthetic Northwind registry for trying every `org` action offline. See [the coverage table](references/org.md#registry-free-health-and-doctor) for partial O2/O3 checks.
+
+| Group | Typical sequence | Reference |
+|---|---|---|
+| `org` | `org about ORG --jobs J`, `org labels ORG --meta-dir M --jobs J` (or `org labels ORG --repos-from-gh --jobs J` without a registry), `org profile ORG --meta-dir M --out-dir <ORG/.github checkout>`, `org pins ORG --jobs J`, then `org doctor ORG --snapshot S` | [references/org.md](references/org.md) |
+| `project` | `project capture-query` (reference board), `normalize`, `copy-plan --target ORG` (stage 1), re-capture, `copy-plan --copied FILE --files-dir DIR --jobs J` (stage 2), `readme`, `lint` | [references/projects.md](references/projects.md) |
+| `enterprise` | `enterprise snapshot-query --slug S` or `snapshot --slug S --out F`, then `doctor`, `seat-check`, `plan --jobs J`; `diff` after the run | [references/enterprise.md](references/enterprise.md) |
+| `content` | `content links --base-ref origin/main`, `linguist`, `actions`, `images`, `sidebar --facts F`, `icon prompt`, `icon normalize`, `icon check`, `social --job` | [references/content.md](references/content.md) |
+
+`content icon` defaults to the installed skill's `references/art-direction.md`,
+including a repository glyph template for option A and the illustration template
+for option B. Palette values come from `references/brand.yaml`; documented family
+seeds are used when available, otherwise the prompt uses the tool's default seed. Use
+`--art-direction FILE` to select another file; relative paths use the current
+directory, and missing files report `needs-input:art-direction` with the selected path.
+Older custom configs without `icon_ink`/`icon_spark` keep normalization and checks
+available (family-ink QA is skipped with `needs-input:icon-palette`). The bundled
+option A glyph prompt names the missing tokens with exit 4; add them or pass an
+explicit palette through `--art-direction`. Option B illustration prompts do not
+require these glyph tokens.
+
+```bash
+S=<skill-dir>/scripts/showcase.py
+SHOWCASE_ESTATE_ROOT=<skill-dir>/examples/estate python3 $S org profile Northwind-Trading-Co --meta-dir <skill-dir>/examples/estate/meta
+python3 $S project copy-plan --target CompleteTech-Skills --source CompleteTech-LLC/7 --jobs jobs.jsonl
+python3 $S enterprise plan --snapshot registry/enterprise.snapshot.json --jobs jobs.jsonl
+python3 $S --meta meta.json content links --base-ref origin/main --diff     # inside the target checkout
+```
+
+**Registry-free labels.** Run `org labels ORG --repos-from-gh --jobs jobs.jsonl` to list all repositories visible to the authenticated GitHub account and capture their labels and file trees. It emits plans only. Rewrite the org `.github` default issue forms first, plan/apply that repository's label changes through the approved writer, then re-plan member repositories. Use `--checkouts DIR --dot-github DIR/ORG/.github` with verified GitHub-origin checkouts stored as `DIR/ORG/REPO` to release safe renames after those content changes; missing checkouts or unknown reference files keep renames held. Git-index and captured reference files must be present before a checkout is trusted, so sparse exclusions and local deletions cannot bypass the guard. Held renames make the plan `incomplete`; affected repository rows report `needs-input`, retain the held operation, and include `rewrite_first` file/line details when references must change. Forks, archived repositories and disabled-Issues members retain their existing exemptions. Do not combine this mode with registry, metadata or decision inputs. See [references/org.md](references/org.md) for the ordered workflow.
+
+## Command Reference
+
+```text
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
+
+meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
+fingerprint [--out-dir docs/images] [--github-output]
+fonts [--check | --fetch]
+config [--write-lock] [--crop]
+describe [--text TEXT] [--type TYPE] [--records FILE]
+topics [--records FILE] [--gh] [--also-in ORG[,ORG] | --registry [FILE]]
+labels --emit-yml
+labels --plan [--references] [--records FILE] [--gh] [--jobs FILE] [--allow-hold]
+banner [--out docs/images/banner.png] [--scale 2] [--icon PATH] [--subtitle TEXT]
+       [--key-chip TEXT]... [--chip TEXT]... [--category TEXT] [--allow-unmeasured] [--allow-hold]
+       [--allow-few-chips] [--png-budget 300000]
+card [--out docs/images/card.svg] [--png PATH] [--icon PATH] [--allow-unmeasured] [--allow-hold]
+org-banner --org OWNER --out PATH [--illustration PATH]
+org-tile --org OWNER [--avatar PATH] [--illustration PATH] [--out PATH] [--png PATH]
+intro (--profile CompleteDotTech | --org OWNER) [--name TEXT] [--eyebrow TEXT] [--tagline TEXT]
+      [--chip key:TEXT] [--chip attr:TEXT]... [--mark PATH] [--height 320|360] [--static] [--out assets/intro.svg]
+footer [--check README.md [--online]] [--org OWNER] [--raw]
+readme [--mode auto|scaffold|upgrade|header] [--variant auto|A|B|C|D|E|F|G|H|I|J]
+       [--write] [--diff] [--records FILE] [--bootstrap]
+lint svg --kind intro|card|tile|plate|divider FILE...
+lint readme [README.md] [--variant auto]
+lint banner [docs/images/banner.png]
+lint all
+lint public-leak FILE... [--meta-dir DIR] [--registry FILE] [--decisions FILE] [--org ORG[,ORG]]
+lint prose [FILE...] [--text TEXT]... [--prose-kind text|description|tagline] [--preserved] [--allow WORD]...
+contact-sheet INPUT... --out PATH [--mode grid|stack|avatar] [--tile W] [--cols N] [--gap 24]
+              [--widths 1012,390] [--mask none|circle|rounded] [--labels] [--title TEXT]
+contact-sheet --org OWNER --cross-surface --out PATH [--avatar PNG] [--banner PNG] [--card SVG|PNG] [--social PNG]
+              [--org-banner JPG]
+doctor [--format tsv|json|md] [--header]
+doctor --estate --meta-dir DIR [--registry FILE] [--template-dir DIR --checkouts DIR] [--out NEW_PROPOSALS.yaml]
+new OWNER/NAME --type TYPE [--description TEXT] [--template OWNER/REPO] [--records FILE] [--jobs FILE] [--approval-id ID]
+adopt OWNER/REPO [--records FILE] [--jobs FILE] [--approval-id ID]
+enterprise snapshot-query --slug SLUG
+enterprise discover
+enterprise snapshot --slug SLUG [--out registry/enterprise.snapshot.json]
+enterprise doctor|seat-check|plan --snapshot FILE [--baseline FILE] [--user LOGIN] [--records FILE] [--jobs FILE]
+    doctor: [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
+enterprise diff --baseline OLD --snapshot NEW
+
+org profile|about|pins|labels|health|doctor ORG [--registry FILE] [--meta-dir DIR] [--decisions FILE]
+    [--approved FILE] [--approved-yaml FILE] [--actions FILE] [--allow-t3] [--jobs FILE]
+    profile: [--out-dir DIR] [--render] [--banner PATH] [--lists FILE] [--email-approved] [--allow-unmeasured]
+    pins: [--lists FILE] [--repo-ids FILE]      health/doctor: [--dot-github DIR]
+    labels: [--repos-from-gh] [--checkouts DIR] [--dot-github DIR]
+    doctor: [--snapshot FILE] [--avatar PATH] [--doctor-format tsv|json|md] [--header]
+org profile --user CompleteDotTech [--registry FILE] [--meta-dir DIR] [--out-dir DIR] [--render] [--allow-t3]
+project capture-query --owner OWNER --number N
+project normalize --capture FILE [--rest-fields FILE] [--out FILE]
+project lint --capture FILE --owner OWNER [--role org|template|estate] [--display-name TEXT]
+project copy-plan --target ORG|@me [--role org|template|estate] [--source OWNER/N] [--copied FILE]
+    [--workstreams FILE] [--repos OWNER/REPO,...] [--approval-id ID] [--files-dir DIR] [--no-status-update] [--jobs FILE]
+    (stage 2 with --jobs needs --files-dir: the REST view bodies the jobs' --input names)
+project readme --capture FILE --owner OWNER [--out FILE]
+project estate-plan [--copied FILE] [--user-id ID] [--source OWNER/N] [--jobs FILE]
+content social [--out PATH] [--title TEXT] [--icon PATH] [--job] [--allow-unmeasured] [--allow-hold]
+content icon prompt|normalize|check [--option A|B] [--glyph FILE] [--art-direction FILE] [--in PNG]
+    [--ground auto|transparent|keep] [--out PATH] [--preview PATH]
+content links [FILE...] [--readme-path PATH] [--base-ref REF] [--online] [--cache FILE] [--strict] [--diff]
+content linguist [--min-share 0.02] [--language NAME]
+content actions [--runs FILE] [--workflows FILE] [--pages FILE] [--changed PATH...] [--approval WORKFLOW=ID]
+content images [FILE...] [--base-ref REF] [--approval-id ID] [--out-dir DIR] [--online]
+content sidebar --facts FILE [--packages FILE]... [--current FILE] [--repo OWNER/REPO]
+    every content action: [--report FILE] [--jobs FILE] [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
+```
+
+| Command | What it does | Writes |
+|---|---|---|
+| `meta` | Normalizes repository metadata from read-only `gh api` GETs and adds the detected type, variant and family. Stdlib only. A `--meta` file keeps every key a later check reads ([references/meta.schema.json](references/meta.schema.json)): `has_pages`, `size`, `template_repository` (the full_name GitHub records for a repository generated from a template) and `template_taglines` (that template's README tagline when the repository was generated and today, read by `--from-gh`), the About sidebar counts (`releases`, `deployments`, `packages`, `environments`), and the R10 evidence `uses_custom_og_image` (the captured GraphQL `usesCustomOpenGraphImage` is mapped to it; only a boolean counts, and two spellings that disagree leave R10 `unknown`). `--from-gh` makes no GraphQL call, so add the flag from the social preview job's read-only check. | `--out` |
+| `fingerprint` | Hashes description, topics, visibility, license, language, icon, override file, skill version and brand config; reports `changed` against `docs/images/.showcase.json`. Stdlib only. | `$GITHUB_OUTPUT` with `--github-output` |
+| `config` | Validates `references/brand.yaml` against its schema and checks the stdlib lock copy; `--write-lock` regenerates `references/brand.lock.json` after an edit. | `references/brand.lock.json` with `--write-lock` |
+| `fonts` | `--check` verifies `assets/fonts/FONTS.json` sha256; `--fetch` downloads the pinned OFL fonts (ClawHub installs). | `assets/fonts/` with `--fetch` |
+| `describe` | Runs D1–D8, V1, P1, B1 and X1 and answers `keep`, `edit` or `needs-writer`. | `--records` |
+| `topics` | Runs the closed-vocabulary merge algorithm (brand, family, org membership, type, domain, tech; 10 public, 8 private). `--also-in ORG[,ORG]` (or `--registry`, which reads the repository's `also_in` from the private registry, read only, or an `also_in` list in the metadata) adds one org membership topic per cross-listing org from `org_topics` (never the home org's own). | `--records` |
+| `labels` | Emits `labels.yml`, or plans renames before creates (never `--force`, never a delete) from the metadata's labels or, without them, a read-only GET of the live labels. `--plan` prints the `gh` argv and the `scripts/writer.py` jobs (the writer re-reads the live labels before applying); standalone users run the printed argv themselves after approving it. A rename is planned only after §6.4 rule 0: in the `--repo-dir` checkout, or, without one, when the metadata's complete file tree (`files_complete: true`) lists no file rule 0 reads; a repository without issue forms of its own is also checked against the owner's `.github` default forms (`--org-defaults` takes a checkout or its metadata JSON). Otherwise it is held (`needs-input:label-references`, `needs_checkout`; [references/labels.md](references/labels.md)). `--references` is a no-op kept for compatibility. The `org labels` gates apply: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off; AI-Ascension gets only the `dependencies` create or patch; `has_issues: false` repositories (except `.github`), forks, archived repositories, T2-R and romgenie answer `n/a`. With `--plan`, `--jobs`, `--records` or `--gh`, metadata without labels is never planned against: the live labels are read first (exit 4, `needs-input:gh`, when they cannot be). Job ids come from the operation, never its position. | `--records`, `--jobs` |
+| `banner` | Renders the golden-layout hero PNG: navy grid canvas, icon card, eyebrow, slug, one-line subtitle, 2–4 chips, accent bar. Fewer than two chips exits 4 unless `--allow-few-chips` (result `incomplete`). | `--out`, sidecar under `docs/images/` |
+| `card` | Renders the 400×160 repo card SVG (no `<text>`, lint must pass first) and an optional PNG preview; same eyebrow and chip order as the banner. | `--out`, `--png` |
+| `org-banner` | Renders the 1600×400 org profile banner JPG (STANDARD §9.5). | `--out` |
+| `org-tile` | Renders the 400×160 org tile for profile directories. | `--out`, `--png` |
+| `intro` | Renders the profile intro (animated only for the personal profile and T1 flagship orgs; `.still` reduced-motion frame). | `--out` |
+| `footer` | Prints the decision 18 footer between `showcase:footer` markers, or checks that the README ends with it; `--check --online` also HEADs both raw logo URLs and fails (`fail:offline`) unless both return 200 (the Phase 4.0 hard gate). `--org OWNER` answers `exempt`, `exempt:footer` or `hold` for an org outside the footer's scope; for the watching org, `--check` still reads the README (its `.github` gets the footer, and `--org` cannot tell it from a fork). | stdout |
+| `readme` | Scaffolds, upgrades or refreshes the header marker blocks; never drops a line (multiset check). `--bootstrap` fills a template body only while its marker's sha256 still matches (a person's edit makes the block theirs). | `README.md` with `--write`; `CONTRIBUTING.md` with `--bootstrap` |
+| `lint` | SVG rules, README rules (R7 plus decisions 13 and 18) and banner PNG checks; `public-leak` checks any public file the run writes against the estate's private set (private slugs and names under every login of the owner, members-only pins, internal notes from the org rows, the registry's top-level notes and judge_changes and the profile's internal keys; OPS-03), reading the private registry and `--meta-dir` only; `prose` runs the CQ-17 checks on text the run writes (§1.2 brand strings, no emoji, no placeholders, the §4.1 formula for descriptions and taglines, typos when the optional `codespell` is installed; `--preserved` text only warns). | nothing |
+| `contact-sheet` | Lays outputs out the way GitHub shows them, on `#0d1117` and `#ffffff` (proofing surfaces, not asset variants). `--org ORG --cross-surface` is the G4 gate: the org avatar at 32 px, a hero banner, a repo card, the social preview and the org banner on one labelled sheet; a missing surface is logged `needs-input:cross-surface:<surface>` (result `incomplete`). | `PATH.on-github-dark.png`, `PATH.on-github-light.png` |
+| `doctor` | Prints the definition-of-done row: `R1`–`R11`, `banner`, `icon`, `card`, `footer`, `done`. No network. `--estate` classifies every repository in `--meta-dir` that `registry/estate.yaml` does not list with `decisions/POLICY.md` (`keep`, `move`, `archive`, `delete`, `merge`, `rename`, `rename-default-branch`; never acted on) and diffs the template-managed files of template-born checkouts against the current template (bump PRs are proposals). | `--out` (merges its own entries into `NEW_PROPOSALS.yaml`; others stay) |
+| `new` | Plans a repository from the template: the `gh repo create OWNER/NAME --template CompleteTech-LLC/completetech-repo-template --private` writer job, then `adopt` on it (naming N1–N4 and the §5.4 type are checked first; the watching org, placeholder orgs and refused owners exit 2). | `--records`, `--jobs` |
+| `adopt` | What "Use this template" does not carry, as Phase 3 change records and writer jobs: the §10.1 settings (wiki, Projects and Discussions only after their reads), the §5.6 topics, the §6 label passes, private vulnerability reporting and Dependabot alerts on public non-forks, plus a UI checklist (social preview upload job, About sidebar). An archived capture plans no jobs or change records, only a `pending` entry: re-capture the metadata inside the approved unarchive window, then adopt again. Metadata from `--meta`, else read-only `gh api` GETs. A family on hold (`hold: true`) is refused (exit 2). | `--records`, `--jobs` |
+| `enterprise` | Decision 24: `snapshot-query` prints the validated read queries; `discover` and `snapshot` run read-only GraphQL queries; `doctor` (E1–E14), `seat-check`, `diff` and `plan` (change records and writer jobs) work offline on snapshots against `references/enterprise.yaml`. | `--out`, `--records`, `--jobs` |
+| `org` | Decisions 5, 8, 9, 14, 15, 18, 20 and 23: the org profile README from the registry's public slice (leak-checked), the personal CompleteDotTech README with `profile --user` (kit order, leak-checked against the whole estate), About payload, pin and star List plan, label jobs for every repository homed in the org, `.github` health cells, and the O-check row. | `--out-dir` (profile only, after the leak check; an existing hand-made profile also needs a `profile-retemplate` approval), `--jobs` |
+| `project` | Decision 23, STANDARD §13: capture query, template spec, board lint (O10), two-stage copy plan (structure only, nothing deleted, mutations inline), board README, and the private Estate board. | `--out`, `--files-dir`, `--jobs` |
+| `content` | Audit gaps CQ-04, RP-09 (links), RP-07, CQ-08 (language bar), RP-06, RP-01, CQ-13 (Actions), RP-03, RP-10 (images), RP-05 (sidebar), RT-04 (repo icon) and R10 (`content social`: the 1280×640 repository social preview, STANDARD §9.5, in the same family design, plus with `--job` its browser upload job). | `--report`, `--jobs`, `--out`, `--out-dir`, `--preview`, `--cache` |
+
+`--type` replaces type detection with a §5.4 type (logged `type-override:<type>`); use it only when neither a checkout nor a captured file tree is available, for example with registry metadata. Without a tree, the type is provisional (`needs-input:file-tree`); a README link to a root `SKILL.md` still counts as rule 5.
+
+`lint readme` and `lint all` refuse excluded, hold and T3 owners like every other repository command. `lint all` fails an applicable banner or card that is missing; an exempt one is linted only if it exists. Forks outside the watching org, backups, archived and `.github` repositories need the banner (they have no card); a preserve-list README is exempt from the banner only when review q57 `pres` is "Leave them unchanged".
+
+Banner refusals: a watching-org fork returns `exempt` and writes nothing; the watching org's `.github` gets the banner and icon like any `.github`; another watching-org repository that is not a fork is refused (exit 2, `hold:watching-non-fork`) until decided, then `--allow-hold`; `CompleteDotTech/CompleteDotTech` (it opens with the intro) and a placeholder org's `.github` return `exempt:*`. Every other repository gets the hero banner (decisions 12, 13 and 18): forks outside the watching org (G), backups and archived repositories (H) and `.github` repositories (J) included, while `card` returns `exempt:no-card` for forks, backups and `.github`. AI-Ascension (`banner: keep-existing`) gets the hero in its own palette above its existing banner (q57 `aia` and `pres` defaults) and returns `exempt:keep-existing` only when `readme.preserve_banner` is `unchanged`; TouchedByAnAgent (`hold: true`) needs `--allow-hold`; families marked `measured: false` need `--allow-unmeasured` (otherwise exit 4, `needs-input:palette-v1.1`).
+
+## Decisions That Override the Standard
+
+These user decisions outrank `STANDARD.md` (`ct-std-v1`). Full text: [references/decisions.md](references/decisions.md).
+
+| Decision | Effect on this skill |
+|---|---|
+| 12 | Every in-scope repository gets its own icon at `assets/icon.png`; until then the banner uses the org's Neon Night mark (every T1 org but CompleteTech-LLC), then the CompleteTech logo (CompleteTech-LLC) or, in every other family, the family's typeset wordmark on its dark plate, and logs `needs-input:repo-icon`. |
+| 13 | Every README opens with the hero banner in the php2shell-check layout, then the nav line (q57 `nav` default), then the title, badge row and bold description; forks outside the watching org, backups, archived and `.github` repositories included. |
+| 18 | Every README ends with the exact CompleteTech LLC footer. It is the only `<picture>` the skill emits. |
+| 19 | The dark logo master is configurable (`brand_assets.dark_master` is `current` or `candidate`); generators never crop a mark at runtime. |
+| 21 | One dark design per surface (banner, card, tile, intro) on both GitHub themes. No light variants, no `-dark`/`-light` sibling files. |
+| 22 | This skill and `completetech-repo-template` make the standard repeatable; the template's Action calls `action.yml`. |
+| 23 | Orgs and GitHub Projects are covered: project boards are copied from the captured golden template, never deleted. |
+| 24 | The CompleteTech Enterprise is covered read-only: snapshot, E-checks, the romgenie seat check and printed change records; policies stay proposals. |
+
+## Brand and Family Data
+
+- `references/brand.yaml` is the single place for colours, fonts, logo paths, eyebrows, company labels, footer strings and per-org rows. A hex colour literal in `scripts/` fails the quality gate.
+- Precedence: schema defaults, then `families.<family>`, then `orgs.<Org>`, then the repository's `.github/showcase.yml`, then CLI flags. Repository files and flags change **content** only (icon, subtitle, chips, category, variant); colours and fonts are never overridable.
+- Icon on the banner card and the card tile, first match wins: `--icon`, `.github/showcase.yml` `icon`, then `assets/icon.png`, then the org mark (`assets/orgs/<Org>/mark.png`), then a family fallback: the light CompleteTech logo for CompleteTech orgs (its cloud-and-bulb crop, `mark_light`, in icon boxes under 200 px), and for every other family (AI-Ascension, Jev-Engineering, jevplay-games, LibreEvolve, TouchedByAnAgent, romgenie, T3) its display name typeset in the family font on the family plate. A T2 surface never carries the CompleteTech logo.
+- An icon that brings its own opaque ground (four corners alike) fills the card with that ground and is drawn full-bleed, so there is never a plate inside a plate; dark plates get a 2 px accent edge. jevplay-games icons are scaled nearest-neighbour at an integer factor.
+- `.github/showcase.yml` may carry `type:` (a §5.4 type for a repository whose code has not landed) and `for: OWNER/REPO` (any login of the org, the name in any case, or the slug an approved rename or transfer gives it; the overrides apply only to that repository, so a template's own chips and subtitle never reach the repositories created from it).
+- Navy surfaces (intro, org tile) use the selected dark master or `mark-dark.png` when committed. Marks are never cropped, masked or recoloured.
+- `readme:` holds the review-page answers that shape README scaffolding, at their defaults: `nav_first: false` (q57 `nav`: hero banner, then nav line), `preserve_banner: above` (q57 `pres`: the hero goes above a preserve-list README's own banner; `unchanged` leaves those READMEs without one) and `fork_readme: note` (q27: forks outside the watching org keep the upstream README under the hero banner and the §7.4 G note; `full` gives them their §5.4 variant). Change a value only after the user's answer, then `config --write-lock`.
+
+## Resource Guide
+
+| Resource | Role |
+|---|---|
+| [references/estate-standard.md](references/estate-standard.md) | Tiers, brand strings, golden rules, org identity table, repo naming. |
+| [references/descriptions.md](references/descriptions.md) | Description checks D1–D8, V1, P1, B1, X1, keep-or-edit order, templates by type. |
+| [references/topics.md](references/topics.md) | Topic layers, type detection rules 1–25, vocabulary, aliases, merge algorithm, safety. |
+| [references/labels.md](references/labels.md) | The 23-label set, migration map, apply algorithm and `labels.yml`. |
+| [references/readme-variants.md](references/readme-variants.md) | Header block with banner and footer, variants A–J, H2 order, license rows, preserve list. |
+| [references/banner-layout.md](references/banner-layout.md) | Banner and card geometry measured from the golden, chip rules, eyebrow rules. |
+| [references/art-direction.md](references/art-direction.md) | Family palettes, motifs, asset sizes, prompt template for illustrations, art QA. |
+| [references/svg-rules.md](references/svg-rules.md) | GitHub-safe SVG rules with decision 21 applied, and what `lint svg` checks. |
+| [references/profile-readmes.md](references/profile-readmes.md) | Org and personal profile README structure, cards, intros and what to skip. |
+| [references/orgs-and-projects.md](references/orgs-and-projects.md) | Org About fields, O-checks, org `.github` contents, profile rules and the GitHub Projects rules. |
+| [references/org.md](references/org.md) | The `org` command group: inputs (with or without the estate bundle), the public slice and leak check, the org resolver (CQ-03), writer jobs and refusals. |
+| [references/projects.md](references/projects.md) | The `project` command group: capture, normalize, lint, the two-stage copy plan, README and the Estate board. |
+| [references/content.md](references/content.md) | The `content` command group: links, language bar, Actions, images, sidebar, repo icon and the social preview. |
+| [references/enterprise.md](references/enterprise.md) | The enterprise module: commands, writer jobs, `enterprise.yaml` desired state, E-checks and guardrails (decision 24). |
+| [references/constraints.md](references/constraints.md) | Platform limits, write discipline, approval-gated actions, change records. |
+| [references/definition-of-done.md](references/definition-of-done.md) | Checks R1–R12 and O1–O11 mapped to `doctor` and `lint` cells. |
+| [references/decisions.md](references/decisions.md) | The user decisions this skill implements, verbatim. |
+| `references/brand.yaml`, `references/brand.schema.json`, `references/repo-config.schema.json`, `references/meta.schema.json` | Brand data and the schemas for it, for `.github/showcase.yml` and for metadata. |
+| `references/standard/` | Machine-readable standard: topics, types, labels, descriptions, README variants, naming. |
+| `examples/` | Synthetic Northwind Trading Co. metadata, small fixture checkouts, an example `.github/showcase.yml`, a synthetic estate (`examples/estate/`: registry and metadata for the `org` commands), and `render_examples.sh`, which regenerates every committed preview. |
+| `action.yml` | Composite GitHub Action that regenerates the banner and card when inputs change. |
+
+## Runtime Permissions
+
+| Area | Runtime behavior |
+|---|---|
+| Execution | Runs the local Python entry point `scripts/showcase.py` (and `scripts/action_commit.sh`, `scripts/action_prepare.py` inside the Action only). |
+| Reads | The target repository directory (`--repo-dir`), a metadata JSON (`--meta`) or directory (`--meta-dir`), `references/` and `assets/`; for the `org`, `project` and `content` groups also the estate registry and the approval files (`--registry`, `--approved`, `--approved-yaml`, `--actions`, `--decisions`, or the bundle beside the skill), read only and never copied. |
+| Writes | Only paths given by `--out`, `--png`, `--records`, `--jobs`, `--report`, `--out-dir`, `--files-dir`, `--preview` or `--cache`; with `--write`, the README marker blocks and `docs/images/*`; with `--bootstrap`, `CONTRIBUTING.md` owner tokens; `content icon normalize` defaults to `assets/icon.png` in the target checkout. |
+| Network | None by default. `meta --from-gh`, `labels --plan` and `adopt` without metadata, and opt-in `org labels --repos-from-gh` run read-only `gh api` GETs; `enterprise discover` and `enterprise snapshot` run read-only `gh api graphql` queries; `content links --online` and `content images --online` make cached, rate-limited HEAD/GET requests to the hosts the files link to and read-only `gh api` GETs; `fonts --fetch` downloads the pinned fonts over HTTPS; `footer --check --online` sends one HEAD to each of the two decision 18 logo URLs on raw.githubusercontent.com. `org` without `--repos-from-gh`, `project`, `enterprise snapshot-query`, `plan` and every other command only print the commands they plan. |
+
+| Not Included | Boundary |
+|---|---|
+| GitHub writes | None: no `gh` write verbs, no `git push`, no settings, labels, topics or description changes. Proposals go to the orchestrator's single writer queue as change records and writer jobs, or, used standalone, to the user, who runs the printed argv after approving it. |
+| Credentials | Does not read tokens, browser sessions or secrets; `gh` uses its own authentication. |
+| System changes | No persistence, schedules, privilege escalation or deletes. |
+
+## Network Boundary
+
+Generation, checking and planning are local. The only network calls are the read-only `gh api` GETs of `meta --from-gh`, `labels --plan`, `adopt` and opt-in `org labels ORG --repos-from-gh` (paginated repository and label discovery, plus repository file trees), the read-only GraphQL queries of `enterprise discover` and `enterprise snapshot` (api.github.com), the opt-in link and image checks of `content links --online` and `content images --online` (the hosts the checked files link to, cached and rate-limited), the font download of `fonts --fetch`, and the two read-only HEAD requests of `footer --check --online` (raw.githubusercontent.com), each run only when asked. The skill posts no metadata or run data anywhere else. The composite Action is the only component that pushes, and only into the repository it runs in.
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index 4b393b1..ac48759 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -1,64 +1,74 @@
-"""Docs for the global `--allow-t3` flag: SKILL.md, CHANGELOG.md and `--help` must describe the same behaviour.
-
-Synthetic checks only: no network, no registry, and no shared package files are touched.
-"""
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-MARKER = "**Co-owner sign-off (`--allow-t3`).**"
-
-
-def _read(name: str) -> str:
-    return (ROOT / name).read_text(encoding="utf-8")
-
-
-def test_skill_synopsis_lists_global_flag():
-    skill = _read("SKILL.md")
-    ref = skill[skill.index("## Command Reference"):]
-    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
-    assert "[--allow-t3]" in synopsis, synopsis
-    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>"), synopsis
-
-
-def test_skill_documents_refusals():
-    skill = _read("SKILL.md")
-    assert MARKER in skill
-    assert "t3-signoff" in skill
-    window = skill[skill.index(MARKER):][:1200]
-    assert "excluded" in window, window
-    assert "HOLD" in window, window
-
-
-def test_changelog_unreleased_lists_flag():
-    changelog = _read("CHANGELOG.md")
-    start = changelog.index("## Unreleased")
-    end = changelog.index("\n## ", start + 1)
-    unreleased = changelog[start:end]
-    # the entry belongs in the Added list of Unreleased, not in Fixed or a dated section
-    added = unreleased[unreleased.index("### Added"):unreleased.index("### Fixed")]
-    assert "--allow-t3" in added
-
-
-# Regression guard for the CLI help. The help text already names the flag on the base commit, so the
-# assertions below pass there too; the cross-check against SKILL.md's synopsis is the part that fails
-# on a base that lacks the doc change.
-def test_help_text_matches_docs():
-    env = dict(os.environ, COLUMNS="200")  # keep argparse from wrapping the usage line
-    result = subprocess.run(
-        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
-        capture_output=True, encoding="utf-8", env=env,
-    )
-    assert result.returncode == 0, result.stderr
-    assert "--allow-t3" in result.stdout
-    fragment = "[--quiet] [--allow-t3] [--version]"
-    help_usage = " ".join(result.stdout.split())
-    skill = _read("SKILL.md")
-    ref = skill[skill.index("## Command Reference"):]
-    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
-    assert fragment in help_usage, help_usage
-    assert fragment in " ".join(synopsis.split()), synopsis
+"""Docs for the global `--allow-t3` flag: SKILL.md, CHANGELOG.md and `--help` must describe the same behaviour.
+
+Synthetic checks only: no network, no registry, and no shared package files are touched.
+"""
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+MARKER = "**Co-owner sign-off (`--allow-t3`).**"
+
+
+def _read(name: str) -> str:
+    return (ROOT / name).read_text(encoding="utf-8")
+
+
+def test_skill_synopsis_lists_global_flag():
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert "[--allow-t3]" in synopsis, synopsis
+    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>"), synopsis
+
+
+def test_skill_documents_refusals():
+    skill = _read("SKILL.md")
+    assert MARKER in skill
+    assert "t3-signoff" in skill
+    window = skill[skill.index(MARKER):][:2400]
+    assert "excluded" in window, window
+    assert "HOLD" in window, window
+
+
+def test_skill_states_which_commands_do_not_enforce_owner_eligibility():
+    """doctor forces R7=hold only without the flag; local meta and fingerprint never refuse (verified in code/tests)."""
+    skill = _read("SKILL.md")
+    para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
+    assert "only without `--allow-t3`" in para, para
+    assert "evaluated normally" in para, para
+    assert "`fingerprint`" in para and "--from-gh" in para, para
+    assert "with or without the flag, with the R7" not in para
+
+
+def test_changelog_unreleased_lists_flag():
+    changelog = _read("CHANGELOG.md")
+    start = changelog.index("## Unreleased")
+    end = changelog.index("\n## ", start + 1)
+    unreleased = changelog[start:end]
+    # the entry belongs in the Added list of Unreleased, not in Fixed or a dated section
+    added = unreleased[unreleased.index("### Added"):unreleased.index("### Fixed")]
+    assert "--allow-t3" in added
+
+
+# Regression guard for the CLI help. The help text already names the flag on the base commit, so the
+# assertions below pass there too; the cross-check against SKILL.md's synopsis is the part that fails
+# on a base that lacks the doc change.
+def test_help_text_matches_docs():
+    env = dict(os.environ, COLUMNS="200")  # keep argparse from wrapping the usage line
+    result = subprocess.run(
+        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+        capture_output=True, encoding="utf-8", env=env,
+    )
+    assert result.returncode == 0, result.stderr
+    assert "--allow-t3" in result.stdout
+    fragment = "[--quiet] [--allow-t3] [--version]"
+    help_usage = " ".join(result.stdout.split())
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert fragment in help_usage, help_usage
+    assert fragment in " ".join(synopsis.split()), synopsis

From e79a0d871cdceed6e0d2e06b3fa349d6241a03f3 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 05:03:32 -0400
Subject: [PATCH 06/79] docs: restore LF line endings in SKILL.md, CHANGELOG.md
 and allow-t3 test

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                | 178 +++++-----
 SKILL.md                    | 672 ++++++++++++++++++------------------
 tests/test_allow_t3_docs.py | 148 ++++----
 3 files changed, 499 insertions(+), 499 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4466fe..eb52978 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,89 +1,89 @@
-# Changelog
-
-All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
-
-## Unreleased
-
-### Added
-
-- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits them; R7 is `hold` only without the flag), local `meta` normalization and `fingerprint`, which do not check eligibility; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
-
-### Fixed
-
-- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
-- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
-- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
-
-- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
-- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
-- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
-- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
-- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
-
-- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
-- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
-- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
-- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
-- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
-- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
-- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
-
-## 1.0.0 — 2026-10-26
-
-First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
-
-### Added
-
-- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
-- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
-- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
-- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
-- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
-
-### Security
-
-- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
-- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
-- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
-- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
-- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
-- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
-- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
-- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
-- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
-- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
-- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
-- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
-- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
-
-### Fixed
-
-- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
-- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
-- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
-- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
-- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
-- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
-- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
-- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
-- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
-- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
-- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
-- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
-- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
-- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
-- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
-- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
-- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
-- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
-- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
-- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
-- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
-- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
-- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
-- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
-- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
-- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
-- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
-- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
+# Changelog
+
+All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
+
+## Unreleased
+
+### Added
+
+- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits them; R7 is `hold` only without the flag), local `meta` normalization and `fingerprint`, which do not check eligibility; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+
+### Fixed
+
+- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
+- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
+- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
+
+- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
+- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
+- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
+- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
+- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
+
+- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
+- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
+- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
+- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
+- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
+- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
+- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
+
+## 1.0.0 — 2026-10-26
+
+First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
+
+### Added
+
+- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
+- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
+- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
+- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
+- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
+
+### Security
+
+- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
+- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
+- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
+- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
+- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
+- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
+- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
+- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
+- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
+- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
+- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
+- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
+- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
+
+### Fixed
+
+- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
+- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
+- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
+- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
+- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
+- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
+- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
+- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
+- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
+- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
+- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
+- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
+- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
+- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
+- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
+- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
+- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
+- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
+- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
+- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
+- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
+- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
+- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
+- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
+- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
+- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
+- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
+- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
diff --git a/SKILL.md b/SKILL.md
index 18aa652..b1a1b2c 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -1,336 +1,336 @@
----
-name: github-showcase-skill
-description: >-
-  Generate CompleteTech LLC README hero banners, repo cards, social previews, repo icons, org tiles, profile intros
-  and footers; audit repos against the CompleteTech GitHub estate standard (About description, topics, labels, README
-  variants, links, language bar, Actions, images, About sidebar, SVG rules); render org profile READMEs and plan org
-  About fields, pins, star lists, labels and health files; capture, lint and copy GitHub Projects boards from the
-  estate template; and snapshot, check and plan the CompleteTech Enterprise. Read-only toward GitHub: it emits files,
-  JSON plans and gh/writer jobs. Use when creating, polishing or auditing any CompleteTech, AI Ascension, Jev
-  Engineering, jevplay-games, LibreEvolve or TouchedByAnAgent repo, README, org, org profile, GitHub Project or the
-  Enterprise so it matches the rest of the estate.
-version: 1.0.0
-metadata:
-  openclaw:
-    skillKey: github-showcase-skill
-    homepage: https://github.com/CompleteTech-Skills/github-showcase-skill
-    requires:
-      bins:
-        - python3
-    install:
-      - kind: uv
-        package: fonttools==4.67.0
-      - kind: uv
-        package: uharfbuzz==0.57.0
-      - kind: uv
-        package: pillow==13.0.0
-      - kind: uv
-        package: pyyaml==6.0.3
----
-
-# GitHub Showcase Skill
-
-## At a Glance
-
-| What it creates | Best for | Output |
-|---|---|---|
-| README hero banners, repo cards, social previews, repo icons, org banners and tiles, profile intros, the estate footer, README scaffolds, org profile READMEs, standard checks, and plans for orgs, GitHub Projects, the Enterprise and repository content | Making any CompleteTech-family repository, README, org, org profile, project board, the Enterprise or the profile page match the estate, and keeping it that way | `docs/images/banner.png` (1280×360 or 2560×720), `docs/images/card.svg`, `assets/social-preview.png` (1280×640), `assets/icon.png` (1024×1024), org banner JPG (1600×400), tile and intro SVGs, README marker blocks, `profile/README.md` and `profile/data.json`, JSON check results and plans, change records, `scripts/writer.py` jobs (JSON lines), coverage rows |
-
-Every surface uses one **dark** design on both GitHub themes (decision 21): navy grid canvas, a card for the repo icon (or the org's Neon Night mark), a sky-blue eyebrow, the repo slug in monospace, two to four fact chips and an accent bar. All text is typeset from the bundled OFL fonts with HarfBuzz and outlined to paths, so outputs are deterministic and never depend on a web font or an image model. One CLI, `scripts/showcase.py`, does every generation, check and plan: the repository commands below, and four command groups, `org`, `project`, `enterprise` and `content`, for orgs, GitHub Projects, the Enterprise and repository content.
-
-## Use When
-
-| Situation | Start with |
-|---|---|
-| A repository needs its README hero banner or repo card | `banner`, then `card` (and `content social` for R10) |
-| A README must be scaffolded or upgraded to its standard variant, with the footer | `readme` (dry run), then `readme --write`, then `footer --check` |
-| A description, topic set or label set must be checked before a write is queued | `describe`, `topics`, `labels --plan` |
-| An org profile or the personal profile needs cards, tiles, a banner or the animated intro | `card`, `org-tile`, `org-banner`, `intro` and [references/profile-readmes.md](references/profile-readmes.md) |
-| An org needs its profile README, About fields, pins and star List, labels or `.github` health files, or an org must be verified as done | `org profile`, `org about`, `org pins`, `org labels`, `org health`, `org doctor` ([references/org.md](references/org.md)) |
-| An org needs its GitHub Project board from the estate template, or a board must be checked | `project capture-query`, `normalize`, `copy-plan`, `readme`, `lint`, `estate-plan` ([references/projects.md](references/projects.md)) |
-| The CompleteTech Enterprise must be captured, checked or planned | `enterprise snapshot-query` or `snapshot`, then `enterprise doctor`, `seat-check`, `plan` ([references/enterprise.md](references/enterprise.md)) |
-| A repository's links, language bar, Actions, README images, About sidebar, icon or social preview must be checked or produced | `content links`, `linguist`, `actions`, `images`, `sidebar`, `icon`, `social` ([references/content.md](references/content.md)) |
-| A new repository is created from `completetech-repo-template` | `new OWNER/NAME --type T` (the create job, then `adopt`), then the composite Action in `action.yml` (runs `readme --bootstrap`) |
-| A repository exists but never went through the standard (created by an agent, a pipeline or a transfer) | `adopt OWNER/REPO`; for the whole estate, `doctor --estate` (intake proposals and template drift) |
-| A set must be reviewed the way GitHub shows it | `contact-sheet` |
-| Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
-
-Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
-
-## Boundaries
-
-| This skill does | This skill does not |
-|---|---|
-| Render banners, cards, tiles, intros and contact sheets from metadata and committed brand files. | Draw illustrations, or let an image model draw text, logos or marks. |
-| Lint descriptions, topics, labels, READMEs, SVGs and banner PNGs against `ct-std-v1` and the user decisions. | Compose a new description sentence, an org description or a tagline; it returns `needs-writer` with the template. |
-| Propose GitHub changes as diffs, `gh` command lines, change records and `scripts/writer.py` jobs (`browser` jobs with exact click paths for UI-only steps) for a serialized writer. | Perform GitHub writes on its own. The only write is the Action committing into its own repository; label plans leave as `gh` argv and writer jobs (`labels --plan`). |
-| Write only the paths given by `--out`, `--out-dir`, `--jobs`, `--report` or `--records`, or README marker blocks and `docs/images/*` with `--write`. | Delete text from a README, crop or recolour a mark, or truncate text with an ellipsis. |
-| Read metadata from a JSON file or with read-only `gh api` GETs, and read the private estate registry without copying it. | Read credentials, persist state, schedule jobs, change repository settings, or copy the registry's private data into a repository. |
-
-## Core Workflow
-
-Run every command **from inside the target repository's checkout**, with the skill's script by path: `python3 <skill-dir>/scripts/showcase.py ...`. With `--meta`, the checkout must be the repository the metadata describes (its `origin` is compared); otherwise pass `--repo-dir DIR` or `--no-repo-dir`. A missing `--repo-dir` exits 2, and default outputs (`docs/images/...`) are always written inside the target checkout, never into the current directory or the skill.
-
-| Step | Command | Gate |
-|---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
-| 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
-| 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
-| 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
-| 5 | `banner`, then `card` (and `content social`) | `art-fail` (exit 3) writes nothing. `needs-input` (exit 4) names the missing fact, including fewer than two fact chips (`needs-input:banner-chips`; add `chips:` to `.github/showcase.yml` or pass `--key-chip`/`--chip`). |
-| 6 | `readme`, then `readme --write` | Dry run prints a unified diff first. `readme-shrink` (exit 1) writes nothing. |
-| 7 | `footer --check README.md`, `lint all` | Every applicable check passes; `incomplete` is allowed for logged `needs-input` omissions. |
-| 8 | `doctor --header` | One coverage row. `done` only when every applicable cell is `pass`, `warn`, `incomplete` or `n/a`, and the banner has two to four chips. |
-| 9 | `contact-sheet` | A human (or an independent verifier) views the set on both GitHub page colours before rollout. Pass PNGs: `card --png`, `org-tile --png` previews, or install the optional `resvg_py` (`requirements-preview.txt`) so SVG inputs (the intro's static frame) render too; otherwise an SVG input exits 2. |
-
-**Who applies GitHub changes.** Under the estate orchestrator, every proposal (description, topics, labels, README) goes to its single writer queue as change records. Used standalone, with no orchestrator: show the user the `--gh` command lines (or the `argv` of `labels --plan`) and the README diff; the user runs them after approving that repository's changes. The skill itself never runs a write.
-
-**Install.** System Python on Ubuntu 24.04, Debian 12 and Homebrew refuses `pip install` ("externally managed environment"). Use a virtual environment (or `uv`):
-
-```bash
-python3 -m venv .venv && . .venv/bin/activate      # or: uv venv && . .venv/bin/activate
-python -m pip install -r <skill-dir>/requirements.txt  # or: uv pip install -r <skill-dir>/requirements.txt
-```
-
-```bash
-cd ../agentic-email-skill                               # the target checkout
-S=<skill-dir>/scripts/showcase.py
-python3 $S meta --from-gh CompleteTech-Skills/agentic-email-skill --out /tmp/meta.json
-python3 $S --meta /tmp/meta.json describe
-python3 $S --meta /tmp/meta.json banner                 # writes docs/images/banner.png in this checkout
-python3 $S --meta /tmp/meta.json doctor --header
-```
-
-| Exit | Meaning |
-|---|---|
-| 0 | ok, including `warn`, `incomplete` and `n/a` |
-| 1 | a check failed |
-| 2 | usage or config error, or an excluded, hold or T3 owner |
-| 3 | `art-fail`: text does not fit the fixed size ladder, or the PNG budget cannot be met |
-| 4 | `needs-input` blocks a generator (for example an empty description) |
-
-Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
-
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands do not enforce owner eligibility, so they are exceptions that never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
-
-## Orgs, Projects, the Enterprise and Content
-
-CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
-JSON, help and errors. Decode captured CLI output as UTF-8; JSON keeps Unicode characters
-without ASCII escaping. Existing stream error handlers are preserved, so diagnostics
-can still escape undecodable filenames. No `PYTHONIOENCODING` workaround is needed.
-The Action summary and quality validator also decode CLI results as UTF-8.
-
-Contributor tests also decode CLI captures and Markdown fixtures as UTF-8. Action
-shell tests use Git Bash on Windows and an explicit `requires_bash` dependency marker;
-see [Windows test portability](references/windows-testing.md) for setup and the individual failure triage.
-
-The four command groups follow the same rules as the repository commands: read-only toward GitHub, one JSON object on stdout (`command`, `action`, `owner`, `result`, `logs[]`), the same exit codes, and refusals for excluded, HOLD and T3 owners. What they add:
-
-**Command-name contract.** The orchestrator, the standard and other workstreams call these names, so they are fixed: the repository commands in the Command Reference; the top-level generators `banner`, `card`, `org-banner`, `org-tile`, `intro` and `contact-sheet`; and the groups `org {profile,about,pins,labels,health,doctor}`, `project {capture-query,normalize,copy-plan,readme,lint,estate-plan}`, `enterprise {snapshot-query,discover,snapshot,doctor,seat-check,diff,plan}` and `content {social,icon,links,linguist,actions,images,sidebar}`. The social preview is `content social`; the old top-level `social-preview` still parses as a hidden, deprecated alias (same options, same file, logged `deprecated:social-preview`) and is not documented as a command.
-
-- **Writer jobs.** Every planned GitHub change is a `scripts/writer.py` job `{id, phase, kind, repo|org, approval_id?, group?, argv, note}`; `--jobs FILE` appends them as JSON lines. Label jobs carry `group: labels:OWNER/REPO` for the writer's half-completed-group reconciliation unless the orchestrator passes its own group. UI-only steps are `kind: "browser"` jobs with `url`, `ui_action` and the exact click path in `steps`. A job that needs an approval carries the id `scripts/writer.py` looks up in `decisions/APPROVED_ACTIONS.yaml` (`ent-001`/`ent-002` for the Enterprise, `q41.orgs`/`q41.estate` for a project copy, the ids you pass with `--approval-id` or `--approval`). Mutations are always inline in `argv`; only read queries load from a file. The skill never runs a job: the orchestrator's writer does, after its guard and approval checks, or, used standalone, the user does after approving it.
-- **One org resolver (CQ-03).** Every org lookup (in `enterprise doctor` too) goes through `scripts/ctshowcase/resolver.py`, which maps old and new logins from `former_slugs` in `brand.yaml` or the registry, the registry's `placeholders`, and approved `org-rename`/`org-merge` items; repository slugs the registry writes after a pending `rename` or `transfer` resolve to today's slug the same way. After an approved rename (for example `CompleTetech-Security` to `CompleteTech-Security`) the brand row, the registry row, the watching-org exemption and every refusal still resolve, and jobs name the new login.
-- **The estate registry is private.** `org` reads `registry/estate.yaml` (`--registry FILE`, or the bundle beside the skill, or `$SHOWCASE_ESTATE_ROOT`) and renders public pages only from its public slice. Never copy the registry into a repository. Without it, `org health` checks a supplied `.github` checkout or captured files, and `org doctor` runs the checks supported by its snapshot, checkout and avatar; registry-dependent coverage is reported as `needs-input:registry`, with `done: no`. `org labels ORG --repos-from-gh` instead discovers accessible repositories with paginated read-only GitHub GETs and uses the committed brand identity without reading the registry or estate decisions. Remaining registry-backed `org` actions exit 4 without a registry; `project`, `enterprise` and `content` run on their input files alone. `examples/estate/` is a synthetic Northwind registry for trying every `org` action offline. See [the coverage table](references/org.md#registry-free-health-and-doctor) for partial O2/O3 checks.
-
-| Group | Typical sequence | Reference |
-|---|---|---|
-| `org` | `org about ORG --jobs J`, `org labels ORG --meta-dir M --jobs J` (or `org labels ORG --repos-from-gh --jobs J` without a registry), `org profile ORG --meta-dir M --out-dir <ORG/.github checkout>`, `org pins ORG --jobs J`, then `org doctor ORG --snapshot S` | [references/org.md](references/org.md) |
-| `project` | `project capture-query` (reference board), `normalize`, `copy-plan --target ORG` (stage 1), re-capture, `copy-plan --copied FILE --files-dir DIR --jobs J` (stage 2), `readme`, `lint` | [references/projects.md](references/projects.md) |
-| `enterprise` | `enterprise snapshot-query --slug S` or `snapshot --slug S --out F`, then `doctor`, `seat-check`, `plan --jobs J`; `diff` after the run | [references/enterprise.md](references/enterprise.md) |
-| `content` | `content links --base-ref origin/main`, `linguist`, `actions`, `images`, `sidebar --facts F`, `icon prompt`, `icon normalize`, `icon check`, `social --job` | [references/content.md](references/content.md) |
-
-`content icon` defaults to the installed skill's `references/art-direction.md`,
-including a repository glyph template for option A and the illustration template
-for option B. Palette values come from `references/brand.yaml`; documented family
-seeds are used when available, otherwise the prompt uses the tool's default seed. Use
-`--art-direction FILE` to select another file; relative paths use the current
-directory, and missing files report `needs-input:art-direction` with the selected path.
-Older custom configs without `icon_ink`/`icon_spark` keep normalization and checks
-available (family-ink QA is skipped with `needs-input:icon-palette`). The bundled
-option A glyph prompt names the missing tokens with exit 4; add them or pass an
-explicit palette through `--art-direction`. Option B illustration prompts do not
-require these glyph tokens.
-
-```bash
-S=<skill-dir>/scripts/showcase.py
-SHOWCASE_ESTATE_ROOT=<skill-dir>/examples/estate python3 $S org profile Northwind-Trading-Co --meta-dir <skill-dir>/examples/estate/meta
-python3 $S project copy-plan --target CompleteTech-Skills --source CompleteTech-LLC/7 --jobs jobs.jsonl
-python3 $S enterprise plan --snapshot registry/enterprise.snapshot.json --jobs jobs.jsonl
-python3 $S --meta meta.json content links --base-ref origin/main --diff     # inside the target checkout
-```
-
-**Registry-free labels.** Run `org labels ORG --repos-from-gh --jobs jobs.jsonl` to list all repositories visible to the authenticated GitHub account and capture their labels and file trees. It emits plans only. Rewrite the org `.github` default issue forms first, plan/apply that repository's label changes through the approved writer, then re-plan member repositories. Use `--checkouts DIR --dot-github DIR/ORG/.github` with verified GitHub-origin checkouts stored as `DIR/ORG/REPO` to release safe renames after those content changes; missing checkouts or unknown reference files keep renames held. Git-index and captured reference files must be present before a checkout is trusted, so sparse exclusions and local deletions cannot bypass the guard. Held renames make the plan `incomplete`; affected repository rows report `needs-input`, retain the held operation, and include `rewrite_first` file/line details when references must change. Forks, archived repositories and disabled-Issues members retain their existing exemptions. Do not combine this mode with registry, metadata or decision inputs. See [references/org.md](references/org.md) for the ordered workflow.
-
-## Command Reference
-
-```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
-
-meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
-fingerprint [--out-dir docs/images] [--github-output]
-fonts [--check | --fetch]
-config [--write-lock] [--crop]
-describe [--text TEXT] [--type TYPE] [--records FILE]
-topics [--records FILE] [--gh] [--also-in ORG[,ORG] | --registry [FILE]]
-labels --emit-yml
-labels --plan [--references] [--records FILE] [--gh] [--jobs FILE] [--allow-hold]
-banner [--out docs/images/banner.png] [--scale 2] [--icon PATH] [--subtitle TEXT]
-       [--key-chip TEXT]... [--chip TEXT]... [--category TEXT] [--allow-unmeasured] [--allow-hold]
-       [--allow-few-chips] [--png-budget 300000]
-card [--out docs/images/card.svg] [--png PATH] [--icon PATH] [--allow-unmeasured] [--allow-hold]
-org-banner --org OWNER --out PATH [--illustration PATH]
-org-tile --org OWNER [--avatar PATH] [--illustration PATH] [--out PATH] [--png PATH]
-intro (--profile CompleteDotTech | --org OWNER) [--name TEXT] [--eyebrow TEXT] [--tagline TEXT]
-      [--chip key:TEXT] [--chip attr:TEXT]... [--mark PATH] [--height 320|360] [--static] [--out assets/intro.svg]
-footer [--check README.md [--online]] [--org OWNER] [--raw]
-readme [--mode auto|scaffold|upgrade|header] [--variant auto|A|B|C|D|E|F|G|H|I|J]
-       [--write] [--diff] [--records FILE] [--bootstrap]
-lint svg --kind intro|card|tile|plate|divider FILE...
-lint readme [README.md] [--variant auto]
-lint banner [docs/images/banner.png]
-lint all
-lint public-leak FILE... [--meta-dir DIR] [--registry FILE] [--decisions FILE] [--org ORG[,ORG]]
-lint prose [FILE...] [--text TEXT]... [--prose-kind text|description|tagline] [--preserved] [--allow WORD]...
-contact-sheet INPUT... --out PATH [--mode grid|stack|avatar] [--tile W] [--cols N] [--gap 24]
-              [--widths 1012,390] [--mask none|circle|rounded] [--labels] [--title TEXT]
-contact-sheet --org OWNER --cross-surface --out PATH [--avatar PNG] [--banner PNG] [--card SVG|PNG] [--social PNG]
-              [--org-banner JPG]
-doctor [--format tsv|json|md] [--header]
-doctor --estate --meta-dir DIR [--registry FILE] [--template-dir DIR --checkouts DIR] [--out NEW_PROPOSALS.yaml]
-new OWNER/NAME --type TYPE [--description TEXT] [--template OWNER/REPO] [--records FILE] [--jobs FILE] [--approval-id ID]
-adopt OWNER/REPO [--records FILE] [--jobs FILE] [--approval-id ID]
-enterprise snapshot-query --slug SLUG
-enterprise discover
-enterprise snapshot --slug SLUG [--out registry/enterprise.snapshot.json]
-enterprise doctor|seat-check|plan --snapshot FILE [--baseline FILE] [--user LOGIN] [--records FILE] [--jobs FILE]
-    doctor: [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
-enterprise diff --baseline OLD --snapshot NEW
-
-org profile|about|pins|labels|health|doctor ORG [--registry FILE] [--meta-dir DIR] [--decisions FILE]
-    [--approved FILE] [--approved-yaml FILE] [--actions FILE] [--allow-t3] [--jobs FILE]
-    profile: [--out-dir DIR] [--render] [--banner PATH] [--lists FILE] [--email-approved] [--allow-unmeasured]
-    pins: [--lists FILE] [--repo-ids FILE]      health/doctor: [--dot-github DIR]
-    labels: [--repos-from-gh] [--checkouts DIR] [--dot-github DIR]
-    doctor: [--snapshot FILE] [--avatar PATH] [--doctor-format tsv|json|md] [--header]
-org profile --user CompleteDotTech [--registry FILE] [--meta-dir DIR] [--out-dir DIR] [--render] [--allow-t3]
-project capture-query --owner OWNER --number N
-project normalize --capture FILE [--rest-fields FILE] [--out FILE]
-project lint --capture FILE --owner OWNER [--role org|template|estate] [--display-name TEXT]
-project copy-plan --target ORG|@me [--role org|template|estate] [--source OWNER/N] [--copied FILE]
-    [--workstreams FILE] [--repos OWNER/REPO,...] [--approval-id ID] [--files-dir DIR] [--no-status-update] [--jobs FILE]
-    (stage 2 with --jobs needs --files-dir: the REST view bodies the jobs' --input names)
-project readme --capture FILE --owner OWNER [--out FILE]
-project estate-plan [--copied FILE] [--user-id ID] [--source OWNER/N] [--jobs FILE]
-content social [--out PATH] [--title TEXT] [--icon PATH] [--job] [--allow-unmeasured] [--allow-hold]
-content icon prompt|normalize|check [--option A|B] [--glyph FILE] [--art-direction FILE] [--in PNG]
-    [--ground auto|transparent|keep] [--out PATH] [--preview PATH]
-content links [FILE...] [--readme-path PATH] [--base-ref REF] [--online] [--cache FILE] [--strict] [--diff]
-content linguist [--min-share 0.02] [--language NAME]
-content actions [--runs FILE] [--workflows FILE] [--pages FILE] [--changed PATH...] [--approval WORKFLOW=ID]
-content images [FILE...] [--base-ref REF] [--approval-id ID] [--out-dir DIR] [--online]
-content sidebar --facts FILE [--packages FILE]... [--current FILE] [--repo OWNER/REPO]
-    every content action: [--report FILE] [--jobs FILE] [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
-```
-
-| Command | What it does | Writes |
-|---|---|---|
-| `meta` | Normalizes repository metadata from read-only `gh api` GETs and adds the detected type, variant and family. Stdlib only. A `--meta` file keeps every key a later check reads ([references/meta.schema.json](references/meta.schema.json)): `has_pages`, `size`, `template_repository` (the full_name GitHub records for a repository generated from a template) and `template_taglines` (that template's README tagline when the repository was generated and today, read by `--from-gh`), the About sidebar counts (`releases`, `deployments`, `packages`, `environments`), and the R10 evidence `uses_custom_og_image` (the captured GraphQL `usesCustomOpenGraphImage` is mapped to it; only a boolean counts, and two spellings that disagree leave R10 `unknown`). `--from-gh` makes no GraphQL call, so add the flag from the social preview job's read-only check. | `--out` |
-| `fingerprint` | Hashes description, topics, visibility, license, language, icon, override file, skill version and brand config; reports `changed` against `docs/images/.showcase.json`. Stdlib only. | `$GITHUB_OUTPUT` with `--github-output` |
-| `config` | Validates `references/brand.yaml` against its schema and checks the stdlib lock copy; `--write-lock` regenerates `references/brand.lock.json` after an edit. | `references/brand.lock.json` with `--write-lock` |
-| `fonts` | `--check` verifies `assets/fonts/FONTS.json` sha256; `--fetch` downloads the pinned OFL fonts (ClawHub installs). | `assets/fonts/` with `--fetch` |
-| `describe` | Runs D1–D8, V1, P1, B1 and X1 and answers `keep`, `edit` or `needs-writer`. | `--records` |
-| `topics` | Runs the closed-vocabulary merge algorithm (brand, family, org membership, type, domain, tech; 10 public, 8 private). `--also-in ORG[,ORG]` (or `--registry`, which reads the repository's `also_in` from the private registry, read only, or an `also_in` list in the metadata) adds one org membership topic per cross-listing org from `org_topics` (never the home org's own). | `--records` |
-| `labels` | Emits `labels.yml`, or plans renames before creates (never `--force`, never a delete) from the metadata's labels or, without them, a read-only GET of the live labels. `--plan` prints the `gh` argv and the `scripts/writer.py` jobs (the writer re-reads the live labels before applying); standalone users run the printed argv themselves after approving it. A rename is planned only after §6.4 rule 0: in the `--repo-dir` checkout, or, without one, when the metadata's complete file tree (`files_complete: true`) lists no file rule 0 reads; a repository without issue forms of its own is also checked against the owner's `.github` default forms (`--org-defaults` takes a checkout or its metadata JSON). Otherwise it is held (`needs-input:label-references`, `needs_checkout`; [references/labels.md](references/labels.md)). `--references` is a no-op kept for compatibility. The `org labels` gates apply: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off; AI-Ascension gets only the `dependencies` create or patch; `has_issues: false` repositories (except `.github`), forks, archived repositories, T2-R and romgenie answer `n/a`. With `--plan`, `--jobs`, `--records` or `--gh`, metadata without labels is never planned against: the live labels are read first (exit 4, `needs-input:gh`, when they cannot be). Job ids come from the operation, never its position. | `--records`, `--jobs` |
-| `banner` | Renders the golden-layout hero PNG: navy grid canvas, icon card, eyebrow, slug, one-line subtitle, 2–4 chips, accent bar. Fewer than two chips exits 4 unless `--allow-few-chips` (result `incomplete`). | `--out`, sidecar under `docs/images/` |
-| `card` | Renders the 400×160 repo card SVG (no `<text>`, lint must pass first) and an optional PNG preview; same eyebrow and chip order as the banner. | `--out`, `--png` |
-| `org-banner` | Renders the 1600×400 org profile banner JPG (STANDARD §9.5). | `--out` |
-| `org-tile` | Renders the 400×160 org tile for profile directories. | `--out`, `--png` |
-| `intro` | Renders the profile intro (animated only for the personal profile and T1 flagship orgs; `.still` reduced-motion frame). | `--out` |
-| `footer` | Prints the decision 18 footer between `showcase:footer` markers, or checks that the README ends with it; `--check --online` also HEADs both raw logo URLs and fails (`fail:offline`) unless both return 200 (the Phase 4.0 hard gate). `--org OWNER` answers `exempt`, `exempt:footer` or `hold` for an org outside the footer's scope; for the watching org, `--check` still reads the README (its `.github` gets the footer, and `--org` cannot tell it from a fork). | stdout |
-| `readme` | Scaffolds, upgrades or refreshes the header marker blocks; never drops a line (multiset check). `--bootstrap` fills a template body only while its marker's sha256 still matches (a person's edit makes the block theirs). | `README.md` with `--write`; `CONTRIBUTING.md` with `--bootstrap` |
-| `lint` | SVG rules, README rules (R7 plus decisions 13 and 18) and banner PNG checks; `public-leak` checks any public file the run writes against the estate's private set (private slugs and names under every login of the owner, members-only pins, internal notes from the org rows, the registry's top-level notes and judge_changes and the profile's internal keys; OPS-03), reading the private registry and `--meta-dir` only; `prose` runs the CQ-17 checks on text the run writes (§1.2 brand strings, no emoji, no placeholders, the §4.1 formula for descriptions and taglines, typos when the optional `codespell` is installed; `--preserved` text only warns). | nothing |
-| `contact-sheet` | Lays outputs out the way GitHub shows them, on `#0d1117` and `#ffffff` (proofing surfaces, not asset variants). `--org ORG --cross-surface` is the G4 gate: the org avatar at 32 px, a hero banner, a repo card, the social preview and the org banner on one labelled sheet; a missing surface is logged `needs-input:cross-surface:<surface>` (result `incomplete`). | `PATH.on-github-dark.png`, `PATH.on-github-light.png` |
-| `doctor` | Prints the definition-of-done row: `R1`–`R11`, `banner`, `icon`, `card`, `footer`, `done`. No network. `--estate` classifies every repository in `--meta-dir` that `registry/estate.yaml` does not list with `decisions/POLICY.md` (`keep`, `move`, `archive`, `delete`, `merge`, `rename`, `rename-default-branch`; never acted on) and diffs the template-managed files of template-born checkouts against the current template (bump PRs are proposals). | `--out` (merges its own entries into `NEW_PROPOSALS.yaml`; others stay) |
-| `new` | Plans a repository from the template: the `gh repo create OWNER/NAME --template CompleteTech-LLC/completetech-repo-template --private` writer job, then `adopt` on it (naming N1–N4 and the §5.4 type are checked first; the watching org, placeholder orgs and refused owners exit 2). | `--records`, `--jobs` |
-| `adopt` | What "Use this template" does not carry, as Phase 3 change records and writer jobs: the §10.1 settings (wiki, Projects and Discussions only after their reads), the §5.6 topics, the §6 label passes, private vulnerability reporting and Dependabot alerts on public non-forks, plus a UI checklist (social preview upload job, About sidebar). An archived capture plans no jobs or change records, only a `pending` entry: re-capture the metadata inside the approved unarchive window, then adopt again. Metadata from `--meta`, else read-only `gh api` GETs. A family on hold (`hold: true`) is refused (exit 2). | `--records`, `--jobs` |
-| `enterprise` | Decision 24: `snapshot-query` prints the validated read queries; `discover` and `snapshot` run read-only GraphQL queries; `doctor` (E1–E14), `seat-check`, `diff` and `plan` (change records and writer jobs) work offline on snapshots against `references/enterprise.yaml`. | `--out`, `--records`, `--jobs` |
-| `org` | Decisions 5, 8, 9, 14, 15, 18, 20 and 23: the org profile README from the registry's public slice (leak-checked), the personal CompleteDotTech README with `profile --user` (kit order, leak-checked against the whole estate), About payload, pin and star List plan, label jobs for every repository homed in the org, `.github` health cells, and the O-check row. | `--out-dir` (profile only, after the leak check; an existing hand-made profile also needs a `profile-retemplate` approval), `--jobs` |
-| `project` | Decision 23, STANDARD §13: capture query, template spec, board lint (O10), two-stage copy plan (structure only, nothing deleted, mutations inline), board README, and the private Estate board. | `--out`, `--files-dir`, `--jobs` |
-| `content` | Audit gaps CQ-04, RP-09 (links), RP-07, CQ-08 (language bar), RP-06, RP-01, CQ-13 (Actions), RP-03, RP-10 (images), RP-05 (sidebar), RT-04 (repo icon) and R10 (`content social`: the 1280×640 repository social preview, STANDARD §9.5, in the same family design, plus with `--job` its browser upload job). | `--report`, `--jobs`, `--out`, `--out-dir`, `--preview`, `--cache` |
-
-`--type` replaces type detection with a §5.4 type (logged `type-override:<type>`); use it only when neither a checkout nor a captured file tree is available, for example with registry metadata. Without a tree, the type is provisional (`needs-input:file-tree`); a README link to a root `SKILL.md` still counts as rule 5.
-
-`lint readme` and `lint all` refuse excluded, hold and T3 owners like every other repository command. `lint all` fails an applicable banner or card that is missing; an exempt one is linted only if it exists. Forks outside the watching org, backups, archived and `.github` repositories need the banner (they have no card); a preserve-list README is exempt from the banner only when review q57 `pres` is "Leave them unchanged".
-
-Banner refusals: a watching-org fork returns `exempt` and writes nothing; the watching org's `.github` gets the banner and icon like any `.github`; another watching-org repository that is not a fork is refused (exit 2, `hold:watching-non-fork`) until decided, then `--allow-hold`; `CompleteDotTech/CompleteDotTech` (it opens with the intro) and a placeholder org's `.github` return `exempt:*`. Every other repository gets the hero banner (decisions 12, 13 and 18): forks outside the watching org (G), backups and archived repositories (H) and `.github` repositories (J) included, while `card` returns `exempt:no-card` for forks, backups and `.github`. AI-Ascension (`banner: keep-existing`) gets the hero in its own palette above its existing banner (q57 `aia` and `pres` defaults) and returns `exempt:keep-existing` only when `readme.preserve_banner` is `unchanged`; TouchedByAnAgent (`hold: true`) needs `--allow-hold`; families marked `measured: false` need `--allow-unmeasured` (otherwise exit 4, `needs-input:palette-v1.1`).
-
-## Decisions That Override the Standard
-
-These user decisions outrank `STANDARD.md` (`ct-std-v1`). Full text: [references/decisions.md](references/decisions.md).
-
-| Decision | Effect on this skill |
-|---|---|
-| 12 | Every in-scope repository gets its own icon at `assets/icon.png`; until then the banner uses the org's Neon Night mark (every T1 org but CompleteTech-LLC), then the CompleteTech logo (CompleteTech-LLC) or, in every other family, the family's typeset wordmark on its dark plate, and logs `needs-input:repo-icon`. |
-| 13 | Every README opens with the hero banner in the php2shell-check layout, then the nav line (q57 `nav` default), then the title, badge row and bold description; forks outside the watching org, backups, archived and `.github` repositories included. |
-| 18 | Every README ends with the exact CompleteTech LLC footer. It is the only `<picture>` the skill emits. |
-| 19 | The dark logo master is configurable (`brand_assets.dark_master` is `current` or `candidate`); generators never crop a mark at runtime. |
-| 21 | One dark design per surface (banner, card, tile, intro) on both GitHub themes. No light variants, no `-dark`/`-light` sibling files. |
-| 22 | This skill and `completetech-repo-template` make the standard repeatable; the template's Action calls `action.yml`. |
-| 23 | Orgs and GitHub Projects are covered: project boards are copied from the captured golden template, never deleted. |
-| 24 | The CompleteTech Enterprise is covered read-only: snapshot, E-checks, the romgenie seat check and printed change records; policies stay proposals. |
-
-## Brand and Family Data
-
-- `references/brand.yaml` is the single place for colours, fonts, logo paths, eyebrows, company labels, footer strings and per-org rows. A hex colour literal in `scripts/` fails the quality gate.
-- Precedence: schema defaults, then `families.<family>`, then `orgs.<Org>`, then the repository's `.github/showcase.yml`, then CLI flags. Repository files and flags change **content** only (icon, subtitle, chips, category, variant); colours and fonts are never overridable.
-- Icon on the banner card and the card tile, first match wins: `--icon`, `.github/showcase.yml` `icon`, then `assets/icon.png`, then the org mark (`assets/orgs/<Org>/mark.png`), then a family fallback: the light CompleteTech logo for CompleteTech orgs (its cloud-and-bulb crop, `mark_light`, in icon boxes under 200 px), and for every other family (AI-Ascension, Jev-Engineering, jevplay-games, LibreEvolve, TouchedByAnAgent, romgenie, T3) its display name typeset in the family font on the family plate. A T2 surface never carries the CompleteTech logo.
-- An icon that brings its own opaque ground (four corners alike) fills the card with that ground and is drawn full-bleed, so there is never a plate inside a plate; dark plates get a 2 px accent edge. jevplay-games icons are scaled nearest-neighbour at an integer factor.
-- `.github/showcase.yml` may carry `type:` (a §5.4 type for a repository whose code has not landed) and `for: OWNER/REPO` (any login of the org, the name in any case, or the slug an approved rename or transfer gives it; the overrides apply only to that repository, so a template's own chips and subtitle never reach the repositories created from it).
-- Navy surfaces (intro, org tile) use the selected dark master or `mark-dark.png` when committed. Marks are never cropped, masked or recoloured.
-- `readme:` holds the review-page answers that shape README scaffolding, at their defaults: `nav_first: false` (q57 `nav`: hero banner, then nav line), `preserve_banner: above` (q57 `pres`: the hero goes above a preserve-list README's own banner; `unchanged` leaves those READMEs without one) and `fork_readme: note` (q27: forks outside the watching org keep the upstream README under the hero banner and the §7.4 G note; `full` gives them their §5.4 variant). Change a value only after the user's answer, then `config --write-lock`.
-
-## Resource Guide
-
-| Resource | Role |
-|---|---|
-| [references/estate-standard.md](references/estate-standard.md) | Tiers, brand strings, golden rules, org identity table, repo naming. |
-| [references/descriptions.md](references/descriptions.md) | Description checks D1–D8, V1, P1, B1, X1, keep-or-edit order, templates by type. |
-| [references/topics.md](references/topics.md) | Topic layers, type detection rules 1–25, vocabulary, aliases, merge algorithm, safety. |
-| [references/labels.md](references/labels.md) | The 23-label set, migration map, apply algorithm and `labels.yml`. |
-| [references/readme-variants.md](references/readme-variants.md) | Header block with banner and footer, variants A–J, H2 order, license rows, preserve list. |
-| [references/banner-layout.md](references/banner-layout.md) | Banner and card geometry measured from the golden, chip rules, eyebrow rules. |
-| [references/art-direction.md](references/art-direction.md) | Family palettes, motifs, asset sizes, prompt template for illustrations, art QA. |
-| [references/svg-rules.md](references/svg-rules.md) | GitHub-safe SVG rules with decision 21 applied, and what `lint svg` checks. |
-| [references/profile-readmes.md](references/profile-readmes.md) | Org and personal profile README structure, cards, intros and what to skip. |
-| [references/orgs-and-projects.md](references/orgs-and-projects.md) | Org About fields, O-checks, org `.github` contents, profile rules and the GitHub Projects rules. |
-| [references/org.md](references/org.md) | The `org` command group: inputs (with or without the estate bundle), the public slice and leak check, the org resolver (CQ-03), writer jobs and refusals. |
-| [references/projects.md](references/projects.md) | The `project` command group: capture, normalize, lint, the two-stage copy plan, README and the Estate board. |
-| [references/content.md](references/content.md) | The `content` command group: links, language bar, Actions, images, sidebar, repo icon and the social preview. |
-| [references/enterprise.md](references/enterprise.md) | The enterprise module: commands, writer jobs, `enterprise.yaml` desired state, E-checks and guardrails (decision 24). |
-| [references/constraints.md](references/constraints.md) | Platform limits, write discipline, approval-gated actions, change records. |
-| [references/definition-of-done.md](references/definition-of-done.md) | Checks R1–R12 and O1–O11 mapped to `doctor` and `lint` cells. |
-| [references/decisions.md](references/decisions.md) | The user decisions this skill implements, verbatim. |
-| `references/brand.yaml`, `references/brand.schema.json`, `references/repo-config.schema.json`, `references/meta.schema.json` | Brand data and the schemas for it, for `.github/showcase.yml` and for metadata. |
-| `references/standard/` | Machine-readable standard: topics, types, labels, descriptions, README variants, naming. |
-| `examples/` | Synthetic Northwind Trading Co. metadata, small fixture checkouts, an example `.github/showcase.yml`, a synthetic estate (`examples/estate/`: registry and metadata for the `org` commands), and `render_examples.sh`, which regenerates every committed preview. |
-| `action.yml` | Composite GitHub Action that regenerates the banner and card when inputs change. |
-
-## Runtime Permissions
-
-| Area | Runtime behavior |
-|---|---|
-| Execution | Runs the local Python entry point `scripts/showcase.py` (and `scripts/action_commit.sh`, `scripts/action_prepare.py` inside the Action only). |
-| Reads | The target repository directory (`--repo-dir`), a metadata JSON (`--meta`) or directory (`--meta-dir`), `references/` and `assets/`; for the `org`, `project` and `content` groups also the estate registry and the approval files (`--registry`, `--approved`, `--approved-yaml`, `--actions`, `--decisions`, or the bundle beside the skill), read only and never copied. |
-| Writes | Only paths given by `--out`, `--png`, `--records`, `--jobs`, `--report`, `--out-dir`, `--files-dir`, `--preview` or `--cache`; with `--write`, the README marker blocks and `docs/images/*`; with `--bootstrap`, `CONTRIBUTING.md` owner tokens; `content icon normalize` defaults to `assets/icon.png` in the target checkout. |
-| Network | None by default. `meta --from-gh`, `labels --plan` and `adopt` without metadata, and opt-in `org labels --repos-from-gh` run read-only `gh api` GETs; `enterprise discover` and `enterprise snapshot` run read-only `gh api graphql` queries; `content links --online` and `content images --online` make cached, rate-limited HEAD/GET requests to the hosts the files link to and read-only `gh api` GETs; `fonts --fetch` downloads the pinned fonts over HTTPS; `footer --check --online` sends one HEAD to each of the two decision 18 logo URLs on raw.githubusercontent.com. `org` without `--repos-from-gh`, `project`, `enterprise snapshot-query`, `plan` and every other command only print the commands they plan. |
-
-| Not Included | Boundary |
-|---|---|
-| GitHub writes | None: no `gh` write verbs, no `git push`, no settings, labels, topics or description changes. Proposals go to the orchestrator's single writer queue as change records and writer jobs, or, used standalone, to the user, who runs the printed argv after approving it. |
-| Credentials | Does not read tokens, browser sessions or secrets; `gh` uses its own authentication. |
-| System changes | No persistence, schedules, privilege escalation or deletes. |
-
-## Network Boundary
-
-Generation, checking and planning are local. The only network calls are the read-only `gh api` GETs of `meta --from-gh`, `labels --plan`, `adopt` and opt-in `org labels ORG --repos-from-gh` (paginated repository and label discovery, plus repository file trees), the read-only GraphQL queries of `enterprise discover` and `enterprise snapshot` (api.github.com), the opt-in link and image checks of `content links --online` and `content images --online` (the hosts the checked files link to, cached and rate-limited), the font download of `fonts --fetch`, and the two read-only HEAD requests of `footer --check --online` (raw.githubusercontent.com), each run only when asked. The skill posts no metadata or run data anywhere else. The composite Action is the only component that pushes, and only into the repository it runs in.
+---
+name: github-showcase-skill
+description: >-
+  Generate CompleteTech LLC README hero banners, repo cards, social previews, repo icons, org tiles, profile intros
+  and footers; audit repos against the CompleteTech GitHub estate standard (About description, topics, labels, README
+  variants, links, language bar, Actions, images, About sidebar, SVG rules); render org profile READMEs and plan org
+  About fields, pins, star lists, labels and health files; capture, lint and copy GitHub Projects boards from the
+  estate template; and snapshot, check and plan the CompleteTech Enterprise. Read-only toward GitHub: it emits files,
+  JSON plans and gh/writer jobs. Use when creating, polishing or auditing any CompleteTech, AI Ascension, Jev
+  Engineering, jevplay-games, LibreEvolve or TouchedByAnAgent repo, README, org, org profile, GitHub Project or the
+  Enterprise so it matches the rest of the estate.
+version: 1.0.0
+metadata:
+  openclaw:
+    skillKey: github-showcase-skill
+    homepage: https://github.com/CompleteTech-Skills/github-showcase-skill
+    requires:
+      bins:
+        - python3
+    install:
+      - kind: uv
+        package: fonttools==4.67.0
+      - kind: uv
+        package: uharfbuzz==0.57.0
+      - kind: uv
+        package: pillow==13.0.0
+      - kind: uv
+        package: pyyaml==6.0.3
+---
+
+# GitHub Showcase Skill
+
+## At a Glance
+
+| What it creates | Best for | Output |
+|---|---|---|
+| README hero banners, repo cards, social previews, repo icons, org banners and tiles, profile intros, the estate footer, README scaffolds, org profile READMEs, standard checks, and plans for orgs, GitHub Projects, the Enterprise and repository content | Making any CompleteTech-family repository, README, org, org profile, project board, the Enterprise or the profile page match the estate, and keeping it that way | `docs/images/banner.png` (1280×360 or 2560×720), `docs/images/card.svg`, `assets/social-preview.png` (1280×640), `assets/icon.png` (1024×1024), org banner JPG (1600×400), tile and intro SVGs, README marker blocks, `profile/README.md` and `profile/data.json`, JSON check results and plans, change records, `scripts/writer.py` jobs (JSON lines), coverage rows |
+
+Every surface uses one **dark** design on both GitHub themes (decision 21): navy grid canvas, a card for the repo icon (or the org's Neon Night mark), a sky-blue eyebrow, the repo slug in monospace, two to four fact chips and an accent bar. All text is typeset from the bundled OFL fonts with HarfBuzz and outlined to paths, so outputs are deterministic and never depend on a web font or an image model. One CLI, `scripts/showcase.py`, does every generation, check and plan: the repository commands below, and four command groups, `org`, `project`, `enterprise` and `content`, for orgs, GitHub Projects, the Enterprise and repository content.
+
+## Use When
+
+| Situation | Start with |
+|---|---|
+| A repository needs its README hero banner or repo card | `banner`, then `card` (and `content social` for R10) |
+| A README must be scaffolded or upgraded to its standard variant, with the footer | `readme` (dry run), then `readme --write`, then `footer --check` |
+| A description, topic set or label set must be checked before a write is queued | `describe`, `topics`, `labels --plan` |
+| An org profile or the personal profile needs cards, tiles, a banner or the animated intro | `card`, `org-tile`, `org-banner`, `intro` and [references/profile-readmes.md](references/profile-readmes.md) |
+| An org needs its profile README, About fields, pins and star List, labels or `.github` health files, or an org must be verified as done | `org profile`, `org about`, `org pins`, `org labels`, `org health`, `org doctor` ([references/org.md](references/org.md)) |
+| An org needs its GitHub Project board from the estate template, or a board must be checked | `project capture-query`, `normalize`, `copy-plan`, `readme`, `lint`, `estate-plan` ([references/projects.md](references/projects.md)) |
+| The CompleteTech Enterprise must be captured, checked or planned | `enterprise snapshot-query` or `snapshot`, then `enterprise doctor`, `seat-check`, `plan` ([references/enterprise.md](references/enterprise.md)) |
+| A repository's links, language bar, Actions, README images, About sidebar, icon or social preview must be checked or produced | `content links`, `linguist`, `actions`, `images`, `sidebar`, `icon`, `social` ([references/content.md](references/content.md)) |
+| A new repository is created from `completetech-repo-template` | `new OWNER/NAME --type T` (the create job, then `adopt`), then the composite Action in `action.yml` (runs `readme --bootstrap`) |
+| A repository exists but never went through the standard (created by an agent, a pipeline or a transfer) | `adopt OWNER/REPO`; for the whole estate, `doctor --estate` (intake proposals and template drift) |
+| A set must be reviewed the way GitHub shows it | `contact-sheet` |
+| Coverage must be reported or a repository verified as done | `lint all`, then `doctor` |
+
+Do not use it for accounts outside the estate. Excluded owners (BunsDev, GoZippy, h-mascot, lmvdz, GalaxyRuler, and per decisions 1 and 2 MetatronAngelAgent and PrompDev) are refused with exit 2, and T3 owners before co-owner sign-off (Pick-Your-AI, Jevelopers-neatHack-2026) are refused with exit 2 unless the global `--allow-t3` is passed for that run.
+
+## Boundaries
+
+| This skill does | This skill does not |
+|---|---|
+| Render banners, cards, tiles, intros and contact sheets from metadata and committed brand files. | Draw illustrations, or let an image model draw text, logos or marks. |
+| Lint descriptions, topics, labels, READMEs, SVGs and banner PNGs against `ct-std-v1` and the user decisions. | Compose a new description sentence, an org description or a tagline; it returns `needs-writer` with the template. |
+| Propose GitHub changes as diffs, `gh` command lines, change records and `scripts/writer.py` jobs (`browser` jobs with exact click paths for UI-only steps) for a serialized writer. | Perform GitHub writes on its own. The only write is the Action committing into its own repository; label plans leave as `gh` argv and writer jobs (`labels --plan`). |
+| Write only the paths given by `--out`, `--out-dir`, `--jobs`, `--report` or `--records`, or README marker blocks and `docs/images/*` with `--write`. | Delete text from a README, crop or recolour a mark, or truncate text with an ellipsis. |
+| Read metadata from a JSON file or with read-only `gh api` GETs, and read the private estate registry without copying it. | Read credentials, persist state, schedule jobs, change repository settings, or copy the registry's private data into a repository. |
+
+## Core Workflow
+
+Run every command **from inside the target repository's checkout**, with the skill's script by path: `python3 <skill-dir>/scripts/showcase.py ...`. With `--meta`, the checkout must be the repository the metadata describes (its `origin` is compared); otherwise pass `--repo-dir DIR` or `--no-repo-dir`. A missing `--repo-dir` exits 2, and default outputs (`docs/images/...`) are always written inside the target checkout, never into the current directory or the skill.
+
+| Step | Command | Gate |
+|---|---|---|
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
+| 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
+| 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
+| 5 | `banner`, then `card` (and `content social`) | `art-fail` (exit 3) writes nothing. `needs-input` (exit 4) names the missing fact, including fewer than two fact chips (`needs-input:banner-chips`; add `chips:` to `.github/showcase.yml` or pass `--key-chip`/`--chip`). |
+| 6 | `readme`, then `readme --write` | Dry run prints a unified diff first. `readme-shrink` (exit 1) writes nothing. |
+| 7 | `footer --check README.md`, `lint all` | Every applicable check passes; `incomplete` is allowed for logged `needs-input` omissions. |
+| 8 | `doctor --header` | One coverage row. `done` only when every applicable cell is `pass`, `warn`, `incomplete` or `n/a`, and the banner has two to four chips. |
+| 9 | `contact-sheet` | A human (or an independent verifier) views the set on both GitHub page colours before rollout. Pass PNGs: `card --png`, `org-tile --png` previews, or install the optional `resvg_py` (`requirements-preview.txt`) so SVG inputs (the intro's static frame) render too; otherwise an SVG input exits 2. |
+
+**Who applies GitHub changes.** Under the estate orchestrator, every proposal (description, topics, labels, README) goes to its single writer queue as change records. Used standalone, with no orchestrator: show the user the `--gh` command lines (or the `argv` of `labels --plan`) and the README diff; the user runs them after approving that repository's changes. The skill itself never runs a write.
+
+**Install.** System Python on Ubuntu 24.04, Debian 12 and Homebrew refuses `pip install` ("externally managed environment"). Use a virtual environment (or `uv`):
+
+```bash
+python3 -m venv .venv && . .venv/bin/activate      # or: uv venv && . .venv/bin/activate
+python -m pip install -r <skill-dir>/requirements.txt  # or: uv pip install -r <skill-dir>/requirements.txt
+```
+
+```bash
+cd ../agentic-email-skill                               # the target checkout
+S=<skill-dir>/scripts/showcase.py
+python3 $S meta --from-gh CompleteTech-Skills/agentic-email-skill --out /tmp/meta.json
+python3 $S --meta /tmp/meta.json describe
+python3 $S --meta /tmp/meta.json banner                 # writes docs/images/banner.png in this checkout
+python3 $S --meta /tmp/meta.json doctor --header
+```
+
+| Exit | Meaning |
+|---|---|
+| 0 | ok, including `warn`, `incomplete` and `n/a` |
+| 1 | a check failed |
+| 2 | usage or config error, or an excluded, hold or T3 owner |
+| 3 | `art-fail`: text does not fit the fixed size ladder, or the PNG budget cannot be met |
+| 4 | `needs-input` blocks a generator (for example an empty description) |
+
+Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
+
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands do not enforce owner eligibility, so they are exceptions that never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+
+## Orgs, Projects, the Enterprise and Content
+
+CLI stdout and stderr use UTF-8, including redirected Windows output, raw footer markup,
+JSON, help and errors. Decode captured CLI output as UTF-8; JSON keeps Unicode characters
+without ASCII escaping. Existing stream error handlers are preserved, so diagnostics
+can still escape undecodable filenames. No `PYTHONIOENCODING` workaround is needed.
+The Action summary and quality validator also decode CLI results as UTF-8.
+
+Contributor tests also decode CLI captures and Markdown fixtures as UTF-8. Action
+shell tests use Git Bash on Windows and an explicit `requires_bash` dependency marker;
+see [Windows test portability](references/windows-testing.md) for setup and the individual failure triage.
+
+The four command groups follow the same rules as the repository commands: read-only toward GitHub, one JSON object on stdout (`command`, `action`, `owner`, `result`, `logs[]`), the same exit codes, and refusals for excluded, HOLD and T3 owners. What they add:
+
+**Command-name contract.** The orchestrator, the standard and other workstreams call these names, so they are fixed: the repository commands in the Command Reference; the top-level generators `banner`, `card`, `org-banner`, `org-tile`, `intro` and `contact-sheet`; and the groups `org {profile,about,pins,labels,health,doctor}`, `project {capture-query,normalize,copy-plan,readme,lint,estate-plan}`, `enterprise {snapshot-query,discover,snapshot,doctor,seat-check,diff,plan}` and `content {social,icon,links,linguist,actions,images,sidebar}`. The social preview is `content social`; the old top-level `social-preview` still parses as a hidden, deprecated alias (same options, same file, logged `deprecated:social-preview`) and is not documented as a command.
+
+- **Writer jobs.** Every planned GitHub change is a `scripts/writer.py` job `{id, phase, kind, repo|org, approval_id?, group?, argv, note}`; `--jobs FILE` appends them as JSON lines. Label jobs carry `group: labels:OWNER/REPO` for the writer's half-completed-group reconciliation unless the orchestrator passes its own group. UI-only steps are `kind: "browser"` jobs with `url`, `ui_action` and the exact click path in `steps`. A job that needs an approval carries the id `scripts/writer.py` looks up in `decisions/APPROVED_ACTIONS.yaml` (`ent-001`/`ent-002` for the Enterprise, `q41.orgs`/`q41.estate` for a project copy, the ids you pass with `--approval-id` or `--approval`). Mutations are always inline in `argv`; only read queries load from a file. The skill never runs a job: the orchestrator's writer does, after its guard and approval checks, or, used standalone, the user does after approving it.
+- **One org resolver (CQ-03).** Every org lookup (in `enterprise doctor` too) goes through `scripts/ctshowcase/resolver.py`, which maps old and new logins from `former_slugs` in `brand.yaml` or the registry, the registry's `placeholders`, and approved `org-rename`/`org-merge` items; repository slugs the registry writes after a pending `rename` or `transfer` resolve to today's slug the same way. After an approved rename (for example `CompleTetech-Security` to `CompleteTech-Security`) the brand row, the registry row, the watching-org exemption and every refusal still resolve, and jobs name the new login.
+- **The estate registry is private.** `org` reads `registry/estate.yaml` (`--registry FILE`, or the bundle beside the skill, or `$SHOWCASE_ESTATE_ROOT`) and renders public pages only from its public slice. Never copy the registry into a repository. Without it, `org health` checks a supplied `.github` checkout or captured files, and `org doctor` runs the checks supported by its snapshot, checkout and avatar; registry-dependent coverage is reported as `needs-input:registry`, with `done: no`. `org labels ORG --repos-from-gh` instead discovers accessible repositories with paginated read-only GitHub GETs and uses the committed brand identity without reading the registry or estate decisions. Remaining registry-backed `org` actions exit 4 without a registry; `project`, `enterprise` and `content` run on their input files alone. `examples/estate/` is a synthetic Northwind registry for trying every `org` action offline. See [the coverage table](references/org.md#registry-free-health-and-doctor) for partial O2/O3 checks.
+
+| Group | Typical sequence | Reference |
+|---|---|---|
+| `org` | `org about ORG --jobs J`, `org labels ORG --meta-dir M --jobs J` (or `org labels ORG --repos-from-gh --jobs J` without a registry), `org profile ORG --meta-dir M --out-dir <ORG/.github checkout>`, `org pins ORG --jobs J`, then `org doctor ORG --snapshot S` | [references/org.md](references/org.md) |
+| `project` | `project capture-query` (reference board), `normalize`, `copy-plan --target ORG` (stage 1), re-capture, `copy-plan --copied FILE --files-dir DIR --jobs J` (stage 2), `readme`, `lint` | [references/projects.md](references/projects.md) |
+| `enterprise` | `enterprise snapshot-query --slug S` or `snapshot --slug S --out F`, then `doctor`, `seat-check`, `plan --jobs J`; `diff` after the run | [references/enterprise.md](references/enterprise.md) |
+| `content` | `content links --base-ref origin/main`, `linguist`, `actions`, `images`, `sidebar --facts F`, `icon prompt`, `icon normalize`, `icon check`, `social --job` | [references/content.md](references/content.md) |
+
+`content icon` defaults to the installed skill's `references/art-direction.md`,
+including a repository glyph template for option A and the illustration template
+for option B. Palette values come from `references/brand.yaml`; documented family
+seeds are used when available, otherwise the prompt uses the tool's default seed. Use
+`--art-direction FILE` to select another file; relative paths use the current
+directory, and missing files report `needs-input:art-direction` with the selected path.
+Older custom configs without `icon_ink`/`icon_spark` keep normalization and checks
+available (family-ink QA is skipped with `needs-input:icon-palette`). The bundled
+option A glyph prompt names the missing tokens with exit 4; add them or pass an
+explicit palette through `--art-direction`. Option B illustration prompts do not
+require these glyph tokens.
+
+```bash
+S=<skill-dir>/scripts/showcase.py
+SHOWCASE_ESTATE_ROOT=<skill-dir>/examples/estate python3 $S org profile Northwind-Trading-Co --meta-dir <skill-dir>/examples/estate/meta
+python3 $S project copy-plan --target CompleteTech-Skills --source CompleteTech-LLC/7 --jobs jobs.jsonl
+python3 $S enterprise plan --snapshot registry/enterprise.snapshot.json --jobs jobs.jsonl
+python3 $S --meta meta.json content links --base-ref origin/main --diff     # inside the target checkout
+```
+
+**Registry-free labels.** Run `org labels ORG --repos-from-gh --jobs jobs.jsonl` to list all repositories visible to the authenticated GitHub account and capture their labels and file trees. It emits plans only. Rewrite the org `.github` default issue forms first, plan/apply that repository's label changes through the approved writer, then re-plan member repositories. Use `--checkouts DIR --dot-github DIR/ORG/.github` with verified GitHub-origin checkouts stored as `DIR/ORG/REPO` to release safe renames after those content changes; missing checkouts or unknown reference files keep renames held. Git-index and captured reference files must be present before a checkout is trusted, so sparse exclusions and local deletions cannot bypass the guard. Held renames make the plan `incomplete`; affected repository rows report `needs-input`, retain the held operation, and include `rewrite_first` file/line details when references must change. Forks, archived repositories and disabled-Issues members retain their existing exemptions. Do not combine this mode with registry, metadata or decision inputs. See [references/org.md](references/org.md) for the ordered workflow.
+
+## Command Reference
+
+```text
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--version] <command> [options]
+
+meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
+fingerprint [--out-dir docs/images] [--github-output]
+fonts [--check | --fetch]
+config [--write-lock] [--crop]
+describe [--text TEXT] [--type TYPE] [--records FILE]
+topics [--records FILE] [--gh] [--also-in ORG[,ORG] | --registry [FILE]]
+labels --emit-yml
+labels --plan [--references] [--records FILE] [--gh] [--jobs FILE] [--allow-hold]
+banner [--out docs/images/banner.png] [--scale 2] [--icon PATH] [--subtitle TEXT]
+       [--key-chip TEXT]... [--chip TEXT]... [--category TEXT] [--allow-unmeasured] [--allow-hold]
+       [--allow-few-chips] [--png-budget 300000]
+card [--out docs/images/card.svg] [--png PATH] [--icon PATH] [--allow-unmeasured] [--allow-hold]
+org-banner --org OWNER --out PATH [--illustration PATH]
+org-tile --org OWNER [--avatar PATH] [--illustration PATH] [--out PATH] [--png PATH]
+intro (--profile CompleteDotTech | --org OWNER) [--name TEXT] [--eyebrow TEXT] [--tagline TEXT]
+      [--chip key:TEXT] [--chip attr:TEXT]... [--mark PATH] [--height 320|360] [--static] [--out assets/intro.svg]
+footer [--check README.md [--online]] [--org OWNER] [--raw]
+readme [--mode auto|scaffold|upgrade|header] [--variant auto|A|B|C|D|E|F|G|H|I|J]
+       [--write] [--diff] [--records FILE] [--bootstrap]
+lint svg --kind intro|card|tile|plate|divider FILE...
+lint readme [README.md] [--variant auto]
+lint banner [docs/images/banner.png]
+lint all
+lint public-leak FILE... [--meta-dir DIR] [--registry FILE] [--decisions FILE] [--org ORG[,ORG]]
+lint prose [FILE...] [--text TEXT]... [--prose-kind text|description|tagline] [--preserved] [--allow WORD]...
+contact-sheet INPUT... --out PATH [--mode grid|stack|avatar] [--tile W] [--cols N] [--gap 24]
+              [--widths 1012,390] [--mask none|circle|rounded] [--labels] [--title TEXT]
+contact-sheet --org OWNER --cross-surface --out PATH [--avatar PNG] [--banner PNG] [--card SVG|PNG] [--social PNG]
+              [--org-banner JPG]
+doctor [--format tsv|json|md] [--header]
+doctor --estate --meta-dir DIR [--registry FILE] [--template-dir DIR --checkouts DIR] [--out NEW_PROPOSALS.yaml]
+new OWNER/NAME --type TYPE [--description TEXT] [--template OWNER/REPO] [--records FILE] [--jobs FILE] [--approval-id ID]
+adopt OWNER/REPO [--records FILE] [--jobs FILE] [--approval-id ID]
+enterprise snapshot-query --slug SLUG
+enterprise discover
+enterprise snapshot --slug SLUG [--out registry/enterprise.snapshot.json]
+enterprise doctor|seat-check|plan --snapshot FILE [--baseline FILE] [--user LOGIN] [--records FILE] [--jobs FILE]
+    doctor: [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
+enterprise diff --baseline OLD --snapshot NEW
+
+org profile|about|pins|labels|health|doctor ORG [--registry FILE] [--meta-dir DIR] [--decisions FILE]
+    [--approved FILE] [--approved-yaml FILE] [--actions FILE] [--allow-t3] [--jobs FILE]
+    profile: [--out-dir DIR] [--render] [--banner PATH] [--lists FILE] [--email-approved] [--allow-unmeasured]
+    pins: [--lists FILE] [--repo-ids FILE]      health/doctor: [--dot-github DIR]
+    labels: [--repos-from-gh] [--checkouts DIR] [--dot-github DIR]
+    doctor: [--snapshot FILE] [--avatar PATH] [--doctor-format tsv|json|md] [--header]
+org profile --user CompleteDotTech [--registry FILE] [--meta-dir DIR] [--out-dir DIR] [--render] [--allow-t3]
+project capture-query --owner OWNER --number N
+project normalize --capture FILE [--rest-fields FILE] [--out FILE]
+project lint --capture FILE --owner OWNER [--role org|template|estate] [--display-name TEXT]
+project copy-plan --target ORG|@me [--role org|template|estate] [--source OWNER/N] [--copied FILE]
+    [--workstreams FILE] [--repos OWNER/REPO,...] [--approval-id ID] [--files-dir DIR] [--no-status-update] [--jobs FILE]
+    (stage 2 with --jobs needs --files-dir: the REST view bodies the jobs' --input names)
+project readme --capture FILE --owner OWNER [--out FILE]
+project estate-plan [--copied FILE] [--user-id ID] [--source OWNER/N] [--jobs FILE]
+content social [--out PATH] [--title TEXT] [--icon PATH] [--job] [--allow-unmeasured] [--allow-hold]
+content icon prompt|normalize|check [--option A|B] [--glyph FILE] [--art-direction FILE] [--in PNG]
+    [--ground auto|transparent|keep] [--out PATH] [--preview PATH]
+content links [FILE...] [--readme-path PATH] [--base-ref REF] [--online] [--cache FILE] [--strict] [--diff]
+content linguist [--min-share 0.02] [--language NAME]
+content actions [--runs FILE] [--workflows FILE] [--pages FILE] [--changed PATH...] [--approval WORKFLOW=ID]
+content images [FILE...] [--base-ref REF] [--approval-id ID] [--out-dir DIR] [--online]
+content sidebar --facts FILE [--packages FILE]... [--current FILE] [--repo OWNER/REPO]
+    every content action: [--report FILE] [--jobs FILE] [--registry FILE] [--approved FILE] [--approved-yaml FILE] [--actions FILE]
+```
+
+| Command | What it does | Writes |
+|---|---|---|
+| `meta` | Normalizes repository metadata from read-only `gh api` GETs and adds the detected type, variant and family. Stdlib only. A `--meta` file keeps every key a later check reads ([references/meta.schema.json](references/meta.schema.json)): `has_pages`, `size`, `template_repository` (the full_name GitHub records for a repository generated from a template) and `template_taglines` (that template's README tagline when the repository was generated and today, read by `--from-gh`), the About sidebar counts (`releases`, `deployments`, `packages`, `environments`), and the R10 evidence `uses_custom_og_image` (the captured GraphQL `usesCustomOpenGraphImage` is mapped to it; only a boolean counts, and two spellings that disagree leave R10 `unknown`). `--from-gh` makes no GraphQL call, so add the flag from the social preview job's read-only check. | `--out` |
+| `fingerprint` | Hashes description, topics, visibility, license, language, icon, override file, skill version and brand config; reports `changed` against `docs/images/.showcase.json`. Stdlib only. | `$GITHUB_OUTPUT` with `--github-output` |
+| `config` | Validates `references/brand.yaml` against its schema and checks the stdlib lock copy; `--write-lock` regenerates `references/brand.lock.json` after an edit. | `references/brand.lock.json` with `--write-lock` |
+| `fonts` | `--check` verifies `assets/fonts/FONTS.json` sha256; `--fetch` downloads the pinned OFL fonts (ClawHub installs). | `assets/fonts/` with `--fetch` |
+| `describe` | Runs D1–D8, V1, P1, B1 and X1 and answers `keep`, `edit` or `needs-writer`. | `--records` |
+| `topics` | Runs the closed-vocabulary merge algorithm (brand, family, org membership, type, domain, tech; 10 public, 8 private). `--also-in ORG[,ORG]` (or `--registry`, which reads the repository's `also_in` from the private registry, read only, or an `also_in` list in the metadata) adds one org membership topic per cross-listing org from `org_topics` (never the home org's own). | `--records` |
+| `labels` | Emits `labels.yml`, or plans renames before creates (never `--force`, never a delete) from the metadata's labels or, without them, a read-only GET of the live labels. `--plan` prints the `gh` argv and the `scripts/writer.py` jobs (the writer re-reads the live labels before applying); standalone users run the printed argv themselves after approving it. A rename is planned only after §6.4 rule 0: in the `--repo-dir` checkout, or, without one, when the metadata's complete file tree (`files_complete: true`) lists no file rule 0 reads; a repository without issue forms of its own is also checked against the owner's `.github` default forms (`--org-defaults` takes a checkout or its metadata JSON). Otherwise it is held (`needs-input:label-references`, `needs_checkout`; [references/labels.md](references/labels.md)). `--references` is a no-op kept for compatibility. The `org labels` gates apply: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off; AI-Ascension gets only the `dependencies` create or patch; `has_issues: false` repositories (except `.github`), forks, archived repositories, T2-R and romgenie answer `n/a`. With `--plan`, `--jobs`, `--records` or `--gh`, metadata without labels is never planned against: the live labels are read first (exit 4, `needs-input:gh`, when they cannot be). Job ids come from the operation, never its position. | `--records`, `--jobs` |
+| `banner` | Renders the golden-layout hero PNG: navy grid canvas, icon card, eyebrow, slug, one-line subtitle, 2–4 chips, accent bar. Fewer than two chips exits 4 unless `--allow-few-chips` (result `incomplete`). | `--out`, sidecar under `docs/images/` |
+| `card` | Renders the 400×160 repo card SVG (no `<text>`, lint must pass first) and an optional PNG preview; same eyebrow and chip order as the banner. | `--out`, `--png` |
+| `org-banner` | Renders the 1600×400 org profile banner JPG (STANDARD §9.5). | `--out` |
+| `org-tile` | Renders the 400×160 org tile for profile directories. | `--out`, `--png` |
+| `intro` | Renders the profile intro (animated only for the personal profile and T1 flagship orgs; `.still` reduced-motion frame). | `--out` |
+| `footer` | Prints the decision 18 footer between `showcase:footer` markers, or checks that the README ends with it; `--check --online` also HEADs both raw logo URLs and fails (`fail:offline`) unless both return 200 (the Phase 4.0 hard gate). `--org OWNER` answers `exempt`, `exempt:footer` or `hold` for an org outside the footer's scope; for the watching org, `--check` still reads the README (its `.github` gets the footer, and `--org` cannot tell it from a fork). | stdout |
+| `readme` | Scaffolds, upgrades or refreshes the header marker blocks; never drops a line (multiset check). `--bootstrap` fills a template body only while its marker's sha256 still matches (a person's edit makes the block theirs). | `README.md` with `--write`; `CONTRIBUTING.md` with `--bootstrap` |
+| `lint` | SVG rules, README rules (R7 plus decisions 13 and 18) and banner PNG checks; `public-leak` checks any public file the run writes against the estate's private set (private slugs and names under every login of the owner, members-only pins, internal notes from the org rows, the registry's top-level notes and judge_changes and the profile's internal keys; OPS-03), reading the private registry and `--meta-dir` only; `prose` runs the CQ-17 checks on text the run writes (§1.2 brand strings, no emoji, no placeholders, the §4.1 formula for descriptions and taglines, typos when the optional `codespell` is installed; `--preserved` text only warns). | nothing |
+| `contact-sheet` | Lays outputs out the way GitHub shows them, on `#0d1117` and `#ffffff` (proofing surfaces, not asset variants). `--org ORG --cross-surface` is the G4 gate: the org avatar at 32 px, a hero banner, a repo card, the social preview and the org banner on one labelled sheet; a missing surface is logged `needs-input:cross-surface:<surface>` (result `incomplete`). | `PATH.on-github-dark.png`, `PATH.on-github-light.png` |
+| `doctor` | Prints the definition-of-done row: `R1`–`R11`, `banner`, `icon`, `card`, `footer`, `done`. No network. `--estate` classifies every repository in `--meta-dir` that `registry/estate.yaml` does not list with `decisions/POLICY.md` (`keep`, `move`, `archive`, `delete`, `merge`, `rename`, `rename-default-branch`; never acted on) and diffs the template-managed files of template-born checkouts against the current template (bump PRs are proposals). | `--out` (merges its own entries into `NEW_PROPOSALS.yaml`; others stay) |
+| `new` | Plans a repository from the template: the `gh repo create OWNER/NAME --template CompleteTech-LLC/completetech-repo-template --private` writer job, then `adopt` on it (naming N1–N4 and the §5.4 type are checked first; the watching org, placeholder orgs and refused owners exit 2). | `--records`, `--jobs` |
+| `adopt` | What "Use this template" does not carry, as Phase 3 change records and writer jobs: the §10.1 settings (wiki, Projects and Discussions only after their reads), the §5.6 topics, the §6 label passes, private vulnerability reporting and Dependabot alerts on public non-forks, plus a UI checklist (social preview upload job, About sidebar). An archived capture plans no jobs or change records, only a `pending` entry: re-capture the metadata inside the approved unarchive window, then adopt again. Metadata from `--meta`, else read-only `gh api` GETs. A family on hold (`hold: true`) is refused (exit 2). | `--records`, `--jobs` |
+| `enterprise` | Decision 24: `snapshot-query` prints the validated read queries; `discover` and `snapshot` run read-only GraphQL queries; `doctor` (E1–E14), `seat-check`, `diff` and `plan` (change records and writer jobs) work offline on snapshots against `references/enterprise.yaml`. | `--out`, `--records`, `--jobs` |
+| `org` | Decisions 5, 8, 9, 14, 15, 18, 20 and 23: the org profile README from the registry's public slice (leak-checked), the personal CompleteDotTech README with `profile --user` (kit order, leak-checked against the whole estate), About payload, pin and star List plan, label jobs for every repository homed in the org, `.github` health cells, and the O-check row. | `--out-dir` (profile only, after the leak check; an existing hand-made profile also needs a `profile-retemplate` approval), `--jobs` |
+| `project` | Decision 23, STANDARD §13: capture query, template spec, board lint (O10), two-stage copy plan (structure only, nothing deleted, mutations inline), board README, and the private Estate board. | `--out`, `--files-dir`, `--jobs` |
+| `content` | Audit gaps CQ-04, RP-09 (links), RP-07, CQ-08 (language bar), RP-06, RP-01, CQ-13 (Actions), RP-03, RP-10 (images), RP-05 (sidebar), RT-04 (repo icon) and R10 (`content social`: the 1280×640 repository social preview, STANDARD §9.5, in the same family design, plus with `--job` its browser upload job). | `--report`, `--jobs`, `--out`, `--out-dir`, `--preview`, `--cache` |
+
+`--type` replaces type detection with a §5.4 type (logged `type-override:<type>`); use it only when neither a checkout nor a captured file tree is available, for example with registry metadata. Without a tree, the type is provisional (`needs-input:file-tree`); a README link to a root `SKILL.md` still counts as rule 5.
+
+`lint readme` and `lint all` refuse excluded, hold and T3 owners like every other repository command. `lint all` fails an applicable banner or card that is missing; an exempt one is linted only if it exists. Forks outside the watching org, backups, archived and `.github` repositories need the banner (they have no card); a preserve-list README is exempt from the banner only when review q57 `pres` is "Leave them unchanged".
+
+Banner refusals: a watching-org fork returns `exempt` and writes nothing; the watching org's `.github` gets the banner and icon like any `.github`; another watching-org repository that is not a fork is refused (exit 2, `hold:watching-non-fork`) until decided, then `--allow-hold`; `CompleteDotTech/CompleteDotTech` (it opens with the intro) and a placeholder org's `.github` return `exempt:*`. Every other repository gets the hero banner (decisions 12, 13 and 18): forks outside the watching org (G), backups and archived repositories (H) and `.github` repositories (J) included, while `card` returns `exempt:no-card` for forks, backups and `.github`. AI-Ascension (`banner: keep-existing`) gets the hero in its own palette above its existing banner (q57 `aia` and `pres` defaults) and returns `exempt:keep-existing` only when `readme.preserve_banner` is `unchanged`; TouchedByAnAgent (`hold: true`) needs `--allow-hold`; families marked `measured: false` need `--allow-unmeasured` (otherwise exit 4, `needs-input:palette-v1.1`).
+
+## Decisions That Override the Standard
+
+These user decisions outrank `STANDARD.md` (`ct-std-v1`). Full text: [references/decisions.md](references/decisions.md).
+
+| Decision | Effect on this skill |
+|---|---|
+| 12 | Every in-scope repository gets its own icon at `assets/icon.png`; until then the banner uses the org's Neon Night mark (every T1 org but CompleteTech-LLC), then the CompleteTech logo (CompleteTech-LLC) or, in every other family, the family's typeset wordmark on its dark plate, and logs `needs-input:repo-icon`. |
+| 13 | Every README opens with the hero banner in the php2shell-check layout, then the nav line (q57 `nav` default), then the title, badge row and bold description; forks outside the watching org, backups, archived and `.github` repositories included. |
+| 18 | Every README ends with the exact CompleteTech LLC footer. It is the only `<picture>` the skill emits. |
+| 19 | The dark logo master is configurable (`brand_assets.dark_master` is `current` or `candidate`); generators never crop a mark at runtime. |
+| 21 | One dark design per surface (banner, card, tile, intro) on both GitHub themes. No light variants, no `-dark`/`-light` sibling files. |
+| 22 | This skill and `completetech-repo-template` make the standard repeatable; the template's Action calls `action.yml`. |
+| 23 | Orgs and GitHub Projects are covered: project boards are copied from the captured golden template, never deleted. |
+| 24 | The CompleteTech Enterprise is covered read-only: snapshot, E-checks, the romgenie seat check and printed change records; policies stay proposals. |
+
+## Brand and Family Data
+
+- `references/brand.yaml` is the single place for colours, fonts, logo paths, eyebrows, company labels, footer strings and per-org rows. A hex colour literal in `scripts/` fails the quality gate.
+- Precedence: schema defaults, then `families.<family>`, then `orgs.<Org>`, then the repository's `.github/showcase.yml`, then CLI flags. Repository files and flags change **content** only (icon, subtitle, chips, category, variant); colours and fonts are never overridable.
+- Icon on the banner card and the card tile, first match wins: `--icon`, `.github/showcase.yml` `icon`, then `assets/icon.png`, then the org mark (`assets/orgs/<Org>/mark.png`), then a family fallback: the light CompleteTech logo for CompleteTech orgs (its cloud-and-bulb crop, `mark_light`, in icon boxes under 200 px), and for every other family (AI-Ascension, Jev-Engineering, jevplay-games, LibreEvolve, TouchedByAnAgent, romgenie, T3) its display name typeset in the family font on the family plate. A T2 surface never carries the CompleteTech logo.
+- An icon that brings its own opaque ground (four corners alike) fills the card with that ground and is drawn full-bleed, so there is never a plate inside a plate; dark plates get a 2 px accent edge. jevplay-games icons are scaled nearest-neighbour at an integer factor.
+- `.github/showcase.yml` may carry `type:` (a §5.4 type for a repository whose code has not landed) and `for: OWNER/REPO` (any login of the org, the name in any case, or the slug an approved rename or transfer gives it; the overrides apply only to that repository, so a template's own chips and subtitle never reach the repositories created from it).
+- Navy surfaces (intro, org tile) use the selected dark master or `mark-dark.png` when committed. Marks are never cropped, masked or recoloured.
+- `readme:` holds the review-page answers that shape README scaffolding, at their defaults: `nav_first: false` (q57 `nav`: hero banner, then nav line), `preserve_banner: above` (q57 `pres`: the hero goes above a preserve-list README's own banner; `unchanged` leaves those READMEs without one) and `fork_readme: note` (q27: forks outside the watching org keep the upstream README under the hero banner and the §7.4 G note; `full` gives them their §5.4 variant). Change a value only after the user's answer, then `config --write-lock`.
+
+## Resource Guide
+
+| Resource | Role |
+|---|---|
+| [references/estate-standard.md](references/estate-standard.md) | Tiers, brand strings, golden rules, org identity table, repo naming. |
+| [references/descriptions.md](references/descriptions.md) | Description checks D1–D8, V1, P1, B1, X1, keep-or-edit order, templates by type. |
+| [references/topics.md](references/topics.md) | Topic layers, type detection rules 1–25, vocabulary, aliases, merge algorithm, safety. |
+| [references/labels.md](references/labels.md) | The 23-label set, migration map, apply algorithm and `labels.yml`. |
+| [references/readme-variants.md](references/readme-variants.md) | Header block with banner and footer, variants A–J, H2 order, license rows, preserve list. |
+| [references/banner-layout.md](references/banner-layout.md) | Banner and card geometry measured from the golden, chip rules, eyebrow rules. |
+| [references/art-direction.md](references/art-direction.md) | Family palettes, motifs, asset sizes, prompt template for illustrations, art QA. |
+| [references/svg-rules.md](references/svg-rules.md) | GitHub-safe SVG rules with decision 21 applied, and what `lint svg` checks. |
+| [references/profile-readmes.md](references/profile-readmes.md) | Org and personal profile README structure, cards, intros and what to skip. |
+| [references/orgs-and-projects.md](references/orgs-and-projects.md) | Org About fields, O-checks, org `.github` contents, profile rules and the GitHub Projects rules. |
+| [references/org.md](references/org.md) | The `org` command group: inputs (with or without the estate bundle), the public slice and leak check, the org resolver (CQ-03), writer jobs and refusals. |
+| [references/projects.md](references/projects.md) | The `project` command group: capture, normalize, lint, the two-stage copy plan, README and the Estate board. |
+| [references/content.md](references/content.md) | The `content` command group: links, language bar, Actions, images, sidebar, repo icon and the social preview. |
+| [references/enterprise.md](references/enterprise.md) | The enterprise module: commands, writer jobs, `enterprise.yaml` desired state, E-checks and guardrails (decision 24). |
+| [references/constraints.md](references/constraints.md) | Platform limits, write discipline, approval-gated actions, change records. |
+| [references/definition-of-done.md](references/definition-of-done.md) | Checks R1–R12 and O1–O11 mapped to `doctor` and `lint` cells. |
+| [references/decisions.md](references/decisions.md) | The user decisions this skill implements, verbatim. |
+| `references/brand.yaml`, `references/brand.schema.json`, `references/repo-config.schema.json`, `references/meta.schema.json` | Brand data and the schemas for it, for `.github/showcase.yml` and for metadata. |
+| `references/standard/` | Machine-readable standard: topics, types, labels, descriptions, README variants, naming. |
+| `examples/` | Synthetic Northwind Trading Co. metadata, small fixture checkouts, an example `.github/showcase.yml`, a synthetic estate (`examples/estate/`: registry and metadata for the `org` commands), and `render_examples.sh`, which regenerates every committed preview. |
+| `action.yml` | Composite GitHub Action that regenerates the banner and card when inputs change. |
+
+## Runtime Permissions
+
+| Area | Runtime behavior |
+|---|---|
+| Execution | Runs the local Python entry point `scripts/showcase.py` (and `scripts/action_commit.sh`, `scripts/action_prepare.py` inside the Action only). |
+| Reads | The target repository directory (`--repo-dir`), a metadata JSON (`--meta`) or directory (`--meta-dir`), `references/` and `assets/`; for the `org`, `project` and `content` groups also the estate registry and the approval files (`--registry`, `--approved`, `--approved-yaml`, `--actions`, `--decisions`, or the bundle beside the skill), read only and never copied. |
+| Writes | Only paths given by `--out`, `--png`, `--records`, `--jobs`, `--report`, `--out-dir`, `--files-dir`, `--preview` or `--cache`; with `--write`, the README marker blocks and `docs/images/*`; with `--bootstrap`, `CONTRIBUTING.md` owner tokens; `content icon normalize` defaults to `assets/icon.png` in the target checkout. |
+| Network | None by default. `meta --from-gh`, `labels --plan` and `adopt` without metadata, and opt-in `org labels --repos-from-gh` run read-only `gh api` GETs; `enterprise discover` and `enterprise snapshot` run read-only `gh api graphql` queries; `content links --online` and `content images --online` make cached, rate-limited HEAD/GET requests to the hosts the files link to and read-only `gh api` GETs; `fonts --fetch` downloads the pinned fonts over HTTPS; `footer --check --online` sends one HEAD to each of the two decision 18 logo URLs on raw.githubusercontent.com. `org` without `--repos-from-gh`, `project`, `enterprise snapshot-query`, `plan` and every other command only print the commands they plan. |
+
+| Not Included | Boundary |
+|---|---|
+| GitHub writes | None: no `gh` write verbs, no `git push`, no settings, labels, topics or description changes. Proposals go to the orchestrator's single writer queue as change records and writer jobs, or, used standalone, to the user, who runs the printed argv after approving it. |
+| Credentials | Does not read tokens, browser sessions or secrets; `gh` uses its own authentication. |
+| System changes | No persistence, schedules, privilege escalation or deletes. |
+
+## Network Boundary
+
+Generation, checking and planning are local. The only network calls are the read-only `gh api` GETs of `meta --from-gh`, `labels --plan`, `adopt` and opt-in `org labels ORG --repos-from-gh` (paginated repository and label discovery, plus repository file trees), the read-only GraphQL queries of `enterprise discover` and `enterprise snapshot` (api.github.com), the opt-in link and image checks of `content links --online` and `content images --online` (the hosts the checked files link to, cached and rate-limited), the font download of `fonts --fetch`, and the two read-only HEAD requests of `footer --check --online` (raw.githubusercontent.com), each run only when asked. The skill posts no metadata or run data anywhere else. The composite Action is the only component that pushes, and only into the repository it runs in.
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index ac48759..628b691 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -1,74 +1,74 @@
-"""Docs for the global `--allow-t3` flag: SKILL.md, CHANGELOG.md and `--help` must describe the same behaviour.
-
-Synthetic checks only: no network, no registry, and no shared package files are touched.
-"""
-from __future__ import annotations
-
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-MARKER = "**Co-owner sign-off (`--allow-t3`).**"
-
-
-def _read(name: str) -> str:
-    return (ROOT / name).read_text(encoding="utf-8")
-
-
-def test_skill_synopsis_lists_global_flag():
-    skill = _read("SKILL.md")
-    ref = skill[skill.index("## Command Reference"):]
-    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
-    assert "[--allow-t3]" in synopsis, synopsis
-    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>"), synopsis
-
-
-def test_skill_documents_refusals():
-    skill = _read("SKILL.md")
-    assert MARKER in skill
-    assert "t3-signoff" in skill
-    window = skill[skill.index(MARKER):][:2400]
-    assert "excluded" in window, window
-    assert "HOLD" in window, window
-
-
-def test_skill_states_which_commands_do_not_enforce_owner_eligibility():
-    """doctor forces R7=hold only without the flag; local meta and fingerprint never refuse (verified in code/tests)."""
-    skill = _read("SKILL.md")
-    para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
-    assert "only without `--allow-t3`" in para, para
-    assert "evaluated normally" in para, para
-    assert "`fingerprint`" in para and "--from-gh" in para, para
-    assert "with or without the flag, with the R7" not in para
-
-
-def test_changelog_unreleased_lists_flag():
-    changelog = _read("CHANGELOG.md")
-    start = changelog.index("## Unreleased")
-    end = changelog.index("\n## ", start + 1)
-    unreleased = changelog[start:end]
-    # the entry belongs in the Added list of Unreleased, not in Fixed or a dated section
-    added = unreleased[unreleased.index("### Added"):unreleased.index("### Fixed")]
-    assert "--allow-t3" in added
-
-
-# Regression guard for the CLI help. The help text already names the flag on the base commit, so the
-# assertions below pass there too; the cross-check against SKILL.md's synopsis is the part that fails
-# on a base that lacks the doc change.
-def test_help_text_matches_docs():
-    env = dict(os.environ, COLUMNS="200")  # keep argparse from wrapping the usage line
-    result = subprocess.run(
-        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
-        capture_output=True, encoding="utf-8", env=env,
-    )
-    assert result.returncode == 0, result.stderr
-    assert "--allow-t3" in result.stdout
-    fragment = "[--quiet] [--allow-t3] [--version]"
-    help_usage = " ".join(result.stdout.split())
-    skill = _read("SKILL.md")
-    ref = skill[skill.index("## Command Reference"):]
-    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
-    assert fragment in help_usage, help_usage
-    assert fragment in " ".join(synopsis.split()), synopsis
+"""Docs for the global `--allow-t3` flag: SKILL.md, CHANGELOG.md and `--help` must describe the same behaviour.
+
+Synthetic checks only: no network, no registry, and no shared package files are touched.
+"""
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+MARKER = "**Co-owner sign-off (`--allow-t3`).**"
+
+
+def _read(name: str) -> str:
+    return (ROOT / name).read_text(encoding="utf-8")
+
+
+def test_skill_synopsis_lists_global_flag():
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert "[--allow-t3]" in synopsis, synopsis
+    assert synopsis.index("[--allow-t3]") < synopsis.index("<command>"), synopsis
+
+
+def test_skill_documents_refusals():
+    skill = _read("SKILL.md")
+    assert MARKER in skill
+    assert "t3-signoff" in skill
+    window = skill[skill.index(MARKER):][:2400]
+    assert "excluded" in window, window
+    assert "HOLD" in window, window
+
+
+def test_skill_states_which_commands_do_not_enforce_owner_eligibility():
+    """doctor forces R7=hold only without the flag; local meta and fingerprint never refuse (verified in code/tests)."""
+    skill = _read("SKILL.md")
+    para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
+    assert "only without `--allow-t3`" in para, para
+    assert "evaluated normally" in para, para
+    assert "`fingerprint`" in para and "--from-gh" in para, para
+    assert "with or without the flag, with the R7" not in para
+
+
+def test_changelog_unreleased_lists_flag():
+    changelog = _read("CHANGELOG.md")
+    start = changelog.index("## Unreleased")
+    end = changelog.index("\n## ", start + 1)
+    unreleased = changelog[start:end]
+    # the entry belongs in the Added list of Unreleased, not in Fixed or a dated section
+    added = unreleased[unreleased.index("### Added"):unreleased.index("### Fixed")]
+    assert "--allow-t3" in added
+
+
+# Regression guard for the CLI help. The help text already names the flag on the base commit, so the
+# assertions below pass there too; the cross-check against SKILL.md's synopsis is the part that fails
+# on a base that lacks the doc change.
+def test_help_text_matches_docs():
+    env = dict(os.environ, COLUMNS="200")  # keep argparse from wrapping the usage line
+    result = subprocess.run(
+        [sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+        capture_output=True, encoding="utf-8", env=env,
+    )
+    assert result.returncode == 0, result.stderr
+    assert "--allow-t3" in result.stdout
+    fragment = "[--quiet] [--allow-t3] [--version]"
+    help_usage = " ".join(result.stdout.split())
+    skill = _read("SKILL.md")
+    ref = skill[skill.index("## Command Reference"):]
+    synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
+    assert fragment in help_usage, help_usage
+    assert fragment in " ".join(synopsis.split()), synopsis

From 589b84eaa0f8a5fa0d066c86f2b4582127f7b25f Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 05:18:27 -0400
Subject: [PATCH 07/79] docs: correct --allow-t3 scope (content group) and
 doctor refusals

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md | 2 +-
 SKILL.md     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb52978..5fb5731 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,7 +7,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 ### Added
 
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits them; R7 is `hold` only without the flag), local `meta` normalization and `fingerprint`, which do not check eligibility; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
diff --git a/SKILL.md b/SKILL.md
index b1a1b2c..8ef4576 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org` and `project` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands do not enforce owner eligibility, so they are exceptions that never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment.
 
 ## Orgs, Projects, the Enterprise and Content
 

From be5cb148a80b91be05b5b584844f68e16cfafa25 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 05:40:05 -0400
Subject: [PATCH 08/79] Make T3 sign-off context-local with a ContextVar

Replace the process-wide _T3_SIGNED_OFF module global with a ContextVar
so --allow-t3 sign-off cannot leak between concurrent or embedded calls.
set_t3_signed_off now returns a token, reset_t3_signed_off restores the
prior value, and showcase.main() wraps each invocation in that token.
Default stays unsigned; CLI behaviour is unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                  |  1 +
 scripts/ctshowcase/config.py  | 17 +++++----
 scripts/showcase.py           |  8 ++---
 tests/test_allow_t3_global.py | 67 +++++++++++++++++++++++++++++++++++
 4 files changed, 83 insertions(+), 10 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46719ce..715fe81 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Fixed
 
+- T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
 - Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
 - Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
 - The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index 05ad8b2..d7d94db 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -4,6 +4,7 @@
 import copy
 import hashlib
 import json
+from contextvars import ContextVar, Token
 from pathlib import Path
 
 from . import REFERENCES, ROOT
@@ -40,19 +41,23 @@ def canonical(obj) -> str:
     return json.dumps(obj, sort_keys=True, ensure_ascii=False, separators=(",", ":"))
 
 
-_T3_SIGNED_OFF = False
+_T3_SIGNED_OFF: ContextVar[bool] = ContextVar("ctshowcase_t3_signed_off", default=False)
 
 
-def set_t3_signed_off(value: bool) -> None:
+def set_t3_signed_off(value: bool) -> Token:
     """Record the run's `--allow-t3`: set once by the CLI, read by every owner gate (check_owner, art_status,
     footer_status). Off by default, so a T3 owner is refused unless the caller passes the flag after an approved
-    t3-metadata or t3-signoff row."""
-    global _T3_SIGNED_OFF
-    _T3_SIGNED_OFF = bool(value)
+    t3-metadata or t3-signoff row. Context-local (contextvars): threads and asyncio tasks do not see each other's
+    sign-off. Returns a token for reset_t3_signed_off."""
+    return _T3_SIGNED_OFF.set(bool(value))
+
+
+def reset_t3_signed_off(token: Token) -> None:
+    _T3_SIGNED_OFF.reset(token)
 
 
 def t3_signed_off() -> bool:
-    return _T3_SIGNED_OFF
+    return _T3_SIGNED_OFF.get()
 
 
 class Brand:
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 244bfd0..765c7f7 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -1191,13 +1191,13 @@ def parser() -> argparse.ArgumentParser:
 
 
 def main(argv=None) -> int:
-    """Run one invocation. `--allow-t3` holds only for this call: the previous value is restored on every exit."""
-    from ctshowcase.config import set_t3_signed_off, t3_signed_off
-    previous = t3_signed_off()
+    """Run one invocation. `--allow-t3` holds only for this call (and this context): the prior value is restored on every exit."""
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    token = set_t3_signed_off(t3_signed_off())
     try:
         return _main(argv)
     finally:
-        set_t3_signed_off(previous)
+        reset_t3_signed_off(token)
 
 
 def _main(argv=None) -> int:
diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index c28d2a4..023765d 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -80,3 +80,70 @@ def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
         assert _star_held(est, "BunsDev") == "excluded"  # sign-off never lifts an excluded owner
     finally:
         set_t3_signed_off(False)
+
+
+def test_token_reset_restores_each_prior_value():
+    """set_t3_signed_off returns a token; reset_t3_signed_off restores exactly the value before that set."""
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    assert t3_signed_off() is False
+    outer = set_t3_signed_off(True)
+    inner = set_t3_signed_off(False)
+    assert t3_signed_off() is False
+    reset_t3_signed_off(inner)
+    assert t3_signed_off() is True
+    reset_t3_signed_off(outer)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_is_invisible_to_a_separate_context():
+    """Sign-off is context-local: code run in a fresh copy of the context (as an embedding host would) stays unsigned."""
+    import contextvars
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        assert t3_signed_off() is True
+        contextvars.Context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False]
+        contextvars.copy_context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False, True]
+    finally:
+        reset_t3_signed_off(token)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_does_not_leak_to_a_thread_started_with_an_empty_context():
+    """A thread started while signed off must not see the sign-off on interpreters that do not inherit context."""
+    import sys
+    import threading
+    import pytest
+    if getattr(sys.flags, "thread_inherit_context", False):
+        pytest.skip("this interpreter's threads inherit the caller's context")
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        worker = threading.Thread(target=lambda: seen.append(t3_signed_off()))
+        worker.start()
+        worker.join()
+    finally:
+        reset_t3_signed_off(token)
+    assert seen == [False]
+
+
+def test_main_restores_the_caller_sign_off_value(capsys):
+    """main() wraps one call in a token: whatever --allow-t3 set inside it is undone, and the caller's value is kept."""
+    import sys
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    sys.path.insert(0, str(ROOT / "scripts"))
+    import showcase
+    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
+    capsys.readouterr()
+    assert t3_signed_off() is False
+    token = set_t3_signed_off(True)
+    try:
+        assert showcase.main(["config"]) in (0, 1)
+        capsys.readouterr()
+        assert t3_signed_off() is True
+    finally:
+        reset_t3_signed_off(token)

From aa4705f05e19a3be980b9e1ac8e52b011aa2c325 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 06:44:02 -0400
Subject: [PATCH 09/79] Test independent T3 sign-off across concurrent threads
 at the owner gate

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_allow_t3_global.py | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index 023765d..7a8db89 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -147,3 +147,38 @@ def test_main_restores_the_caller_sign_off_value(capsys):
         assert t3_signed_off() is True
     finally:
         reset_t3_signed_off(token)
+
+
+def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand):
+    """Acceptance: one thread signed off and one not behave independently; the unsigned one is refused for a T3 owner.
+
+    Each thread sets its own state explicitly, so this also runs where threads inherit the caller's context. The barrier
+    makes both threads hold their state at the same time before either calls the gate."""
+    import threading
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    from ctshowcase.errors import Refused
+    barrier = threading.Barrier(2, timeout=10)
+    out: dict[str, tuple] = {}
+
+    def worker(name, signed):
+        token = set_t3_signed_off(signed)
+        try:
+            barrier.wait()  # both states are live at once
+            try:
+                result = ("passed", brand.check_owner("Pick-Your-AI"))
+            except Refused as exc:
+                result = ("refused", exc.log)
+            barrier.wait()  # neither resets until both have checked
+            out[name] = (*result, t3_signed_off())
+        finally:
+            reset_t3_signed_off(token)
+
+    threads = [threading.Thread(target=worker, args=("signed", True)),
+               threading.Thread(target=worker, args=("unsigned", False))]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    assert out["signed"] == ("passed", "t3", True), out
+    assert out["unsigned"] == ("refused", "t3-signoff", False), out
+    assert t3_signed_off() is False

From 1dbbf620ae1a6dee4e1d9a6d33e8464d040731f8 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 06:49:22 -0400
Subject: [PATCH 10/79] Document which T3 sign-off tests discriminate the
 ContextVar change

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_allow_t3_global.py | 304 +++++++++++++++++-----------------
 1 file changed, 155 insertions(+), 149 deletions(-)

diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index 7a8db89..9012f84 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -1,152 +1,158 @@
-"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2)."""
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
-META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
-
-
-def _run(tmp_path, *argv, owner="Pick-Your-AI"):
-    meta = tmp_path / "meta.json"
-    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
-    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT,
-                          capture_output=True, text=True, encoding="utf-8")
-
-
-def test_t3_owner_is_refused_without_the_flag(tmp_path):
-    for cmd in (["describe"], ["topics"], ["readme"],
-                ["banner", "--out", str(tmp_path / "b.png")]):
-        r = _run(tmp_path, *cmd)
-        assert r.returncode == 2, (cmd, r.stdout, r.stderr)
-        assert "co-owner sign-off" in r.stdout + r.stderr or "t3-signoff" in r.stdout + r.stderr
-
-
-def test_global_flag_lets_repository_commands_run(tmp_path):
-    for cmd in (["describe"], ["topics"]):
-        r = _run(tmp_path, "--allow-t3", *cmd)
-        assert r.returncode != 2, (cmd, r.stdout, r.stderr)
-        assert "t3-signoff" not in r.stdout + r.stderr
-
-
-def test_global_flag_renders_art_for_a_t3_owner(tmp_path):
-    out = tmp_path / "banner.png"
-    r = _run(tmp_path, "--allow-t3", "banner", "--out", str(out), "--allow-unmeasured", "--allow-few-chips")
-    assert r.returncode == 0, (r.stdout, r.stderr)
-    assert out.is_file() and out.stat().st_size > 10_000
-    assert "t3-signoff" not in r.stdout + r.stderr
-
-
-def test_flag_does_not_lift_excluded_owners(tmp_path):
-    r = _run(tmp_path, "--allow-t3", "describe", owner="BunsDev")
-    assert r.returncode == 2, (r.stdout, r.stderr)
-
-
-def test_doctor_reports_t3_cells_as_held_only_without_the_flag(tmp_path):
-    held = _run(tmp_path, "doctor", "--format", "json")
-    assert json.loads(held.stdout)["cells"]["R7"] == "hold", held.stdout
-    signed = _run(tmp_path, "--allow-t3", "doctor", "--format", "json")
-    assert json.loads(signed.stdout)["cells"]["R7"] != "hold", signed.stdout
-
-
-def test_signoff_does_not_outlive_the_invocation(tmp_path, capsys):
-    """`--allow-t3` holds for one main() call only: a later library call in the same process is refused again."""
-    import pytest
-    sys.path.insert(0, str(ROOT / "scripts"))
-    import showcase
-    from ctshowcase.config import load_brand, t3_signed_off
-    from ctshowcase.errors import Refused
-    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
-    capsys.readouterr()
-    assert t3_signed_off() is False
-    with pytest.raises(Refused):
-        load_brand().check_owner("Pick-Your-AI")
-
-
-def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
-    from ctshowcase.config import set_t3_signed_off
-    from ctshowcase.org import _star_held
-    from ctshowcase.resolver import Resolver
-    est = type("E", (), {"resolver": Resolver(brand, {"orgs": {}}, None)})()
-    assert _star_held(est, "Pick-Your-AI") == "t3"
-    assert _star_held(est, "Pick-Your-AI", allow_t3=True) is None
-    set_t3_signed_off(True)
-    try:
-        assert _star_held(est, "Pick-Your-AI") is None
-        assert _star_held(est, "BunsDev") == "excluded"  # sign-off never lifts an excluded owner
-    finally:
-        set_t3_signed_off(False)
-
-
-def test_token_reset_restores_each_prior_value():
-    """set_t3_signed_off returns a token; reset_t3_signed_off restores exactly the value before that set."""
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    assert t3_signed_off() is False
-    outer = set_t3_signed_off(True)
-    inner = set_t3_signed_off(False)
-    assert t3_signed_off() is False
-    reset_t3_signed_off(inner)
-    assert t3_signed_off() is True
-    reset_t3_signed_off(outer)
-    assert t3_signed_off() is False
-
-
-def test_sign_off_is_invisible_to_a_separate_context():
-    """Sign-off is context-local: code run in a fresh copy of the context (as an embedding host would) stays unsigned."""
-    import contextvars
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    seen = []
-    token = set_t3_signed_off(True)
-    try:
-        assert t3_signed_off() is True
-        contextvars.Context().run(lambda: seen.append(t3_signed_off()))
-        assert seen == [False]
-        contextvars.copy_context().run(lambda: seen.append(t3_signed_off()))
-        assert seen == [False, True]
-    finally:
-        reset_t3_signed_off(token)
-    assert t3_signed_off() is False
-
-
-def test_sign_off_does_not_leak_to_a_thread_started_with_an_empty_context():
-    """A thread started while signed off must not see the sign-off on interpreters that do not inherit context."""
-    import sys
-    import threading
-    import pytest
-    if getattr(sys.flags, "thread_inherit_context", False):
-        pytest.skip("this interpreter's threads inherit the caller's context")
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    seen = []
-    token = set_t3_signed_off(True)
-    try:
-        worker = threading.Thread(target=lambda: seen.append(t3_signed_off()))
-        worker.start()
-        worker.join()
-    finally:
-        reset_t3_signed_off(token)
-    assert seen == [False]
-
-
-def test_main_restores_the_caller_sign_off_value(capsys):
-    """main() wraps one call in a token: whatever --allow-t3 set inside it is undone, and the caller's value is kept."""
-    import sys
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    sys.path.insert(0, str(ROOT / "scripts"))
-    import showcase
-    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
-    capsys.readouterr()
-    assert t3_signed_off() is False
-    token = set_t3_signed_off(True)
-    try:
-        assert showcase.main(["config"]) in (0, 1)
-        capsys.readouterr()
-        assert t3_signed_off() is True
-    finally:
-        reset_t3_signed_off(token)
+"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2)."""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+
+
+def _run(tmp_path, *argv, owner="Pick-Your-AI"):
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT,
+                          capture_output=True, text=True, encoding="utf-8")
+
+
+def test_t3_owner_is_refused_without_the_flag(tmp_path):
+    for cmd in (["describe"], ["topics"], ["readme"],
+                ["banner", "--out", str(tmp_path / "b.png")]):
+        r = _run(tmp_path, *cmd)
+        assert r.returncode == 2, (cmd, r.stdout, r.stderr)
+        assert "co-owner sign-off" in r.stdout + r.stderr or "t3-signoff" in r.stdout + r.stderr
+
+
+def test_global_flag_lets_repository_commands_run(tmp_path):
+    for cmd in (["describe"], ["topics"]):
+        r = _run(tmp_path, "--allow-t3", *cmd)
+        assert r.returncode != 2, (cmd, r.stdout, r.stderr)
+        assert "t3-signoff" not in r.stdout + r.stderr
+
+
+def test_global_flag_renders_art_for_a_t3_owner(tmp_path):
+    out = tmp_path / "banner.png"
+    r = _run(tmp_path, "--allow-t3", "banner", "--out", str(out), "--allow-unmeasured", "--allow-few-chips")
+    assert r.returncode == 0, (r.stdout, r.stderr)
+    assert out.is_file() and out.stat().st_size > 10_000
+    assert "t3-signoff" not in r.stdout + r.stderr
+
+
+def test_flag_does_not_lift_excluded_owners(tmp_path):
+    r = _run(tmp_path, "--allow-t3", "describe", owner="BunsDev")
+    assert r.returncode == 2, (r.stdout, r.stderr)
+
+
+def test_doctor_reports_t3_cells_as_held_only_without_the_flag(tmp_path):
+    held = _run(tmp_path, "doctor", "--format", "json")
+    assert json.loads(held.stdout)["cells"]["R7"] == "hold", held.stdout
+    signed = _run(tmp_path, "--allow-t3", "doctor", "--format", "json")
+    assert json.loads(signed.stdout)["cells"]["R7"] != "hold", signed.stdout
+
+
+def test_signoff_does_not_outlive_the_invocation(tmp_path, capsys):
+    """`--allow-t3` holds for one main() call only: a later library call in the same process is refused again."""
+    import pytest
+    sys.path.insert(0, str(ROOT / "scripts"))
+    import showcase
+    from ctshowcase.config import load_brand, t3_signed_off
+    from ctshowcase.errors import Refused
+    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
+    capsys.readouterr()
+    assert t3_signed_off() is False
+    with pytest.raises(Refused):
+        load_brand().check_owner("Pick-Your-AI")
+
+
+def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
+    from ctshowcase.config import set_t3_signed_off
+    from ctshowcase.org import _star_held
+    from ctshowcase.resolver import Resolver
+    est = type("E", (), {"resolver": Resolver(brand, {"orgs": {}}, None)})()
+    assert _star_held(est, "Pick-Your-AI") == "t3"
+    assert _star_held(est, "Pick-Your-AI", allow_t3=True) is None
+    set_t3_signed_off(True)
+    try:
+        assert _star_held(est, "Pick-Your-AI") is None
+        assert _star_held(est, "BunsDev") == "excluded"  # sign-off never lifts an excluded owner
+    finally:
+        set_t3_signed_off(False)
+
+
+# Evidence note for reviewers: the seven tests above this line predate the ContextVar change
+# (they exist at 2be04ac, before be5cb14) and are regression guards for the CLI contract that
+# must keep passing. The five tests from here down are the discriminating ones: run against the
+# tree before be5cb14 they fail with ImportError on `reset_t3_signed_off`.
+
+
+def test_token_reset_restores_each_prior_value():
+    """set_t3_signed_off returns a token; reset_t3_signed_off restores exactly the value before that set."""
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    assert t3_signed_off() is False
+    outer = set_t3_signed_off(True)
+    inner = set_t3_signed_off(False)
+    assert t3_signed_off() is False
+    reset_t3_signed_off(inner)
+    assert t3_signed_off() is True
+    reset_t3_signed_off(outer)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_is_invisible_to_a_separate_context():
+    """Sign-off is context-local: code run in a fresh copy of the context (as an embedding host would) stays unsigned."""
+    import contextvars
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        assert t3_signed_off() is True
+        contextvars.Context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False]
+        contextvars.copy_context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False, True]
+    finally:
+        reset_t3_signed_off(token)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_does_not_leak_to_a_thread_started_with_an_empty_context():
+    """A thread started while signed off must not see the sign-off on interpreters that do not inherit context."""
+    import sys
+    import threading
+    import pytest
+    if getattr(sys.flags, "thread_inherit_context", False):
+        pytest.skip("this interpreter's threads inherit the caller's context")
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        worker = threading.Thread(target=lambda: seen.append(t3_signed_off()))
+        worker.start()
+        worker.join()
+    finally:
+        reset_t3_signed_off(token)
+    assert seen == [False]
+
+
+def test_main_restores_the_caller_sign_off_value(capsys):
+    """main() wraps one call in a token: whatever --allow-t3 set inside it is undone, and the caller's value is kept."""
+    import sys
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    sys.path.insert(0, str(ROOT / "scripts"))
+    import showcase
+    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
+    capsys.readouterr()
+    assert t3_signed_off() is False
+    token = set_t3_signed_off(True)
+    try:
+        assert showcase.main(["config"]) in (0, 1)
+        capsys.readouterr()
+        assert t3_signed_off() is True
+    finally:
+        reset_t3_signed_off(token)
 
 
 def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand):

From 351f35c749c747ca5e5f67c1f8f7f2d6569aea46 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 07:22:55 -0400
Subject: [PATCH 11/79] Add opt-in --require-t3-signoff to verify T3 sign-off
 records (#23)

With the flag (or SHOWCASE_REQUIRE_T3_SIGNOFF=1), --allow-t3 is honoured only when decisions/t3-signoffs.yaml in the estate bundle holds an approved, unexpired record for the owner (and repository when scoped); otherwise exit 2 with t3-signoff:missing|expired|scope. Writer jobs carry signoff_id/approval_id and doctor shows signoff_id. Default behaviour unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |   1 +
 SKILL.md                         |   2 +-
 scripts/ctshowcase/config.py     |  12 ++-
 scripts/ctshowcase/context.py    |   4 +-
 scripts/ctshowcase/doctor.py     |  12 ++-
 scripts/ctshowcase/org.py        |  15 ++-
 scripts/ctshowcase/project.py    |  10 +-
 scripts/ctshowcase/records.py    |   2 +
 scripts/ctshowcase/resolver.py   |   3 +
 scripts/ctshowcase/signoff.py    | 140 +++++++++++++++++++++++++++
 scripts/ctshowcase/topics.py     |   2 +-
 scripts/showcase.py              |  19 +++-
 tests/test_t3_signoff_require.py | 160 +++++++++++++++++++++++++++++++
 13 files changed, 363 insertions(+), 19 deletions(-)
 create mode 100644 scripts/ctshowcase/signoff.py
 create mode 100644 tests/test_t3_signoff_require.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 46719ce..7c43a7d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the estate bundle's `decisions/t3-signoffs.yaml` holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). Otherwise the command exits 2 with `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set) and `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 
 ### Fixed
diff --git a/SKILL.md b/SKILL.md
index e76ae1c..1b7e53d 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -73,7 +73,7 @@ Run every command **from inside the target repository's checkout**, with the ski
 
 | Step | Command | Gate |
 |---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. With the opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`), `--allow-t3` also needs a valid, unexpired record in the estate bundle's `decisions/t3-signoffs.yaml` (`id`, `owner`, `repos` as names or `*`, `approved`, `expires`), else exit 2 with `t3-signoff:missing|expired|scope`. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
 | 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
 | 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
 | 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index 05ad8b2..bf1e958 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -51,7 +51,12 @@ def set_t3_signed_off(value: bool) -> None:
     _T3_SIGNED_OFF = bool(value)
 
 
-def t3_signed_off() -> bool:
+def t3_signed_off(owner: str | None = None, repo: str | None = None) -> bool:
+    """The run's `--allow-t3`. With an owner and `--require-t3-signoff`, also needs a valid sign-off record
+    (ctshowcase/signoff.py); without the opt-in flag the answer is the bare flag, as before."""
+    if owner is not None and _T3_SIGNED_OFF:
+        from . import signoff
+        return signoff.granted(owner, repo)
     return _T3_SIGNED_OFF
 
 
@@ -104,7 +109,7 @@ def owner_status(self, owner: str) -> str | None:
                     return status
         return None
 
-    def check_owner(self, owner: str, *, allow_t3: bool = False) -> str | None:
+    def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None = None) -> str | None:
         """Raise Refused for excluded/hold/T3 owners; return 'watching' or None."""
         status = self.owner_status(owner)
         if status == "excluded":
@@ -113,6 +118,9 @@ def check_owner(self, owner: str, *, allow_t3: bool = False) -> str | None:
             raise Refused(f"{owner} is on HOLD", log="hold")
         if status == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{owner} is T3; needs co-owner sign-off", log="t3-signoff")
+        if status == "t3" and t3_signed_off():
+            from . import signoff
+            signoff.require(owner, repo, self.aliases(owner))  # no-op unless --require-t3-signoff
         return status
 
     def org(self, owner: str) -> dict:
diff --git a/scripts/ctshowcase/context.py b/scripts/ctshowcase/context.py
index bd7083f..88d2357 100644
--- a/scripts/ctshowcase/context.py
+++ b/scripts/ctshowcase/context.py
@@ -150,7 +150,7 @@ def art_status(self) -> dict:
         no_card = "exempt:no-card" if self.card_exempt() else None  # §5.4 holds whatever the owner code says
         if watching:  # a watching-org repository that is not a fork and not its `.github`: decided explicitly
             return {"banner": watching, "card": no_card or watching, "icon": watching}
-        if status in ("t3", "hold", "excluded") and not (status == "t3" and t3_signed_off()):
+        if status in ("t3", "hold", "excluded") and not (status == "t3" and t3_signed_off(self.owner, self.repo)):
             code = {"t3": "t3-signoff", "hold": "hold", "excluded": "exempt"}[status]
             return {"banner": code, "card": no_card or code, "icon": code}
         if no_card:
@@ -182,7 +182,7 @@ def footer_status(self) -> str | None:
         """None when the decision 18 footer applies, else why not: `exempt:watching-fork`, `hold:watching-non-fork`,
         `t3-signoff`, `hold` (org row `footer: hold`) or `exempt:footer` (org row `footer: false`). The watching org's
         `footer: false` exempts only its forks (org.md), so its `.github` needs the footer."""
-        if self.brand.owner_status(self.owner) == "t3" and not t3_signed_off():
+        if self.brand.owner_status(self.owner) == "t3" and not t3_signed_off(self.owner, self.repo):
             return "t3-signoff"
         watching = self.watching_status()
         if watching or self.brand.owner_status(self.owner) == "watching":
diff --git a/scripts/ctshowcase/doctor.py b/scripts/ctshowcase/doctor.py
index 1d01fc7..10145f9 100644
--- a/scripts/ctshowcase/doctor.py
+++ b/scripts/ctshowcase/doctor.py
@@ -89,7 +89,7 @@ def row(ctx: RepoContext) -> dict:
         logs += rl.get("logs", [])
     else:
         cells["R7"] = "unknown" if not rd else "fail"
-    if ctx.brand.owner_status(ctx.owner) == "t3" and not t3_signed_off():
+    if ctx.brand.owner_status(ctx.owner) == "t3" and not t3_signed_off(ctx.owner, ctx.repo):
         cells["R7"] = "hold"  # T3: no README change before co-owner sign-off (lint readme refuses)
     lic = ctx.meta.get("license")
     cells["R8"] = "pass" if lic or not ctx.public else "warn"
@@ -162,8 +162,14 @@ def row(ctx: RepoContext) -> dict:
         if re.search(r"<!-- showcase:checklist:start -->.*- \[ \].*<!-- showcase:checklist:end -->",
                      (rd / "README.md").read_text(encoding="utf-8"), re.S):
             logs.append("checklist: open")
-    return {"repo": f"{ctx.owner}/{ctx.repo}", "type": ctx.det["type"], "variant": ctx.det["variant"], "cells": cells,
-            "done": "yes" if done else "no", "logs": sorted(set(logs + ctx.logs))}
+    row = {"repo": f"{ctx.owner}/{ctx.repo}", "type": ctx.det["type"], "variant": ctx.det["variant"], "cells": cells,
+           "done": "yes" if done else "no", "logs": sorted(set(logs + ctx.logs))}
+    from . import signoff
+    rec = signoff.record_for(ctx.owner, ctx.repo)
+    if rec is not None:  # only under --require-t3-signoff with a valid record: show which sign-off lifted the hold
+        row["signoff_id"] = str(rec.get("id") or "")
+        row["signoff_expires"] = str(rec.get("expires") or "")
+    return row
 
 
 def as_tsv(r: dict, header: bool = False) -> str:
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 804fa37..5f1396f 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -282,7 +282,7 @@ def _gate(estate: Estate, org: str, *, allow_t3=False, allow_hold=False,
     r.check_owner(org, allow_t3=allow_t3, allow_hold=allow_hold)
     login = r.canonical(org)
     row = r.brand_org(org)
-    if row.get("tier") == "T3" and not allow_t3:
+    if row.get("tier") == "T3" and not (allow_t3 and _t3_granted(login)):
         from .errors import Refused
         raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
     if r.family_hold(org) and not allow_hold:
@@ -292,6 +292,12 @@ def _gate(estate: Estate, org: str, *, allow_t3=False, allow_hold=False,
     return login, row, reg
 
 
+def _t3_granted(owner: str, repo: str | None = None) -> bool:
+    """True unless `--require-t3-signoff` is on and no valid sign-off record covers the owner (signoff.py)."""
+    from . import signoff
+    return signoff.granted(owner, repo)
+
+
 def _tier(row: dict) -> str:
     return str(row.get("tier") or "unknown").split()[0]
 
@@ -311,7 +317,7 @@ def _star_entry(estate: Estate, org: str, reg: dict) -> dict | None:
 def _star_held(estate: Estate, org: str, allow_t3: bool = False) -> str | None:
     from .config import t3_signed_off
     st = estate.resolver.owner_status(org)
-    if st == "t3" and (allow_t3 or t3_signed_off()):
+    if st == "t3" and (allow_t3 or t3_signed_off()) and _t3_granted(org):
         st = None  # co-owner sign-off lifts the T3 hold (decision 12); HOLD and excluded stay held
     if st in ("t3", "hold", "excluded"):
         return st
@@ -361,7 +367,8 @@ def public_favorites(estate: Estate, reg: dict, *, allow_t3: bool = False) -> tu
 
 def _t3_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     """A repository of a T3 org (any of its logins) before co-owner sign-off: never named on a public profile."""
-    return not allow_t3 and "/" in (full or "") and estate.resolver.owner_status(full.split("/")[0]) == "t3"
+    return "/" in (full or "") and estate.resolver.owner_status(full.split("/")[0]) == "t3" \
+        and not (allow_t3 and _t3_granted(full.split("/")[0], full.split("/")[1]))
 
 
 def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
@@ -1022,7 +1029,7 @@ def entry(full: str) -> dict | None:
             st = r.owner_status(o)
             if r.is_placeholder(o) or st == "excluded":
                 continue  # q71: placeholder orgs are left out
-            if st == "t3" and not allow_t3:
+            if st == "t3" and not (allow_t3 and _t3_granted(o)):
                 logs.append(f"t3-signoff:{o}")
                 continue
             try:
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index fd7ad24..eb878a9 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -174,6 +174,12 @@ def _slug(owner: str) -> str:
     return "me" if is_user(owner) else owner
 
 
+def _t3_granted(owner: str) -> bool:
+    """True unless `--require-t3-signoff` is on and no valid sign-off record covers the owner (signoff.py)."""
+    from . import signoff
+    return signoff.granted(owner)
+
+
 def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = False) -> str:
     """Targets of a write: never T3 without sign-off, never excluded or HOLD. Returns the resolved login."""
     if is_user(owner):
@@ -185,7 +191,7 @@ def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = Fals
         raise Refused(f"{owner} is out of scope; no project writes", log="exempt")
     if st == "hold" or resolver.family_hold(owner):
         raise Refused(f"{owner} is on HOLD", log="hold")
-    if st == "t3" and not allow_t3:
+    if st == "t3" and not (allow_t3 and _t3_granted(owner)):
         raise Refused(f"{owner} is T3: reading its project is fine, changing anything needs co-owner sign-off",
                       log="t3-signoff")
     return resolver.canonical(owner)
@@ -1092,7 +1098,7 @@ def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
         except NeedsInput:
             continue
         tier = str(row.get("tier") or "").split()[0]
-        if tier == "T3" and not allow_t3:
+        if tier == "T3" and not (allow_t3 and _t3_granted(key)):
             continue
         if tier in TIER_COLOR:
             out.append({"login": resolver.canonical(key), "name": row.get("display_name") or key, "tier": tier})
diff --git a/scripts/ctshowcase/records.py b/scripts/ctshowcase/records.py
index 1e5e758..c4e8f54 100644
--- a/scripts/ctshowcase/records.py
+++ b/scripts/ctshowcase/records.py
@@ -20,6 +20,8 @@ def append(path: str | Path | None, recs: list[dict]) -> None:
     """Append JSON lines (change records or scripts/writer.py jobs) to PATH, creating its directory."""
     if not path or not recs:
         return
+    from .signoff import stamp
+    stamp(recs)  # only under --require-t3-signoff: writer jobs of a signed-off T3 owner carry signoff_id
     p = Path(path)
     p.parent.mkdir(parents=True, exist_ok=True)
     with p.open("a", encoding="utf-8") as fh:
diff --git a/scripts/ctshowcase/resolver.py b/scripts/ctshowcase/resolver.py
index 44a540d..d34c0b1 100644
--- a/scripts/ctshowcase/resolver.py
+++ b/scripts/ctshowcase/resolver.py
@@ -295,6 +295,9 @@ def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool =
             raise Refused(f"{login} is on HOLD", log="hold")
         if st == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
+        if st == "t3" and t3_signed_off():
+            from . import signoff
+            signoff.require(login, None, self.aliases(login))  # no-op unless --require-t3-signoff
         return st
 
     def family_hold(self, login: str) -> bool:
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
new file mode 100644
index 0000000..d3d5c35
--- /dev/null
+++ b/scripts/ctshowcase/signoff.py
@@ -0,0 +1,140 @@
+"""Opt-in T3 sign-off verification (`--require-t3-signoff`, env SHOWCASE_REQUIRE_T3_SIGNOFF=1; issue 23).
+
+Off by default: nothing here runs and `--allow-t3` keeps its original meaning (tests/test_allow_t3_global.py).
+When on, `--allow-t3` is honoured only while the estate bundle holds a valid, unexpired sign-off record for the
+owner (and the repository when the record is scoped). The bundle is read, never copied: `decisions/t3-signoffs.yaml`
+under `estate_root()` (env SHOWCASE_ESTATE_ROOT)::
+
+    signoffs:
+      - id: t3s-001            # carried onto writer jobs as `signoff_id` (and `approval_id` when none else is set)
+        owner: Example-Co-Owned   # any login of the org (renames resolve through the aliases the gate passes in)
+        repos: ["*"]           # "*" or repository names / OWNER/NAME; absent or empty matches nothing (fail closed)
+        approved: true
+        expires: 2099-12-31    # required: a record with no parsable date never validates
+
+Refusals are exit 2 with log `t3-signoff:missing` (no approved record for the owner), `t3-signoff:expired` (every
+matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none covers the repository; an
+owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are refused before this runs.
+"""
+from __future__ import annotations
+
+import datetime as _dt
+import os
+from pathlib import Path
+
+from .errors import Refused
+
+SIGNOFF_FILE = "t3-signoffs.yaml"
+_REQUIRE = False
+_GRANTED: dict[str, dict] = {}  # lowercase login -> the record that granted it, for stamping this run's writer jobs
+
+
+def env_required() -> bool:
+    return os.environ.get("SHOWCASE_REQUIRE_T3_SIGNOFF", "").strip().lower() in ("1", "true", "yes", "on")
+
+
+def set_required(value: bool) -> None:
+    global _REQUIRE
+    _REQUIRE = bool(value)
+
+
+def required() -> bool:
+    return _REQUIRE
+
+
+def reset() -> None:
+    _GRANTED.clear()
+
+
+def load_records(root: Path | None = None) -> list[dict]:
+    from .config import load_yaml_text
+    from .resolver import estate_root
+    root = root or estate_root()
+    path = root / "decisions" / SIGNOFF_FILE if root else None
+    if not path or not path.is_file():
+        return []
+    data = load_yaml_text(path.read_text(encoding="utf-8"))
+    items = data.get("signoffs") if isinstance(data, dict) else data
+    return [r for r in items or [] if isinstance(r, dict)]
+
+
+def _expiry(rec: dict) -> _dt.date | None:
+    v = rec.get("expires")
+    if isinstance(v, _dt.datetime):
+        return v.date()
+    if isinstance(v, _dt.date):
+        return v
+    try:
+        return _dt.date.fromisoformat(str(v)[:10])
+    except ValueError:
+        return None
+
+
+def _covers(rec: dict, repo: str | None) -> bool:
+    repos = rec.get("repos")
+    repos = [repos] if isinstance(repos, str) else [str(x) for x in repos or []]
+    if "*" in repos:
+        return True
+    name = (repo or "").split("/")[-1].lower()
+    return bool(name) and any(r.split("/")[-1].lower() == name for r in repos)
+
+
+def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
+             records: list[dict] | None = None) -> tuple[dict | None, str | None]:
+    """(record, None) when signed off, else (None, 'missing' | 'expired' | 'scope')."""
+    today = today or _dt.date.today()
+    logins = {o.lower() for o in owners if o}
+    recs = load_records() if records is None else records
+    mine = [r for r in recs if r.get("approved") is True and str(r.get("owner") or "").lower() in logins]
+    if not mine:
+        return None, "missing"
+    scoped = [r for r in mine if _covers(r, repo)]
+    if not scoped:
+        return None, "scope"
+    live = [r for r in scoped if (_expiry(r) or _dt.date.min) >= today]
+    if not live:
+        return None, "expired"
+    return live[0], None
+
+
+def granted(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> bool:
+    """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
+    if not _REQUIRE:
+        return True
+    rec, _ = evaluate([owner, *(aliases or [])], repo)
+    return rec is not None
+
+
+def require(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
+    """Gate for a requested `--allow-t3`: the record, or Refused (exit 2) logged t3-signoff:<why>. No-op when off."""
+    if not _REQUIRE:
+        return None
+    logins = [owner, *(aliases or [])]
+    rec, why = evaluate(logins, repo)
+    if rec is None:
+        raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
+                      f"no valid sign-off record ({why})", log=f"t3-signoff:{why}")
+    for login in logins:
+        _GRANTED[login.lower()] = rec
+    return rec
+
+
+def record_for(owner: str, repo: str | None = None) -> dict | None:
+    rec = _GRANTED.get((owner or "").lower())
+    return rec if rec is not None and _covers(rec, repo) else None
+
+
+def stamp(jobs):
+    """Under the flag, writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set)."""
+    if not _REQUIRE or not _GRANTED:
+        return jobs
+    for j in jobs or []:
+        if not isinstance(j, dict) or "phase" not in j:
+            continue
+        full = str(j.get("repo") or "")
+        owner = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
+        rec = record_for(str(owner), full or None)
+        if rec is not None and rec.get("id"):
+            j["signoff_id"] = str(rec["id"])
+            j.setdefault("approval_id", str(rec["id"]))
+    return jobs
diff --git a/scripts/ctshowcase/topics.py b/scripts/ctshowcase/topics.py
index c561331..41ede7f 100644
--- a/scripts/ctshowcase/topics.py
+++ b/scripts/ctshowcase/topics.py
@@ -65,7 +65,7 @@ def membership_topics(ctx: RepoContext, also_in: list[str]) -> tuple[list[str],
         if status in ("excluded", "hold"):
             logs.append(f"exempt:also-in:{org}")
             continue
-        if status == "t3" and not t3_signed_off():
+        if status == "t3" and not t3_signed_off(org):
             logs.append(f"t3-signoff:also-in:{org}")
             continue
         known, topic = org_topic(ctx.brand, org)
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 244bfd0..937087d 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -137,7 +137,7 @@ def base(cmd, ctx=None, **kw) -> dict:
 
 def gate_owner(ctx, allow_hold=False) -> str | None:
     """Refuse excluded/hold/T3 (exit 2); return 'watching' for the watching org."""
-    status = ctx.brand.check_owner(ctx.owner)
+    status = ctx.brand.check_owner(ctx.owner, repo=ctx.repo)
     if ctx.style.get("hold") and not allow_hold:
         raise ShowcaseError(f"{ctx.owner} family is on hold; pass --allow-hold", log="hold")
     return status
@@ -842,7 +842,7 @@ def cmd_doctor(args):
                                    template_dir=args.template_dir, checkouts=args.checkouts, out=args.out)
         return res, OK
     ctx = context(args)
-    ctx.brand.check_owner(ctx.owner, allow_t3=True)
+    ctx.brand.check_owner(ctx.owner, allow_t3=True, repo=ctx.repo)
     r = doctor.row(ctx)
     fmt = args.doctor_format
     if fmt == "tsv":
@@ -950,6 +950,10 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--quiet", action="store_true")
     p.add_argument("--allow-t3", action="store_true",
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2)")
+    p.add_argument("--require-t3-signoff", action="store_true",
+                   help="opt-in (env SHOWCASE_REQUIRE_T3_SIGNOFF=1): honour --allow-t3 only when a valid, unexpired sign-off record "
+                        "in the estate bundle (decisions/t3-signoffs.yaml) covers the owner and repository; otherwise exit 2 "
+                        "(t3-signoff:missing|expired|scope). Default off: --allow-t3 behaves as before")
     p.add_argument("--version", action="version", version=f"%(prog)s {__version__} ({STANDARD})")
     sub = p.add_subparsers(dest="command", required=True, metavar="<command>")
 
@@ -1193,11 +1197,14 @@ def parser() -> argparse.ArgumentParser:
 def main(argv=None) -> int:
     """Run one invocation. `--allow-t3` holds only for this call: the previous value is restored on every exit."""
     from ctshowcase.config import set_t3_signed_off, t3_signed_off
-    previous = t3_signed_off()
+    from ctshowcase import signoff
+    previous, previous_required = t3_signed_off(), signoff.required()
     try:
         return _main(argv)
     finally:
         set_t3_signed_off(previous)
+        signoff.set_required(previous_required)
+        signoff.reset()
 
 
 def _main(argv=None) -> int:
@@ -1222,12 +1229,14 @@ def _main(argv=None) -> int:
         cli.error("unrecognized arguments: " + " ".join(remaining))
     from ctshowcase.config import set_t3_signed_off
     set_t3_signed_off(getattr(args, "allow_t3", False))
+    from ctshowcase import signoff
+    signoff.set_required(getattr(args, "require_t3_signoff", False) or signoff.env_required())
     if args.format is None:
         args.format = "text" if args.command in GENERATORS else "json"
     try:
         obj, code = args.func(args)
     except ShowcaseError as exc:
-        obj = {"command": args.command, "result": "refused" if exc.code == USAGE and exc.log in ("hold", "t3-signoff", "exempt")
+        obj = {"command": args.command, "result": "refused" if exc.code == USAGE and (exc.log in ("hold", "t3-signoff", "exempt") or exc.log.startswith("t3-signoff:"))
                else exc.log.split(":")[0], "error": str(exc), "logs": [exc.log]}
         code = exc.code
         if args.format == "text" and not args.quiet:
@@ -1241,6 +1250,8 @@ def _main(argv=None) -> int:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
     if obj is not None:
+        if signoff.required() and isinstance(obj.get("jobs"), list):
+            signoff.stamp(obj["jobs"])
         emit(args, obj)
     return code
 
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
new file mode 100644
index 0000000..a5e8b97
--- /dev/null
+++ b/tests/test_t3_signoff_require.py
@@ -0,0 +1,160 @@
+"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the estate bundle.
+
+Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
+tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+OWNER = "Pick-Your-AI"
+
+
+def _bundle(tmp_path, records):
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    lines = ["signoffs:"]
+    for r in records:
+        lines.append(f"  - id: {r['id']}")
+        lines.append(f"    owner: {r.get('owner', OWNER)}")
+        lines.append(f"    repos: {json.dumps(r.get('repos', ['*']))}")
+        lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
+        lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
+    (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return tmp_path / "bundle"
+
+
+def _run(tmp_path, bundle, *argv, owner=OWNER, env=None):
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
+    e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
+    e.update(env or {})
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=e,
+                          capture_output=True, text=True, encoding="utf-8")
+
+
+def _out(r):
+    return r.stdout + r.stderr
+
+
+def test_missing_record_refuses(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_unapproved_record_counts_as_missing(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-9", "approved": False}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_expired_record_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-1", "expires": "2020-01-01"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
+
+
+def test_record_scoped_to_other_repo_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-2", "repos": ["some-other-repo"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_valid_wildcard_and_repo_scoped_records_are_honoured(tmp_path):
+    for repos in (["*"], ["northwind-synthetic"], [f"{OWNER}/northwind-synthetic"]):
+        b = _bundle(tmp_path / "_".join(repos).replace("/", "_").replace("*", "star"), [{"id": "t3s-3", "repos": repos}])
+        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+        assert r.returncode != 2 and "t3-signoff" not in _out(r), (repos, _out(r))
+
+
+def test_env_var_is_equivalent_to_the_flag(tmp_path):
+    b = _bundle(tmp_path, [])
+    r = _run(tmp_path, b, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "1"})
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
+    assert r.returncode == 2 and "t3-signoff" in _out(r)
+
+
+def test_default_is_unchanged_without_the_new_flag(tmp_path):
+    """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
+    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+
+
+def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-5", "owner": "BunsDev"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe", owner="BunsDev")
+    assert r.returncode == 2, _out(r)
+    assert "t3-signoff" not in _out(r) or "exempt" in _out(r)
+
+
+def test_doctor_shows_the_signoff_id(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-7", "expires": "2099-01-02"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
+    row = json.loads(r.stdout)
+    assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
+    plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", "json")
+    assert "signoff_id" not in json.loads(plain.stdout)  # off by default: the row is unchanged
+
+
+def test_writer_jobs_carry_the_signoff_id(tmp_path):
+    from ctshowcase import signoff
+    from ctshowcase.records import append
+    rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+    signoff.set_required(True)
+    try:
+        signoff._GRANTED[OWNER.lower()] = rec
+        out = tmp_path / "jobs.jsonl"
+        append(out, [{"id": "a", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/x", "argv": []},
+                     {"id": "b", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/y", "argv": [],
+                      "approval_id": "ent-009"},
+                     {"id": "c", "phase": "p", "kind": "repo-settings", "repo": "Other-Org/z", "argv": []}])
+        a, b, c = (json.loads(x) for x in out.read_text(encoding="utf-8").splitlines())
+        assert a["signoff_id"] == "t3s-8" and a["approval_id"] == "t3s-8"
+        assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # an existing approval is kept
+        assert "signoff_id" not in c
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_jobs_are_untouched_without_the_flag(tmp_path):
+    from ctshowcase import signoff
+    from ctshowcase.records import append
+    signoff._GRANTED[OWNER.lower()] = {"id": "t3s-8", "repos": ["*"]}
+    try:
+        out = tmp_path / "jobs.jsonl"
+        append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
+        assert "signoff_id" not in json.loads(out.read_text(encoding="utf-8"))
+    finally:
+        signoff.reset()
+
+
+def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
+    from ctshowcase import signoff
+    import showcase
+    showcase.main(["--require-t3-signoff", "config"])
+    capsys.readouterr()
+    assert signoff.required() is False and not signoff._GRANTED
+
+
+@pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
+def test_evaluate_scope_rules(repo, expect):
+    from ctshowcase import signoff
+    recs = [{"id": "s", "owner": OWNER, "repos": ["a", "x/b"], "approved": True, "expires": "2099-01-01"}]
+    rec, why = signoff.evaluate([OWNER], repo, records=recs)
+    assert why == expect and (rec is None) == (expect is not None)

From 5f6a5fdc5fc661d3915cb0452bea0c29f130b0cc Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 07:38:49 -0400
Subject: [PATCH 12/79] Thread repository scope through every T3 sign-off gate,
 require record ids, honour aliases, show sign-off in doctor (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/config.py     |  2 +-
 scripts/ctshowcase/content.py    |  8 ++--
 scripts/ctshowcase/doctor.py     | 23 +++++++---
 scripts/ctshowcase/intake.py     |  2 +-
 scripts/ctshowcase/project.py    |  5 ++-
 scripts/ctshowcase/resolver.py   | 10 +++--
 scripts/ctshowcase/signoff.py    | 38 +++++++++++++---
 scripts/showcase.py              |  4 +-
 tests/test_t3_signoff_require.py | 75 +++++++++++++++++++++++++++++++-
 9 files changed, 142 insertions(+), 25 deletions(-)

diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index bf1e958..b92a655 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -118,7 +118,7 @@ def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None =
             raise Refused(f"{owner} is on HOLD", log="hold")
         if status == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{owner} is T3; needs co-owner sign-off", log="t3-signoff")
-        if status == "t3" and t3_signed_off():
+        if status == "t3":
             from . import signoff
             signoff.require(owner, repo, self.aliases(owner))  # no-op unless --require-t3-signoff
         return status
diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index 1245921..1ba35f8 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -2421,7 +2421,7 @@ def cmd_content(args, cli=None):
         return _finish(args, obj, _code(obj["result"]))
     if act == "linguist":
         ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
         tree = Tree(ctx.repo_dir) if ctx.repo_dir else None
         override = dict(ctx.override)
         if args.language:
@@ -2430,7 +2430,7 @@ def cmd_content(args, cli=None):
         return _finish(args, {**head, "owner": ctx.owner, "repo": ctx.repo, **res, "logs": ctx.logs + res["logs"]}, OK)
     if act == "actions":
         ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
         wf_files, root_files, readme = {}, (), ""
         if ctx.repo_dir:
             tree = Tree(ctx.repo_dir)
@@ -2484,7 +2484,7 @@ def _cmd_sidebar(args, cli, resolver, head):
     keyed = isinstance(facts, dict) and facts and all(isinstance(k, str) and "/" in k for k in facts)
     if not keyed:
         ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
         res = sidebar_plan(ctx.meta, facts, resolver=resolver, packages=pk,
                            current=current.get(f"{ctx.owner}/{ctx.repo}") or current or None)
         obj = dict(head, owner=ctx.owner, repo=ctx.repo, **{k: v for k, v in res.items() if k != "logs"},
@@ -2518,7 +2518,7 @@ def _cmd_sidebar(args, cli, resolver, head):
 def _cmd_icon(args, cli, resolver, head):
     from PIL import Image
     ctx = _ctx(args, cli, resolver)
-    resolver.check_owner(ctx.owner)
+    resolver.check_owner(ctx.owner, repo=ctx.repo)
     # decision 12: the same applicability as banner, card, lint all and doctor (RepoContext.art_status); only
     # watching-org forks and a placeholder org's `.github` are exempt. Forks outside the watching org, backups and
     # `.github` repositories need their own icon. The resolver also sees the renames and placeholders passed here.
diff --git a/scripts/ctshowcase/doctor.py b/scripts/ctshowcase/doctor.py
index 10145f9..b5a4b47 100644
--- a/scripts/ctshowcase/doctor.py
+++ b/scripts/ctshowcase/doctor.py
@@ -165,21 +165,34 @@ def row(ctx: RepoContext) -> dict:
     row = {"repo": f"{ctx.owner}/{ctx.repo}", "type": ctx.det["type"], "variant": ctx.det["variant"], "cells": cells,
            "done": "yes" if done else "no", "logs": sorted(set(logs + ctx.logs))}
     from . import signoff
-    rec = signoff.record_for(ctx.owner, ctx.repo)
+    rec = None
+    if signoff.required() and ctx.brand.owner_status(ctx.owner) == "t3" and t3_signed_off(ctx.owner, ctx.repo):
+        # evaluated directly (not via the gate's cache) so `doctor --estate` rows, which never run check_owner, show it too
+        rec, _ = signoff.evaluate(ctx.brand.aliases(ctx.owner), ctx.repo)
     if rec is not None:  # only under --require-t3-signoff with a valid record: show which sign-off lifted the hold
         row["signoff_id"] = str(rec.get("id") or "")
         row["signoff_expires"] = str(rec.get("expires") or "")
     return row
 
 
+def _signoff_cols() -> list[str]:
+    from . import signoff
+    return ["signoff_id"] if signoff.required() else []  # extra column only under --require-t3-signoff
+
+
+def _signoff_vals(r: dict) -> list[str]:
+    return [r.get("signoff_id", "")] if _signoff_cols() else []
+
+
 def as_tsv(r: dict, header: bool = False) -> str:
-    cols = ["owner/repo", "type", "variant", *COLUMNS, "done"]
-    line = "\t".join([r["repo"], r["type"], r["variant"], *[r["cells"][c] for c in COLUMNS], r["done"]])
+    cols = ["owner/repo", "type", "variant", *COLUMNS, "done", *_signoff_cols()]
+    line = "\t".join([r["repo"], r["type"], r["variant"], *[r["cells"][c] for c in COLUMNS], r["done"],
+                      *_signoff_vals(r)])
     return ("\t".join(cols) + "\n" if header else "") + line
 
 
 def as_md(r: dict, header: bool = False) -> str:
-    cols = ["owner/repo", "type", "variant", *COLUMNS, "done"]
-    vals = [r["repo"], r["type"], r["variant"], *[r["cells"][c] for c in COLUMNS], r["done"]]
+    cols = ["owner/repo", "type", "variant", *COLUMNS, "done", *_signoff_cols()]
+    vals = [r["repo"], r["type"], r["variant"], *[r["cells"][c] for c in COLUMNS], r["done"], *_signoff_vals(r)]
     head = ("| " + " | ".join(cols) + " |\n|" + "---|" * len(cols) + "\n") if header else ""
     return head + "| " + " | ".join(vals) + " |"
diff --git a/scripts/ctshowcase/intake.py b/scripts/ctshowcase/intake.py
index 04ce05b..28c74f7 100644
--- a/scripts/ctshowcase/intake.py
+++ b/scripts/ctshowcase/intake.py
@@ -50,7 +50,7 @@ def adopt(ctx, resolver=None, *, approval_id: str | None = None, fresh: bool = F
     from .content import sidebar_plan, social_job
     from .org import label_ops_argv
     owner, repo = ctx.owner, ctx.repo
-    status = ctx.brand.check_owner(owner)  # excluded, HOLD and T3 owners refuse (exit 2)
+    status = ctx.brand.check_owner(owner, repo=repo)  # excluded, HOLD and T3 owners refuse (exit 2)
     if ctx.style.get("hold") or (resolver.family_hold(owner) if resolver else False):  # as showcase.cmd_adopt refuses
         raise Refused(f"{owner} family is on hold: adopt plans nothing for it", log="hold")
     full = f"{resolver.canonical(owner) if resolver else owner}/{repo}"
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index eb878a9..5990640 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -191,9 +191,12 @@ def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = Fals
         raise Refused(f"{owner} is out of scope; no project writes", log="exempt")
     if st == "hold" or resolver.family_hold(owner):
         raise Refused(f"{owner} is on HOLD", log="hold")
-    if st == "t3" and not (allow_t3 and _t3_granted(owner)):
+    if st == "t3" and not allow_t3:
         raise Refused(f"{owner} is T3: reading its project is fine, changing anything needs co-owner sign-off",
                       log="t3-signoff")
+    if st == "t3":  # registers the grant so writer jobs carry signoff_id; refuses t3-signoff:<why>; no-op unless the flag is on
+        from . import signoff
+        signoff.require(owner, None, resolver.aliases(owner))
     return resolver.canonical(owner)
 
 
diff --git a/scripts/ctshowcase/resolver.py b/scripts/ctshowcase/resolver.py
index d34c0b1..fb79165 100644
--- a/scripts/ctshowcase/resolver.py
+++ b/scripts/ctshowcase/resolver.py
@@ -221,6 +221,9 @@ def aliases(self, login: str) -> list[str]:
             if x.lower() not in seen:
                 seen.add(x.lower())
                 uniq.append(x)
+        from . import signoff
+        if signoff.required():  # --require-t3-signoff: a record under any login of the org matches wherever it is re-checked
+            signoff.register_aliases(uniq)
         return uniq
 
     def same(self, a: str, b: str) -> bool:
@@ -284,7 +287,8 @@ def owner_status(self, login: str) -> str | None:
                 return st
         return None
 
-    def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool = False) -> str | None:
+    def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool = False,
+                    repo: str | None = None) -> str | None:
         """Refuse excluded, hold and (unless signed off) T3 orgs under any of their logins; return the status."""
         from .config import t3_signed_off
         from .errors import Refused
@@ -295,9 +299,9 @@ def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool =
             raise Refused(f"{login} is on HOLD", log="hold")
         if st == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
-        if st == "t3" and t3_signed_off():
+        if st == "t3":
             from . import signoff
-            signoff.require(login, None, self.aliases(login))  # no-op unless --require-t3-signoff
+            signoff.require(login, repo, self.aliases(login))  # no-op unless --require-t3-signoff
         return st
 
     def family_hold(self, login: str) -> bool:
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index d3d5c35..cd1dc9b 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -26,7 +26,8 @@
 
 SIGNOFF_FILE = "t3-signoffs.yaml"
 _REQUIRE = False
-_GRANTED: dict[str, dict] = {}  # lowercase login -> the record that granted it, for stamping this run's writer jobs
+_GRANTED: dict[str, list[dict]] = {}  # lowercase login -> the records that granted it, for stamping this run's writer jobs
+_ALIASES: dict[str, set[str]] = {}  # lowercase login -> every login of its org, filled by Resolver.aliases under the flag
 
 
 def env_required() -> bool:
@@ -44,6 +45,24 @@ def required() -> bool:
 
 def reset() -> None:
     _GRANTED.clear()
+    _ALIASES.clear()
+
+
+def register_aliases(logins: list[str]) -> None:
+    """Remember that these logins name one org, so a record under a former login still matches wherever the owner is
+    re-checked (doctor rows, org and project helpers) without each caller passing the aliases again."""
+    group = {x.lower() for x in logins if x}
+    for x in list(group):
+        group |= _ALIASES.get(x, set())
+    for x in group:
+        _ALIASES[x] = group
+
+
+def _expand(owners: list[str]) -> list[str]:
+    out = {o.lower() for o in owners if o}
+    for o in list(out):
+        out |= _ALIASES.get(o, set())
+    return sorted(out)
 
 
 def load_records(root: Path | None = None) -> list[dict]:
@@ -85,7 +104,10 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     today = today or _dt.date.today()
     logins = {o.lower() for o in owners if o}
     recs = load_records() if records is None else records
-    mine = [r for r in recs if r.get("approved") is True and str(r.get("owner") or "").lower() in logins]
+    logins = set(_expand(list(logins)))
+    # a record with no id cannot be carried onto writer jobs, so it never authorizes anything
+    mine = [r for r in recs if r.get("approved") is True and str(r.get("id") or "").strip()
+            and str(r.get("owner") or "").lower() in logins]
     if not mine:
         return None, "missing"
     scoped = [r for r in mine if _covers(r, repo)]
@@ -101,7 +123,7 @@ def granted(owner: str, repo: str | None = None, aliases: list[str] | None = Non
     """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
     if not _REQUIRE:
         return True
-    rec, _ = evaluate([owner, *(aliases or [])], repo)
+    rec, _ = evaluate([owner, *(aliases or [])], repo)  # evaluate also expands the aliases Resolver.aliases registered
     return rec is not None
 
 
@@ -114,14 +136,16 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
     if rec is None:
         raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
                       f"no valid sign-off record ({why})", log=f"t3-signoff:{why}")
-    for login in logins:
-        _GRANTED[login.lower()] = rec
+    for login in _expand(logins):
+        _GRANTED.setdefault(login, []).append(rec)
     return rec
 
 
 def record_for(owner: str, repo: str | None = None) -> dict | None:
-    rec = _GRANTED.get((owner or "").lower())
-    return rec if rec is not None and _covers(rec, repo) else None
+    for rec in _GRANTED.get((owner or "").lower(), []):
+        if _covers(rec, repo):
+            return rec
+    return None
 
 
 def stamp(jobs):
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 937087d..303f617 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -507,7 +507,7 @@ def cmd_labels(args):
         sys.stdout.write(labels.emit_yml())
         return None, OK
     ctx = context(args)
-    ctx.brand.check_owner(ctx.owner)
+    ctx.brand.check_owner(ctx.owner, repo=ctx.repo)
     # the gates `org labels` applies (labels.md Scope): a family on hold is refused like banner and card
     if (ctx.style.get("hold") or ctx.brand.resolver().family_hold(ctx.owner)) and not args.allow_hold:
         raise ShowcaseError(f"{ctx.owner} family is on hold: labels are not applied; pass --allow-hold", log="hold")
@@ -595,7 +595,7 @@ def cmd_meta(args):
         status = brand(args, prefer_lock=True).owner_status(owner)
         if status in ("excluded", "hold", "t3"):
             # raises Refused (exit 2); --allow-t3 only after an approved t3-metadata or t3-signoff row
-            brand(args, prefer_lock=True).check_owner(owner, allow_t3=args.allow_t3)
+            brand(args, prefer_lock=True).check_owner(owner, allow_t3=args.allow_t3, repo=args.from_gh.split("/")[1] if "/" in args.from_gh else None)
         m = M.from_gh(args.from_gh)
     else:
         rd = repo_dir(args)
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index a5e8b97..5284b20 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -117,7 +117,7 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
     rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
     signoff.set_required(True)
     try:
-        signoff._GRANTED[OWNER.lower()] = rec
+        signoff._GRANTED[OWNER.lower()] = [rec]
         out = tmp_path / "jobs.jsonl"
         append(out, [{"id": "a", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/x", "argv": []},
                      {"id": "b", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/y", "argv": [],
@@ -158,3 +158,76 @@ def test_evaluate_scope_rules(repo, expect):
     recs = [{"id": "s", "owner": OWNER, "repos": ["a", "x/b"], "approved": True, "expires": "2099-01-01"}]
     rec, why = signoff.evaluate([OWNER], repo, records=recs)
     assert why == expect and (rec is None) == (expect is not None)
+
+
+# --- review round: repository scope threading, ids, aliases, project gate, doctor renderers ---------------------
+
+@pytest.mark.parametrize("argv", [("labels", "--plan"), ("content", "linguist"), ("content", "actions")])
+def test_repo_scoped_record_is_honoured_by_repository_commands(tmp_path, argv):
+    """Regression: only gate_owner/doctor passed the repo, so a repo-scoped record hit t3-signoff:scope elsewhere."""
+    b = _bundle(tmp_path, [{"id": "t3s-9", "repos": ["northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", *argv)
+    assert "t3-signoff" not in _out(r), _out(r)
+    other = _bundle(tmp_path / "o", [{"id": "t3s-9", "repos": ["some-other-repo"]}])
+    r = _run(tmp_path, other, "--require-t3-signoff", "--allow-t3", *argv)
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_record_without_an_id_never_authorizes(tmp_path):
+    from ctshowcase import signoff
+    rec = {"owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+    assert signoff.evaluate([OWNER], None, records=[rec]) == (None, "missing")
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="  ")]) == (None, "missing")
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="t3s-1")])[1] is None
+
+
+def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
+    """A record under a former login must satisfy the secondary helpers (config/org/project/doctor), not just the gate."""
+    from ctshowcase import signoff
+    from ctshowcase.config import set_t3_signed_off, t3_signed_off
+    from ctshowcase.org import _t3_granted as org_granted
+    from ctshowcase.project import _t3_granted as project_granted
+    b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
+    signoff.set_required(True)
+    set_t3_signed_off(True)
+    try:
+        assert not t3_signed_off("New-Login")  # nothing links the logins yet
+        signoff.register_aliases(["New-Login", "Old-Login"])  # what Resolver.aliases does under the flag
+        assert t3_signed_off("New-Login") and org_granted("New-Login") and project_granted("New-Login")
+    finally:
+        set_t3_signed_off(False)
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    from ctshowcase.errors import Refused
+    from ctshowcase.project import _gate_target
+    from ctshowcase.resolver import Resolver
+    from ctshowcase.config import Brand
+    brand = Brand({"owners": {"t3": [OWNER]}}, ROOT / "references" / "brand.yaml")
+    resolver = Resolver(brand, {}, None)
+    signoff.set_required(True)
+    try:
+        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "ok", [{"id": "t3s-11"}])))
+        assert _gate_target(resolver, OWNER, allow_t3=True) == OWNER
+        assert signoff.record_for(OWNER, None)["id"] == "t3s-11"  # so stamp() can put it on the writer job
+        signoff.reset()
+        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "old", [{"id": "t3s-12", "expires": "2000-01-01"}])))
+        with pytest.raises(Refused) as exc:
+            _gate_target(resolver, OWNER, allow_t3=True)
+        assert exc.value.log == "t3-signoff:expired"
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-13"}])
+    for fmt in ("tsv", "md"):
+        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
+        assert "t3s-13" in r.stdout, _out(r)
+        plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
+        assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged

From c480a83bf62c3985c48ea566d339555f50ea4833 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 07:50:49 -0400
Subject: [PATCH 13/79] Fix T3 sign-off review findings: doctor stays
 read-only, owner-qualified scopes, strict expiry, malformed scopes, repo
 threading, report stamping (#23)

Fresh VM verification: not run.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/config.py     |  5 +--
 scripts/ctshowcase/content.py    | 10 +++---
 scripts/ctshowcase/intake.py     |  2 +-
 scripts/ctshowcase/resolver.py   |  4 +--
 scripts/ctshowcase/signoff.py    | 32 +++++++++++++----
 scripts/showcase.py              |  4 +--
 tests/test_t3_signoff_require.py | 60 +++++++++++++++++++++++++++++++-
 7 files changed, 99 insertions(+), 18 deletions(-)

diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index b92a655..c74d4ac 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -109,7 +109,8 @@ def owner_status(self, owner: str) -> str | None:
                     return status
         return None
 
-    def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None = None) -> str | None:
+    def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None = None,
+                    verify_signoff: bool = True) -> str | None:
         """Raise Refused for excluded/hold/T3 owners; return 'watching' or None."""
         status = self.owner_status(owner)
         if status == "excluded":
@@ -118,7 +119,7 @@ def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None =
             raise Refused(f"{owner} is on HOLD", log="hold")
         if status == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{owner} is T3; needs co-owner sign-off", log="t3-signoff")
-        if status == "t3":
+        if status == "t3" and verify_signoff:
             from . import signoff
             signoff.require(owner, repo, self.aliases(owner))  # no-op unless --require-t3-signoff
         return status
diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index 1ba35f8..391fe29 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -2348,6 +2348,8 @@ def _ctx(args, cli, resolver):
 
 def _finish(args, obj: dict, code: int):
     jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
+    from .signoff import stamp
+    stamp(jobs)  # before any serialization (--jobs, --report): a no-op unless --require-t3-signoff
     if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
         from .records import append
         append(args.jobs, jobs)
@@ -2369,9 +2371,9 @@ def cmd_content(args, cli=None):
     resolver = _resolver(args, cli)
     head = {"command": "content", "action": act}
     if act == "social":
-        owner, _, _ = _owner_repo(args, cli, None)
+        owner, srepo, _ = _owner_repo(args, cli, None)
         if owner:
-            resolver.check_owner(owner, allow_hold=args.allow_hold)
+            resolver.check_owner(owner, allow_hold=args.allow_hold, repo=srepo)
         obj, code = cli.cmd_social(args)
         obj = dict(head, **{k: v for k, v in obj.items() if k != "command"}, alias_of="social-preview")
         if args.job and obj.get("result") == "ok":
@@ -2391,7 +2393,7 @@ def cmd_content(args, cli=None):
             raise ShowcaseError(f"content {act} needs a checkout (--repo-dir)", log="usage")
         owner, repo, _ = _owner_repo(args, cli, rd)
         if owner:
-            resolver.check_owner(owner)
+            resolver.check_owner(owner, repo=repo)
         tree = Tree(rd)
         readme = displayed_readme(tree, args.readme_path)
         files = list(args.files) or markdown_files(tree, readme)
@@ -2496,7 +2498,7 @@ def _cmd_sidebar(args, cli, resolver, head):
         if args.only and not (resolver.same(o, args.only.split("/")[0]) and r.lower() == args.only.split("/")[1].lower()):
             continue
         try:
-            resolver.check_owner(o)
+            resolver.check_owner(o, repo=r)
         except Refused as exc:
             skipped.append({"repo": full, "why": exc.log})
             continue
diff --git a/scripts/ctshowcase/intake.py b/scripts/ctshowcase/intake.py
index 28c74f7..8bbb02d 100644
--- a/scripts/ctshowcase/intake.py
+++ b/scripts/ctshowcase/intake.py
@@ -193,7 +193,7 @@ def new_plan(brand, slug: str, type_: str, *, template: str = TEMPLATE_REPO, des
     if not m:
         raise ShowcaseError("new needs OWNER/NAME", log="usage")
     owner, name = m.group(1), m.group(2)
-    status = brand.check_owner(owner)
+    status = brand.check_owner(owner, repo=name)
     if status == "watching":
         raise ShowcaseError(f"{owner} is the watching org: it holds forks only, never new repositories", log="exempt")
     if resolver is not None and resolver.is_placeholder(owner):
diff --git a/scripts/ctshowcase/resolver.py b/scripts/ctshowcase/resolver.py
index fb79165..88f47c1 100644
--- a/scripts/ctshowcase/resolver.py
+++ b/scripts/ctshowcase/resolver.py
@@ -288,7 +288,7 @@ def owner_status(self, login: str) -> str | None:
         return None
 
     def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool = False,
-                    repo: str | None = None) -> str | None:
+                    repo: str | None = None, verify_signoff: bool = True) -> str | None:
         """Refuse excluded, hold and (unless signed off) T3 orgs under any of their logins; return the status."""
         from .config import t3_signed_off
         from .errors import Refused
@@ -299,7 +299,7 @@ def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool =
             raise Refused(f"{login} is on HOLD", log="hold")
         if st == "t3" and not (allow_t3 or t3_signed_off()):
             raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
-        if st == "t3":
+        if st == "t3" and verify_signoff:  # doctor passes False: it reports the hold instead of refusing
             from . import signoff
             signoff.require(login, repo, self.aliases(login))  # no-op unless --require-t3-signoff
         return st
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index cd1dc9b..76f1756 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -83,19 +83,39 @@ def _expiry(rec: dict) -> _dt.date | None:
         return v.date()
     if isinstance(v, _dt.date):
         return v
+    # the whole value must parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
     try:
-        return _dt.date.fromisoformat(str(v)[:10])
+        return _dt.date.fromisoformat(str(v).strip())
+    except ValueError:
+        pass
+    try:
+        return _dt.datetime.fromisoformat(str(v).strip()).date()
     except ValueError:
         return None
 
 
-def _covers(rec: dict, repo: str | None) -> bool:
+def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
+    """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
+    (the requested owner and its org aliases) as well as the name. A malformed `repos` (not a string or a list of
+    strings) covers nothing, so it surfaces as t3-signoff:scope instead of an uncaught exception."""
     repos = rec.get("repos")
-    repos = [repos] if isinstance(repos, str) else [str(x) for x in repos or []]
+    if isinstance(repos, str):
+        repos = [repos]
+    if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
+        return False
     if "*" in repos:
         return True
     name = (repo or "").split("/")[-1].lower()
-    return bool(name) and any(r.split("/")[-1].lower() == name for r in repos)
+    if not name:
+        return False
+    mine = {x.lower() for x in logins or []}
+    for r in repos:
+        head, _, tail = r.rpartition("/")
+        if tail.lower() != name:
+            continue
+        if not head or head.lower() in mine or logins is None:
+            return True
+    return False
 
 
 def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
@@ -110,7 +130,7 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
             and str(r.get("owner") or "").lower() in logins]
     if not mine:
         return None, "missing"
-    scoped = [r for r in mine if _covers(r, repo)]
+    scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
     if not scoped:
         return None, "scope"
     live = [r for r in scoped if (_expiry(r) or _dt.date.min) >= today]
@@ -143,7 +163,7 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
 
 def record_for(owner: str, repo: str | None = None) -> dict | None:
     for rec in _GRANTED.get((owner or "").lower(), []):
-        if _covers(rec, repo):
+        if _covers(rec, repo, _expand([owner or ""])):
             return rec
     return None
 
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 303f617..9bd8515 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -791,7 +791,7 @@ def cmd_adopt(args):
     if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9-]*/[A-Za-z0-9._-]+", args.slug or ""):
         raise ShowcaseError("adopt needs OWNER/REPO", log="usage")
     b = brand(args)
-    b.check_owner(args.slug.split("/")[0])
+    b.check_owner(args.slug.split("/")[0], repo=args.slug.split("/")[1] if "/" in args.slug else None)
     if args.meta:
         m = M.load_file(args.meta)
         if not _same_slug(args, f"{m.get('owner')}/{m.get('repo')}", args.slug):
@@ -842,7 +842,7 @@ def cmd_doctor(args):
                                    template_dir=args.template_dir, checkouts=args.checkouts, out=args.out)
         return res, OK
     ctx = context(args)
-    ctx.brand.check_owner(ctx.owner, allow_t3=True, repo=ctx.repo)
+    ctx.brand.check_owner(ctx.owner, allow_t3=True, repo=ctx.repo, verify_signoff=False)  # read-only: doctor.row shows R7 hold
     r = doctor.row(ctx)
     fmt = args.doctor_format
     if fmt == "tsv":
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 5284b20..7032be5 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -155,7 +155,7 @@ def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
 @pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
 def test_evaluate_scope_rules(repo, expect):
     from ctshowcase import signoff
-    recs = [{"id": "s", "owner": OWNER, "repos": ["a", "x/b"], "approved": True, "expires": "2099-01-01"}]
+    recs = [{"id": "s", "owner": OWNER, "repos": ["a", f"{OWNER}/b"], "approved": True, "expires": "2099-01-01"}]
     rec, why = signoff.evaluate([OWNER], repo, records=recs)
     assert why == expect and (rec is None) == (expect is not None)
 
@@ -231,3 +231,61 @@ def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
         assert "t3s-13" in r.stdout, _out(r)
         plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
         assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged
+
+
+# --- review round 2: evidence for each fixed finding (synthetic records only) ---
+
+def _raw_bundle(tmp_path, body):
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    (d / "t3-signoffs.yaml").write_text("signoffs:\n" + body, encoding="utf-8")
+    return tmp_path / "bundle"
+
+
+def test_doctor_without_allow_t3_still_reports_hold_under_the_flag(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "doctor", "--format", "json")
+    assert r.returncode in (0, 1) and "t3-signoff:missing" not in _out(r), _out(r)
+    assert "hold" in _out(r)
+
+
+def test_qualified_scope_for_another_owner_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-4", "repos": ["Other-Org/northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_garbage_expiry_never_validates(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-5", "expires": "2099-12-31garbage"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
+
+
+def test_malformed_repos_refuses_instead_of_raising(tmp_path):
+    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n    expires: 2099-12-31\n")
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r) and "Traceback" not in _out(r), _out(r)
+
+
+def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-7", "repos": ["northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    assert "t3-signoff" not in _out(r), _out(r)
+
+
+def test_report_jobs_carry_signoff_id(tmp_path):
+    from ctshowcase import signoff
+    signoff.reset()
+    signoff.set_required(True)
+    try:
+        rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+        signoff._GRANTED[OWNER.lower()] = [rec]
+        from ctshowcase.content import _finish
+        import argparse
+        rp = tmp_path / "report.json"
+        _finish(argparse.Namespace(jobs=None, report=str(rp)),
+                {"job": {"phase": 3, "org": OWNER, "repo": f"{OWNER}/northwind-synthetic"}}, 0)
+        saved = json.loads(rp.read_text(encoding="utf-8"))["job"]
+        assert saved["signoff_id"] == "t3s-8" and saved["approval_id"] == "t3s-8"
+    finally:
+        signoff.set_required(False)
+        signoff.reset()

From 67fc27bb931581fbdd1b731084b65ea3569aeb53 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 08:05:32 -0400
Subject: [PATCH 14/79] Document the two base-passing guard tests in the T3
 sign-off suite (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_t3_signoff_require.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 7032be5..10dd3be 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -84,11 +84,13 @@ def test_env_var_is_equivalent_to_the_flag(tmp_path):
     assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
 
 
+# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
 def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
     r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
     assert r.returncode == 2 and "t3-signoff" in _out(r)
 
 
+# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
 def test_default_is_unchanged_without_the_new_flag(tmp_path):
     """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
     r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")

From 6a670d010e115575d557307a23239e49854be4dd Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 08:18:14 -0400
Subject: [PATCH 15/79] Re-raise sign-off refusals from keyed sidebar batches,
 fail closed on malformed sign-off files, test HOLD owners (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/content.py    | 5294 +++++++++++++++---------------
 scripts/ctshowcase/signoff.py    |  373 +--
 tests/test_t3_signoff_require.py |  627 ++--
 3 files changed, 3171 insertions(+), 3123 deletions(-)

diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index 391fe29..85ca0e4 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -1,2646 +1,2648 @@
-"""`showcase.py content ...`: links (CQ-04, RP-09), linguist (RP-07, CQ-08), actions (RP-06, RP-01, CQ-13), images
-(RP-03, RP-10), sidebar (RP-05), icon (RT-04) and social (R10; the contract name of the social preview, with the
-hidden top-level `social-preview` kept as a deprecated alias).
-
-Read-only toward GitHub, like every other module. Nothing here rewrites a README, edits `.gitattributes`, touches a
-workflow file or uploads anything: each action reports facts and emits proposals (unified diffs, `gh` argv and
-`scripts/writer.py` jobs `{id, phase, kind, repo|org, approval_id?, argv, note}`; UI-only steps are jobs of kind
-`browser` with the exact click path in `steps`). The only files written are the paths given with `--report`, `--jobs`
-(JSON lines, appended), `--out`, `--out-dir`, `--preview` and `--cache`. Network use is opt-in (`--online`): cached,
-polite HEAD/GET requests and read-only `gh api` GETs.
-
-Every org lookup goes through the shared `resolver.Resolver` (CQ-03): after an approved rename
-(CompleTetech-Security -> CompleteTech-Security, CompleteTech-Pokemon -> CompleteTech-TCG) a repository keeps its
-brand row, its owner status (watching, T3, excluded), its packages and its links, and jobs name the current login.
-"""
-from __future__ import annotations
-
-import difflib
-import hashlib
-import html
-import io
-import json
-import re
-import subprocess
-import time
-import unicodedata
-import urllib.error
-import urllib.parse
-import urllib.request
-from datetime import datetime, timezone
-from pathlib import Path, PurePosixPath
-
-from . import ROOT, STANDARD, __version__, estate_candidates
-from .config import load_yaml_text
-from .errors import CHECK_FAILED, OK, ArtFail, NeedsInput, Refused, ShowcaseError
-from .resolver import Resolver
-
-# the estate hand-off tree when the skill lives inside it (or is its installed copy); optional everywhere
-ESTATE = next((c for c in estate_candidates() if (c / "art").is_dir()), ROOT.parent)
-SKILL_ART_DIRECTION = ROOT / "references" / "art-direction.md"
-DEFAULT_ART_DIRECTION = SKILL_ART_DIRECTION
-
-
-def _now() -> str:
-    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-# =====================================================================================================
-# Org lookups (CQ-03): always through the shared resolver.Resolver
-# =====================================================================================================
-def brand_key(r: Resolver | None, login: str) -> str:
-    """The brand.yaml `orgs:` key for any login of the org (old or new), else the login itself."""
-    return (r.brand_key(login) if r else None) or login
-
-
-def current_login(r: Resolver | None, login: str) -> str:
-    """The org's login after approved renames: what links, URLs and writer jobs name."""
-    return r.canonical(login) if r else login
-
-
-def org_row(r: Resolver | None, brand, login: str, require: bool = False) -> dict:
-    if r is None:
-        row = brand.org(login)
-        if require and not row.get("known"):
-            raise NeedsInput("org", f"{login} has no row in references/brand.yaml")
-        return dict(row, brand_key=login)
-    row = r.brand_org(login, strict=require)
-    row.setdefault("brand_key", r.brand_key(login) or login)
-    return row
-
-
-def org_style(r: Resolver | None, brand, login: str) -> dict:
-    return brand.style(brand_key(r, login))
-
-
-def in_estate(r: Resolver | None, login: str) -> bool:
-    """An org of the estate (a brand or registry row under any of its logins), not an excluded owner."""
-    if r is None or not login:
-        return False
-    return (r.brand_key(login) is not None or r.registry_key(login) is not None) and r.owner_status(login) != "excluded"
-
-
-def load_resolver(brand, registry=None, approved=None, approved_yaml=None, actions=None) -> Resolver:
-    """The shared resolver from brand.yaml plus the registry and approvals (defaults: the estate bundle beside the
-    skill, when present). Read-only: the registry is private data and is never copied anywhere."""
-    return Resolver.from_paths(brand, registry, approved, approved_yaml, actions)
-
-
-# =====================================================================================================
-# Writer jobs
-# =====================================================================================================
-_JID = re.compile(r"[^A-Za-z0-9._:@/+-]+")
-SAFETY_STEP = ("Never click a control inside a \"Danger Zone\" section and never type an owner, repository or org name "
-               "into a confirmation field; if a dialog mentioning delete, transfer, archive, rename or visibility opens, "
-               "press Escape and log ui-danger-dialog.")
-
-
-def job_id(*parts) -> str:
-    """A writer job id: letters, digits and ._:@/+- only (scripts/writer.py ID_RE), at most 200 characters."""
-    s = _JID.sub("-", ":".join(str(p) for p in parts if p not in (None, ""))).strip("-.")
-    return s[:200] or "job"
-
-
-def writer_job(jid: str, phase, kind: str, target: str, argv: list, note: str, approval_id: str | None = None,
-               **extra) -> dict:
-    j = {"id": jid, "phase": str(phase), "kind": kind, ("repo" if "/" in target else "org"): target}
-    if approval_id:
-        j["approval_id"] = approval_id
-    j["argv"] = [str(a) for a in argv]
-    j["note"] = note
-    j.update(extra)
-    return j
-
-
-def browser_job(jid: str, phase, target: str, url: str, ui_action: str, steps: list[str], note: str,
-                approval: dict | None = None) -> dict:
-    shot = "state/screens/" + re.sub(r"[^A-Za-z0-9._-]+", "_", jid) + ".png"
-    steps = [*steps, f"Take a screenshot of the result and save it as {shot}.", SAFETY_STEP]
-    j = writer_job(jid, phase, "browser", target, [], note, url=url, ui_action=ui_action, steps=steps)
-    if approval:
-        j["approval"] = approval
-    return j
-
-
-# =====================================================================================================
-# Repository tree (what GitHub sees)
-# =====================================================================================================
-SKIP_WALK = {".git", "node_modules", ".venv", "venv", "__pycache__", ".showcase-cache"}
-
-
-class Tree:
-    """Files of a checkout as GitHub serves them: tracked plus untracked-but-not-ignored files that exist (git work
-    tree), every file on disk (no git), or the tree at a git ref (`--base-ref`)."""
-
-    def __init__(self, root: str | Path, ref: str | None = None):
-        self.root, self.ref = Path(root), ref
-        self.git = False
-        self.files = self._list()
-        self.lower: dict[str, list[str]] = {}
-        self.dirs: set[str] = {""}
-        for f in self.files:
-            self.lower.setdefault(f.lower(), []).append(f)
-            parts = f.split("/")
-            for i in range(1, len(parts)):
-                self.dirs.add("/".join(parts[:i]))
-        self._cache: dict[str, str | None] = {}
-
-    def _git(self, *args) -> str | None:
-        try:
-            p = subprocess.run(["git", "-C", str(self.root), *args], capture_output=True, timeout=60)
-        except (OSError, subprocess.SubprocessError):
-            return None
-        return p.stdout.decode("utf-8", "surrogateescape") if p.returncode == 0 else None
-
-    def _list(self) -> set[str]:
-        if self.ref:
-            out = self._git("ls-tree", "-r", "--name-only", "-z", self.ref)
-            if out is None:
-                raise ShowcaseError(f"cannot list {self.ref} in {self.root}", log="usage")
-            self.git = True
-            return {f for f in out.split("\0") if f}
-        if (self.root / ".git").exists():
-            out = self._git("ls-files", "-z", "--cached", "--others", "--exclude-standard")
-            if out is not None:
-                self.git = True
-                return {f for f in out.split("\0") if f and (self.root / f).is_file()}
-        files = set()
-        for p in self.root.rglob("*"):
-            rel = p.relative_to(self.root)
-            if p.is_file() and not (set(rel.parts) & SKIP_WALK):
-                files.add(rel.as_posix())
-        return files
-
-    def is_file(self, rel: str) -> bool:
-        return rel in self.files
-
-    def is_dir(self, rel: str) -> bool:
-        return rel.rstrip("/") in self.dirs
-
-    def read(self, rel: str) -> str | None:
-        if rel not in self._cache:
-            if rel not in self.files:
-                self._cache[rel] = None
-            elif self.ref:
-                self._cache[rel] = self._git("show", f"{self.ref}:{rel}")
-            else:
-                try:
-                    self._cache[rel] = (self.root / rel).read_text(encoding="utf-8", errors="replace")
-                except OSError:
-                    self._cache[rel] = None
-        return self._cache[rel]
-
-    def read_bytes(self, rel: str) -> bytes | None:
-        if rel not in self.files:
-            return None
-        if self.ref:
-            try:
-                p = subprocess.run(["git", "-C", str(self.root), "show", f"{self.ref}:{rel}"], capture_output=True,
-                                   timeout=60)
-            except (OSError, subprocess.SubprocessError):
-                return None
-            return p.stdout if p.returncode == 0 else None
-        try:
-            return (self.root / rel).read_bytes()
-        except OSError:
-            return None
-
-    def size(self, rel: str) -> int:
-        if not self.ref:
-            try:
-                return (self.root / rel).stat().st_size
-            except OSError:
-                return 0
-        b = self.read_bytes(rel)
-        return len(b) if b is not None else 0
-
-
-def displayed_readme(tree: Tree, given: str | None = None) -> str | None:
-    """The README GitHub displays (RP-09): `.github/README.md`, then the root, then `docs/` (GitHub's precedence), or
-    the `/readme` `.path` captured in metadata."""
-    if given:
-        return given if tree.is_file(given) else None
-    for d in (".github/", "", "docs/"):
-        for name in ("README.md", "readme.md", "Readme.md", "README.markdown", "README"):
-            if tree.is_file(d + name):
-                return d + name
-    return None
-
-
-def markdown_files(tree: Tree, readme: str | None) -> list[str]:
-    """README (displayed path), docs/**/*.md, .github/*.md and the org profile README (CQ-04 scope)."""
-    out = [readme] if readme else []
-    for f in sorted(tree.files):
-        low = f.lower()
-        if not low.endswith((".md", ".markdown")) or f in out:
-            continue
-        if low.startswith("docs/") or (low.startswith(".github/") and low.count("/") == 1) or low in (
-                "profile/readme.md", ".github/profile/readme.md"):
-            out.append(f)
-    return out
-
-
-# =====================================================================================================
-# Markdown scanning
-# =====================================================================================================
-FENCE = re.compile(r"^ {0,3}(`{3,}(?=[^`\n]*$)|~{3,})")  # CommonMark: no backtick in a ``` info string
-INLINE_CODE = re.compile(r"(`+)(?:.+?)\1")
-ATX = re.compile(r"^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$")
-SETEXT = re.compile(r"^ {0,3}(=+|-+)[ \t]*$")
-MD_LINK = re.compile(r"(!?)\[((?:[^\[\]\n]|\[[^\[\]\n]*\])*)\]\(\s*(<[^>\n]*>|[^\s()]*(?:\([^\s()]*\)[^\s()]*)*)"
-                     r"(?:\s+(?:\"[^\"\n]*\"|'[^'\n]*'|\([^)\n]*\)))?\s*\)")
-REF_DEF = re.compile(r"^ {0,3}\[([^\]\n]+)\]:\s*(<[^>\n]*>|\S+)")
-HTML_TAG = re.compile(r"<(a|img|source|link|video|audio|image|use)\b([^>]*)>", re.I)
-ATTR = re.compile(r"""(?<![\w-])(href|src|srcset|alt|xlink:href|name|id)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))""", re.I)
-ANCHOR_ATTR = re.compile(r"""<[a-z][^>]*?(?<![\w-])(?:name|id)\s*=\s*["']([^"']+)["']""", re.I)
-HTML_HEADING = re.compile(r"<h([1-6])\b[^>]*>(.*?)</h\1>", re.I | re.S)
-BARE_URL = re.compile(r"https?://[^\s<>()\[\]\"'`]+")
-IMG_EXT = (".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".avif", ".bmp", ".ico")
-
-
-def scan_lines(text: str) -> list[tuple[int, str | None, str | None]]:
-    """(line number, text without HTML comments, the same with inline code blanked); both None inside a code fence."""
-    out, fence, comment = [], None, False
-    for n, raw in enumerate(text.replace("\r\n", "\n").split("\n"), 1):
-        m = FENCE.match(raw)
-        if fence:
-            if m and m.group(1)[0] == fence[0] and len(m.group(1)) >= len(fence) and not raw.strip().strip(fence[0]):
-                fence = None
-            out.append((n, None, None))
-            continue
-        if m and not comment:
-            fence = m.group(1)
-            out.append((n, None, None))
-            continue
-        line, rest = "", raw
-        while rest:
-            if comment:
-                end = rest.find("-->")
-                if end < 0:
-                    rest = ""
-                    break
-                rest, comment = rest[end + 3:], False
-                continue
-            start = rest.find("<!--")
-            if start < 0:
-                line += rest
-                break
-            line += rest[:start] + " "
-            rest, comment = rest[start + 4:], True
-        out.append((n, line, INLINE_CODE.sub(lambda mm: " " * len(mm.group(0)), line)))
-    return out
-
-
-def plain_heading(md: str) -> str:
-    s = re.sub(r"!\[[^\]]*\]\([^)]*\)", "", md)
-    s = re.sub(r"\[([^\]]*)\]\([^)]*\)", r"\1", s)
-    s = re.sub(r"\[([^\]]*)\]\[[^\]]*\]", r"\1", s)
-    s = re.sub(r"<[^>]+>", "", s)
-    s = re.sub(r"(`+)(.*?)\1", r"\2", s)
-    s = re.sub(r"(\*\*|__|~~)(.+?)\1", r"\2", s)
-    s = re.sub(r"(?<![\w*])\*(?!\s)(.+?)(?<!\s)\*(?![\w*])", r"\1", s)
-    s = re.sub(r"(?<![\w])_(?!\s)(.+?)(?<!\s)_(?![\w])", r"\1", s)
-    s = re.sub(r"\\([!-/:-@\[-`{-~])", r"\1", s)
-    return html.unescape(s).strip()
-
-
-def github_slug(text: str) -> str:
-    """GitHub's heading anchor (github-slugger): lower-case; letters, digits, marks, '-' and '_' kept; every other
-    character removed (stripped emoji leave their space); each space becomes '-'."""
-    out = []
-    for ch in text.lower():
-        if ch == " ":
-            out.append("-")
-        elif ch in "-_" or unicodedata.category(ch)[0] in "LMN":
-            out.append(ch)
-    return "".join(out)
-
-
-def headings(text: str) -> list[dict]:
-    """Markdown headings in order with their GitHub anchors (duplicates get -1, -2 ...)."""
-    rows, seen = [], {}
-    lines = scan_lines(text)
-    para = re.compile(r"^\s*([#<>|*+\-!\[]|\d+[.)]\s)")
-    for i, (n, t, _) in enumerate(lines):
-        if t is None:
-            continue
-        m = ATX.match(t)
-        title = None
-        if m:
-            title = m.group(2) or ""
-        elif i + 1 < len(lines) and lines[i + 1][1] is not None and SETEXT.match(lines[i + 1][1] or "") \
-                and t.strip() and not para.match(t):
-            title = t.strip()
-        elif HTML_HEADING.search(t):
-            title = HTML_HEADING.search(t).group(2)
-        if title is None:
-            continue
-        base = github_slug(plain_heading(title))
-        slug = base
-        if base in seen:
-            seen[base] += 1
-            slug = f"{base}-{seen[base]}"
-        else:
-            seen[base] = 0
-        rows.append({"line": n, "text": plain_heading(title), "slug": slug})
-    return rows
-
-
-def anchors(text: str) -> set[str]:
-    out = {h["slug"] for h in headings(text)}
-    for _, t, _ in scan_lines(text):
-        if t:
-            out |= {m.group(1) for m in ANCHOR_ATTR.finditer(t)}
-    return out
-
-
-def _attrs(s: str) -> dict:
-    return {m.group(1).lower(): next(g for g in (m.group(3), m.group(4), m.group(5)) if g is not None)
-            for m in ATTR.finditer(s)}
-
-
-def extract_links(text: str) -> list[dict]:
-    """Every link and image target outside code: inline, reference definitions, HTML and bare URLs."""
-    found = []
-    for n, _, masked in scan_lines(text):
-        if not masked:
-            continue
-        spans = []
-
-        def md(s: str, offset: int):
-            for m in MD_LINK.finditer(s):
-                target = m.group(3).strip("<>")
-                found.append({"line": n, "target": target, "image": m.group(1) == "!", "alt": m.group(2),
-                              "syntax": "markdown"})
-                spans.append((offset + m.start(), offset + m.end()))
-                md(m.group(2), offset + m.start(2))
-        md(masked, 0)
-        m = REF_DEF.match(masked)
-        if m:
-            found.append({"line": n, "target": m.group(2).strip("<>"), "image": False, "alt": m.group(1),
-                          "syntax": "reference"})
-            spans.append((m.start(), m.end()))
-        for m in HTML_TAG.finditer(masked):
-            tag, a = m.group(1).lower(), _attrs(m.group(2))
-            for key in ("href", "src", "xlink:href", "srcset"):
-                if key in a and a[key]:
-                    target = a[key].split(",")[0].strip().split(" ")[0] if key == "srcset" else a[key]
-                    found.append({"line": n, "target": target, "image": tag in ("img", "source", "image") or key == "src",
-                                  "alt": a.get("alt"), "syntax": f"html-{tag}"})
-            spans.append((m.start(), m.end()))
-        rest = list(masked)
-        for a, b in spans:
-            rest[a:b] = " " * (b - a)
-        for m in BARE_URL.finditer("".join(rest)):
-            found.append({"line": n, "target": m.group(0).rstrip(".,;:!?*_~'\""), "image": False, "alt": None,
-                          "syntax": "bare"})
-    return found
-
-
-# =====================================================================================================
-# links (CQ-04)
-# =====================================================================================================
-LINK_ALLOW_HOSTS = ("localhost", "127.0.0.1", "0.0.0.0", "::1", "example.com", "example.org", "example.net")
-LINK_ALLOW_SUFFIX = (".home.complete.tech", ".example.com", ".localhost")
-GITHUB_ROUTES = {"issues", "pulls", "pull", "actions", "wiki", "releases", "discussions", "security", "blob", "tree",
-                 "raw", "compare", "graphs", "network", "projects", "stargazers", "tags", "commits", "commit",
-                 "milestones", "labels", "branches", "packages", "deployments", "pulse", "forks", "watchers", "settings"}
-GITHUB_RESERVED = {"orgs", "settings", "topics", "sponsors", "marketplace", "apps", "features", "about", "login",
-                   "search", "explore", "collections", "trending", "notifications", "pricing", "enterprise", "users",
-                   "site", "security", "contact", "readme", "codespaces", "new", "organizations", "account", "stars"}
-OK_STATUS, BROKEN = "ok", "broken"
-
-
-def _private_host(host: str) -> bool:
-    return bool(re.match(r"^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)", host or ""))
-
-
-class Fetcher:
-    """Polite remote checks: a cached §10.2 GET (HEAD first; GET when HEAD is refused), `Mozilla/5.0` agent, at most
-    one request per host per `delay` seconds, `max_requests` per run. The cache file (opt-in) keeps results for
-    `ttl_days`; nothing else persists. `opener(url, method) -> (status|None, final_url, error|None)` is injectable."""
-
-    def __init__(self, cache_path=None, ttl_days: float = 7, delay: float = 1.0, timeout: float = 20,
-                 max_requests: int = 300, opener=None, gh=None, sleep=time.sleep, clock=time.time):
-        self.cache_path = Path(cache_path) if cache_path else None
-        self.ttl, self.delay, self.timeout, self.left = ttl_days * 86400, delay, timeout, max_requests
-        self.opener, self.gh, self.sleep, self.clock = opener or self._open, gh or _gh_full_name, sleep, clock
-        self.cache: dict = {}
-        self._last: dict[str, float] = {}
-        self.requests = 0
-        if self.cache_path and self.cache_path.is_file():
-            try:
-                self.cache = json.loads(self.cache_path.read_text(encoding="utf-8"))
-            except ValueError:
-                self.cache = {}
-
-    def _open(self, url: str, method: str):
-        req = urllib.request.Request(url, method=method, headers={"User-Agent": "Mozilla/5.0", "Accept": "*/*"})
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as r:
-                if method == "GET":
-                    r.read(1024)
-                return r.status, r.geturl(), None
-        except urllib.error.HTTPError as e:
-            return e.code, url, None
-        except urllib.error.URLError as e:
-            reason = str(e.reason)
-            return None, url, ("dns" if "Name or service" in reason or "nodename" in reason or "getaddrinfo" in reason
-                               else reason[:120])
-        except (TimeoutError, OSError, ValueError) as e:
-            return None, url, ("timeout" if "timed out" in str(e) else str(e)[:120])
-
-    def _fresh(self, key: str):
-        hit = self.cache.get(key)
-        if hit and self.clock() - hit.get("t", 0) <= self.ttl:
-            return dict(hit, cached=True)
-        return None
-
-    def _pace(self, host: str):
-        last = self._last.get(host)
-        if last is not None:
-            wait = self.delay - (self.clock() - last)
-            if wait > 0:
-                self.sleep(wait)
-        self._last[host] = self.clock()
-
-    def check(self, url: str) -> dict:
-        hit = self._fresh(url)
-        if hit:
-            return hit
-        if self.left <= 0:
-            return {"status": None, "error": "budget", "cached": False}
-        host = urllib.parse.urlsplit(url).hostname or ""
-        self._pace(host)
-        self.left -= 1
-        self.requests += 1
-        status, final, err = self.opener(url, "HEAD")
-        if status in (400, 403, 405, 406, 429, 500, 501, 503) or (status is None and err not in ("dns",)):
-            self._pace(host)
-            self.requests += 1
-            status, final, err = self.opener(url, "GET")
-        res = {"status": status, "final": final, "error": err, "t": self.clock()}
-        self.cache[url] = res
-        return dict(res, cached=False)
-
-    def full_name(self, owner: str, repo: str) -> dict:
-        key = f"gh:{owner}/{repo}"
-        hit = self._fresh(key)
-        if hit:
-            return hit
-        if self.left <= 0:
-            return {"full_name": None, "error": "budget"}
-        self.left -= 1
-        self.requests += 1
-        name, err = self.gh(owner, repo)
-        res = {"full_name": name, "error": err, "t": self.clock()}
-        self.cache[key] = res
-        return dict(res, cached=False)
-
-    def save(self):
-        if self.cache_path:
-            self.cache_path.parent.mkdir(parents=True, exist_ok=True)
-            self.cache_path.write_text(json.dumps(self.cache, sort_keys=True, indent=0) + "\n", encoding="utf-8")
-
-
-def _gh_full_name(owner: str, repo: str):
-    """Read-only `gh api repos/<o>/<r> --jq .full_name` (STANDARD §7.1 link rule). Returns (full_name|None, error)."""
-    try:
-        p = subprocess.run(["gh", "api", "-X", "GET", f"repos/{owner}/{repo}", "--jq", ".full_name"],
-                           capture_output=True, text=True, timeout=60)
-    except (OSError, subprocess.SubprocessError) as exc:
-        return None, f"gh: {exc}"
-    if p.returncode != 0:
-        return None, ("404" if "404" in (p.stderr or "") or "Not Found" in (p.stderr or "") else (p.stderr or "").strip()[:160])
-    return p.stdout.strip() or None, None
-
-
-def _resolve(file: str, target: str) -> tuple[str | None, str | None]:
-    """(path relative to the repository root, GitHub route) for a relative link from `file`; (None, None) if it
-    leaves the repository without landing on a repository route (../../issues from the root README is a route)."""
-    base = PurePosixPath(file).parent
-    path = target if not target.startswith("/") else target.lstrip("/")
-    parts = [] if target.startswith("/") else [p for p in base.parts if p not in ("", ".")]
-    up = 0
-    for seg in path.split("/"):
-        if seg in ("", "."):
-            continue
-        if seg == "..":
-            if parts:
-                parts.pop()
-            else:
-                up += 1
-            continue
-        if up:
-            return None, seg if up == 2 and seg in GITHUB_ROUTES else None
-        parts.append(seg)
-    if up:
-        return None, None
-    return "/".join(parts), None
-
-
-class _FileInfo:
-    def __init__(self, tree: Tree, rel: str):
-        self.text = tree.read(rel) or ""
-        self.slugs = anchors(self.text)
-        self.heads = headings(self.text)
-
-
-def _github_ref(url: str) -> tuple[str, str] | None:
-    u = urllib.parse.urlsplit(url)
-    host = (u.hostname or "").lower()
-    parts = [p for p in u.path.split("/") if p]
-    if host in ("github.com", "www.github.com") and len(parts) >= 2 and parts[0].lower() not in GITHUB_RESERVED:
-        return parts[0], re.sub(r"\.git$", "", parts[1])
-    if host == "raw.githubusercontent.com" and len(parts) >= 2:
-        return parts[0], parts[1]
-    return None
-
-
-def check_links(tree: Tree, files: list[str], *, resolver: Resolver | None = None, fetcher: Fetcher | None = None,
-                online: bool = False, base: Tree | None = None, base_files: list[str] | None = None,
-                self_slug: tuple[str, str] | None = None) -> dict:
-    """Check every link, anchor and image target in `files`. Never rewrites: broken findings carry a proposal."""
-    infos: dict[str, _FileInfo] = {}
-
-    def info(rel: str) -> _FileInfo:
-        if rel not in infos:
-            infos[rel] = _FileInfo(tree, rel)
-        return infos[rel]
-
-    base_slugs: dict[str, set[str]] = {}
-    if base is not None:
-        for f in base_files or files:
-            if base.is_file(f):
-                base_slugs[f] = anchors(base.read(f) or "")
-    findings: list[dict] = []
-    for f in files:
-        fi = info(f)
-        for ln in extract_links(fi.text):
-            findings.append(_check_one(tree, f, ln, info, resolver, fetcher if online else None, base_slugs,
-                                       self_slug))
-    return {"files": files, "findings": findings, "headings": {f: info(f).heads for f in files}}
-
-
-def _check_one(tree: Tree, f: str, ln: dict, info, resolver, fetcher, base_slugs, self_slug=None) -> dict:
-    target = ln["target"].strip()
-    row = {"file": f, "line": ln["line"], "target": target, "image": ln["image"], "syntax": ln["syntax"],
-           "kind": "relative", "status": OK_STATUS, "reason": "", "proposal": None}
-    if ln["image"]:
-        row["alt"] = ln.get("alt")
-    low = target.lower()
-    if not target:
-        return dict(row, kind="empty", status=BROKEN, reason="empty link target")
-    if re.match(r"^(mailto|tel|data|javascript|ftp|irc|news|sms):", low):
-        return dict(row, kind="scheme", status="skipped", reason=low.split(":", 1)[0])
-    if target.startswith("#"):
-        frag = urllib.parse.unquote(target[1:])
-        row["kind"] = "anchor"
-        return _anchor(row, f, frag, info(f), base_slugs.get(f), info(f).heads)
-    if re.match(r"^(https?:)?//", low):
-        return _remote(row, target, resolver, fetcher, self_slug)
-    if re.match(r"^[a-z][a-z0-9+.-]*:", low) and not re.match(r"^[a-z]:[\\/]", low):
-        return dict(row, kind="scheme", status="skipped", reason=low.split(":", 1)[0])
-    path, _, frag = target.partition("#")
-    path = urllib.parse.unquote(path.split("?", 1)[0])
-    if re.match(r"^[a-zA-Z]:[\\/]", path) or (path.startswith(("/mnt/", "/home/", "/Users/", "~"))
-                                              and not tree.is_file(path.lstrip("/")) and not tree.is_dir(path.lstrip("/"))):
-        return dict(row, status=BROKEN, reason="machine-local path", proposal=None)
-    if not path:
-        row["kind"] = "anchor"
-        return _anchor(row, f, urllib.parse.unquote(frag), info(f), base_slugs.get(f), info(f).heads)
-    rel, route = _resolve(f, path)
-    if route:
-        return dict(row, kind="github-route", status="skipped", reason=f"repository route /{route}")
-    if rel is None:
-        return dict(row, status=BROKEN, reason="leaves the repository")
-    if tree.is_file(rel) or tree.is_dir(rel):
-        if frag and rel.lower().endswith((".md", ".markdown")) and tree.is_file(rel) and not re.match(r"^L\d+", frag):
-            row["kind"] = "anchor"
-            return _anchor(row, rel, urllib.parse.unquote(frag), info(rel), None, info(rel).heads)
-        return row
-    row["status"] = BROKEN
-    hits = tree.lower.get(rel.lower())
-    if hits:
-        fixed = _relpath(f, hits[0])
-        return dict(row, reason="case differs from the git tree", proposal=_prop(f, ln["line"], path, fixed,
-                                                                                    "§7.1 relative link case"))
-    if (tree.root / rel).exists() and tree.git:
-        return dict(row, reason="exists on disk but not in the git tree (untracked or ignored)")
-    name = PurePosixPath(rel).name.lower()
-    same = sorted(x for x in tree.files if PurePosixPath(x).name.lower() == name)
-    if len(same) == 1:
-        return dict(row, reason="target not found", proposal=_prop(f, ln["line"], path, _relpath(f, same[0]),
-                                                                    "moved file (one file of that name in the tree)"))
-    return dict(row, reason="target not found")
-
-
-def _relpath(src_file: str, target: str) -> str:
-    base = PurePosixPath(src_file).parent
-    t = PurePosixPath(target)
-    try:
-        return str(t.relative_to(base)) if str(base) != "." else str(t)
-    except ValueError:
-        ups = len([p for p in base.parts if p not in ("", ".")])
-        return "../" * ups + str(t)
-
-
-def _prop(file: str, line: int, old: str, new: str, rule: str, op: str = "replace") -> dict:
-    return {"file": file, "line": line, "op": op, "old": old, "new": new, "rule": rule}
-
-
-def _anchor(row: dict, f: str, frag: str, fi: _FileInfo, base: set[str] | None, heads: list[dict]) -> dict:
-    if frag in fi.slugs or frag.lower() in {s.lower() for s in fi.slugs} or re.match(r"^L\d+(-L\d+)?$", frag):
-        return row
-    row["status"] = BROKEN
-    if base is not None and frag in base:
-        row["reason"] = "heading renamed or emoji stripped by this change"
-        row["introduced"] = True
-    else:
-        row["reason"] = "no heading or anchor with this slug"
-    near = difflib.get_close_matches(frag.lower(), sorted(fi.slugs), n=1, cutoff=0.6)
-    if near:
-        old = f"#{frag}" if row["target"].startswith("#") else row["target"]
-        new = f"#{near[0]}" if row["target"].startswith("#") else row["target"].split("#")[0] + f"#{near[0]}"
-        row["proposal"] = _prop(row["file"], row["line"], old, new, "§7.1 rule 6: rewrite to the new slug")
-        if row.get("introduced"):
-            h = next((x for x in heads if x["slug"] == near[0]), None)
-            if h:
-                row["proposal_anchor"] = _prop(f, h["line"], "", f'<a name="{frag}"></a>',
-                                               "§7.1 rule 6: keep inbound deep links", op="insert-before")
-    return row
-
-
-def _fixed_urls(resolver: Resolver | None) -> set[str]:
-    """Every URL `references/brand.yaml` holds (the decision 18 footer's href and logo URLs, the brand site, the hub
-    sites): fixed brand content, identical in every repository, so a link check never proposes rewriting one."""
-    out: set[str] = set()
-
-    def walk(v):
-        if isinstance(v, dict):
-            for x in v.values():
-                walk(x)
-        elif isinstance(v, (list, tuple)):
-            for x in v:
-                walk(x)
-        elif isinstance(v, str) and re.match(r"^https?://", v.strip(), re.I):
-            out.add(v.strip().rstrip("/").lower())
-    walk((resolver.brand.raw if resolver is not None and resolver.brand is not None else None) or {})
-    return out
-
-
-def _self_moved(url: str, host: str, resolver: Resolver | None, self_slug) -> tuple[str, str] | None:
-    """A link to this repository under its former slug (a transfer left its own README pointing at the old org:
-    php2shell-check's badges still name CompleteTech-LLC). GitHub redirects it today, but the redirect breaks the day
-    the old owner reuses the name, and the badge, release and clone URLs read wrong. Only an approved repository
-    rename or transfer in the estate actions (`Resolver.repo_before`) that produces exactly this repository counts: a
-    repository of the same name under another org is a different one (every org has its own `.github`). (old, new)."""
-    if not self_slug or not resolver or not (host in ("github.com", "www.github.com", "raw.githubusercontent.com")
-                                             or host.endswith("shields.io")):
-        return None
-    cur_owner, repo = current_login(resolver, self_slug[0]), self_slug[1]
-    hit = resolver.repo_before(f"{cur_owner}/{repo}")
-    if not hit or "/" not in hit[0] or not resolver.repo_action_approved(hit[1]):
-        return None
-    old_owner, old_repo = hit[0].split("/", 1)
-    if resolver.same(old_owner, cur_owner) and old_repo.lower() == repo.lower():
-        return None
-    owners = "|".join(re.escape(a) for a in resolver.aliases(old_owner))
-    m = re.search(r"/(" + owners + r")/(" + re.escape(old_repo) + r")(?=$|[/?#.])", urllib.parse.urlsplit(url).path,
-                  re.I)
-    return (f"{m.group(1)}/{m.group(2)}", f"{cur_owner}/{repo}") if m else None
-
-
-def _remote(row: dict, url: str, resolver: Resolver | None, fetcher: Fetcher | None, self_slug=None) -> dict:
-    full = url if not url.startswith("//") else "https:" + url
-    u = urllib.parse.urlsplit(full)
-    host = (u.hostname or "").lower()
-    row["kind"] = "image" if row["image"] else "remote"
-    if host in LINK_ALLOW_HOSTS or host.endswith(LINK_ALLOW_SUFFIX) or _private_host(host):
-        return dict(row, status="allowlisted", reason="local or example host (§10.2 allowlist)")
-    fixed = full.strip().rstrip("/").lower() in _fixed_urls(resolver)  # decision 18 footer and brand URLs: never rewritten
-    if fixed:
-        row["fixed"] = True
-    moved = None if fixed else _self_moved(full, host, resolver, self_slug)
-    if moved:
-        if _github_ref(full):
-            row["kind"] = "github"
-        new = url.replace(f"/{moved[0]}", f"/{moved[1]}", 1)
-        return dict(row, status="moved", reason=f"this repository under a former owner ({moved[0]}); it is now {moved[1]}",
-                    proposal=_prop(row["file"], row["line"], url, new, "§7.1 links: rewrite to the current slug"))
-    gh = _github_ref(full)
-    if gh:
-        row["kind"] = "github"
-        owner, repo = gh
-        if resolver is not None and not fixed:
-            cur = resolver.canonical(owner)
-            if cur != owner:
-                renamed = cur.lower() != owner.lower()
-                new = url.replace(f"/{owner}/", f"/{cur}/", 1)
-                row.update(status="renamed", reason=f"org renamed: {owner} -> {cur}" if renamed else
-                           f"owner spelled {cur} on GitHub", proposal=_prop(row["file"], row["line"], url, new,
-                                                                             "§7.1 links: rewrite to the current owner"))
-                return row
-        if fetcher is not None and not fixed and in_estate(resolver, owner):
-            res = fetcher.full_name(owner, repo)
-            name = res.get("full_name")
-            if name and name != f"{owner}/{repo}":
-                new_owner, new_repo = name.split("/", 1)
-                new = url.replace(f"/{owner}/{repo}", f"/{new_owner}/{new_repo}", 1)
-                return dict(row, status="moved", reason=f"repository is now {name}",
-                            proposal=_prop(row["file"], row["line"], url, new, "§7.1 links: full_name differs"))
-            if res.get("error") == "404":
-                return dict(row, status=BROKEN, reason="repository not found (dead-link; keep the link)")
-    if fetcher is None:
-        return dict(row, status="unchecked", reason="offline (pass --online for the cached §10.2 GET)")
-    res = fetcher.check(full)
-    st = res.get("status")
-    row["http"] = st
-    if st is not None and 200 <= st < 400:
-        return row
-    if st in (404, 410) or res.get("error") == "dns":
-        return dict(row, status=BROKEN, reason=f"HTTP {st}" if st else "host does not resolve")
-    return dict(row, status="unverified", reason=f"HTTP {st}" if st else (res.get("error") or "no answer"))
-
-
-def links_report(tree: Tree, files: list[str], *, resolver=None, fetcher=None, online=False, base=None,
-                 strict=False, self_slug: tuple[str, str] | None = None) -> dict:
-    res = check_links(tree, files, resolver=resolver, fetcher=fetcher, online=online, base=base,
-                      base_files=files if base is not None else None, self_slug=self_slug)
-    broken = [x for x in res["findings"] if x["status"] == BROKEN]
-    pre: set = set()
-    if base is not None:
-        bfiles = [f for f in files if base.is_file(f)]
-        bres = check_links(base, bfiles, resolver=resolver, fetcher=None, online=False)
-        pre = {(x["file"], x["target"]) for x in bres["findings"] if x["status"] == BROKEN}
-    for x in broken:
-        x["introduced"] = bool(x.get("introduced")) or (base is not None and (x["file"], x["target"]) not in pre)
-    introduced = [x for x in broken if x["introduced"]]
-    logs = sorted({"dead-link"} if broken else set())
-    if any(x["status"] in ("renamed", "moved") for x in res["findings"]):
-        logs.append("link-rewrite")
-    if base is not None or strict:
-        result = "fail" if (introduced if base is not None else broken) else ("warn" if broken else "pass")
-    else:
-        result = "warn" if broken else "pass"
-    counts: dict[str, int] = {}
-    for x in res["findings"]:
-        counts[x["status"]] = counts.get(x["status"], 0) + 1
-    proposals = [x["proposal"] for x in res["findings"] if x.get("proposal")] + \
-        [x["proposal_anchor"] for x in res["findings"] if x.get("proposal_anchor")]
-    rows = [[x["file"], str(x["line"]), x["kind"], x["target"], x["reason"], "introduced" if x["introduced"] else
-             "pre-existing"] for x in broken]
-    return {"result": result, "counts": counts, "findings": res["findings"], "broken": len(broken),
-            "introduced": len(introduced), "proposals": proposals, "dead_links_tsv": rows,
-            "baseline": "git ref" if base is not None else None, "logs": logs}
-
-
-def proposal_diff(tree: Tree, proposals: list[dict]) -> str:
-    """Unified diff of the proposals applied in memory (the file on disk is never changed)."""
-    out = []
-    by_file: dict[str, list[dict]] = {}
-    for p in proposals:
-        by_file.setdefault(p["file"], []).append(p)
-    for f, props in sorted(by_file.items()):
-        text = tree.read(f) or ""
-        lines = text.split("\n")
-        new = list(lines)
-        inserts: dict[int, list[str]] = {}
-        for p in props:
-            i = p["line"] - 1
-            if not 0 <= i < len(new):
-                continue
-            if p["op"] == "insert-before":
-                if p["new"] not in inserts.setdefault(i, []):
-                    inserts[i].append(p["new"])
-            elif p["old"] and p["old"] in new[i]:
-                # the whole target only: a link that is a prefix of another target on the line (`.../tests.yml` and
-                # `.../tests.yml/badge.svg`) must not rewrite the longer one
-                rx = re.compile(re.escape(p["old"]) + r"(?![\w/.%?#=&~:+-])")
-                new[i] = rx.sub(lambda _m: p["new"], new[i], count=1) if rx.search(new[i]) else \
-                    new[i].replace(p["old"], p["new"], 1)
-        merged = []
-        for i, ln in enumerate(new):
-            merged += inserts.get(i, [])
-            merged.append(ln)
-        out += difflib.unified_diff([x + "\n" for x in lines], [x + "\n" for x in merged], f"a/{f}", f"b/{f}")
-    return "".join(out)
-
-
-# =====================================================================================================
-# linguist (RP-07, CQ-08)
-# =====================================================================================================
-EXT_LANG = {
-    ".py": "Python", ".pyi": "Python", ".js": "JavaScript", ".mjs": "JavaScript", ".cjs": "JavaScript",
-    ".jsx": "JavaScript", ".ts": "TypeScript", ".mts": "TypeScript", ".cts": "TypeScript", ".tsx": "TSX",
-    ".html": "HTML", ".htm": "HTML", ".css": "CSS", ".scss": "SCSS", ".sass": "Sass", ".less": "Less", ".php": "PHP",
-    ".rs": "Rust", ".go": "Go", ".java": "Java", ".kt": "Kotlin", ".kts": "Kotlin", ".swift": "Swift", ".c": "C",
-    ".h": "C", ".cc": "C++", ".cpp": "C++", ".cxx": "C++", ".hpp": "C++", ".cs": "C#", ".rb": "Ruby", ".sh": "Shell",
-    ".bash": "Shell", ".zsh": "Shell", ".ps1": "PowerShell", ".psm1": "PowerShell", ".bat": "Batchfile",
-    ".cmd": "Batchfile", ".ipynb": "Jupyter Notebook", ".mmd": "Mermaid", ".mermaid": "Mermaid", ".vim": "Vim Script",
-    ".snippets": "Vim Snippet", ".lua": "Lua", ".dart": "Dart", ".vue": "Vue", ".svelte": "Svelte", ".astro": "Astro",
-    ".r": "R", ".jl": "Julia", ".tex": "TeX", ".gd": "GDScript", ".scala": "Scala", ".ex": "Elixir", ".exs": "Elixir",
-    ".hs": "Haskell", ".zig": "Zig", ".nix": "Nix", ".tf": "HCL", ".hcl": "HCL", ".m": "Objective-C",
-    ".sol": "Solidity", ".pl": "Perl", ".clj": "Clojure", ".fs": "F#", ".ml": "OCaml", ".nim": "Nim", ".erl": "Erlang",
-    ".groovy": "Groovy", ".roff": "Roff", ".1": "Roff", ".mdx": "MDX", ".svg": None, ".ejs": "EJS",
-    ".hbs": "Handlebars", ".jinja": "Jinja", ".j2": "Jinja", ".twig": "Twig", ".cu": "Cuda", ".asm": "Assembly",
-}
-NAME_LANG = {"Dockerfile": "Dockerfile", "Makefile": "Makefile", "makefile": "Makefile", "GNUmakefile": "Makefile",
-             "CMakeLists.txt": "CMake", "Jenkinsfile": "Groovy"}
-# programming languages a chip or badge 1 may name (RP-07 rule 3); markup, config and snippet languages are left out
-PROGRAMMING = {"Python", "JavaScript", "TypeScript", "TSX", "Go", "Rust", "PHP", "Shell", "PowerShell", "C", "C++",
-               "C#", "Java", "Kotlin", "Swift", "Lua", "GDScript", "Ruby", "Dart", "Scala", "Elixir", "Haskell", "Zig",
-               "R", "Julia", "Objective-C", "Vue", "Svelte", "Solidity", "Perl", "Clojure", "F#", "OCaml", "Nim",
-               "Erlang", "Groovy", "Jupyter Notebook", "Cuda", "Assembly", "Nix", "HCL", "Astro"}
-# Linguist's own vendored and documentation paths (vendor.yml, documentation.yml), approximated: never proposed again
-LINGUIST_VENDORED = [re.compile(p) for p in (
-    r"(^|/)node_modules/", r"(^|/)vendors?/", r"(^|/)(3rd|[Tt]hird)[-_]?[Pp]arty/", r"(^|/)bower_components/",
-    r"(^|/)extern(al)?/", r"^deps/", r"^[Dd]ependencies/", r"(^|/)cache/", r"(\.|-)min\.(js|css)$",
-    r"(^|/)jquery[^/]*\.js$", r"(^|/)bootstrap[^/]*\.(js|css)$", r"\.(js|css)\.map$", r"(^|/)\.(yarn|pnpm-store)/",
-    r"(^|/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|poetry\.lock|Cargo\.lock|go\.sum)$")]
-LINGUIST_DOCS = [re.compile(p) for p in (
-    r"^[Dd]ocs?/", r"(^|/)[Dd]ocumentation/", r"(^|/)[Jj]avadoc/", r"^[Mm]an/", r"^[Ee]xamples/", r"^[Dd]emos?/",
-    r"(^|/)inst/doc/", r"(^|/)CHANGE(S|LOG)?(\.|$)", r"(^|/)CONTRIBUTING(\.|$)", r"(^|/)COPYING(\.|$)",
-    r"(^|/)INSTALL(\.|$)", r"(^|/)LICEN[CS]E(\.|$)", r"(^|/)README(\.|$)")]
-# Candidates for the `# ct-std linguist` block (STANDARD §8.5): generated output and example or fixture material
-GENERATED_DIRS = ("results", "reports", "report", "output", "outputs", "out", "build", "dist", "coverage", "htmlcov",
-                  "_site", "site", "generated", "__generated__", "gen", "storybook-static", "artifacts", "runs")
-DOC_DIRS = ("docs", "doc", "examples", "example", "demo", "demos", "samples", "sample", "assets/examples",
-            "assets/diagrams", "fixtures", "testdata", "test-data", "__fixtures__", "__snapshots__", "snapshots")
-GENERATED_MARK = re.compile(r"@generated|DO NOT EDIT|auto-?generated|generated by|<meta[^>]+name=[\"']generator", re.I)
-MANIFEST_LANG = (("pyproject.toml", "Python"), ("setup.py", "Python"), ("setup.cfg", "Python"), ("Pipfile", "Python"),
-                 ("requirements.txt", "Python"), ("Cargo.toml", "Rust"), ("go.mod", "Go"), ("composer.json", "PHP"),
-                 ("Gemfile", "Ruby"), ("pubspec.yaml", "Dart"), ("Package.swift", "Swift"), ("mix.exs", "Elixir"),
-                 ("project.godot", "GDScript"), ("package.json", "JavaScript"), ("pom.xml", "Java"),
-                 ("build.gradle", "Java"), ("build.gradle.kts", "Kotlin"))
-BLOCK_HEAD = "# ct-std linguist"
-
-
-def file_language(path: str) -> str | None:
-    name = PurePosixPath(path).name
-    if name in NAME_LANG:
-        return NAME_LANG[name]
-    return EXT_LANG.get(PurePosixPath(name).suffix.lower())
-
-
-def _gitattributes(text: str) -> list[tuple[re.Pattern, bool]]:
-    """(pattern, excluded?) for linguist-vendored/-generated/-documentation lines; later lines win."""
-    out = []
-    for ln in (text or "").splitlines():
-        ln = ln.strip()
-        if not ln or ln.startswith("#"):
-            continue
-        pat, *attrs = ln.split()
-        for a in attrs:
-            m = re.match(r"^(-|!)?linguist-(vendored|generated|documentation)(?:=(true|false))?$", a)
-            if m:
-                out.append((_gitglob(pat), not m.group(1) and m.group(3) != "false"))
-    return out
-
-
-def _gitglob(pat: str) -> re.Pattern:
-    anchored = pat.startswith("/") or "/" in pat.rstrip("/")
-    p = pat.lstrip("/")
-    rx = ""
-    i = 0
-    while i < len(p):
-        if p.startswith("**/", i):
-            rx += "(?:.*/)?"
-            i += 3
-        elif p.startswith("/**", i) and i + 3 == len(p):
-            rx += "/.*"
-            i += 3
-        elif p.startswith("**", i):
-            rx += ".*"
-            i += 2
-        elif p[i] == "*":
-            rx += "[^/]*"
-            i += 1
-        elif p[i] == "?":
-            rx += "[^/]"
-            i += 1
-        else:
-            rx += re.escape(p[i])
-            i += 1
-    if p.endswith("/"):
-        rx += ".*"
-    return re.compile(("^" if anchored else "(^|.*/)") + rx + "(/.*)?$")
-
-
-def _excluded_by_linguist(path: str, attrs: list[tuple[re.Pattern, bool]]) -> bool:
-    state = any(r.search(path) for r in LINGUIST_VENDORED + LINGUIST_DOCS) or path.startswith(".")
-    for rx, excl in attrs:
-        if rx.match(path):
-            state = excl
-    return state
-
-
-def _candidate(path: str, head: str | None) -> tuple[str, str, str, str] | None:
-    """(glob, attribute, reason, confidence) for a path the block should cover, else None."""
-    parts = path.split("/")
-    for i, seg in enumerate(parts[:-1]):
-        low = seg.lower()
-        prefix = "/".join(parts[:i + 1])
-        if low in GENERATED_DIRS:
-            return f"{prefix}/**", "linguist-generated", f"generated output ({seg}/)", "high"
-        two = "/".join(p.lower() for p in parts[max(0, i - 1):i + 1])
-        if low in DOC_DIRS or two in DOC_DIRS:
-            conf = "review" if low in ("fixtures", "testdata", "test-data", "__fixtures__", "snapshots",
-                                       "__snapshots__") else "high"
-            return f"{prefix}/**", "linguist-documentation", f"examples, fixtures or docs ({prefix}/)", conf
-    name = parts[-1].lower()
-    if path.lower().endswith((".html", ".htm")) and re.search(r"(report|results?|output|coverage|sample)", name):
-        return path, "linguist-generated", "generated HTML report", "review"
-    if head and GENERATED_MARK.search(head):
-        return path, "linguist-generated", "file says it is generated", "high"
-    if path.lower().endswith((".mmd", ".mermaid")):
-        return path, "linguist-documentation", "diagram source", "high"
-    return None
-
-
-def manifest_language(files: set[str], read, bytes_by_lang: dict | None = None) -> str | None:
-    """RP-07 rule 1: the runtime named by a root manifest (TypeScript when package.json uses it)."""
-    roots = {f for f in files if "/" not in f}
-    found = []
-    for name, lang in MANIFEST_LANG:
-        if name in roots or (name == "requirements.txt" and any(re.fullmatch(r"requirements[^/]*\.txt", f) for f in roots)):
-            if lang == "JavaScript":
-                pj = read("package.json") or ""
-                if "tsconfig.json" in roots or re.search(r'"typescript"\s*:', pj):
-                    lang = "TypeScript"
-                elif not re.search(r'"(main|bin|exports|module)"\s*:|"(dependencies)"\s*:\s*\{\s*"', pj):
-                    continue  # a package.json for tooling only (lint, prettier) names no runtime
-            if lang == "Java" and any(f.endswith(".kt") for f in files):
-                lang = "Kotlin"
-            if lang not in found:
-                found.append(lang)
-    if not found:
-        return None
-    if len(found) > 1 and bytes_by_lang:
-        return max(found, key=lambda lg: (bytes_by_lang.get(lg, 0) + bytes_by_lang.get("TSX" if lg == "TypeScript"
-                                                                                      else "", 0), -found.index(lg)))
-    return found[0]
-
-
-def primary_language(meta: dict, files: set[str] | None = None, read=None, override: dict | None = None,
-                     corrected: dict | None = None) -> tuple[str | None, str]:
-    """The language a banner chip, card dot or badge 1 may show (RP-07): manifest runtime, then a `language:`
-    override (`.github/showcase.yml` or the registry), then the top language after the linguist correction if it is
-    a programming language. (None, "language-omitted") when none applies."""
-    if files:
-        lang = manifest_language(files, read or (lambda _p: None), corrected or meta.get("languages") or {})
-        if lang:
-            return lang, "manifest"
-    if override and override.get("language"):
-        return str(override["language"]), "override"
-    langs = corrected if corrected is not None else (meta.get("languages") or {})
-    ranked = sorted(((v, k) for k, v in langs.items() if v > 0), reverse=True)
-    for _, k in ranked[:1]:
-        if k in PROGRAMMING:
-            return ("TypeScript" if k == "TSX" else k), "linguist"
-    if not ranked and meta.get("language") in PROGRAMMING:
-        return meta["language"], "github"
-    return None, "language-omitted"
-
-
-def _bar(langs: dict) -> list[dict]:
-    total = sum(v for v in langs.values() if v > 0) or 1
-    return [{"language": k, "bytes": v, "share": round(v / total, 4)}
-            for k, v in sorted(langs.items(), key=lambda kv: -kv[1]) if v > 0]
-
-
-def linguist_report(meta: dict, tree: Tree | None = None, files: list[str] | None = None,
-                    sizes: dict | None = None, override: dict | None = None, min_share: float = 0.02) -> dict:
-    """Paths that distort the language bar, the proposed append-only `# ct-std linguist` block, and the corrected
-    primary language. `tree` is a checkout; without one, `files`/`sizes` come from captured metadata."""
-    if tree is not None:
-        all_files = set(tree.files)
-        size_of, read = tree.size, tree.read
-    else:
-        all_files = set(files or meta.get("files") or [])
-        sizes = sizes or meta.get("file_sizes") or {}
-        manifests = meta.get("manifests") or {}
-
-        def size_of(p):
-            return int(sizes.get(p, 0))
-
-        def read(p):
-            return manifests.get(p)
-    if not all_files:
-        raise NeedsInput("file-tree", "linguist needs a checkout (--repo-dir) or a captured file tree in the metadata")
-    ga_text = read(".gitattributes") or ""
-    attrs = _gitattributes(ga_text)
-    counted: dict[str, int] = {}
-    cands: dict[str, dict] = {}
-    for p in sorted(all_files):
-        lang = file_language(p)
-        if not lang or _excluded_by_linguist(p, attrs):
-            continue
-        n = size_of(p)
-        counted[lang] = counted.get(lang, 0) + n
-        head = None
-        if lang in ("HTML", "JavaScript", "TypeScript", "CSS", "Python") and tree is not None and n <= 2_000_000:
-            head = (read(p) or "")[:1024]
-        c = _candidate(p, head)
-        if not c:
-            continue
-        glob, attr, reason, conf = c
-        row = cands.setdefault(glob, {"pattern": glob, "attribute": attr, "reason": reason, "confidence": conf,
-                                      "bytes": 0, "languages": {}, "files": 0})
-        row["bytes"] += n
-        row["files"] += 1
-        row["languages"][lang] = row["languages"].get(lang, 0) + n
-    github = {k: int(v) for k, v in (meta.get("languages") or {}).items()}
-    before = github or counted
-    total = sum(before.values()) or 1
-    proposed = []
-    for row in sorted(cands.values(), key=lambda r: -r["bytes"]):
-        manifest_inside = any(f.startswith(row["pattern"][:-2]) and PurePosixPath(f).name in
-                              ("package.json", "pyproject.toml", "Cargo.toml", "go.mod") for f in all_files) \
-            if row["pattern"].endswith("/**") else False
-        if manifest_inside:
-            row["confidence"] = "review"
-            row["reason"] += "; holds a manifest, so it may be real source"
-        row["share"] = round(row["bytes"] / total, 4)
-        if row["share"] >= min_share:
-            proposed.append(row)
-    after = dict(before)
-    for row in proposed:
-        for lg, n in row["languages"].items():
-            if lg in after:
-                after[lg] = max(0, after[lg] - n)
-    old_primary = primary_language(meta, None, None, override, before)
-    new_primary = primary_language(meta, all_files, read, override, after)
-    raw_top = max(before, key=before.get) if before else meta.get("language")
-    for row in proposed:
-        row["changes_primary"] = bool(raw_top) and raw_top in row["languages"] and \
-            (max(after, key=after.get) if any(after.values()) else None) != raw_top
-    present = {ln.strip() for ln in ga_text.splitlines()}
-    lines = [f"{r['pattern']} {r['attribute']}" for r in proposed]
-    new_lines = [ln for ln in lines if ln not in present]
-    diff = ""
-    if new_lines:
-        old = ga_text
-        if BLOCK_HEAD in old:
-            idx = old.split("\n")
-            pos = idx.index(next(x for x in idx if x.strip() == BLOCK_HEAD)) + 1
-            while pos < len(idx) and idx[pos].strip() and not idx[pos].startswith("#"):
-                pos += 1
-            new = "\n".join(idx[:pos] + new_lines + idx[pos:])
-        else:
-            new = old + ("" if not old or old.endswith("\n") else "\n") + ("\n" if old.strip() else "") + \
-                BLOCK_HEAD + "\n" + "\n".join(new_lines) + "\n"
-        diff = "".join(difflib.unified_diff(old.splitlines(True), new.splitlines(True), "a/.gitattributes",
-                                            "b/.gitattributes"))
-    logs = []
-    if new_primary[0] is None:
-        logs.append("language-omitted")
-    if new_lines:
-        logs.append("linguist-proposal")
-    return {"result": "proposal" if new_lines else "pass",
-            "github_language": meta.get("language"), "bar_before": _bar(before), "bar_after": _bar(after),
-            "primary": {"language": new_primary[0], "source": new_primary[1]},
-            "primary_before": {"language": old_primary[0], "source": old_primary[1]},
-            "candidates": sorted(cands.values(), key=lambda r: -r["bytes"]), "proposed": proposed,
-            "gitattributes_lines": new_lines, "diff": diff,
-            "note": "Append-only block; linguist-generated and linguist-documentation lines only; never on real source. "
-                    "A writer confirms the list and the G1 report approves it; after the merge, re-read "
-                    "GET /repos/{o}/{r}/languages before generating the banner and card (STANDARD §8.5).",
-            "logs": logs}
-
-
-# =====================================================================================================
-# actions (RP-06, RP-01, CQ-13)
-# =====================================================================================================
-RED = {"failure", "timed_out", "startup_failure"}
-POLISH_PATHS = ("README.md", "docs/images/banner.png", "docs/images/card.svg", "docs/images/.showcase.json",
-                "assets/icon.png", "assets/social-preview.png", ".github/showcase.yml", "CONTRIBUTING.md")
-DEPLOY_USES = ("actions/deploy-pages", "peaceiris/actions-gh-pages", "jamesives/github-pages-deploy-action",
-               "amondnet/vercel-action", "vercel/", "netlify/", "nwtgck/actions-netlify", "cloudflare/wrangler-action",
-               "cloudflare/pages-action", "aws-actions/", "azure/webapps-deploy", "azure/static-web-apps-deploy",
-               "google-github-actions/deploy", "firebaseextended/action-hosting-deploy", "appleboy/ssh-action",
-               "appleboy/scp-action", "easingthemes/ssh-deploy", "samkirkland/ftp-deploy-action",
-               "docker/build-push-action", "pypa/gh-action-pypi-publish", "softprops/action-gh-release",
-               "superfly/flyctl-actions", "akhileshns/heroku-deploy", "dokku/github-action", "burnett01/rsync-deployments")
-DEPLOY_RUN = re.compile(r"\b(vercel\b[^\n]*--prod|netlify\s+deploy|wrangler\s+(pages\s+)?(deploy|publish)|firebase\s+deploy|"
-                        r"gh-pages\b|npm\s+publish|yarn\s+publish|twine\s+upload|docker\s+push|rsync\b|scp\b|"
-                        r"flyctl\s+deploy|kubectl\s+apply|helm\s+upgrade|gh\s+release\s+create|aws\s+s3\s+sync|"
-                        r"curl\b[^\n]*(deploy|hook))", re.I)
-UPSTREAM_USES = {"contributor-assistant/github-action": "CLA", "cla-assistant/": "CLA", "actions/labeler": "labeler",
-                 "github/issue-labeler": "labeler", "actions/stale": "stale closer", "dessant/lock-threads": "lock threads",
-                 "actions/first-interaction": "greeter", "release-drafter/release-drafter": "release drafter",
-                 "peter-evans/close-": "issue closer", "dependabot/fetch-metadata": "dependabot auto-merge",
-                 "amannn/action-semantic-pull-request": "PR title lint", "actions/add-to-project": "project automation",
-                 "pozil/auto-assign-issue": "auto assign", "kentaro-m/auto-assign-action": "auto assign"}
-UPSTREAM_NAMES = re.compile(r"(^|[-_/.])(cla|stale|labeler|label|lock|triage|greetings?|welcome|close[-_]?issues?|"
-                            r"auto[-_]?assign|release[-_]?drafter)([-_.]|$)", re.I)
-EXTERNAL_FILES = {"vercel.json": "Vercel", "netlify.toml": "Netlify", "wrangler.toml": "Cloudflare",
-                  "wrangler.json": "Cloudflare", "wrangler.jsonc": "Cloudflare", "firebase.json": "Firebase",
-                  "render.yaml": "Render", "fly.toml": "Fly.io", "app.yaml": "App Engine", "Procfile": "Heroku"}
-
-
-def _filter_rx(pat: str) -> re.Pattern:
-    """GitHub Actions filter pattern: `**`, `*`, `?` and `+` (quantifiers on the preceding character), `[...]`."""
-    rx, i = "", 0
-    while i < len(pat):
-        c = pat[i]
-        if pat.startswith("**", i):
-            rx += ".*"
-            i += 2
-            continue
-        if c == "*":
-            rx += "[^/]*"
-        elif c in "?+":
-            rx += c
-        elif c == "[":
-            j = pat.find("]", i)
-            rx += pat[i:j + 1] if j > i else re.escape(c)
-            i = j if j > i else i
-        else:
-            rx += re.escape(c)
-        i += 1
-    return re.compile("^" + rx + "$")
-
-
-def _match_any(patterns, value: str) -> bool:
-    pats = [patterns] if isinstance(patterns, str) else list(patterns or [])
-    hit = False
-    for p in pats:
-        p = str(p)
-        neg = p.startswith("!")
-        if _filter_rx(p[1:] if neg else p).match(value):
-            hit = not neg
-    return hit
-
-
-def _on(doc: dict) -> dict:
-    on = doc.get("on", doc.get(True))
-    if isinstance(on, str):
-        return {on: None}
-    if isinstance(on, list):
-        return {str(e): None for e in on}
-    return dict(on) if isinstance(on, dict) else {}
-
-
-def push_triggered(spec, branch: str, changed) -> bool:
-    """Would a merge commit on `branch` touching only `changed` paths start this `on.push`?"""
-    spec = spec if isinstance(spec, dict) else {}
-    br, bri = spec.get("branches"), spec.get("branches-ignore")
-    if br is None and bri is None and (spec.get("tags") is not None or spec.get("tags-ignore") is not None):
-        return False
-    if br is not None and not _match_any(br, branch):
-        return False
-    if bri is not None and _match_any(bri, branch):
-        return False
-    paths, ign = spec.get("paths"), spec.get("paths-ignore")
-    if paths is not None:
-        return any(_match_any(paths, c) for c in changed)
-    if ign is not None:
-        return not all(_match_any(ign, c) for c in changed)
-    return True
-
-
-def _walk_steps(doc: dict):
-    for name, job in (doc.get("jobs") or {}).items():
-        if not isinstance(job, dict):
-            continue
-        yield name, job, None
-        for st in job.get("steps") or []:
-            if isinstance(st, dict):
-                yield name, job, st
-
-
-def workflow_facts(path: str, text: str, default_branch: str, changed=POLISH_PATHS, repo: str = "",
-                   resolver: Resolver | None = None) -> dict:
-    try:
-        doc = load_yaml_text(text) or {}
-    except Exception as exc:  # a malformed workflow is reported, never fixed
-        return {"path": path, "error": f"yaml: {str(exc)[:120]}", "events": []}
-    doc = doc if isinstance(doc, dict) else {}
-    on = _on(doc)
-    deploy, upstream, envs = [], [], []
-    guards = set()
-    for _jname, job, st in _walk_steps(doc):
-        if st is None:
-            env = job.get("environment")
-            if env:
-                envs.append(env.get("name") if isinstance(env, dict) else str(env))
-            cond = str(job.get("if") or "")
-        else:
-            uses = str(st.get("uses") or "").lower()
-            run = str(st.get("run") or "")
-            cond = str(st.get("if") or "")
-            deploy += [f"uses {uses}" for d in DEPLOY_USES if uses.startswith(d)]
-            if DEPLOY_RUN.search(run):
-                deploy.append(f"run {DEPLOY_RUN.search(run).group(0)[:40]}")
-            upstream += [f"{label} ({uses})" for key, label in UPSTREAM_USES.items() if uses.startswith(key)]
-        for m in re.finditer(r"github\.repository(_owner)?\s*==\s*['\"]([^'\"]+)['\"]", cond):
-            guards.add(m.group(2))
-    perms = json.dumps(doc.get("permissions") or {}) + json.dumps([j.get("permissions") for _, j, s in _walk_steps(doc)
-                                                                  if s is None])
-    if '"pages": "write"' in perms:
-        deploy.append("permissions pages: write")
-    if envs:
-        deploy.append("environment " + ", ".join(sorted(set(map(str, envs)))))
-    name = str(doc.get("name") or PurePosixPath(path).name)
-    if not deploy and re.search(r"(deploy|publish|pages|release)", f"{name} {PurePosixPath(path).stem}", re.I):
-        deploy.append("named deploy/publish/release/pages")
-    if not upstream and UPSTREAM_NAMES.search(PurePosixPath(path).stem):
-        upstream.append(f"named {PurePosixPath(path).stem}")
-    def ours(g: str) -> bool:  # `github.repository[_owner] == '...'` names this repository or its org, under any login
-        if resolver is not None and "/" in g and "/" in repo:
-            return resolver.slug(g).lower() == resolver.slug(repo).lower()
-        if resolver is not None and "/" not in g:
-            return resolver.same(g, repo.split("/")[0])
-        return g.lower() in (repo.lower(), repo.split("/")[0].lower())
-    guarded = bool(guards) and not any(ours(g) for g in guards)
-    return {"path": path, "name": name, "events": sorted(on), "push": "push" in on,
-            "merge_triggers": "push" in on and push_triggered(on.get("push"), default_branch, changed),
-            "workflow_run": list(((on.get("workflow_run") or {}) or {}).get("workflows") or []) if isinstance(
-                on.get("workflow_run"), dict) else [],
-            "schedule": "schedule" in on, "deploy": sorted(set(deploy)), "upstream": sorted(set(upstream)),
-            "environments": sorted(set(map(str, envs))), "guarded_to": sorted(guards), "guarded": guarded}
-
-
-def _norm_runs(obj) -> list[dict]:
-    if isinstance(obj, dict):
-        obj = obj.get("workflow_runs") or obj.get("runs") or []
-    out = []
-    for r in obj or []:
-        if not isinstance(r, dict):
-            continue
-        out.append({"workflow": r.get("workflowName") or r.get("name") or "",
-                    "path": (r.get("path") or "").split("@")[0],
-                    "workflow_id": r.get("workflow_id") or r.get("workflowDatabaseId"),
-                    "branch": r.get("head_branch") or r.get("headBranch"), "event": r.get("event"),
-                    "status": r.get("status"), "conclusion": r.get("conclusion") or None,
-                    "created_at": r.get("created_at") or r.get("createdAt") or "",
-                    "sha": r.get("head_sha") or r.get("headSha"),
-                    "url": r.get("html_url") or r.get("url")})
-    return out
-
-
-def _norm_workflows(obj) -> list[dict]:
-    if isinstance(obj, dict):
-        obj = obj.get("workflows") or []
-    return [{"id": w.get("id"), "name": w.get("name"), "path": w.get("path"), "state": w.get("state"),
-             "badge_url": w.get("badge_url")} for w in obj or [] if isinstance(w, dict)]
-
-
-def readme_ci_badges(readme: str) -> list[str]:
-    """Workflow files whose status badge the README shows."""
-    return sorted(set(re.findall(r"/actions/workflows/([^/\s\"')]+?\.ya?ml)/badge\.svg", readme or "")))
-
-
-def actions_report(meta: dict, *, runs=None, workflows=None, workflow_files: dict | None = None, readme: str = "",
-                   root_files=(), pages: dict | None = None, resolver: Resolver | None = None,
-                   changed=POLISH_PATHS, approval_ids: dict | None = None) -> dict:
-    """Per-repo Actions health for the orchestrator: red badges, upstream-only automation in forks, and what a
-    README merge would start (deploys first: RP-01)."""
-    owner, repo = meta.get("owner", "unknown"), meta.get("repo", "unknown")
-    full = f"{current_login(resolver, owner)}/{repo}"
-    branch = meta.get("default_branch") or "main"
-    runs_n, wfs = _norm_runs(runs), _norm_workflows(workflows)
-    files = dict(workflow_files or {})
-    by_path: dict[str, dict] = {}
-    for w in wfs:
-        if w.get("path"):
-            by_path.setdefault(w["path"], {}).update(api=w)
-    for p, text in files.items():
-        by_path.setdefault(p, {})["facts"] = workflow_facts(p, text, branch, changed, full, resolver)
-    name_to_path = {(v.get("api") or {}).get("name") or (v.get("facts") or {}).get("name"): p for p, v in by_path.items()}
-    id_to_path = {(v.get("api") or {}).get("id"): p for p, v in by_path.items() if (v.get("api") or {}).get("id")}
-    for r in runs_n:
-        p = r["path"] or id_to_path.get(r["workflow_id"]) or name_to_path.get(r["workflow"])
-        if not p:
-            p = f"(dynamic) {r['workflow']}"
-        by_path.setdefault(p, {}).setdefault("runs", []).append(r)
-    fork = bool(meta.get("fork")) or repo.endswith("-fork")
-    parent = (meta.get("parent") or {}).get("full_name") if isinstance(meta.get("parent"), dict) else meta.get("parent")
-    parent_owner = parent.split("/")[0] if parent else None
-    upstream_fork = fork and not (parent_owner and in_estate(resolver, parent_owner))
-    badges = readme_ci_badges(readme)
-    rows, deploy_rows, proposals, jobs, logs = [], [], [], [], []
-    push_names = set()
-    for p, v in by_path.items():
-        f = v.get("facts") or {}
-        if f.get("merge_triggers"):
-            push_names.add(f.get("name"))
-            push_names.add((v.get("api") or {}).get("name"))
-    for p, v in sorted(by_path.items()):
-        api, f = v.get("api") or {}, v.get("facts") or {}
-        on_branch = [r for r in v.get("runs") or [] if r["branch"] == branch]
-        on_branch.sort(key=lambda r: r["created_at"], reverse=True)
-        done = [r for r in on_branch if r["status"] in (None, "completed")]
-        latest = done[0] if done else None
-        concl = (latest or {}).get("conclusion") or ("pending" if on_branch else "none")
-        state = api.get("state") or ("unknown" if not api else None)
-        flags = []
-        if concl in RED:
-            flags.append("ci-red")
-        if state in ("disabled_manually", "disabled_inactivity", "disabled_fork"):
-            flags.append(state)
-        chained = [n for n in f.get("workflow_run") or [] if n in push_names]
-        triggers = []
-        if f.get("merge_triggers"):
-            triggers.append("push")
-        if chained:
-            triggers.append("workflow_run:" + ",".join(chained))
-        if f.get("schedule"):
-            triggers.append("schedule")
-        fname = PurePosixPath(p).name
-        badge = fname in badges
-        if badge and concl != "success":
-            flags.append("badge-red" if concl in RED else "badge-unknown")
-        is_deploy = bool(f.get("deploy"))
-        if is_deploy and (f.get("merge_triggers") or chained):
-            flags.append("deploy-on-merge")
-            deploy_rows.append({"repo": full, "workflow": p, "trigger": "+".join(triggers),
-                                "environment": ",".join(f.get("environments") or []) or "-",
-                                "external": "-", "suppressed_by_skip_ci": True})
-        if is_deploy and f.get("schedule"):
-            deploy_rows.append({"repo": full, "workflow": p, "trigger": "schedule",
-                                "environment": ",".join(f.get("environments") or []) or "-", "external": "-",
-                                "suppressed_by_skip_ci": False})
-        upstream = upstream_fork and not f.get("guarded") and state not in ("disabled_manually", "disabled_fork") and (
-            bool(f.get("upstream")) or (f.get("schedule") and concl in RED))
-        if upstream:
-            flags.append("upstream-only")
-            # the file name, never the numeric id: the guard matches the workflow-toggle approval's detail (the
-            # workflow file) against this argument (scripts/guard.py B5)
-            wid = fname
-            reason = ", ".join(f.get("upstream") or ["failing upstream schedule"])
-            jid = job_id("p0", "workflow-toggle", full, fname)
-            job = writer_job(jid, "3", "workflow-toggle", full, ["gh", "workflow", "disable", str(wid), "-R", full],
-                             f"Disable upstream-only automation in a kept fork ({reason}); never edit the workflow "
-                             "file (RP-06, CQ-13, q79).", (approval_ids or {}).get(fname) or (approval_ids or {}).get(p))
-            (jobs if job.get("approval_id") else proposals).append(job)
-        rows.append({"path": p, "name": f.get("name") or api.get("name") or v.get("runs", [{}])[0].get("workflow"),
-                     "state": state, "latest": concl, "latest_at": (latest or {}).get("created_at"),
-                     "latest_url": (latest or {}).get("url"), "events": f.get("events") or [],
-                     "merge_triggers": triggers, "deploy": f.get("deploy") or [], "upstream": f.get("upstream") or [],
-                     "guarded_to": f.get("guarded_to") or [], "badge": badge, "flags": flags,
-                     **({"error": f["error"]} if f.get("error") else {})})
-    externals = sorted({EXTERNAL_FILES[n] for n in root_files if n in EXTERNAL_FILES})
-    for ext in externals:
-        deploy_rows.append({"repo": full, "workflow": "-", "trigger": "external integration", "environment": "-",
-                            "external": ext, "suppressed_by_skip_ci": False})
-    has_pages_wf = any("uses actions/deploy-pages" in (r["deploy"] or []) for r in rows)
-    pages_src = (pages or {}).get("source") or {}
-    if (pages or {}).get("build_type") == "legacy" or (meta.get("has_pages") and not pages and not has_pages_wf):
-        if not pages or pages_src.get("branch") in (None, branch):
-            deploy_rows.append({"repo": full, "workflow": "pages-build-deployment", "trigger": "branch-source Pages",
-                                "environment": "github-pages", "external": "GitHub Pages" if pages else
-                                "GitHub Pages (assumed: has_pages, no Pages workflow)", "suppressed_by_skip_ci": False})
-    if any("ci-red" in r["flags"] for r in rows):
-        logs.append("ci-red")
-    if any(r["flags"] and set(r["flags"]) & {"disabled_manually", "disabled_inactivity"} for r in rows):
-        logs.append("workflow-disabled")
-    if proposals or jobs:
-        logs.append("workflow-toggle")
-    merge_runs = [r for r in rows if r["merge_triggers"] and set(r["merge_triggers"]) - {"schedule"}]
-    not_suppressed = [d for d in deploy_rows if not d["suppressed_by_skip_ci"]]
-    ci_ok = {r["path"]: r["latest"] == "success" for r in rows}
-    for b in badges:  # a README badge with no run data is never shown as green (STANDARD §7.2 badge 4)
-        if not any(PurePosixPath(p).name == b for p in ci_ok):
-            ci_ok[f".github/workflows/{b}"] = False
-            logs.append("needs-input:ci-status")
-    if not by_path:
-        logs.append("needs-input:workflows")
-    post = []
-    if any(d["suppressed_by_skip_ci"] for d in deploy_rows) or not_suppressed:
-        post = [["gh", "api", f"repos/{full}/actions/runs?event=push&per_page=1"],
-                ["gh", "api", f"repos/{full}/deployments?per_page=1"]]
-    red = any("ci-red" in r["flags"] or "badge-red" in r["flags"] for r in rows)
-    return {"result": "fail" if red else ("needs-input" if not by_path else
-                                         ("warn" if deploy_rows or proposals else "pass")),
-            "repo": full, "default_branch": branch, "fork": fork, "upstream_fork": upstream_fork, "parent": parent,
-            "workflows": rows, "ci_badge_allowed": ci_ok, "readme_badges": badges,
-            "redeploy": {"merge_starts": [r["path"] for r in merge_runs], "deploy_on_merge": deploy_rows,
-                         "not_suppressed_by_skip_ci": not_suppressed,
-                         "avoid_redeploy": bool(deploy_rows),
-                         "merge_subject": "<PR title> [skip ci]",  # always (STANDARD §10.3; RP-01)
-                         "post_merge_checks": post},
-            "proposals": proposals, "jobs": jobs,
-            "tsv": {"actions-health": [[full, r["path"], r["state"] or "-", r["latest"], r["latest_at"] or "-",
-                                        ",".join(r["flags"]) or "-"] for r in rows],
-                    "deploy-on-push": [[d["repo"], d["workflow"], d["trigger"], d["environment"], d["external"]]
-                                       for d in deploy_rows]},
-            "logs": logs}
-
-
-# =====================================================================================================
-# images (RP-03, RP-10)
-# =====================================================================================================
-IMG_LIMIT, EXAMPLE_LIMIT, EXAMPLE_WIDTH = 300_000, 600_000, 2600
-PROTECTED_DIRS = ("public", "static", "src", "results", "notebooks")
-EXEMPT_LOGOS = {  # STANDARD §9.2 brand pair (R9), exempt from the image weight rule
-    "a5c3c4ef55336ed4b883d3bc3bb6e1e942b836469bd2b2933bc8cc230b321621",
-    "0dc00c0e5159518ff1d552b7052293b4e545ddd35be489e6d114e3ea64db27ec"}
-
-
-def _is_example(rel: str) -> bool:
-    return rel.startswith("assets/examples/") or bool(re.search(r"(^|/)example[^/]*\.(png|jpe?g|webp|gif)$", rel, re.I))
-
-
-def _png_lossless(data: bytes) -> tuple[bytes | None, str]:
-    """A pixel-identical re-encode (zlib 9, filter search) to estimate what `oxipng -o4 --strip safe` saves."""
-    from PIL import Image
-    try:
-        im = Image.open(io.BytesIO(data))
-        im.load()
-    except Exception as exc:  # unreadable images are reported, not fixed
-        return None, f"unreadable: {str(exc)[:80]}"
-    frames = getattr(im, "n_frames", 1)
-    if getattr(im, "is_animated", False) or frames > 1:  # a re-save keeps one frame: no candidate (fail closed)
-        return None, f"animated: {frames} frames; no lossless candidate (a re-encode would keep only the first frame)"
-    b = io.BytesIO()
-    kw = {"optimize": True}
-    if im.info.get("icc_profile"):
-        kw["icc_profile"] = im.info["icc_profile"]
-    if im.mode == "P" and "transparency" in im.info:
-        kw["transparency"] = im.info["transparency"]
-    im.save(b, "PNG", **kw)
-    new = b.getvalue()
-    back = Image.open(io.BytesIO(new))
-    back.load()
-    if back.mode != im.mode or back.size != im.size or back.tobytes() != im.tobytes():
-        return None, "re-encode not pixel-identical"
-    return new, "ok"
-
-
-def _dark_theme(rel: str, data: bytes) -> str | None:
-    """RP-10 static heuristics: content that may vanish on GitHub's dark page."""
-    low = rel.lower()
-    if low.endswith(".svg"):
-        text = data.decode("utf-8", "replace")
-        fills = re.findall(r"(?:fill|stroke)\s*[:=]\s*[\"']?(#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}\b|black)", text)
-        from .color import luminance
-        dark = [f for f in fills if f == "black" or luminance(f) < 0.05]
-        has_bg = re.search(r"<rect[^>]*(width=[\"']100%|x=[\"']0)", text) or "prefers-color-scheme" in text
-        if dark and not has_bg and len(dark) * 2 >= len(fills):
-            return "svg: dark fills and no background rect or prefers-color-scheme"
-        return None
-    if not low.endswith((".png", ".gif", ".webp")):
-        return None
-    from PIL import Image
-    try:
-        im = Image.open(io.BytesIO(data))
-        im.thumbnail((256, 256))
-        im = im.convert("RGBA")
-    except Exception:  # unreadable images are reported elsewhere
-        return None
-    px = _px(im)
-    clear = sum(1 for p in px if p[3] < 128)
-    ink = [p for p in px if p[3] >= 128]
-    if not ink or clear / len(px) <= 0.30:
-        return None
-    lum = sum(0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2] for p in ink) / len(ink)
-    return f"png: {clear / len(px):.0%} transparent, mean ink luminance {lum:.0f} < 80" if lum < 80 else None
-
-
-def _mermaid_flags(text: str) -> list[int]:
-    out, inside = [], False
-    for n, ln in enumerate(text.splitlines(), 1):
-        s = ln.strip()
-        if s.startswith("```mermaid") or s.startswith("~~~mermaid"):
-            inside = True
-            continue
-        if inside and s.startswith(("```", "~~~")):
-            inside = False
-            continue
-        if inside and re.search(r"\b(classDef|style)\b", s) and "fill:" in s and "color:" not in s:
-            out.append(n)
-    return out
-
-
-def images_report(tree: Tree, files: list[str], *, new_paths: set[str] | None = None, approval_id: str | None = None,
-                  out_dir: str | Path | None = None, fetcher: Fetcher | None = None) -> dict:
-    """README and docs image budget (RP-03): bytes, pixels, alt text; lossless proposals; lossy only with an
-    approval; dark-theme flags (RP-10)."""
-    from PIL import Image
-    refs: dict[str, dict] = {}
-    remote, alt_missing, mermaid = [], [], []
-    for f in files:
-        text = tree.read(f) or ""
-        for n in _mermaid_flags(text):
-            mermaid.append({"file": f, "line": n, "flag": "mermaid fill without color"})
-        for ln in extract_links(text):
-            target = ln["target"].strip()
-            is_img = ln["image"] or urllib.parse.urlsplit(target).path.lower().endswith(IMG_EXT)
-            if not is_img or target.startswith("data:"):
-                continue
-            if ln["image"] and ln["syntax"] in ("markdown", "html-img") and not (ln.get("alt") or "").strip():
-                alt_missing.append({"file": f, "line": ln["line"], "target": target})
-            if re.match(r"^(https?:)?//", target, re.I):
-                remote.append({"file": f, "line": ln["line"], "target": target})
-                continue
-            path = urllib.parse.unquote(target.split("#")[0].split("?")[0])
-            rel, _ = _resolve(f, path)
-            if rel is None:
-                continue
-            refs.setdefault(rel, {"path": rel, "referenced_from": []})["referenced_from"].append(f"{f}:{ln['line']}")
-    rows, plan, needs_approval, logs = [], [], [], []
-    for rel, row in sorted(refs.items()):
-        data = tree.read_bytes(rel)
-        if data is None:
-            rows.append(dict(row, status="missing"))
-            continue
-        row["bytes"] = len(data)
-        row["sha256"] = hashlib.sha256(data).hexdigest()
-        try:
-            if rel.lower().endswith(".svg"):
-                m = re.search(r"<svg[^>]*\bwidth=[\"']?([\d.]+)[^>]*\bheight=[\"']?([\d.]+)", data.decode("utf-8", "replace"))
-                row["px"] = [round(float(m.group(1))), round(float(m.group(2)))] if m else None
-                row["format"] = "SVG"
-            else:
-                im = Image.open(io.BytesIO(data))
-                row["px"], row["format"] = list(im.size), im.format
-        except Exception:  # an image PIL cannot open is reported as such
-            row["format"] = "unreadable"
-        example = _is_example(rel)
-        limit = EXAMPLE_LIMIT if example else IMG_LIMIT
-        row["limit"] = limit
-        row["new"] = rel in (new_paths or set())
-        row["protected"] = any(seg in PROTECTED_DIRS for seg in rel.split("/")[:-1])
-        flags = []
-        if row["sha256"] in EXEMPT_LOGOS:
-            flags.append("exempt:brand-logo")
-        elif len(data) > limit:
-            flags.append("fail:image-weight" if row["new"] else "warn:image-weight")
-        if example and (row.get("px") or [0])[0] > EXAMPLE_WIDTH:
-            flags.append("warn:example-width")
-        dark = _dark_theme(rel, data)
-        if dark:
-            flags.append("warn:dark-theme")
-            row["dark_theme"] = dark
-        row["flags"] = flags
-        over = any(fl.endswith("image-weight") for fl in flags)
-        if over and not row["protected"]:
-            fmt = (row.get("format") or "").upper()
-            if fmt == "PNG":
-                new, why = _png_lossless(data)
-                saved = len(data) - len(new) if new else 0
-                row["lossless"] = {"bytes": len(new) if new else None, "saved": saved, "check": why}
-                plan.append({"path": rel, "kind": "lossless", "argv": ["oxipng", "-o4", "--strip", "safe", rel],
-                             "estimate_bytes": len(new) if new else None, "meets_limit": bool(new) and len(new) <= limit,
-                             "note": "identical pixels, same path (STANDARD §10.3)"})
-                if out_dir and new and saved > 0:
-                    dest = Path(out_dir) / rel
-                    dest.parent.mkdir(parents=True, exist_ok=True)
-                    dest.write_bytes(new)
-                    row["lossless"]["candidate"] = str(dest)
-                fits = bool(new) and len(new) <= limit
-            elif fmt == "GIF":
-                plan.append({"path": rel, "kind": "lossless", "argv": ["gifsicle", "-O3", "--batch", rel],
-                             "estimate_bytes": None, "meets_limit": None, "note": "identical frames, same path"})
-                fits = False
-            else:
-                fits = False
-            if not fits:
-                lossy = {"path": rel, "kind": "lossy", "approval": "lossy-image", "bytes": len(data), "limit": limit,
-                         "argv": (["pngquant", "--quality", "80-95", "--skip-if-larger", "--force", "--ext", ".png", rel]
-                                  if fmt == "PNG" else ["cwebp", "-q", "85", rel, "-o", rel + ".webp"]),
-                         "note": "lossy recompression needs a per-repo lossy-image approval (q69)"}
-                if approval_id:
-                    plan.append(dict(lossy, approval_id=approval_id))
-                else:
-                    needs_approval.append(lossy)
-        elif over:
-            row["note"] = "under public/, static/, src/, results/ or notebooks/: never touched (STANDARD §10.3)"
-        rows.append(row)
-    if fetcher is not None:
-        for r in remote:
-            res = fetcher.check(r["target"] if not r["target"].startswith("//") else "https:" + r["target"])
-            r["http"] = res.get("status")
-    fails = [r for r in rows if any(f.startswith("fail:") for f in r.get("flags", []))] + \
-        [r for r in rows if r.get("status") == "missing"]
-    warns = [r for r in rows if any(f.startswith("warn:") for f in r.get("flags", []))]
-    if any("image-weight" in f for r in rows for f in r.get("flags", [])):
-        logs.append("warn:image-weight" if not fails else "image-weight")
-    if any("warn:dark-theme" in r.get("flags", []) for r in rows) or mermaid:
-        logs.append("warn:dark-theme")
-    if alt_missing:
-        logs.append("warn:alt-missing")
-    return {"result": "fail" if fails else ("warn" if warns or alt_missing or mermaid else "pass"),
-            "images": rows, "remote": remote, "alt_missing": alt_missing, "mermaid": mermaid, "plan": plan,
-            "needs_approval": needs_approval, "logs": logs}
-
-
-def new_files(tree: Tree, base_ref: str | None) -> set[str]:
-    """Files the run adds: not in `base_ref` (default HEAD) or untracked."""
-    if not tree.git:
-        return set()
-    out = tree._git("ls-tree", "-r", "--name-only", "-z", base_ref or "HEAD")
-    if out is None:
-        return set(tree.files)
-    return set(tree.files) - {f for f in out.split("\0") if f}
-
-
-# =====================================================================================================
-# sidebar (RP-05)
-# =====================================================================================================
-SIDEBAR_BOXES = ("releases", "packages", "deployments")
-
-
-def _count(v) -> int | None:
-    if v is None:
-        return None
-    if isinstance(v, bool):
-        return int(v)
-    if isinstance(v, (int, float)):
-        return int(v)
-    if isinstance(v, list):
-        return len(v)
-    if isinstance(v, dict):
-        for k in ("total_count", "totalCount"):  # REST and GraphQL counts win over a (possibly paged) list
-            n = v.get(k)
-            if isinstance(n, int) and not isinstance(n, bool):
-                return n
-            if isinstance(n, str) and n.isdigit():
-                return int(n)
-        for k in ("environments", "releases", "deployments", "packages", "items", "nodes"):
-            if isinstance(v.get(k), list):
-                return len(v[k])
-    return None
-
-
-def packages_by_repo(packages, resolver: Resolver | None = None) -> dict[str, int]:
-    """Org package listings (`gh api orgs/<org>/packages?package_type=...`, one or many) keyed by OWNER/REPO, owners
-    folded through the resolver so a renamed org's packages still map to its repositories."""
-    out: dict[str, int] = {}
-    items = packages if isinstance(packages, list) else (packages or {}).get("packages") or []
-    for p in items:
-        if isinstance(p, list):
-            for k, v in packages_by_repo(p, resolver).items():
-                out[k] = out.get(k, 0) + v
-            continue
-        full = ((p or {}).get("repository") or {}).get("full_name")
-        if not full:
-            continue
-        o, r = full.split("/", 1)
-        key = f"{current_login(resolver, o).lower()}/{r.lower()}"
-        out[key] = out.get(key, 0) + 1
-    return out
-
-
-def sidebar_plan(meta: dict, facts: dict, *, resolver: Resolver | None = None, packages: dict | None = None,
-                 current: dict | None = None, phase="3.3") -> dict:
-    """Target state of the About "Include in the home page" boxes (decision 7, STANDARD §10.1) and the browser job
-    that sets them. GitHub's default shows all three; only repos whose target differs get a job."""
-    owner, repo = meta.get("owner", "unknown"), meta.get("repo", "unknown")
-    cur_owner = current_login(resolver, owner)
-    full = f"{cur_owner}/{repo}"
-    counts = {b: _count(facts.get(b)) for b in SIDEBAR_BOXES}
-    if counts["packages"] is None and packages is not None:
-        key = f"{cur_owner.lower()}/{repo.lower()}"
-        counts["packages"] = packages.get(key, 0)
-    target = {b: (None if counts[b] is None else counts[b] > 0) for b in SIDEBAR_BOXES}
-    unknown = [b for b in SIDEBAR_BOXES if target[b] is None]
-    default = {b: True for b in SIDEBAR_BOXES}
-    base_state = {b: (current or {}).get(b, default[b]) for b in SIDEBAR_BOXES}
-    differs = [b for b in SIDEBAR_BOXES if target[b] is not None and target[b] != base_state[b]]
-    has_pages = bool(facts.get("has_pages", meta.get("has_pages")))
-    public = meta.get("visibility", "public") == "public"
-    row = {"repo": full, **{b: counts[b] for b in SIDEBAR_BOXES}, "environments": _count(facts.get("environments")),
-           **{f"show_{b}": target[b] for b in SIDEBAR_BOXES}, "has_pages": has_pages,
-           "differs_from_default": bool(differs), "unknown": unknown}
-    logs = [f"needs-input:sidebar-facts:{b}" for b in unknown]
-    job = None
-    if differs and not unknown:
-        word = {True: "checked", False: "unchecked"}
-        steps = [f"Open https://github.com/{full} while signed in as an owner of {cur_owner}.",
-                 "In the right-hand column, click the gear icon next to the \"About\" heading; the \"Edit repository "
-                 "details\" dialog opens.",
-                 "Do not change Description, Website or Topics in this dialog; the writer sets them."]
-        if has_pages:
-            steps.append("Tick \"Use your GitHub Pages website\" only if the Website field already holds this "
-                         "repository's GitHub Pages URL; otherwise leave it as it is.")
-        for b in SIDEBAR_BOXES:
-            label = b.capitalize()
-            steps.append(f"Under \"Include in the home page\", make sure \"{label}\" is {word[target[b]]} "
-                         f"({counts[b]} {b} found).")
-        steps.append("Click \"Save changes\".")
-        if public:
-            steps.append(f"Verify signed out (or with `curl -s https://github.com/{full}`): the page shows neither "
-                         "\"No releases published\" nor \"No packages published\".")
-        else:
-            steps.append("Private repository: keep the screenshot of the About column for the per-org sample.")
-        job = browser_job(job_id(f"p{phase}", "sidebar", full), phase, full, f"https://github.com/{full}",
-                          "about-sidebar", steps,
-                          "About sidebar: Releases, Packages and Deployments shown only where they exist (UD 7, RP-05; "
-                          "STANDARD §10.1, §12.4).")
-    tsv = [full] + ["?" if counts[b] is None else str(counts[b]) for b in SIDEBAR_BOXES] + \
-        ["?" if target[b] is None else ("show" if target[b] else "hide") for b in SIDEBAR_BOXES] + \
-        ["yes" if differs else "no"]
-    return {"result": "needs-input" if unknown else ("proposal" if job else "pass"), "row": row, "tsv": tsv,
-            "job": job, "logs": logs}
-
-
-SIDEBAR_TSV_HEADER = ["repo", "releases", "packages", "deployments", "releases_box", "packages_box", "deployments_box",
-                      "differs_from_default"]
-
-
-# =====================================================================================================
-# icon (RT-04): prompt file, normalize, QA
-# =====================================================================================================
-ICON_PX, ICON_BUDGET = 1024, 300_000
-LIVE_MARGIN = round(82 * ICON_PX / 500)  # 168: the avatar live area (a.3) at 1024 px
-LIVE = ICON_PX - 2 * LIVE_MARGIN          # 688
-KEY_DE, CONTENT_DE = 6.0, 12.0
-ART_FAMILY = {"completetech": "CompleteTech core", "ai-ascension": "AI-Ascension", "jev-engineering": "Jev",
-              "jevplay-games": "Jev", "libreevolve": "LibreEvolve", "touchedbyanagent": "TouchedByAnAgent",
-              "romgenie": "romgenie utility"}
-ART_OWNER = {"CompleteDotTech": ("Founder", None), "Pick-Your-AI": ("Pick Your AI", None),
-             "Jev-Engineering": ("Jev", "Jev-Engineering"), "jevplay-games": ("Jev", "jevplay-games"),
-             "Jevelopers-neatHack-2026": ("Jev", "Jevelopers")}
-WRITER_SLOTS = ("GLYPH_NAME", "GLYPH_DESCRIPTION", "SPARK_PLACEMENT", "SIZE_CLASS")
-SIZE_CLASSES = {
-    "WIDE": "the glyph spans close to the full 688 px width and is about 430 to 560 px tall",
-    "TALL": "spans close to the full 688 px height and is about 400 to 600 px wide",
-    "SQUARE": "a squarish glyph about 600 to 660 px on each side",
-    "DIAGONAL": "the mass runs corner to corner inside a 656 × 656 px box"}
-HEX = r"`(#[0-9A-Fa-f]{6})`"
-
-
-def load_art_direction(path=None) -> str:
-    p = Path(path) if path else DEFAULT_ART_DIRECTION
-    if not p.is_file():
-        raise NeedsInput("art-direction", f"art direction not found: {p} (pass --art-direction FILE to use another file)")
-    return p.read_text(encoding="utf-8")
-
-
-def _section(text: str, head: str) -> str:
-    m = re.search(rf"^## {re.escape(head)}.*?$(.*?)(?=^## |\Z)", text, re.M | re.S)
-    return m.group(1) if m else ""
-
-
-def palette_rows(text: str) -> list[dict]:
-    """Rows of the (b) family palette table: family, role, name, hex values and notes."""
-    rows, fam = [], ""
-    for ln in _section(text, "(b) Family palette").splitlines():
-        cells = [c.strip() for c in ln.strip().strip("|").split("|")]
-        if len(cells) < 4 or not ln.lstrip().startswith("|") or set(cells[0]) <= set("-: ") and cells[0]:
-            continue
-        if cells[0] in ("Family",):
-            continue
-        fam = re.sub(r"\*\*|\(.*?\)", "", cells[0]).strip() or fam
-        rows.append({"family": fam, "role": cells[1], "name": cells[2], "hex": re.findall(HEX, cells[3]),
-                     "notes": cells[4] if len(cells) > 4 else ""})
-    return rows
-
-
-def family_colours(text: str, owner: str, family: str, aliases=()) -> dict:
-    """The family palette for the org: its ART_OWNER row under any of its logins (`aliases`, CQ-03), else the family's."""
-    owners = {k.lower(): v for k, v in ART_OWNER.items()}
-    fam, prefix = next((owners[a.lower()] for a in (owner, *aliases) if a and a.lower() in owners),
-                       (ART_FAMILY.get(family), None))
-    rows = [r for r in palette_rows(text) if fam and r["family"].lower().startswith(fam.lower())]
-    if prefix:
-        own = [r for r in rows if r["role"].lower().startswith(prefix.lower())]
-        rows = own + [r for r in rows if r["role"].lower().startswith("light-surface")]
-    out: dict = {"family_label": fam}
-
-    def note(r, key):
-        m = re.search(rf"{key} `(#[0-9A-Fa-f]{{6}})`", r["notes"] if r else "")
-        return m.group(1) if m else None
-    line = next((r for r in rows if re.search(r"\bline\b", r["role"], re.I) and "second" not in r["role"].lower()
-                 and r["hex"]), None)
-    spark = next((r for r in rows if re.search(r"\bspark\b", r["role"], re.I) and "light-surface" not in r["role"].lower()
-                  and r["hex"]), None)
-    glow_row = next((r for r in rows if r["role"].lower() == "glow" and r["hex"]), None)
-    if line:
-        out.update(LINE_NAME=line["name"], LINE_HEX=line["hex"][0], CORE_HEX=note(line, "core"),
-                   GLOW_HEX=note(line, "glow") or (glow_row["hex"][0] if glow_row else None))
-    if spark:
-        out.update(SPARK_NAME=spark["name"], SPARK_HEX=spark["hex"][0], SPARK_CORE_HEX=note(spark, "centre"),
-                   SPARK_BLOOM_HEX=note(spark, "bloom"))
-    ink = next((r for r in rows if r["role"].lower().startswith("light-surface")), None)
-    out["INK"] = ink["hex"] if ink else []
-    return out
-
-
-def org_glyph(text: str, owner: str) -> str | None:
-    for ln in _section(text, "(c) All 28 accounts").splitlines():
-        cells = [c.strip() for c in ln.strip().strip("|").split("|")]
-        if len(cells) >= 6 and cells[1].split(" (")[0].lower() == owner.lower():
-            return cells[5]
-    return None
-
-
-def icon_colours(ctx, text: str, org: dict, resolver: Resolver, *, require_palette: bool = True) -> dict:
-    """Keep estate palettes explicit; the bundled template uses the committed brand tokens."""
-    family = org_style(resolver, ctx.brand, ctx.owner)["name"]
-    colours = family_colours(text, org["brand_key"], family, resolver.aliases(ctx.owner))
-    if _section(text, "Repository glyph prompt template") and not _section(text, "(b) Family palette"):
-        tokens = ctx.style["tokens"]
-        missing = [key for key in ("icon_ink", "icon_spark") if not tokens.get(key)]
-        if missing:
-            if not require_palette:
-                return colours
-            raise NeedsInput("icon-palette", "selected brand config needs " + ", ".join(missing) +
-                             " tokens for the bundled prompt; add them or pass --art-direction FILE "
-                             "with a family palette")
-        colours.update(family_label=family, LINE_NAME="family icon ink", LINE_HEX=tokens["icon_ink"],
-                       CORE_HEX=tokens["title"], GLOW_HEX=tokens["accent_mid"],
-                       SPARK_NAME="family icon spark", SPARK_HEX=tokens["icon_spark"],
-                       SPARK_CORE_HEX=tokens["title"], SPARK_BLOOM_HEX=tokens["icon_spark"],
-                       INK=[tokens["icon_ink"], tokens["icon_spark"]])
-    return colours
-
-
-def seed_for(text: str, owner: str | list[str], family: str) -> str | None:
-    """The org's seed (any of its logins, CQ-03), else the family's."""
-    m = re.search(r"seeds \(([^)]*)\)", text)
-    if not m:
-        return None
-    seeds = dict((k.strip(), v) for k, v in re.findall(r"([A-Za-z][\w-]*)\s+`?(\d{3,5})`?", m.group(1)))
-    for key in (*([owner] if isinstance(owner, str) else owner), {"completetech": "CompleteTech"}.get(family), family):
-        for k, v in seeds.items():
-            if key and k.lower() == str(key).lower():
-                return v
-    return None
-
-
-def _template(text: str, section: str) -> str | None:
-    m = re.search(r"```text\n(.*?)\n```", _section(text, section), re.S)
-    return m.group(1) if m else None
-
-
-def icon_prompt(ctx, resolver: Resolver, art_text: str, glyph: dict | None = None, option: str = "A",
-                language: str | None = None, skill_art: str | None = None) -> dict:
-    """The Codex prompt for a repository icon (f.3 option A: the (d) template with "repo icon" for "avatar"; option
-    B: the illustration template on the light card). The tool fills every mechanical slot from the art direction and
-    the repository's facts; the glyph itself is the writer's (needs-writer until `glyph` supplies it)."""
-    glyph = {k.upper(): v for k, v in (glyph or {}).items() if v}
-    owner, repo = ctx.owner, ctx.repo
-    org = org_row(resolver, ctx.brand, owner, require=True)
-    org["canonical"], org["current"] = org["brand_key"], current_login(resolver, owner)
-    family = org_style(resolver, ctx.brand, owner)["name"]
-    logins = [org["canonical"], *resolver.aliases(owner)]  # ART_DIRECTION may name the org by any of its logins (CQ-03)
-    colours = icon_colours(ctx, art_text, org, resolver, require_palette=option.upper() == "A")
-    org_mark = next((g for g in (org_glyph(art_text, x) for x in logins) if g), None)
-    facts = {"repository": f"{org['current']}/{repo}", "description": ctx.meta.get("description") or "",
-             "type": ctx.det.get("type"), "category": ctx.det.get("category"), "topics": ctx.meta.get("topics") or [],
-             "language": language or ctx.meta.get("language"), "product": ctx.facts.h1(), "family": family,
-             "org_glyph": org_mark}
-    missing: list[str] = []
-    if option.upper() == "B":
-        tpl = _template(skill_art or "", "Prompt template for illustrations")
-        if not tpl:
-            raise NeedsInput("art-direction", "references/art-direction.md has no illustration template")
-        lock = None
-        names = {family, family.replace("-", " "), org["canonical"].lower(), str(org.get("display_name") or "").lower()}
-        for ln in (skill_art or "").splitlines():
-            cells = [c.strip() for c in ln.strip().strip("|").split("|")]
-            if len(cells) == 2 and cells[0].lower() in names:
-                lock = cells[1]
-        adds = dict(re.findall(r"(Security|TCG|Discord orgs|jevplay-games|TouchedByAnAgent) `([^`]*)`",
-                               (re.search(r"Family additions:(.*)", skill_art or "") or re.match("", "")).group(0)))
-        add_map = {"completetech-security": "Security", "completetech-pokemon": "TCG", "completetech-tcg": "TCG",
-                   "completetech-discordapps": "Discord orgs", "completetechdiscord-games": "Discord orgs",
-                   "jevplay-games": "jevplay-games", "touchedbyanagent": "TouchedByAnAgent"}
-        add_names = {"completetech security": "Security", "completetech tcg": "TCG",
-                     "completetech discord apps": "Discord orgs", "completetech discord games": "Discord orgs",
-                     "jevplay.games": "jevplay-games", "touched by an agent": "TouchedByAnAgent"}
-        # any login of the org (CQ-03), else its display name, so a re-keyed brand.yaml row keeps its negatives
-        add_key = next((add_map[a.lower()] for a in logins if a and a.lower() in add_map), None) or \
-            add_names.get(str(org.get("display_name") or "").lower())
-        if add_key and not adds.get(add_key):
-            # a trademark family whose negatives cannot be found: never a prompt without them (fail closed)
-            raise NeedsInput("family-additions", f"{org['current']}: references/art-direction.md has no {add_key} "
-                                                 "family addition (trademark negatives)")
-        pal = re.search(r"CompleteTech palette: `([^`]*)`; highlight line `([^`]*)`", skill_art or "")
-        card = ctx.style["tokens"]["card_fill"]
-        prompt = tpl.replace("FAMILY STYLE LOCK, VERBATIM", lock or "{STYLE_LOCK}")
-        prompt = prompt.replace("Square 1024x1024 | Wide 1536x1024", "Square 1024x1024")
-        prompt = prompt.replace("untextured BG background", f"untextured {card} background")
-        if family == "completetech" and pal:
-            prompt = prompt.replace("PALETTE. HIGHLIGHT LINE", f"{pal.group(1)}. {pal.group(2)}")
-        prompt = prompt.replace("One sentence: the single hero object or scene that represents the repository or "
-                                "org's function.", glyph.get("SUBJECT") or "{SUBJECT}")
-        prompt = re.sub(r"3–5 objects\.[^\n]*", glyph.get("OBJECTS") or "{OBJECTS}", prompt)
-        prompt = prompt.replace("FAMILY ADDITIONS", " ".join(x for x in (adds.get(add_key), glyph.get("EXTRA_NEGATIVES"))
-                                                             if x)).rstrip()
-        prompt = prompt.replace("[STYLE LOCK — FAMILY]", f"[STYLE LOCK — {colours.get('family_label') or family}]")
-    else:
-        tpl = _template(art_text, "(d) Shared prompt template") or \
-            _template(art_text, "Repository glyph prompt template")
-        if not tpl:
-            raise NeedsInput("art-direction", "selected art direction has no (d) Shared prompt template "
-                             "or Repository glyph prompt template")
-        seed = seed_for(art_text, logins, family)
-        slots = {k: colours.get(k) for k in ("LINE_NAME", "LINE_HEX", "CORE_HEX", "GLOW_HEX", "SPARK_NAME", "SPARK_HEX",
-                                              "SPARK_CORE_HEX", "SPARK_BLOOM_HEX")}
-        slots.update(ACCOUNT=f"{org['current']}/{repo}", KIND="repository", CIRCLE_CLAUSE="",
-                     CROP="repository icon, shown inside the light card of the README hero banner, the repo card and the "
-                          "social preview", SECONDARY_LIGHT="", SECONDARY_LINE="", SPARK_D="94", SPARK_CORE_D="37",
-                     TEXT_RULE="Any text, letters, numbers or words",
-                     SEED=seed or "not set",
-                     SEED_INSTRUCTION=f"Use seed {seed} when supported." if seed else "Use the tool's default seed.",
-                     STYLE_REFERENCES="the three approved pilot renders from art/golden/neon-night/.",
-                     BRAND_REFERENCE=f"Org avatar art/reference/avatars/{org['canonical']}.png for family consistency "
-                                     "only: do not copy its glyph; this repository's silhouette must differ from it at "
-                                     "48 px (f.3).")
-        if slots.get("SPARK_NAME"):
-            slots["SPARK_EXCLUSIVITY"] = f" and the only element in {slots['SPARK_NAME']}"
-        if slots.get("GLOW_HEX"):
-            slots["POOL"] = (f"one very soft round pool of {slots['GLOW_HEX']} light at about 10% strength, about 880 px "
-                             "across, centred behind the glyph and fading to nothing well before the edges")
-        size = str(glyph.get("SIZE_CLASS") or "").upper()
-        if size in SIZE_CLASSES:
-            slots["SIZE_CLASS"] = f"{size}: {SIZE_CLASSES[size]}"
-        for k in ("GLYPH_NAME", "GLYPH_DESCRIPTION", "SPARK_PLACEMENT"):
-            if glyph.get(k):
-                slots[k] = glyph[k]
-        neg = f"Do not draw the {org['canonical']} org glyph ({org_mark})." if org_mark else ""
-        slots["EXTRA_NEGATIVES"] = " ".join(x for x in (glyph.get("EXTRA_NEGATIVES"), neg) if x)
-        prompt = re.sub(r"\(a\) Geometry:.*?(?= \(b\) Style:)",
-                        "(a) Geometry: none yet; this glyph is new, so section 7 is the geometry and the lock pass "
-                        "traces the chosen candidate into the compositor.", tpl, flags=re.S)
-        prompt = re.sub(r"output art/out/avatars/\S+", f"output art/out/icons/{org['current']}/{repo}-1024-c{{1..4}}.png",
-                        prompt)
-        prompt = re.sub(r"The pipeline downsamples your image[^.]*\.",
-                        "The lock pass traces your image into the compositor, which renders the flat 1024 × 1024 px "
-                        "assets/icon.png in the family light-surface inks.", prompt)
-        prompt = prompt.replace("NEON NIGHT AVATAR", "NEON NIGHT REPO ICON")
-        prompt = re.sub(r"\bavatars\b", "repo icons", prompt)
-        prompt = re.sub(r"\bavatar\b", "repo icon", prompt)
-        prompt = prompt.replace("It is one of 28 repo icons in a single matched family",
-                                "It joins the 28 Neon Night avatars and its sibling repo icons as one matched family")
-        prompt = prompt.replace("(identical in all 28 repo icons)", "(identical to the Neon Night avatars)")
-        prompt = prompt.replace("same model and version for all 28", "same model and version as the avatar set")
-        for k, v in slots.items():
-            if v is not None:
-                prompt = prompt.replace("{" + k + "}", str(v))
-    missing = sorted(set(re.findall(r"\{([A-Z_]+)\}", prompt)))
-    ink = colours.get("INK") or []
-    return {"prompt": prompt, "missing": missing, "facts": facts, "option": option.upper(),
-            "render": {"ink": ink[0] if ink else None, "spark": ink[1] if len(ink) > 1 else None,
-                       "size": [ICON_PX, ICON_PX], "live_area": [LIVE_MARGIN, LIVE_MARGIN, ICON_PX - LIVE_MARGIN,
-                                                                 ICON_PX - LIVE_MARGIN], "budget": ICON_BUDGET}}
-
-
-def prompt_markdown(res: dict) -> str:
-    f, r = res["facts"], res["render"]
-    rows = "\n".join(f"| {k.replace('_', ' ').capitalize()} | {', '.join(v) if isinstance(v, list) else (v or '-')} |"
-                     for k, v in f.items())
-    return (f"# Repo icon prompt: {f['repository']}\n\n"
-            f"- Standard {STANDARD}; github-showcase-skill {__version__}; option {res['option']} (q59); decision 12.\n"
-            f"- Output `assets/icon.png`: {ICON_PX} × {ICON_PX} PNG RGBA, transparent, at most {ICON_BUDGET // 1000} KB, "
-            "no text, one file for both GitHub themes (decision 21; no `-dark` or `-light` sibling).\n"
-            f"- Render (lock pass): flat body in the light-surface ink {r['ink'] or '(see ART_DIRECTION (b))'}, spark in "
-            f"{r['spark'] or '(see ART_DIRECTION (b))'}, no tile and no glow, centred in the live area "
-            f"{r['live_area']}.\n"
-            "- Then: `showcase.py content icon normalize --in <candidate.png>` and `showcase.py content icon check`.\n\n"
-            "## Repository facts\n\n| Fact | Value |\n|---|---|\n" + rows + "\n\n## Prompt\n\n```text\n" +
-            res["prompt"] + "\n```\n")
-
-
-def _lab_cache():
-    from .color import lab
-    cache: dict = {}
-
-    def get(rgb):
-        v = cache.get(rgb)
-        if v is None:
-            v = cache[rgb] = lab(rgb)
-        return v
-    return get
-
-
-def _px(im) -> list:
-    """Pixel values in raster order (Pillow 13 deprecates getdata for get_flattened_data)."""
-    get = getattr(im, "get_flattened_data", None)
-    return list(get() if get else im.getdata())
-
-
-def _de(a, b) -> float:
-    return ((a[0] - b[0]) ** 2 + (a[1] - b[1]) ** 2 + (a[2] - b[2]) ** 2) ** 0.5
-
-
-def normalize_icon(img, ground: str = "auto", card: str | None = None, pixel_art: bool = False):
-    """(1024 px RGBA or RGB image, info). Transparent icons are keyed (ΔE ≤ 6 from the ground, 2 px feather),
-    trimmed to their alpha box and fitted to the 688 px live area; an icon with its own opaque ground (an avatar-style
-    night tile) is kept full-bleed (`ground="keep"`)."""
-    from PIL import Image, ImageFilter
-    from .color import rgb as hexrgb
-    from .iconbox import corner_ground, native_pixels
-    im = img.convert("RGBA")
-    info: dict = {"source_px": list(im.size)}
-    corners = [im.getpixel(p) for p in ((0, 0), (im.width - 1, 0), (0, im.height - 1), (im.width - 1, im.height - 1))]
-    has_alpha = any(c[3] < 255 for c in corners)
-    gnd = None if has_alpha else corner_ground(im)
-    mode = ground
-    if mode == "auto":
-        if has_alpha:
-            mode = "transparent"
-        elif gnd is None:
-            raise ArtFail("icon-ground", "corners are neither transparent nor one opaque ground")
-        else:
-            lab = _lab_cache()
-            near_card = card is not None and _de(lab(hexrgb(gnd)), lab(hexrgb(card))) <= CONTENT_DE
-            mode = "transparent" if near_card else "keep"
-    info["mode"] = mode
-    if mode == "keep":
-        if gnd is None:
-            raise ArtFail("icon-ground", "--ground keep needs four opaque corners of one colour")
-        side = max(im.size)
-        sq = Image.new("RGBA", (side, side), hexrgb(gnd) + (255,))
-        sq.paste(im, ((side - im.width) // 2, (side - im.height) // 2))
-        out = sq.convert("RGB").resize((ICON_PX, ICON_PX), Image.LANCZOS)
-        info.update(ground=gnd)
-        return out, info
-    if not has_alpha:
-        if gnd is None:
-            raise ArtFail("icon-ground", "no transparent or uniform ground to key out")
-        lab = _lab_cache()
-        g = lab(hexrgb(gnd))
-        src = _px(im)
-        mask = Image.new("L", im.size)
-        mask.putdata([0 if _de(lab(p[:3]), g) <= KEY_DE else 255 for p in src])
-        alpha = _min(mask, mask.filter(ImageFilter.GaussianBlur(2)))  # 2 px feather inside the edge, no ground halo
-        gr, gg, gb = hexrgb(gnd)
-        rgba = []
-        for p, a in zip(src, _px(alpha)):
-            if a == 0:
-                rgba.append((0, 0, 0, 0))
-            elif a == 255:
-                rgba.append((p[0], p[1], p[2], 255))
-            else:  # decontaminate the ground out of the feathered edge
-                k = a / 255
-                rgba.append(tuple(max(0, min(255, round((c - gc * (1 - k)) / k))) for c, gc in
-                                  ((p[0], gr), (p[1], gg), (p[2], gb))) + (a,))
-        im = Image.new("RGBA", im.size)
-        im.putdata(rgba)
-        info.update(keyed_from=gnd)
-    box = im.getchannel("A").point(lambda v: 255 if v > 8 else 0).getbbox()
-    if not box:
-        raise ArtFail("icon-empty", "nothing left after keying the ground")
-    im = im.crop(box)
-    native = native_pixels(im) if pixel_art else None
-    canvas = Image.new("RGBA", (ICON_PX, ICON_PX), (0, 0, 0, 0))
-    if native is not None:
-        k = max(1, LIVE // max(native.size))
-        im = native.resize((native.width * k, native.height * k), Image.NEAREST)
-        info["resample"] = f"nearest x{k}"
-    else:
-        k = LIVE / max(im.size)
-        im = im.resize((max(1, round(im.width * k)), max(1, round(im.height * k))), Image.LANCZOS)
-        info["resample"] = "lanczos"
-    canvas.alpha_composite(im, ((ICON_PX - im.width) // 2, (ICON_PX - im.height) // 2))
-    info["trim_box"] = list(box)
-    return canvas, info
-
-
-def _min(a, b):
-    from PIL import ImageChops
-    return ImageChops.darker(a, b)
-
-
-def icon_bytes(img) -> tuple[bytes, list[str]]:
-    from .scene import png_bytes
-    data = png_bytes(img)
-    logs = []
-    if len(data) > ICON_BUDGET and img.mode == "RGBA":
-        q = img.quantize(256, method=2)  # fast octree keeps alpha
-        b = io.BytesIO()
-        q.save(b, "PNG", optimize=True)
-        data = b.getvalue()
-        logs.append("icon-quantized")
-    if len(data) > ICON_BUDGET:
-        raise ArtFail("icon-budget", f"{len(data)} bytes > {ICON_BUDGET}")
-    return data, logs
-
-
-def _dhash(img, size: int = 16) -> int:
-    from PIL import Image
-    g = img.convert("RGBA")
-    bg = Image.new("RGBA", g.size, (255, 255, 255, 255))
-    bg.alpha_composite(g)
-    s = bg.convert("L").resize((size + 1, size), Image.LANCZOS)
-    px = _px(s)
-    bits = 0
-    for y in range(size):
-        for x in range(size):
-            bits = (bits << 1) | (px[y * (size + 1) + x] > px[y * (size + 1) + x + 1])
-    return bits
-
-
-def icon_qa(data: bytes, *, card: str, ink: list[str] | None = None, org_mark: Path | None = None,
-            siblings: list[str] | None = None) -> dict:
-    """Automated icon checks (f.3, art QA): size, budget, alpha, live area, coverage, contrast on the card, family
-    inks, not the org glyph, one file. OCR and the 48 px set sheet stay manual."""
-    from PIL import Image
-    from .color import contrast, hexstr, rgb as hexrgb
-    from .pnglint import validate_png
-    checks: list[dict] = []
-
-    def add(name, ok, detail="", level="fail"):
-        checks.append({"check": name, "result": "pass" if ok else level, "detail": detail})
-    try:
-        w, h, colour = validate_png(data)
-    except ValueError as exc:
-        add("png", False, str(exc))
-        return {"result": "fail", "checks": checks}
-    add("png", True)
-    add("size", (w, h) == (ICON_PX, ICON_PX), f"{w}x{h}")
-    add("bytes", len(data) <= ICON_BUDGET, f"{len(data)} <= {ICON_BUDGET}")
-    im = Image.open(io.BytesIO(data))
-    im.load()
-    rgba = im.convert("RGBA")
-    alpha = rgba.getchannel("A")
-    transparent = colour in (4, 6) or (colour == 3 and "transparency" in im.info)
-    lab = _lab_cache()
-    if transparent:
-        corners = [alpha.crop((x, y, x + 16, y + 16)).getextrema()[1] for x, y in
-                   ((0, 0), (w - 16, 0), (0, h - 16), (w - 16, h - 16))]
-        add("transparent-corners", max(corners) == 0, f"max corner alpha {max(corners)}")
-        box = alpha.point(lambda v: 255 if v > 8 else 0).getbbox()
-        ink_px = [p for p in _px(rgba.resize((256, 256))) if p[3] >= 200]
-        coverage = sum(1 for v in _px(alpha.resize((256, 256))) if v > 128) / 65536
-    else:
-        from .iconbox import corner_ground
-        g = corner_ground(rgba)
-        add("opaque-ground", g is not None, g or "corners differ")
-        gl = lab(hexrgb(g)) if g else None
-        small = rgba.convert("RGB").resize((256, 256))
-        diff = Image.new("L", small.size)
-        diff.putdata([255 if gl and _de(lab(p), gl) > CONTENT_DE else 0 for p in _px(small)])
-        b = diff.getbbox()
-        box = tuple(round(v * w / 256) for v in b) if b else None
-        ink_px = [p + (255,) for p, d in zip(_px(small), _px(diff)) if d]
-        coverage = len(ink_px) / 65536
-        card = g or card
-    tol = 4
-    inside = bool(box) and box[0] >= LIVE_MARGIN - tol and box[1] >= LIVE_MARGIN - tol and \
-        box[2] <= ICON_PX - LIVE_MARGIN + tol and box[3] <= ICON_PX - LIVE_MARGIN + tol
-    add("live-area", inside, f"content box {list(box) if box else None}, live area {LIVE_MARGIN}..{ICON_PX - LIVE_MARGIN}")
-    span = max(box[2] - box[0], box[3] - box[1]) if box else 0
-    add("fills-live-area", span >= 0.75 * LIVE, f"longest side {span} px of {LIVE}", level="warn")
-    add("coverage", 0.03 <= coverage <= 0.45, f"{coverage:.1%} of the canvas", level="warn")
-    dom = None
-    if ink_px:
-        counts: dict = {}
-        for p in ink_px:
-            key = (p[0] // 16 * 16 + 8, p[1] // 16 * 16 + 8, p[2] // 16 * 16 + 8)
-            counts[key] = counts.get(key, 0) + 1
-        dom = hexstr(max(counts, key=counts.get))
-        cr = contrast(dom, card)
-        add("contrast-on-card", cr >= 3.0, f"dominant ink {dom} on {card}: {cr:.2f}:1 (>= 3:1)")
-        if ink:
-            near = min(_de(lab(hexrgb(dom)), lab(hexrgb(x))) for x in ink)
-            add("family-ink", near <= 12, f"dominant ink {dom}, nearest family ink ΔE {near:.1f}", level="warn")
-    else:
-        add("contrast-on-card", False, "no opaque ink")
-    if org_mark and Path(org_mark).is_file() and Path(org_mark).stat().st_size > 0:
-        try:
-            mk = Image.open(org_mark)
-            mk.load()
-            d = bin(_dhash(rgba) ^ _dhash(mk)).count("1")
-            add("not-org-glyph", d > 24, f"dHash distance {d} to {Path(org_mark).name}")
-        except Exception as exc:  # an unreadable org mark cannot be compared
-            add("not-org-glyph", True, f"org mark unreadable: {str(exc)[:60]}", level="warn")
-    bad = [s for s in siblings or [] if re.search(r"icon[-_.](dark|light)\.", s, re.I)]
-    add("one-file", not bad, ", ".join(bad) or "no -dark or -light sibling (decision 21)")
-    checks.append({"check": "no-text", "result": "manual", "detail": "OCR and the 48 px org sheet are reviewed (f.3, g)"})
-    res = "fail" if any(c["result"] == "fail" for c in checks) else (
-        "warn" if any(c["result"] == "warn" for c in checks) else "pass")
-    return {"result": res, "checks": checks, "dominant_ink": dom}
-
-
-# =====================================================================================================
-# CLI (`showcase.py content ...`): wired by showcase.py with `content.add_parser(sub, <showcase module>)`
-# =====================================================================================================
-ACTIONS = ("social", "icon", "links", "linguist", "actions", "images", "sidebar")
-
-
-def register(sub) -> None:
-    """showcase.py wires `content` with register(sub), like `org` and `project`."""
-    add_parser(sub)
-
-
-def add_parser(sub, cli=None):
-    """Register `content {social,icon,links,linguist,actions,images,sidebar}` on showcase.py's subparsers. `cli` is the
-    showcase module (its context, repo_dir and cmd_social helpers); by default the running showcase.py."""
-    import argparse
-    common = argparse.ArgumentParser(add_help=False)
-    common.add_argument("--report", help="also write the JSON result to this file")
-    common.add_argument("--registry", help="registry/estate.yaml (default: the bundle's, when present)")
-    common.add_argument("--approved", help="decisions/approved.tsv (approved org renames, CQ-03)")
-    common.add_argument("--approved-yaml", help="decisions/APPROVED_ACTIONS.yaml")
-    common.add_argument("--actions", help="decisions/estate-actions.json")
-    common.add_argument("--jobs", help="append the writer jobs (JSON lines) to FILE")
-    s = sub.add_parser("content", help="content checks and proposals: social, icon, links, linguist, actions, images, "
-                                       "sidebar (read-only; emits diffs, gh argv and writer jobs)")
-    cs = s.add_subparsers(dest="content_action", required=True, metavar="<action>")
-
-    a = cs.add_parser("social", parents=[common], help="1280x640 repo social preview (R10; same options and file as the deprecated "
-                                                    "social-preview), plus the browser upload job")
-    a.add_argument("--out")
-    a.add_argument("--title")
-    a.add_argument("--icon")
-    a.add_argument("--allow-unmeasured", action="store_true")
-    a.add_argument("--allow-hold", action="store_true")
-    a.add_argument("--job", action="store_true", help="also emit the writer browser job that uploads it")
-
-    a = cs.add_parser("icon", parents=[common], help="repo icon (RT-04): prompt file, normalize a candidate, QA check")
-    a.add_argument("icon_action", choices=("prompt", "normalize", "check"))
-    a.add_argument("--option", choices=("A", "B"), default="A", help="q59 option: A Neon Night glyph, B isometric")
-    a.add_argument("--glyph", help="YAML/JSON with the writer's glyph_name, glyph_description, spark_placement, "
-                                   "size_class (option B: subject, objects)")
-    a.add_argument("--art-direction", help="art direction file (default: the skill's references/art-direction.md)")
-    a.add_argument("--in", dest="src", help="normalize: the returned candidate PNG")
-    a.add_argument("--ground", choices=("auto", "transparent", "keep"), default="auto")
-    a.add_argument("--out", help="prompt: the prompt file (art/prompts/<org>/<repo>/icon.md); normalize: the icon "
-                                 "(default assets/icon.png in the checkout); check: the icon to check")
-    a.add_argument("--preview", help="normalize: also write a 48 px preview on the card colour")
-    a.add_argument("--allow-hold", action="store_true", help="work on a family that is on hold (as banner and card)")
-
-    a = cs.add_parser("links", parents=[common], help="CQ-04: relative links, anchors and remote targets")
-    a.add_argument("files", nargs="*", help="Markdown files (default: displayed README, docs/**, .github/*.md, profile)")
-    a.add_argument("--readme-path", help="the README GitHub displays (GET /repos/{o}/{r}/readme .path)")
-    a.add_argument("--base-ref", help="git ref of the base: only breakage this change introduces fails")
-    a.add_argument("--online", action="store_true", help="cached §10.2 GET of remote URLs and gh full_name checks")
-    a.add_argument("--cache", help="remote-check cache file (JSON)")
-    a.add_argument("--max-remote", type=int, default=300)
-    a.add_argument("--delay", type=float, default=1.0, help="seconds between requests to one host")
-    a.add_argument("--strict", action="store_true", help="fail on any broken link, even without --base-ref")
-    a.add_argument("--diff", action="store_true", help="print the proposals as a unified diff (never applied)")
-
-    a = cs.add_parser("linguist", parents=[common], help="RP-07: paths that distort the language bar")
-    a.add_argument("--min-share", type=float, default=0.02)
-    a.add_argument("--language", help="a registry `language:` override for the chip")
-
-    a = cs.add_parser("actions", parents=[common], help="RP-06/RP-01: Actions health and merge side effects")
-    a.add_argument("--runs", help="`gh run list --json ...` output or REST actions/runs JSON")
-    a.add_argument("--workflows", help="REST actions/workflows JSON or `gh workflow list --json id,name,path,state`")
-    a.add_argument("--pages", help="REST repos/{o}/{r}/pages JSON")
-    a.add_argument("--changed", nargs="*", help="paths the merge changes (default: the estate polish set)")
-    a.add_argument("--approval", action="append", default=[], metavar="WORKFLOW=ID",
-                   help="approved workflow-toggle id for a workflow file (q79)")
-
-    a = cs.add_parser("images", parents=[common], help="RP-03/RP-10: README image budget and dark-theme flags")
-    a.add_argument("files", nargs="*")
-    a.add_argument("--readme-path")
-    a.add_argument("--base-ref", help="images not in this ref are new (default HEAD)")
-    a.add_argument("--approval-id", help="per-repo lossy-image approval id (q69)")
-    a.add_argument("--out-dir", help="write pixel-identical optimized candidates here for review")
-    a.add_argument("--online", action="store_true")
-
-    a = cs.add_parser("sidebar", parents=[common], help="RP-05: About sidebar target and browser job")
-    a.add_argument("--facts", required=True, help="JSON: releases, deployments, environments, packages (per repo, or "
-                                                  "keyed by OWNER/REPO for many)")
-    a.add_argument("--packages", action="append", default=[], help="org packages JSON (repeatable)")
-    a.add_argument("--current", help="JSON of known current box states (skip no-ops)")
-    a.add_argument("--repo", dest="only", help="OWNER/REPO filter for an estate facts file")
-    s.set_defaults(func=lambda args: cmd_content(args, cli))
-    return s
-
-
-def _load_json(path, flag: str):
-    if not path:
-        return None
-    try:
-        return json.loads(Path(path).read_text(encoding="utf-8"))
-    except (OSError, ValueError) as exc:
-        raise ShowcaseError(f"cannot read {flag} {path}: {exc}", log="usage")
-
-
-def _cli():
-    import sys
-    main = sys.modules.get("__main__")
-    if main is not None and hasattr(main, "context") and hasattr(main, "cmd_social"):
-        return main
-    import showcase  # scripts/ is on sys.path when ctshowcase is imported from showcase.py or the tests
-    return showcase
-
-
-def _owner_repo(args, cli, rd: Path | None) -> tuple[str | None, str | None, dict]:
-    from .meta import from_repo_dir, load_file
-    if args.meta:
-        m = load_file(args.meta)
-        return m.get("owner"), m.get("repo"), m
-    if rd is not None:
-        m = from_repo_dir(rd)
-        return m.get("owner"), m.get("repo"), m
-    return None, None, {}
-
-
-def _resolver(args, cli):
-    if getattr(args, "_content_resolver", None) is None:
-        args._content_resolver = load_resolver(cli.brand(args), args.registry, args.approved, args.approved_yaml,
-                                               args.actions)
-    return args._content_resolver
-
-
-def _ctx(args, cli, resolver):
-    """RepoContext with the org row and style taken through the resolver (a renamed org keeps its row)."""
-    ctx = cli.context(args)
-    key = resolver.brand_key(ctx.owner)
-    if key and key != ctx.owner and not ctx.org.get("known"):
-        ctx.org = org_row(resolver, ctx.brand, ctx.owner)
-        ctx.style = org_style(resolver, ctx.brand, ctx.owner)
-        ctx.logs = [x for x in ctx.logs if x != "needs-input:org-row"]
-        ctx.log(f"org-alias:{key}")
-    return ctx
-
-
-def _finish(args, obj: dict, code: int):
-    jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
-    from .signoff import stamp
-    stamp(jobs)  # before any serialization (--jobs, --report): a no-op unless --require-t3-signoff
-    if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
-        from .records import append
-        append(args.jobs, jobs)
-        obj["jobs_file"] = str(args.jobs)
-    if getattr(args, "report", None):
-        p = Path(args.report)
-        p.parent.mkdir(parents=True, exist_ok=True)
-        p.write_text(json.dumps(obj, indent=1, ensure_ascii=False, default=str) + "\n", encoding="utf-8")
-    return obj, code
-
-
-def _code(result: str) -> int:
-    return CHECK_FAILED if result in ("fail", "needs-writer") else OK
-
-
-def cmd_content(args, cli=None):
-    cli = cli or _cli()
-    act = args.content_action
-    resolver = _resolver(args, cli)
-    head = {"command": "content", "action": act}
-    if act == "social":
-        owner, srepo, _ = _owner_repo(args, cli, None)
-        if owner:
-            resolver.check_owner(owner, allow_hold=args.allow_hold, repo=srepo)
-        obj, code = cli.cmd_social(args)
-        obj = dict(head, **{k: v for k, v in obj.items() if k != "command"}, alias_of="social-preview")
-        if args.job and obj.get("result") == "ok":
-            ctx = _ctx(args, cli, resolver)
-            job = social_job(ctx, resolver, obj["out"])
-            if job and obj.get("footer") != f"github.com/{job['repo']}":
-                # the image names another login than the repository it would be uploaded to (an approved rename the
-                # render did not see): never upload it; re-render once the image names the current login
-                obj["result"], code = "needs-input", CHECK_FAILED
-                obj["logs"] = list(obj.get("logs") or []) + ["needs-input:social-login"]
-                job = None
-            obj["job"] = job
-        return _finish(args, obj, code)
-    if act in ("links", "images"):
-        rd = cli.repo_dir(args)
-        if rd is None:
-            raise ShowcaseError(f"content {act} needs a checkout (--repo-dir)", log="usage")
-        owner, repo, _ = _owner_repo(args, cli, rd)
-        if owner:
-            resolver.check_owner(owner, repo=repo)
-        tree = Tree(rd)
-        readme = displayed_readme(tree, args.readme_path)
-        files = list(args.files) or markdown_files(tree, readme)
-        missing = [f for f in files if not tree.is_file(f)]
-        if missing:
-            raise ShowcaseError(f"not in the checkout: {', '.join(missing)}", log="usage")
-        if not files:  # the wrong directory (no README, no docs) must not read as a clean pass
-            raise NeedsInput("readme", f"content {act}: {rd} has no README or Markdown file to check (run it inside the "
-                                       "target checkout, or pass --repo-dir or FILE ...)")
-        head.update(owner=owner, repo=repo, readme=readme)
-        if act == "links":
-            fetcher = Fetcher(args.cache, delay=args.delay, max_requests=args.max_remote) if args.online else None
-            base = Tree(rd, args.base_ref) if args.base_ref else None
-            res = links_report(tree, files, resolver=resolver, fetcher=fetcher, online=args.online, base=base,
-                               strict=args.strict, self_slug=(owner, repo) if owner and repo else None)
-            if fetcher:
-                fetcher.save()
-                res["requests"] = fetcher.requests
-            if args.diff:
-                res["diff"] = proposal_diff(tree, res["proposals"])
-            obj = dict(head, **res)
-        else:
-            fetcher = Fetcher(None) if args.online else None
-            res = images_report(tree, files, new_paths=new_files(tree, args.base_ref), approval_id=args.approval_id,
-                                out_dir=args.out_dir, fetcher=fetcher)
-            obj = dict(head, **res)
-        return _finish(args, obj, _code(obj["result"]))
-    if act == "linguist":
-        ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner, repo=ctx.repo)
-        tree = Tree(ctx.repo_dir) if ctx.repo_dir else None
-        override = dict(ctx.override)
-        if args.language:
-            override["language"] = args.language
-        res = linguist_report(ctx.meta, tree, override=override, min_share=args.min_share)
-        return _finish(args, {**head, "owner": ctx.owner, "repo": ctx.repo, **res, "logs": ctx.logs + res["logs"]}, OK)
-    if act == "actions":
-        ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner, repo=ctx.repo)
-        wf_files, root_files, readme = {}, (), ""
-        if ctx.repo_dir:
-            tree = Tree(ctx.repo_dir)
-            wf_files = {f: tree.read(f) or "" for f in sorted(tree.files)
-                        if re.match(r"^\.github/workflows/[^/]+\.ya?ml$", f)}
-            root_files = [f for f in tree.files if "/" not in f]
-            rp = displayed_readme(tree)
-            readme = tree.read(rp) if rp else ""
-        else:
-            readme = ctx.meta.get("readme_head") or ""
-            root_files = [f for f in ctx.meta.get("files") or [] if "/" not in f]
-        approvals = dict(x.split("=", 1) for x in args.approval if "=" in x)
-        res = actions_report(ctx.meta, runs=_load_json(args.runs, "--runs"),
-                             workflows=_load_json(args.workflows, "--workflows"), workflow_files=wf_files,
-                             readme=readme, root_files=root_files, pages=_load_json(args.pages, "--pages"),
-                             resolver=resolver, changed=tuple(args.changed) if args.changed else POLISH_PATHS,
-                             approval_ids=approvals)
-        obj = dict(head, owner=ctx.owner, **{k: v for k, v in res.items() if k != "logs"}, logs=ctx.logs + res["logs"])
-        return _finish(args, obj, _code(res["result"]))
-    if act == "sidebar":
-        return _finish(args, *_cmd_sidebar(args, cli, resolver, head))
-    if act == "icon":
-        return _finish(args, *_cmd_icon(args, cli, resolver, head))
-    raise ShowcaseError(f"unknown content action {act}", log="usage")
-
-
-def social_job(ctx, resolver: Resolver, out: str) -> dict | None:
-    """Browser job for the repository social preview upload (STANDARD §12.4; public T1/T2 repos only)."""
-    if not ctx.social_applicable():
-        return None
-    full = f"{current_login(resolver, ctx.owner)}/{ctx.repo}"
-    steps = [f"Open https://github.com/{full}/settings (the General page).",
-             "Scroll to \"Social preview\" and click \"Edit\", then \"Upload an image…\".",
-             f"Choose the file {out} from the repository checkout and confirm the dialog.",
-             "Wait until the preview shows the new image; do not change any other setting on this page.",
-             f"Verify with the read-only query: gh api graphql -f query='{{repository(owner:\"{full.split('/')[0]}\","
-             f"name:\"{ctx.repo}\"){{usesCustomOpenGraphImage openGraphImageUrl}}}}' (usesCustomOpenGraphImage is true)."]
-    return browser_job(job_id("p5", "social-preview", full), "5", full, f"https://github.com/{full}/settings",
-                       "social-preview", steps, "Upload the repository social preview (R10; STANDARD §9.5, §12.4).")
-
-
-def _cmd_sidebar(args, cli, resolver, head):
-    facts = _load_json(args.facts, "--facts") or {}
-    pk = None
-    if args.packages:
-        pk = {}
-        for p in args.packages:
-            for k, v in packages_by_repo(_load_json(p, "--packages"), resolver).items():
-                pk[k] = pk.get(k, 0) + v
-    current = _load_json(args.current, "--current") or {}
-    keyed = isinstance(facts, dict) and facts and all(isinstance(k, str) and "/" in k for k in facts)
-    if not keyed:
-        ctx = _ctx(args, cli, resolver)
-        resolver.check_owner(ctx.owner, repo=ctx.repo)
-        res = sidebar_plan(ctx.meta, facts, resolver=resolver, packages=pk,
-                           current=current.get(f"{ctx.owner}/{ctx.repo}") or current or None)
-        obj = dict(head, owner=ctx.owner, repo=ctx.repo, **{k: v for k, v in res.items() if k != "logs"},
-                   jobs=[res["job"]] if res["job"] else [], tsv_header=SIDEBAR_TSV_HEADER, logs=ctx.logs + res["logs"])
-        return obj, OK
-    rows, jobs, logs, skipped, unknown = [], [], [], [], 0
-    for full, f in sorted(facts.items()):
-        o, r = full.split("/", 1)
-        if args.only and not (resolver.same(o, args.only.split("/")[0]) and r.lower() == args.only.split("/")[1].lower()):
-            continue
-        try:
-            resolver.check_owner(o, repo=r)
-        except Refused as exc:
-            skipped.append({"repo": full, "why": exc.log})
-            continue
-        meta = dict((f or {}).get("meta") or {}, owner=o, repo=r)
-        meta.setdefault("visibility", (f or {}).get("visibility", "public"))
-        res = sidebar_plan(meta, f or {}, resolver=resolver, packages=pk, current=current.get(full))
-        rows.append(res["tsv"])
-        if res["job"]:
-            jobs.append(res["job"])
-        unknown += res["result"] == "needs-input"
-        logs += [f"{full}:{x}" for x in res["logs"]]
-    # a repository whose facts are incomplete gets no job; the batch must say so instead of reading as a pass
-    result = "proposal" if jobs else ("needs-input" if unknown else "pass")
-    obj = dict(head, result=result, repos=len(rows), needs_input=unknown, tsv_header=SIDEBAR_TSV_HEADER, tsv=rows,
-               jobs=jobs, skipped=skipped, logs=logs)
-    return obj, OK
-
-
-def _cmd_icon(args, cli, resolver, head):
-    from PIL import Image
-    ctx = _ctx(args, cli, resolver)
-    resolver.check_owner(ctx.owner, repo=ctx.repo)
-    # decision 12: the same applicability as banner, card, lint all and doctor (RepoContext.art_status); only
-    # watching-org forks and a placeholder org's `.github` are exempt. Forks outside the watching org, backups and
-    # `.github` repositories need their own icon. The resolver also sees the renames and placeholders passed here.
-    why = ctx.art_status()["icon"]
-    if resolver.owner_status(ctx.owner) == "watching":  # only its forks are exempt; its `.github` needs an icon
-        why = "exempt:watching-fork" if ctx.is_fork else \
-            why if ctx.repo == ".github" else "hold:watching-non-fork"
-    elif ctx.repo == ".github" and resolver.is_placeholder(ctx.owner):
-        why = "exempt:placeholder-org"
-    if why and why.startswith("exempt"):
-        return dict(head, owner=ctx.owner, repo=ctx.repo, result="exempt", logs=[why]), OK
-    if why == "t3-signoff":
-        raise Refused(f"{ctx.owner} is T3; needs co-owner sign-off", log="t3-signoff")
-    if why and why.startswith("hold") and not getattr(args, "allow_hold", False):  # a family on hold (brand.yaml style
-        # `hold`) or a watching-org non-fork (`hold:watching-non-fork`), as banner and card refuse
-        raise ShowcaseError(f"{ctx.owner}/{ctx.repo} is held ({why}); pass --allow-hold", log=why)
-    head.update(owner=ctx.owner, repo=ctx.repo, icon_action=args.icon_action)
-    card = ctx.style["tokens"]["card_fill"]
-    org = org_row(resolver, ctx.brand, ctx.owner)
-    mark = ctx.brand.asset(org.get("mark"))
-    if args.icon_action == "prompt":
-        art = load_art_direction(args.art_direction)
-        glyph = None
-        if args.glyph:
-            try:
-                glyph = load_yaml_text(Path(args.glyph).read_text(encoding="utf-8")) or {}
-            except OSError as exc:
-                raise ShowcaseError(f"cannot read --glyph {args.glyph}: {exc}", log="usage")
-        lang = None
-        if ctx.repo_dir or ctx.meta.get("files"):
-            try:
-                lang = linguist_report(ctx.meta, Tree(ctx.repo_dir) if ctx.repo_dir else None,
-                                       override=ctx.override)["primary"]["language"]
-            except NeedsInput:
-                lang = None
-        skill_art = SKILL_ART_DIRECTION.read_text(encoding="utf-8") if args.option == "B" else None
-        res = icon_prompt(ctx, resolver, art, glyph, args.option, lang, skill_art)
-        md = prompt_markdown(res)
-        result = "needs-writer" if res["missing"] else "ok"
-        out = None
-        if args.out and not res["missing"]:
-            out = Path(args.out)
-            out.parent.mkdir(parents=True, exist_ok=True)
-            out.write_text(md, encoding="utf-8")
-        logs = ctx.logs + ([f"needs-writer:{s}" for s in res["missing"]])
-        obj = dict(head, result=result, out=str(out) if out else None, missing=res["missing"], facts=res["facts"],
-                   render=res["render"], prompt=res["prompt"], markdown=None if out else md, logs=logs,
-                   note="The glyph is the writer's: fill glyph_name, glyph_description, spark_placement and size_class "
-                        "(--glyph FILE) and re-run until the result is ok; nothing is written before then.")
-        return obj, _code(result)
-    ink = []
-    try:
-        art = load_art_direction(args.art_direction)
-        ink = icon_colours(ctx, art, org, resolver).get("INK") or []
-    except NeedsInput as exc:
-        ctx.log(exc.log)
-    rd = ctx.repo_dir
-    siblings = [p.name for p in (rd / "assets").glob("icon*")] if rd and (rd / "assets").is_dir() else []
-    if args.icon_action == "normalize":
-        if not args.src:
-            raise ShowcaseError("content icon normalize needs --in CANDIDATE.png", log="usage")
-        src = Image.open(args.src)
-        src.load()
-        img, info = normalize_icon(src, args.ground, card, pixel_art=bool(ctx.style.get("icon_pixel_art")))
-        data, qlogs = icon_bytes(img)
-        qa = icon_qa(data, card=card, ink=ink, org_mark=mark, siblings=siblings)
-        out = Path(args.out) if args.out else cli.default_out(args, "assets/icon.png")
-        if qa["result"] == "fail":
-            return dict(head, result="fail", out=None, info=info, qa=qa, logs=ctx.logs + qlogs + ["art-fail:icon-qa"],
-                        note="nothing written"), CHECK_FAILED
-        cli.write_bytes(out, data)
-        if args.preview:
-            prev = Image.new("RGBA", (48, 48), _hex_rgba(card))
-            prev.alpha_composite(img.convert("RGBA").resize((48, 48), Image.LANCZOS))
-            cli.write_bytes(Path(args.preview), _png(prev.convert("RGB")))
-        return dict(head, result=qa["result"], out=str(out), bytes=len(data),
-                    sha256=hashlib.sha256(data).hexdigest(), info=info, qa=qa, logs=ctx.logs + qlogs), OK
-    path = Path(args.out) if args.out else (rd / "assets" / "icon.png" if rd else None)
-    if path is None or not path.is_file():
-        return dict(head, result="fail", file=str(path) if path else None, logs=ctx.logs + ["needs-input:repo-icon"]), \
-            CHECK_FAILED
-    qa = icon_qa(path.read_bytes(), card=card, ink=ink, org_mark=mark, siblings=siblings)
-    return dict(head, result=qa["result"], file=str(path), qa=qa, logs=ctx.logs), _code(qa["result"])
-
-
-def _hex_rgba(value: str) -> tuple[int, int, int, int]:
-    from .color import rgba
-    return rgba(value)
-
-
-def _png(img) -> bytes:
-    from .scene import png_bytes
-    return png_bytes(img)
-
-
-def main(argv=None) -> int:
-    """Standalone entry (`python -m ctshowcase.content ...` from scripts/) until showcase.py registers `content`."""
-    import argparse
-    import sys
-    cli = _cli()
-    p = cli.parser()
-    sub = next(a for a in p._actions if isinstance(a, argparse._SubParsersAction))
-    if "content" not in sub.choices:
-        add_parser(sub, cli)
-    args = p.parse_args(argv)
-    if args.format is None:
-        args.format = "text" if args.command in cli.GENERATORS else "json"
-    try:
-        obj, code = args.func(args)
-    except ShowcaseError as exc:
-        obj = {"command": args.command, "result": "refused" if exc.code == 2 and exc.log in ("hold", "t3-signoff", "exempt")
-               else exc.log.split(":")[0], "error": str(exc), "logs": [exc.log]}
-        code = exc.code
-        if args.format == "text" and not args.quiet:
-            print(f"{args.command}: {exc}", file=sys.stderr)
-            return code
-    if obj is not None:
-        cli.emit(args, obj)
-    return code
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
+"""`showcase.py content ...`: links (CQ-04, RP-09), linguist (RP-07, CQ-08), actions (RP-06, RP-01, CQ-13), images
+(RP-03, RP-10), sidebar (RP-05), icon (RT-04) and social (R10; the contract name of the social preview, with the
+hidden top-level `social-preview` kept as a deprecated alias).
+
+Read-only toward GitHub, like every other module. Nothing here rewrites a README, edits `.gitattributes`, touches a
+workflow file or uploads anything: each action reports facts and emits proposals (unified diffs, `gh` argv and
+`scripts/writer.py` jobs `{id, phase, kind, repo|org, approval_id?, argv, note}`; UI-only steps are jobs of kind
+`browser` with the exact click path in `steps`). The only files written are the paths given with `--report`, `--jobs`
+(JSON lines, appended), `--out`, `--out-dir`, `--preview` and `--cache`. Network use is opt-in (`--online`): cached,
+polite HEAD/GET requests and read-only `gh api` GETs.
+
+Every org lookup goes through the shared `resolver.Resolver` (CQ-03): after an approved rename
+(CompleTetech-Security -> CompleteTech-Security, CompleteTech-Pokemon -> CompleteTech-TCG) a repository keeps its
+brand row, its owner status (watching, T3, excluded), its packages and its links, and jobs name the current login.
+"""
+from __future__ import annotations
+
+import difflib
+import hashlib
+import html
+import io
+import json
+import re
+import subprocess
+import time
+import unicodedata
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+from pathlib import Path, PurePosixPath
+
+from . import ROOT, STANDARD, __version__, estate_candidates
+from .config import load_yaml_text
+from .errors import CHECK_FAILED, OK, ArtFail, NeedsInput, Refused, ShowcaseError
+from .resolver import Resolver
+
+# the estate hand-off tree when the skill lives inside it (or is its installed copy); optional everywhere
+ESTATE = next((c for c in estate_candidates() if (c / "art").is_dir()), ROOT.parent)
+SKILL_ART_DIRECTION = ROOT / "references" / "art-direction.md"
+DEFAULT_ART_DIRECTION = SKILL_ART_DIRECTION
+
+
+def _now() -> str:
+    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+# =====================================================================================================
+# Org lookups (CQ-03): always through the shared resolver.Resolver
+# =====================================================================================================
+def brand_key(r: Resolver | None, login: str) -> str:
+    """The brand.yaml `orgs:` key for any login of the org (old or new), else the login itself."""
+    return (r.brand_key(login) if r else None) or login
+
+
+def current_login(r: Resolver | None, login: str) -> str:
+    """The org's login after approved renames: what links, URLs and writer jobs name."""
+    return r.canonical(login) if r else login
+
+
+def org_row(r: Resolver | None, brand, login: str, require: bool = False) -> dict:
+    if r is None:
+        row = brand.org(login)
+        if require and not row.get("known"):
+            raise NeedsInput("org", f"{login} has no row in references/brand.yaml")
+        return dict(row, brand_key=login)
+    row = r.brand_org(login, strict=require)
+    row.setdefault("brand_key", r.brand_key(login) or login)
+    return row
+
+
+def org_style(r: Resolver | None, brand, login: str) -> dict:
+    return brand.style(brand_key(r, login))
+
+
+def in_estate(r: Resolver | None, login: str) -> bool:
+    """An org of the estate (a brand or registry row under any of its logins), not an excluded owner."""
+    if r is None or not login:
+        return False
+    return (r.brand_key(login) is not None or r.registry_key(login) is not None) and r.owner_status(login) != "excluded"
+
+
+def load_resolver(brand, registry=None, approved=None, approved_yaml=None, actions=None) -> Resolver:
+    """The shared resolver from brand.yaml plus the registry and approvals (defaults: the estate bundle beside the
+    skill, when present). Read-only: the registry is private data and is never copied anywhere."""
+    return Resolver.from_paths(brand, registry, approved, approved_yaml, actions)
+
+
+# =====================================================================================================
+# Writer jobs
+# =====================================================================================================
+_JID = re.compile(r"[^A-Za-z0-9._:@/+-]+")
+SAFETY_STEP = ("Never click a control inside a \"Danger Zone\" section and never type an owner, repository or org name "
+               "into a confirmation field; if a dialog mentioning delete, transfer, archive, rename or visibility opens, "
+               "press Escape and log ui-danger-dialog.")
+
+
+def job_id(*parts) -> str:
+    """A writer job id: letters, digits and ._:@/+- only (scripts/writer.py ID_RE), at most 200 characters."""
+    s = _JID.sub("-", ":".join(str(p) for p in parts if p not in (None, ""))).strip("-.")
+    return s[:200] or "job"
+
+
+def writer_job(jid: str, phase, kind: str, target: str, argv: list, note: str, approval_id: str | None = None,
+               **extra) -> dict:
+    j = {"id": jid, "phase": str(phase), "kind": kind, ("repo" if "/" in target else "org"): target}
+    if approval_id:
+        j["approval_id"] = approval_id
+    j["argv"] = [str(a) for a in argv]
+    j["note"] = note
+    j.update(extra)
+    return j
+
+
+def browser_job(jid: str, phase, target: str, url: str, ui_action: str, steps: list[str], note: str,
+                approval: dict | None = None) -> dict:
+    shot = "state/screens/" + re.sub(r"[^A-Za-z0-9._-]+", "_", jid) + ".png"
+    steps = [*steps, f"Take a screenshot of the result and save it as {shot}.", SAFETY_STEP]
+    j = writer_job(jid, phase, "browser", target, [], note, url=url, ui_action=ui_action, steps=steps)
+    if approval:
+        j["approval"] = approval
+    return j
+
+
+# =====================================================================================================
+# Repository tree (what GitHub sees)
+# =====================================================================================================
+SKIP_WALK = {".git", "node_modules", ".venv", "venv", "__pycache__", ".showcase-cache"}
+
+
+class Tree:
+    """Files of a checkout as GitHub serves them: tracked plus untracked-but-not-ignored files that exist (git work
+    tree), every file on disk (no git), or the tree at a git ref (`--base-ref`)."""
+
+    def __init__(self, root: str | Path, ref: str | None = None):
+        self.root, self.ref = Path(root), ref
+        self.git = False
+        self.files = self._list()
+        self.lower: dict[str, list[str]] = {}
+        self.dirs: set[str] = {""}
+        for f in self.files:
+            self.lower.setdefault(f.lower(), []).append(f)
+            parts = f.split("/")
+            for i in range(1, len(parts)):
+                self.dirs.add("/".join(parts[:i]))
+        self._cache: dict[str, str | None] = {}
+
+    def _git(self, *args) -> str | None:
+        try:
+            p = subprocess.run(["git", "-C", str(self.root), *args], capture_output=True, timeout=60)
+        except (OSError, subprocess.SubprocessError):
+            return None
+        return p.stdout.decode("utf-8", "surrogateescape") if p.returncode == 0 else None
+
+    def _list(self) -> set[str]:
+        if self.ref:
+            out = self._git("ls-tree", "-r", "--name-only", "-z", self.ref)
+            if out is None:
+                raise ShowcaseError(f"cannot list {self.ref} in {self.root}", log="usage")
+            self.git = True
+            return {f for f in out.split("\0") if f}
+        if (self.root / ".git").exists():
+            out = self._git("ls-files", "-z", "--cached", "--others", "--exclude-standard")
+            if out is not None:
+                self.git = True
+                return {f for f in out.split("\0") if f and (self.root / f).is_file()}
+        files = set()
+        for p in self.root.rglob("*"):
+            rel = p.relative_to(self.root)
+            if p.is_file() and not (set(rel.parts) & SKIP_WALK):
+                files.add(rel.as_posix())
+        return files
+
+    def is_file(self, rel: str) -> bool:
+        return rel in self.files
+
+    def is_dir(self, rel: str) -> bool:
+        return rel.rstrip("/") in self.dirs
+
+    def read(self, rel: str) -> str | None:
+        if rel not in self._cache:
+            if rel not in self.files:
+                self._cache[rel] = None
+            elif self.ref:
+                self._cache[rel] = self._git("show", f"{self.ref}:{rel}")
+            else:
+                try:
+                    self._cache[rel] = (self.root / rel).read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    self._cache[rel] = None
+        return self._cache[rel]
+
+    def read_bytes(self, rel: str) -> bytes | None:
+        if rel not in self.files:
+            return None
+        if self.ref:
+            try:
+                p = subprocess.run(["git", "-C", str(self.root), "show", f"{self.ref}:{rel}"], capture_output=True,
+                                   timeout=60)
+            except (OSError, subprocess.SubprocessError):
+                return None
+            return p.stdout if p.returncode == 0 else None
+        try:
+            return (self.root / rel).read_bytes()
+        except OSError:
+            return None
+
+    def size(self, rel: str) -> int:
+        if not self.ref:
+            try:
+                return (self.root / rel).stat().st_size
+            except OSError:
+                return 0
+        b = self.read_bytes(rel)
+        return len(b) if b is not None else 0
+
+
+def displayed_readme(tree: Tree, given: str | None = None) -> str | None:
+    """The README GitHub displays (RP-09): `.github/README.md`, then the root, then `docs/` (GitHub's precedence), or
+    the `/readme` `.path` captured in metadata."""
+    if given:
+        return given if tree.is_file(given) else None
+    for d in (".github/", "", "docs/"):
+        for name in ("README.md", "readme.md", "Readme.md", "README.markdown", "README"):
+            if tree.is_file(d + name):
+                return d + name
+    return None
+
+
+def markdown_files(tree: Tree, readme: str | None) -> list[str]:
+    """README (displayed path), docs/**/*.md, .github/*.md and the org profile README (CQ-04 scope)."""
+    out = [readme] if readme else []
+    for f in sorted(tree.files):
+        low = f.lower()
+        if not low.endswith((".md", ".markdown")) or f in out:
+            continue
+        if low.startswith("docs/") or (low.startswith(".github/") and low.count("/") == 1) or low in (
+                "profile/readme.md", ".github/profile/readme.md"):
+            out.append(f)
+    return out
+
+
+# =====================================================================================================
+# Markdown scanning
+# =====================================================================================================
+FENCE = re.compile(r"^ {0,3}(`{3,}(?=[^`\n]*$)|~{3,})")  # CommonMark: no backtick in a ``` info string
+INLINE_CODE = re.compile(r"(`+)(?:.+?)\1")
+ATX = re.compile(r"^ {0,3}(#{1,6})(?:[ \t]+(.*?))?(?:[ \t]+#+)?[ \t]*$")
+SETEXT = re.compile(r"^ {0,3}(=+|-+)[ \t]*$")
+MD_LINK = re.compile(r"(!?)\[((?:[^\[\]\n]|\[[^\[\]\n]*\])*)\]\(\s*(<[^>\n]*>|[^\s()]*(?:\([^\s()]*\)[^\s()]*)*)"
+                     r"(?:\s+(?:\"[^\"\n]*\"|'[^'\n]*'|\([^)\n]*\)))?\s*\)")
+REF_DEF = re.compile(r"^ {0,3}\[([^\]\n]+)\]:\s*(<[^>\n]*>|\S+)")
+HTML_TAG = re.compile(r"<(a|img|source|link|video|audio|image|use)\b([^>]*)>", re.I)
+ATTR = re.compile(r"""(?<![\w-])(href|src|srcset|alt|xlink:href|name|id)\s*=\s*("([^"]*)"|'([^']*)'|([^\s>]+))""", re.I)
+ANCHOR_ATTR = re.compile(r"""<[a-z][^>]*?(?<![\w-])(?:name|id)\s*=\s*["']([^"']+)["']""", re.I)
+HTML_HEADING = re.compile(r"<h([1-6])\b[^>]*>(.*?)</h\1>", re.I | re.S)
+BARE_URL = re.compile(r"https?://[^\s<>()\[\]\"'`]+")
+IMG_EXT = (".png", ".jpg", ".jpeg", ".gif", ".svg", ".webp", ".avif", ".bmp", ".ico")
+
+
+def scan_lines(text: str) -> list[tuple[int, str | None, str | None]]:
+    """(line number, text without HTML comments, the same with inline code blanked); both None inside a code fence."""
+    out, fence, comment = [], None, False
+    for n, raw in enumerate(text.replace("\r\n", "\n").split("\n"), 1):
+        m = FENCE.match(raw)
+        if fence:
+            if m and m.group(1)[0] == fence[0] and len(m.group(1)) >= len(fence) and not raw.strip().strip(fence[0]):
+                fence = None
+            out.append((n, None, None))
+            continue
+        if m and not comment:
+            fence = m.group(1)
+            out.append((n, None, None))
+            continue
+        line, rest = "", raw
+        while rest:
+            if comment:
+                end = rest.find("-->")
+                if end < 0:
+                    rest = ""
+                    break
+                rest, comment = rest[end + 3:], False
+                continue
+            start = rest.find("<!--")
+            if start < 0:
+                line += rest
+                break
+            line += rest[:start] + " "
+            rest, comment = rest[start + 4:], True
+        out.append((n, line, INLINE_CODE.sub(lambda mm: " " * len(mm.group(0)), line)))
+    return out
+
+
+def plain_heading(md: str) -> str:
+    s = re.sub(r"!\[[^\]]*\]\([^)]*\)", "", md)
+    s = re.sub(r"\[([^\]]*)\]\([^)]*\)", r"\1", s)
+    s = re.sub(r"\[([^\]]*)\]\[[^\]]*\]", r"\1", s)
+    s = re.sub(r"<[^>]+>", "", s)
+    s = re.sub(r"(`+)(.*?)\1", r"\2", s)
+    s = re.sub(r"(\*\*|__|~~)(.+?)\1", r"\2", s)
+    s = re.sub(r"(?<![\w*])\*(?!\s)(.+?)(?<!\s)\*(?![\w*])", r"\1", s)
+    s = re.sub(r"(?<![\w])_(?!\s)(.+?)(?<!\s)_(?![\w])", r"\1", s)
+    s = re.sub(r"\\([!-/:-@\[-`{-~])", r"\1", s)
+    return html.unescape(s).strip()
+
+
+def github_slug(text: str) -> str:
+    """GitHub's heading anchor (github-slugger): lower-case; letters, digits, marks, '-' and '_' kept; every other
+    character removed (stripped emoji leave their space); each space becomes '-'."""
+    out = []
+    for ch in text.lower():
+        if ch == " ":
+            out.append("-")
+        elif ch in "-_" or unicodedata.category(ch)[0] in "LMN":
+            out.append(ch)
+    return "".join(out)
+
+
+def headings(text: str) -> list[dict]:
+    """Markdown headings in order with their GitHub anchors (duplicates get -1, -2 ...)."""
+    rows, seen = [], {}
+    lines = scan_lines(text)
+    para = re.compile(r"^\s*([#<>|*+\-!\[]|\d+[.)]\s)")
+    for i, (n, t, _) in enumerate(lines):
+        if t is None:
+            continue
+        m = ATX.match(t)
+        title = None
+        if m:
+            title = m.group(2) or ""
+        elif i + 1 < len(lines) and lines[i + 1][1] is not None and SETEXT.match(lines[i + 1][1] or "") \
+                and t.strip() and not para.match(t):
+            title = t.strip()
+        elif HTML_HEADING.search(t):
+            title = HTML_HEADING.search(t).group(2)
+        if title is None:
+            continue
+        base = github_slug(plain_heading(title))
+        slug = base
+        if base in seen:
+            seen[base] += 1
+            slug = f"{base}-{seen[base]}"
+        else:
+            seen[base] = 0
+        rows.append({"line": n, "text": plain_heading(title), "slug": slug})
+    return rows
+
+
+def anchors(text: str) -> set[str]:
+    out = {h["slug"] for h in headings(text)}
+    for _, t, _ in scan_lines(text):
+        if t:
+            out |= {m.group(1) for m in ANCHOR_ATTR.finditer(t)}
+    return out
+
+
+def _attrs(s: str) -> dict:
+    return {m.group(1).lower(): next(g for g in (m.group(3), m.group(4), m.group(5)) if g is not None)
+            for m in ATTR.finditer(s)}
+
+
+def extract_links(text: str) -> list[dict]:
+    """Every link and image target outside code: inline, reference definitions, HTML and bare URLs."""
+    found = []
+    for n, _, masked in scan_lines(text):
+        if not masked:
+            continue
+        spans = []
+
+        def md(s: str, offset: int):
+            for m in MD_LINK.finditer(s):
+                target = m.group(3).strip("<>")
+                found.append({"line": n, "target": target, "image": m.group(1) == "!", "alt": m.group(2),
+                              "syntax": "markdown"})
+                spans.append((offset + m.start(), offset + m.end()))
+                md(m.group(2), offset + m.start(2))
+        md(masked, 0)
+        m = REF_DEF.match(masked)
+        if m:
+            found.append({"line": n, "target": m.group(2).strip("<>"), "image": False, "alt": m.group(1),
+                          "syntax": "reference"})
+            spans.append((m.start(), m.end()))
+        for m in HTML_TAG.finditer(masked):
+            tag, a = m.group(1).lower(), _attrs(m.group(2))
+            for key in ("href", "src", "xlink:href", "srcset"):
+                if key in a and a[key]:
+                    target = a[key].split(",")[0].strip().split(" ")[0] if key == "srcset" else a[key]
+                    found.append({"line": n, "target": target, "image": tag in ("img", "source", "image") or key == "src",
+                                  "alt": a.get("alt"), "syntax": f"html-{tag}"})
+            spans.append((m.start(), m.end()))
+        rest = list(masked)
+        for a, b in spans:
+            rest[a:b] = " " * (b - a)
+        for m in BARE_URL.finditer("".join(rest)):
+            found.append({"line": n, "target": m.group(0).rstrip(".,;:!?*_~'\""), "image": False, "alt": None,
+                          "syntax": "bare"})
+    return found
+
+
+# =====================================================================================================
+# links (CQ-04)
+# =====================================================================================================
+LINK_ALLOW_HOSTS = ("localhost", "127.0.0.1", "0.0.0.0", "::1", "example.com", "example.org", "example.net")
+LINK_ALLOW_SUFFIX = (".home.complete.tech", ".example.com", ".localhost")
+GITHUB_ROUTES = {"issues", "pulls", "pull", "actions", "wiki", "releases", "discussions", "security", "blob", "tree",
+                 "raw", "compare", "graphs", "network", "projects", "stargazers", "tags", "commits", "commit",
+                 "milestones", "labels", "branches", "packages", "deployments", "pulse", "forks", "watchers", "settings"}
+GITHUB_RESERVED = {"orgs", "settings", "topics", "sponsors", "marketplace", "apps", "features", "about", "login",
+                   "search", "explore", "collections", "trending", "notifications", "pricing", "enterprise", "users",
+                   "site", "security", "contact", "readme", "codespaces", "new", "organizations", "account", "stars"}
+OK_STATUS, BROKEN = "ok", "broken"
+
+
+def _private_host(host: str) -> bool:
+    return bool(re.match(r"^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.|169\.254\.)", host or ""))
+
+
+class Fetcher:
+    """Polite remote checks: a cached §10.2 GET (HEAD first; GET when HEAD is refused), `Mozilla/5.0` agent, at most
+    one request per host per `delay` seconds, `max_requests` per run. The cache file (opt-in) keeps results for
+    `ttl_days`; nothing else persists. `opener(url, method) -> (status|None, final_url, error|None)` is injectable."""
+
+    def __init__(self, cache_path=None, ttl_days: float = 7, delay: float = 1.0, timeout: float = 20,
+                 max_requests: int = 300, opener=None, gh=None, sleep=time.sleep, clock=time.time):
+        self.cache_path = Path(cache_path) if cache_path else None
+        self.ttl, self.delay, self.timeout, self.left = ttl_days * 86400, delay, timeout, max_requests
+        self.opener, self.gh, self.sleep, self.clock = opener or self._open, gh or _gh_full_name, sleep, clock
+        self.cache: dict = {}
+        self._last: dict[str, float] = {}
+        self.requests = 0
+        if self.cache_path and self.cache_path.is_file():
+            try:
+                self.cache = json.loads(self.cache_path.read_text(encoding="utf-8"))
+            except ValueError:
+                self.cache = {}
+
+    def _open(self, url: str, method: str):
+        req = urllib.request.Request(url, method=method, headers={"User-Agent": "Mozilla/5.0", "Accept": "*/*"})
+        try:
+            with urllib.request.urlopen(req, timeout=self.timeout) as r:
+                if method == "GET":
+                    r.read(1024)
+                return r.status, r.geturl(), None
+        except urllib.error.HTTPError as e:
+            return e.code, url, None
+        except urllib.error.URLError as e:
+            reason = str(e.reason)
+            return None, url, ("dns" if "Name or service" in reason or "nodename" in reason or "getaddrinfo" in reason
+                               else reason[:120])
+        except (TimeoutError, OSError, ValueError) as e:
+            return None, url, ("timeout" if "timed out" in str(e) else str(e)[:120])
+
+    def _fresh(self, key: str):
+        hit = self.cache.get(key)
+        if hit and self.clock() - hit.get("t", 0) <= self.ttl:
+            return dict(hit, cached=True)
+        return None
+
+    def _pace(self, host: str):
+        last = self._last.get(host)
+        if last is not None:
+            wait = self.delay - (self.clock() - last)
+            if wait > 0:
+                self.sleep(wait)
+        self._last[host] = self.clock()
+
+    def check(self, url: str) -> dict:
+        hit = self._fresh(url)
+        if hit:
+            return hit
+        if self.left <= 0:
+            return {"status": None, "error": "budget", "cached": False}
+        host = urllib.parse.urlsplit(url).hostname or ""
+        self._pace(host)
+        self.left -= 1
+        self.requests += 1
+        status, final, err = self.opener(url, "HEAD")
+        if status in (400, 403, 405, 406, 429, 500, 501, 503) or (status is None and err not in ("dns",)):
+            self._pace(host)
+            self.requests += 1
+            status, final, err = self.opener(url, "GET")
+        res = {"status": status, "final": final, "error": err, "t": self.clock()}
+        self.cache[url] = res
+        return dict(res, cached=False)
+
+    def full_name(self, owner: str, repo: str) -> dict:
+        key = f"gh:{owner}/{repo}"
+        hit = self._fresh(key)
+        if hit:
+            return hit
+        if self.left <= 0:
+            return {"full_name": None, "error": "budget"}
+        self.left -= 1
+        self.requests += 1
+        name, err = self.gh(owner, repo)
+        res = {"full_name": name, "error": err, "t": self.clock()}
+        self.cache[key] = res
+        return dict(res, cached=False)
+
+    def save(self):
+        if self.cache_path:
+            self.cache_path.parent.mkdir(parents=True, exist_ok=True)
+            self.cache_path.write_text(json.dumps(self.cache, sort_keys=True, indent=0) + "\n", encoding="utf-8")
+
+
+def _gh_full_name(owner: str, repo: str):
+    """Read-only `gh api repos/<o>/<r> --jq .full_name` (STANDARD §7.1 link rule). Returns (full_name|None, error)."""
+    try:
+        p = subprocess.run(["gh", "api", "-X", "GET", f"repos/{owner}/{repo}", "--jq", ".full_name"],
+                           capture_output=True, text=True, timeout=60)
+    except (OSError, subprocess.SubprocessError) as exc:
+        return None, f"gh: {exc}"
+    if p.returncode != 0:
+        return None, ("404" if "404" in (p.stderr or "") or "Not Found" in (p.stderr or "") else (p.stderr or "").strip()[:160])
+    return p.stdout.strip() or None, None
+
+
+def _resolve(file: str, target: str) -> tuple[str | None, str | None]:
+    """(path relative to the repository root, GitHub route) for a relative link from `file`; (None, None) if it
+    leaves the repository without landing on a repository route (../../issues from the root README is a route)."""
+    base = PurePosixPath(file).parent
+    path = target if not target.startswith("/") else target.lstrip("/")
+    parts = [] if target.startswith("/") else [p for p in base.parts if p not in ("", ".")]
+    up = 0
+    for seg in path.split("/"):
+        if seg in ("", "."):
+            continue
+        if seg == "..":
+            if parts:
+                parts.pop()
+            else:
+                up += 1
+            continue
+        if up:
+            return None, seg if up == 2 and seg in GITHUB_ROUTES else None
+        parts.append(seg)
+    if up:
+        return None, None
+    return "/".join(parts), None
+
+
+class _FileInfo:
+    def __init__(self, tree: Tree, rel: str):
+        self.text = tree.read(rel) or ""
+        self.slugs = anchors(self.text)
+        self.heads = headings(self.text)
+
+
+def _github_ref(url: str) -> tuple[str, str] | None:
+    u = urllib.parse.urlsplit(url)
+    host = (u.hostname or "").lower()
+    parts = [p for p in u.path.split("/") if p]
+    if host in ("github.com", "www.github.com") and len(parts) >= 2 and parts[0].lower() not in GITHUB_RESERVED:
+        return parts[0], re.sub(r"\.git$", "", parts[1])
+    if host == "raw.githubusercontent.com" and len(parts) >= 2:
+        return parts[0], parts[1]
+    return None
+
+
+def check_links(tree: Tree, files: list[str], *, resolver: Resolver | None = None, fetcher: Fetcher | None = None,
+                online: bool = False, base: Tree | None = None, base_files: list[str] | None = None,
+                self_slug: tuple[str, str] | None = None) -> dict:
+    """Check every link, anchor and image target in `files`. Never rewrites: broken findings carry a proposal."""
+    infos: dict[str, _FileInfo] = {}
+
+    def info(rel: str) -> _FileInfo:
+        if rel not in infos:
+            infos[rel] = _FileInfo(tree, rel)
+        return infos[rel]
+
+    base_slugs: dict[str, set[str]] = {}
+    if base is not None:
+        for f in base_files or files:
+            if base.is_file(f):
+                base_slugs[f] = anchors(base.read(f) or "")
+    findings: list[dict] = []
+    for f in files:
+        fi = info(f)
+        for ln in extract_links(fi.text):
+            findings.append(_check_one(tree, f, ln, info, resolver, fetcher if online else None, base_slugs,
+                                       self_slug))
+    return {"files": files, "findings": findings, "headings": {f: info(f).heads for f in files}}
+
+
+def _check_one(tree: Tree, f: str, ln: dict, info, resolver, fetcher, base_slugs, self_slug=None) -> dict:
+    target = ln["target"].strip()
+    row = {"file": f, "line": ln["line"], "target": target, "image": ln["image"], "syntax": ln["syntax"],
+           "kind": "relative", "status": OK_STATUS, "reason": "", "proposal": None}
+    if ln["image"]:
+        row["alt"] = ln.get("alt")
+    low = target.lower()
+    if not target:
+        return dict(row, kind="empty", status=BROKEN, reason="empty link target")
+    if re.match(r"^(mailto|tel|data|javascript|ftp|irc|news|sms):", low):
+        return dict(row, kind="scheme", status="skipped", reason=low.split(":", 1)[0])
+    if target.startswith("#"):
+        frag = urllib.parse.unquote(target[1:])
+        row["kind"] = "anchor"
+        return _anchor(row, f, frag, info(f), base_slugs.get(f), info(f).heads)
+    if re.match(r"^(https?:)?//", low):
+        return _remote(row, target, resolver, fetcher, self_slug)
+    if re.match(r"^[a-z][a-z0-9+.-]*:", low) and not re.match(r"^[a-z]:[\\/]", low):
+        return dict(row, kind="scheme", status="skipped", reason=low.split(":", 1)[0])
+    path, _, frag = target.partition("#")
+    path = urllib.parse.unquote(path.split("?", 1)[0])
+    if re.match(r"^[a-zA-Z]:[\\/]", path) or (path.startswith(("/mnt/", "/home/", "/Users/", "~"))
+                                              and not tree.is_file(path.lstrip("/")) and not tree.is_dir(path.lstrip("/"))):
+        return dict(row, status=BROKEN, reason="machine-local path", proposal=None)
+    if not path:
+        row["kind"] = "anchor"
+        return _anchor(row, f, urllib.parse.unquote(frag), info(f), base_slugs.get(f), info(f).heads)
+    rel, route = _resolve(f, path)
+    if route:
+        return dict(row, kind="github-route", status="skipped", reason=f"repository route /{route}")
+    if rel is None:
+        return dict(row, status=BROKEN, reason="leaves the repository")
+    if tree.is_file(rel) or tree.is_dir(rel):
+        if frag and rel.lower().endswith((".md", ".markdown")) and tree.is_file(rel) and not re.match(r"^L\d+", frag):
+            row["kind"] = "anchor"
+            return _anchor(row, rel, urllib.parse.unquote(frag), info(rel), None, info(rel).heads)
+        return row
+    row["status"] = BROKEN
+    hits = tree.lower.get(rel.lower())
+    if hits:
+        fixed = _relpath(f, hits[0])
+        return dict(row, reason="case differs from the git tree", proposal=_prop(f, ln["line"], path, fixed,
+                                                                                    "§7.1 relative link case"))
+    if (tree.root / rel).exists() and tree.git:
+        return dict(row, reason="exists on disk but not in the git tree (untracked or ignored)")
+    name = PurePosixPath(rel).name.lower()
+    same = sorted(x for x in tree.files if PurePosixPath(x).name.lower() == name)
+    if len(same) == 1:
+        return dict(row, reason="target not found", proposal=_prop(f, ln["line"], path, _relpath(f, same[0]),
+                                                                    "moved file (one file of that name in the tree)"))
+    return dict(row, reason="target not found")
+
+
+def _relpath(src_file: str, target: str) -> str:
+    base = PurePosixPath(src_file).parent
+    t = PurePosixPath(target)
+    try:
+        return str(t.relative_to(base)) if str(base) != "." else str(t)
+    except ValueError:
+        ups = len([p for p in base.parts if p not in ("", ".")])
+        return "../" * ups + str(t)
+
+
+def _prop(file: str, line: int, old: str, new: str, rule: str, op: str = "replace") -> dict:
+    return {"file": file, "line": line, "op": op, "old": old, "new": new, "rule": rule}
+
+
+def _anchor(row: dict, f: str, frag: str, fi: _FileInfo, base: set[str] | None, heads: list[dict]) -> dict:
+    if frag in fi.slugs or frag.lower() in {s.lower() for s in fi.slugs} or re.match(r"^L\d+(-L\d+)?$", frag):
+        return row
+    row["status"] = BROKEN
+    if base is not None and frag in base:
+        row["reason"] = "heading renamed or emoji stripped by this change"
+        row["introduced"] = True
+    else:
+        row["reason"] = "no heading or anchor with this slug"
+    near = difflib.get_close_matches(frag.lower(), sorted(fi.slugs), n=1, cutoff=0.6)
+    if near:
+        old = f"#{frag}" if row["target"].startswith("#") else row["target"]
+        new = f"#{near[0]}" if row["target"].startswith("#") else row["target"].split("#")[0] + f"#{near[0]}"
+        row["proposal"] = _prop(row["file"], row["line"], old, new, "§7.1 rule 6: rewrite to the new slug")
+        if row.get("introduced"):
+            h = next((x for x in heads if x["slug"] == near[0]), None)
+            if h:
+                row["proposal_anchor"] = _prop(f, h["line"], "", f'<a name="{frag}"></a>',
+                                               "§7.1 rule 6: keep inbound deep links", op="insert-before")
+    return row
+
+
+def _fixed_urls(resolver: Resolver | None) -> set[str]:
+    """Every URL `references/brand.yaml` holds (the decision 18 footer's href and logo URLs, the brand site, the hub
+    sites): fixed brand content, identical in every repository, so a link check never proposes rewriting one."""
+    out: set[str] = set()
+
+    def walk(v):
+        if isinstance(v, dict):
+            for x in v.values():
+                walk(x)
+        elif isinstance(v, (list, tuple)):
+            for x in v:
+                walk(x)
+        elif isinstance(v, str) and re.match(r"^https?://", v.strip(), re.I):
+            out.add(v.strip().rstrip("/").lower())
+    walk((resolver.brand.raw if resolver is not None and resolver.brand is not None else None) or {})
+    return out
+
+
+def _self_moved(url: str, host: str, resolver: Resolver | None, self_slug) -> tuple[str, str] | None:
+    """A link to this repository under its former slug (a transfer left its own README pointing at the old org:
+    php2shell-check's badges still name CompleteTech-LLC). GitHub redirects it today, but the redirect breaks the day
+    the old owner reuses the name, and the badge, release and clone URLs read wrong. Only an approved repository
+    rename or transfer in the estate actions (`Resolver.repo_before`) that produces exactly this repository counts: a
+    repository of the same name under another org is a different one (every org has its own `.github`). (old, new)."""
+    if not self_slug or not resolver or not (host in ("github.com", "www.github.com", "raw.githubusercontent.com")
+                                             or host.endswith("shields.io")):
+        return None
+    cur_owner, repo = current_login(resolver, self_slug[0]), self_slug[1]
+    hit = resolver.repo_before(f"{cur_owner}/{repo}")
+    if not hit or "/" not in hit[0] or not resolver.repo_action_approved(hit[1]):
+        return None
+    old_owner, old_repo = hit[0].split("/", 1)
+    if resolver.same(old_owner, cur_owner) and old_repo.lower() == repo.lower():
+        return None
+    owners = "|".join(re.escape(a) for a in resolver.aliases(old_owner))
+    m = re.search(r"/(" + owners + r")/(" + re.escape(old_repo) + r")(?=$|[/?#.])", urllib.parse.urlsplit(url).path,
+                  re.I)
+    return (f"{m.group(1)}/{m.group(2)}", f"{cur_owner}/{repo}") if m else None
+
+
+def _remote(row: dict, url: str, resolver: Resolver | None, fetcher: Fetcher | None, self_slug=None) -> dict:
+    full = url if not url.startswith("//") else "https:" + url
+    u = urllib.parse.urlsplit(full)
+    host = (u.hostname or "").lower()
+    row["kind"] = "image" if row["image"] else "remote"
+    if host in LINK_ALLOW_HOSTS or host.endswith(LINK_ALLOW_SUFFIX) or _private_host(host):
+        return dict(row, status="allowlisted", reason="local or example host (§10.2 allowlist)")
+    fixed = full.strip().rstrip("/").lower() in _fixed_urls(resolver)  # decision 18 footer and brand URLs: never rewritten
+    if fixed:
+        row["fixed"] = True
+    moved = None if fixed else _self_moved(full, host, resolver, self_slug)
+    if moved:
+        if _github_ref(full):
+            row["kind"] = "github"
+        new = url.replace(f"/{moved[0]}", f"/{moved[1]}", 1)
+        return dict(row, status="moved", reason=f"this repository under a former owner ({moved[0]}); it is now {moved[1]}",
+                    proposal=_prop(row["file"], row["line"], url, new, "§7.1 links: rewrite to the current slug"))
+    gh = _github_ref(full)
+    if gh:
+        row["kind"] = "github"
+        owner, repo = gh
+        if resolver is not None and not fixed:
+            cur = resolver.canonical(owner)
+            if cur != owner:
+                renamed = cur.lower() != owner.lower()
+                new = url.replace(f"/{owner}/", f"/{cur}/", 1)
+                row.update(status="renamed", reason=f"org renamed: {owner} -> {cur}" if renamed else
+                           f"owner spelled {cur} on GitHub", proposal=_prop(row["file"], row["line"], url, new,
+                                                                             "§7.1 links: rewrite to the current owner"))
+                return row
+        if fetcher is not None and not fixed and in_estate(resolver, owner):
+            res = fetcher.full_name(owner, repo)
+            name = res.get("full_name")
+            if name and name != f"{owner}/{repo}":
+                new_owner, new_repo = name.split("/", 1)
+                new = url.replace(f"/{owner}/{repo}", f"/{new_owner}/{new_repo}", 1)
+                return dict(row, status="moved", reason=f"repository is now {name}",
+                            proposal=_prop(row["file"], row["line"], url, new, "§7.1 links: full_name differs"))
+            if res.get("error") == "404":
+                return dict(row, status=BROKEN, reason="repository not found (dead-link; keep the link)")
+    if fetcher is None:
+        return dict(row, status="unchecked", reason="offline (pass --online for the cached §10.2 GET)")
+    res = fetcher.check(full)
+    st = res.get("status")
+    row["http"] = st
+    if st is not None and 200 <= st < 400:
+        return row
+    if st in (404, 410) or res.get("error") == "dns":
+        return dict(row, status=BROKEN, reason=f"HTTP {st}" if st else "host does not resolve")
+    return dict(row, status="unverified", reason=f"HTTP {st}" if st else (res.get("error") or "no answer"))
+
+
+def links_report(tree: Tree, files: list[str], *, resolver=None, fetcher=None, online=False, base=None,
+                 strict=False, self_slug: tuple[str, str] | None = None) -> dict:
+    res = check_links(tree, files, resolver=resolver, fetcher=fetcher, online=online, base=base,
+                      base_files=files if base is not None else None, self_slug=self_slug)
+    broken = [x for x in res["findings"] if x["status"] == BROKEN]
+    pre: set = set()
+    if base is not None:
+        bfiles = [f for f in files if base.is_file(f)]
+        bres = check_links(base, bfiles, resolver=resolver, fetcher=None, online=False)
+        pre = {(x["file"], x["target"]) for x in bres["findings"] if x["status"] == BROKEN}
+    for x in broken:
+        x["introduced"] = bool(x.get("introduced")) or (base is not None and (x["file"], x["target"]) not in pre)
+    introduced = [x for x in broken if x["introduced"]]
+    logs = sorted({"dead-link"} if broken else set())
+    if any(x["status"] in ("renamed", "moved") for x in res["findings"]):
+        logs.append("link-rewrite")
+    if base is not None or strict:
+        result = "fail" if (introduced if base is not None else broken) else ("warn" if broken else "pass")
+    else:
+        result = "warn" if broken else "pass"
+    counts: dict[str, int] = {}
+    for x in res["findings"]:
+        counts[x["status"]] = counts.get(x["status"], 0) + 1
+    proposals = [x["proposal"] for x in res["findings"] if x.get("proposal")] + \
+        [x["proposal_anchor"] for x in res["findings"] if x.get("proposal_anchor")]
+    rows = [[x["file"], str(x["line"]), x["kind"], x["target"], x["reason"], "introduced" if x["introduced"] else
+             "pre-existing"] for x in broken]
+    return {"result": result, "counts": counts, "findings": res["findings"], "broken": len(broken),
+            "introduced": len(introduced), "proposals": proposals, "dead_links_tsv": rows,
+            "baseline": "git ref" if base is not None else None, "logs": logs}
+
+
+def proposal_diff(tree: Tree, proposals: list[dict]) -> str:
+    """Unified diff of the proposals applied in memory (the file on disk is never changed)."""
+    out = []
+    by_file: dict[str, list[dict]] = {}
+    for p in proposals:
+        by_file.setdefault(p["file"], []).append(p)
+    for f, props in sorted(by_file.items()):
+        text = tree.read(f) or ""
+        lines = text.split("\n")
+        new = list(lines)
+        inserts: dict[int, list[str]] = {}
+        for p in props:
+            i = p["line"] - 1
+            if not 0 <= i < len(new):
+                continue
+            if p["op"] == "insert-before":
+                if p["new"] not in inserts.setdefault(i, []):
+                    inserts[i].append(p["new"])
+            elif p["old"] and p["old"] in new[i]:
+                # the whole target only: a link that is a prefix of another target on the line (`.../tests.yml` and
+                # `.../tests.yml/badge.svg`) must not rewrite the longer one
+                rx = re.compile(re.escape(p["old"]) + r"(?![\w/.%?#=&~:+-])")
+                new[i] = rx.sub(lambda _m: p["new"], new[i], count=1) if rx.search(new[i]) else \
+                    new[i].replace(p["old"], p["new"], 1)
+        merged = []
+        for i, ln in enumerate(new):
+            merged += inserts.get(i, [])
+            merged.append(ln)
+        out += difflib.unified_diff([x + "\n" for x in lines], [x + "\n" for x in merged], f"a/{f}", f"b/{f}")
+    return "".join(out)
+
+
+# =====================================================================================================
+# linguist (RP-07, CQ-08)
+# =====================================================================================================
+EXT_LANG = {
+    ".py": "Python", ".pyi": "Python", ".js": "JavaScript", ".mjs": "JavaScript", ".cjs": "JavaScript",
+    ".jsx": "JavaScript", ".ts": "TypeScript", ".mts": "TypeScript", ".cts": "TypeScript", ".tsx": "TSX",
+    ".html": "HTML", ".htm": "HTML", ".css": "CSS", ".scss": "SCSS", ".sass": "Sass", ".less": "Less", ".php": "PHP",
+    ".rs": "Rust", ".go": "Go", ".java": "Java", ".kt": "Kotlin", ".kts": "Kotlin", ".swift": "Swift", ".c": "C",
+    ".h": "C", ".cc": "C++", ".cpp": "C++", ".cxx": "C++", ".hpp": "C++", ".cs": "C#", ".rb": "Ruby", ".sh": "Shell",
+    ".bash": "Shell", ".zsh": "Shell", ".ps1": "PowerShell", ".psm1": "PowerShell", ".bat": "Batchfile",
+    ".cmd": "Batchfile", ".ipynb": "Jupyter Notebook", ".mmd": "Mermaid", ".mermaid": "Mermaid", ".vim": "Vim Script",
+    ".snippets": "Vim Snippet", ".lua": "Lua", ".dart": "Dart", ".vue": "Vue", ".svelte": "Svelte", ".astro": "Astro",
+    ".r": "R", ".jl": "Julia", ".tex": "TeX", ".gd": "GDScript", ".scala": "Scala", ".ex": "Elixir", ".exs": "Elixir",
+    ".hs": "Haskell", ".zig": "Zig", ".nix": "Nix", ".tf": "HCL", ".hcl": "HCL", ".m": "Objective-C",
+    ".sol": "Solidity", ".pl": "Perl", ".clj": "Clojure", ".fs": "F#", ".ml": "OCaml", ".nim": "Nim", ".erl": "Erlang",
+    ".groovy": "Groovy", ".roff": "Roff", ".1": "Roff", ".mdx": "MDX", ".svg": None, ".ejs": "EJS",
+    ".hbs": "Handlebars", ".jinja": "Jinja", ".j2": "Jinja", ".twig": "Twig", ".cu": "Cuda", ".asm": "Assembly",
+}
+NAME_LANG = {"Dockerfile": "Dockerfile", "Makefile": "Makefile", "makefile": "Makefile", "GNUmakefile": "Makefile",
+             "CMakeLists.txt": "CMake", "Jenkinsfile": "Groovy"}
+# programming languages a chip or badge 1 may name (RP-07 rule 3); markup, config and snippet languages are left out
+PROGRAMMING = {"Python", "JavaScript", "TypeScript", "TSX", "Go", "Rust", "PHP", "Shell", "PowerShell", "C", "C++",
+               "C#", "Java", "Kotlin", "Swift", "Lua", "GDScript", "Ruby", "Dart", "Scala", "Elixir", "Haskell", "Zig",
+               "R", "Julia", "Objective-C", "Vue", "Svelte", "Solidity", "Perl", "Clojure", "F#", "OCaml", "Nim",
+               "Erlang", "Groovy", "Jupyter Notebook", "Cuda", "Assembly", "Nix", "HCL", "Astro"}
+# Linguist's own vendored and documentation paths (vendor.yml, documentation.yml), approximated: never proposed again
+LINGUIST_VENDORED = [re.compile(p) for p in (
+    r"(^|/)node_modules/", r"(^|/)vendors?/", r"(^|/)(3rd|[Tt]hird)[-_]?[Pp]arty/", r"(^|/)bower_components/",
+    r"(^|/)extern(al)?/", r"^deps/", r"^[Dd]ependencies/", r"(^|/)cache/", r"(\.|-)min\.(js|css)$",
+    r"(^|/)jquery[^/]*\.js$", r"(^|/)bootstrap[^/]*\.(js|css)$", r"\.(js|css)\.map$", r"(^|/)\.(yarn|pnpm-store)/",
+    r"(^|/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|poetry\.lock|Cargo\.lock|go\.sum)$")]
+LINGUIST_DOCS = [re.compile(p) for p in (
+    r"^[Dd]ocs?/", r"(^|/)[Dd]ocumentation/", r"(^|/)[Jj]avadoc/", r"^[Mm]an/", r"^[Ee]xamples/", r"^[Dd]emos?/",
+    r"(^|/)inst/doc/", r"(^|/)CHANGE(S|LOG)?(\.|$)", r"(^|/)CONTRIBUTING(\.|$)", r"(^|/)COPYING(\.|$)",
+    r"(^|/)INSTALL(\.|$)", r"(^|/)LICEN[CS]E(\.|$)", r"(^|/)README(\.|$)")]
+# Candidates for the `# ct-std linguist` block (STANDARD §8.5): generated output and example or fixture material
+GENERATED_DIRS = ("results", "reports", "report", "output", "outputs", "out", "build", "dist", "coverage", "htmlcov",
+                  "_site", "site", "generated", "__generated__", "gen", "storybook-static", "artifacts", "runs")
+DOC_DIRS = ("docs", "doc", "examples", "example", "demo", "demos", "samples", "sample", "assets/examples",
+            "assets/diagrams", "fixtures", "testdata", "test-data", "__fixtures__", "__snapshots__", "snapshots")
+GENERATED_MARK = re.compile(r"@generated|DO NOT EDIT|auto-?generated|generated by|<meta[^>]+name=[\"']generator", re.I)
+MANIFEST_LANG = (("pyproject.toml", "Python"), ("setup.py", "Python"), ("setup.cfg", "Python"), ("Pipfile", "Python"),
+                 ("requirements.txt", "Python"), ("Cargo.toml", "Rust"), ("go.mod", "Go"), ("composer.json", "PHP"),
+                 ("Gemfile", "Ruby"), ("pubspec.yaml", "Dart"), ("Package.swift", "Swift"), ("mix.exs", "Elixir"),
+                 ("project.godot", "GDScript"), ("package.json", "JavaScript"), ("pom.xml", "Java"),
+                 ("build.gradle", "Java"), ("build.gradle.kts", "Kotlin"))
+BLOCK_HEAD = "# ct-std linguist"
+
+
+def file_language(path: str) -> str | None:
+    name = PurePosixPath(path).name
+    if name in NAME_LANG:
+        return NAME_LANG[name]
+    return EXT_LANG.get(PurePosixPath(name).suffix.lower())
+
+
+def _gitattributes(text: str) -> list[tuple[re.Pattern, bool]]:
+    """(pattern, excluded?) for linguist-vendored/-generated/-documentation lines; later lines win."""
+    out = []
+    for ln in (text or "").splitlines():
+        ln = ln.strip()
+        if not ln or ln.startswith("#"):
+            continue
+        pat, *attrs = ln.split()
+        for a in attrs:
+            m = re.match(r"^(-|!)?linguist-(vendored|generated|documentation)(?:=(true|false))?$", a)
+            if m:
+                out.append((_gitglob(pat), not m.group(1) and m.group(3) != "false"))
+    return out
+
+
+def _gitglob(pat: str) -> re.Pattern:
+    anchored = pat.startswith("/") or "/" in pat.rstrip("/")
+    p = pat.lstrip("/")
+    rx = ""
+    i = 0
+    while i < len(p):
+        if p.startswith("**/", i):
+            rx += "(?:.*/)?"
+            i += 3
+        elif p.startswith("/**", i) and i + 3 == len(p):
+            rx += "/.*"
+            i += 3
+        elif p.startswith("**", i):
+            rx += ".*"
+            i += 2
+        elif p[i] == "*":
+            rx += "[^/]*"
+            i += 1
+        elif p[i] == "?":
+            rx += "[^/]"
+            i += 1
+        else:
+            rx += re.escape(p[i])
+            i += 1
+    if p.endswith("/"):
+        rx += ".*"
+    return re.compile(("^" if anchored else "(^|.*/)") + rx + "(/.*)?$")
+
+
+def _excluded_by_linguist(path: str, attrs: list[tuple[re.Pattern, bool]]) -> bool:
+    state = any(r.search(path) for r in LINGUIST_VENDORED + LINGUIST_DOCS) or path.startswith(".")
+    for rx, excl in attrs:
+        if rx.match(path):
+            state = excl
+    return state
+
+
+def _candidate(path: str, head: str | None) -> tuple[str, str, str, str] | None:
+    """(glob, attribute, reason, confidence) for a path the block should cover, else None."""
+    parts = path.split("/")
+    for i, seg in enumerate(parts[:-1]):
+        low = seg.lower()
+        prefix = "/".join(parts[:i + 1])
+        if low in GENERATED_DIRS:
+            return f"{prefix}/**", "linguist-generated", f"generated output ({seg}/)", "high"
+        two = "/".join(p.lower() for p in parts[max(0, i - 1):i + 1])
+        if low in DOC_DIRS or two in DOC_DIRS:
+            conf = "review" if low in ("fixtures", "testdata", "test-data", "__fixtures__", "snapshots",
+                                       "__snapshots__") else "high"
+            return f"{prefix}/**", "linguist-documentation", f"examples, fixtures or docs ({prefix}/)", conf
+    name = parts[-1].lower()
+    if path.lower().endswith((".html", ".htm")) and re.search(r"(report|results?|output|coverage|sample)", name):
+        return path, "linguist-generated", "generated HTML report", "review"
+    if head and GENERATED_MARK.search(head):
+        return path, "linguist-generated", "file says it is generated", "high"
+    if path.lower().endswith((".mmd", ".mermaid")):
+        return path, "linguist-documentation", "diagram source", "high"
+    return None
+
+
+def manifest_language(files: set[str], read, bytes_by_lang: dict | None = None) -> str | None:
+    """RP-07 rule 1: the runtime named by a root manifest (TypeScript when package.json uses it)."""
+    roots = {f for f in files if "/" not in f}
+    found = []
+    for name, lang in MANIFEST_LANG:
+        if name in roots or (name == "requirements.txt" and any(re.fullmatch(r"requirements[^/]*\.txt", f) for f in roots)):
+            if lang == "JavaScript":
+                pj = read("package.json") or ""
+                if "tsconfig.json" in roots or re.search(r'"typescript"\s*:', pj):
+                    lang = "TypeScript"
+                elif not re.search(r'"(main|bin|exports|module)"\s*:|"(dependencies)"\s*:\s*\{\s*"', pj):
+                    continue  # a package.json for tooling only (lint, prettier) names no runtime
+            if lang == "Java" and any(f.endswith(".kt") for f in files):
+                lang = "Kotlin"
+            if lang not in found:
+                found.append(lang)
+    if not found:
+        return None
+    if len(found) > 1 and bytes_by_lang:
+        return max(found, key=lambda lg: (bytes_by_lang.get(lg, 0) + bytes_by_lang.get("TSX" if lg == "TypeScript"
+                                                                                      else "", 0), -found.index(lg)))
+    return found[0]
+
+
+def primary_language(meta: dict, files: set[str] | None = None, read=None, override: dict | None = None,
+                     corrected: dict | None = None) -> tuple[str | None, str]:
+    """The language a banner chip, card dot or badge 1 may show (RP-07): manifest runtime, then a `language:`
+    override (`.github/showcase.yml` or the registry), then the top language after the linguist correction if it is
+    a programming language. (None, "language-omitted") when none applies."""
+    if files:
+        lang = manifest_language(files, read or (lambda _p: None), corrected or meta.get("languages") or {})
+        if lang:
+            return lang, "manifest"
+    if override and override.get("language"):
+        return str(override["language"]), "override"
+    langs = corrected if corrected is not None else (meta.get("languages") or {})
+    ranked = sorted(((v, k) for k, v in langs.items() if v > 0), reverse=True)
+    for _, k in ranked[:1]:
+        if k in PROGRAMMING:
+            return ("TypeScript" if k == "TSX" else k), "linguist"
+    if not ranked and meta.get("language") in PROGRAMMING:
+        return meta["language"], "github"
+    return None, "language-omitted"
+
+
+def _bar(langs: dict) -> list[dict]:
+    total = sum(v for v in langs.values() if v > 0) or 1
+    return [{"language": k, "bytes": v, "share": round(v / total, 4)}
+            for k, v in sorted(langs.items(), key=lambda kv: -kv[1]) if v > 0]
+
+
+def linguist_report(meta: dict, tree: Tree | None = None, files: list[str] | None = None,
+                    sizes: dict | None = None, override: dict | None = None, min_share: float = 0.02) -> dict:
+    """Paths that distort the language bar, the proposed append-only `# ct-std linguist` block, and the corrected
+    primary language. `tree` is a checkout; without one, `files`/`sizes` come from captured metadata."""
+    if tree is not None:
+        all_files = set(tree.files)
+        size_of, read = tree.size, tree.read
+    else:
+        all_files = set(files or meta.get("files") or [])
+        sizes = sizes or meta.get("file_sizes") or {}
+        manifests = meta.get("manifests") or {}
+
+        def size_of(p):
+            return int(sizes.get(p, 0))
+
+        def read(p):
+            return manifests.get(p)
+    if not all_files:
+        raise NeedsInput("file-tree", "linguist needs a checkout (--repo-dir) or a captured file tree in the metadata")
+    ga_text = read(".gitattributes") or ""
+    attrs = _gitattributes(ga_text)
+    counted: dict[str, int] = {}
+    cands: dict[str, dict] = {}
+    for p in sorted(all_files):
+        lang = file_language(p)
+        if not lang or _excluded_by_linguist(p, attrs):
+            continue
+        n = size_of(p)
+        counted[lang] = counted.get(lang, 0) + n
+        head = None
+        if lang in ("HTML", "JavaScript", "TypeScript", "CSS", "Python") and tree is not None and n <= 2_000_000:
+            head = (read(p) or "")[:1024]
+        c = _candidate(p, head)
+        if not c:
+            continue
+        glob, attr, reason, conf = c
+        row = cands.setdefault(glob, {"pattern": glob, "attribute": attr, "reason": reason, "confidence": conf,
+                                      "bytes": 0, "languages": {}, "files": 0})
+        row["bytes"] += n
+        row["files"] += 1
+        row["languages"][lang] = row["languages"].get(lang, 0) + n
+    github = {k: int(v) for k, v in (meta.get("languages") or {}).items()}
+    before = github or counted
+    total = sum(before.values()) or 1
+    proposed = []
+    for row in sorted(cands.values(), key=lambda r: -r["bytes"]):
+        manifest_inside = any(f.startswith(row["pattern"][:-2]) and PurePosixPath(f).name in
+                              ("package.json", "pyproject.toml", "Cargo.toml", "go.mod") for f in all_files) \
+            if row["pattern"].endswith("/**") else False
+        if manifest_inside:
+            row["confidence"] = "review"
+            row["reason"] += "; holds a manifest, so it may be real source"
+        row["share"] = round(row["bytes"] / total, 4)
+        if row["share"] >= min_share:
+            proposed.append(row)
+    after = dict(before)
+    for row in proposed:
+        for lg, n in row["languages"].items():
+            if lg in after:
+                after[lg] = max(0, after[lg] - n)
+    old_primary = primary_language(meta, None, None, override, before)
+    new_primary = primary_language(meta, all_files, read, override, after)
+    raw_top = max(before, key=before.get) if before else meta.get("language")
+    for row in proposed:
+        row["changes_primary"] = bool(raw_top) and raw_top in row["languages"] and \
+            (max(after, key=after.get) if any(after.values()) else None) != raw_top
+    present = {ln.strip() for ln in ga_text.splitlines()}
+    lines = [f"{r['pattern']} {r['attribute']}" for r in proposed]
+    new_lines = [ln for ln in lines if ln not in present]
+    diff = ""
+    if new_lines:
+        old = ga_text
+        if BLOCK_HEAD in old:
+            idx = old.split("\n")
+            pos = idx.index(next(x for x in idx if x.strip() == BLOCK_HEAD)) + 1
+            while pos < len(idx) and idx[pos].strip() and not idx[pos].startswith("#"):
+                pos += 1
+            new = "\n".join(idx[:pos] + new_lines + idx[pos:])
+        else:
+            new = old + ("" if not old or old.endswith("\n") else "\n") + ("\n" if old.strip() else "") + \
+                BLOCK_HEAD + "\n" + "\n".join(new_lines) + "\n"
+        diff = "".join(difflib.unified_diff(old.splitlines(True), new.splitlines(True), "a/.gitattributes",
+                                            "b/.gitattributes"))
+    logs = []
+    if new_primary[0] is None:
+        logs.append("language-omitted")
+    if new_lines:
+        logs.append("linguist-proposal")
+    return {"result": "proposal" if new_lines else "pass",
+            "github_language": meta.get("language"), "bar_before": _bar(before), "bar_after": _bar(after),
+            "primary": {"language": new_primary[0], "source": new_primary[1]},
+            "primary_before": {"language": old_primary[0], "source": old_primary[1]},
+            "candidates": sorted(cands.values(), key=lambda r: -r["bytes"]), "proposed": proposed,
+            "gitattributes_lines": new_lines, "diff": diff,
+            "note": "Append-only block; linguist-generated and linguist-documentation lines only; never on real source. "
+                    "A writer confirms the list and the G1 report approves it; after the merge, re-read "
+                    "GET /repos/{o}/{r}/languages before generating the banner and card (STANDARD §8.5).",
+            "logs": logs}
+
+
+# =====================================================================================================
+# actions (RP-06, RP-01, CQ-13)
+# =====================================================================================================
+RED = {"failure", "timed_out", "startup_failure"}
+POLISH_PATHS = ("README.md", "docs/images/banner.png", "docs/images/card.svg", "docs/images/.showcase.json",
+                "assets/icon.png", "assets/social-preview.png", ".github/showcase.yml", "CONTRIBUTING.md")
+DEPLOY_USES = ("actions/deploy-pages", "peaceiris/actions-gh-pages", "jamesives/github-pages-deploy-action",
+               "amondnet/vercel-action", "vercel/", "netlify/", "nwtgck/actions-netlify", "cloudflare/wrangler-action",
+               "cloudflare/pages-action", "aws-actions/", "azure/webapps-deploy", "azure/static-web-apps-deploy",
+               "google-github-actions/deploy", "firebaseextended/action-hosting-deploy", "appleboy/ssh-action",
+               "appleboy/scp-action", "easingthemes/ssh-deploy", "samkirkland/ftp-deploy-action",
+               "docker/build-push-action", "pypa/gh-action-pypi-publish", "softprops/action-gh-release",
+               "superfly/flyctl-actions", "akhileshns/heroku-deploy", "dokku/github-action", "burnett01/rsync-deployments")
+DEPLOY_RUN = re.compile(r"\b(vercel\b[^\n]*--prod|netlify\s+deploy|wrangler\s+(pages\s+)?(deploy|publish)|firebase\s+deploy|"
+                        r"gh-pages\b|npm\s+publish|yarn\s+publish|twine\s+upload|docker\s+push|rsync\b|scp\b|"
+                        r"flyctl\s+deploy|kubectl\s+apply|helm\s+upgrade|gh\s+release\s+create|aws\s+s3\s+sync|"
+                        r"curl\b[^\n]*(deploy|hook))", re.I)
+UPSTREAM_USES = {"contributor-assistant/github-action": "CLA", "cla-assistant/": "CLA", "actions/labeler": "labeler",
+                 "github/issue-labeler": "labeler", "actions/stale": "stale closer", "dessant/lock-threads": "lock threads",
+                 "actions/first-interaction": "greeter", "release-drafter/release-drafter": "release drafter",
+                 "peter-evans/close-": "issue closer", "dependabot/fetch-metadata": "dependabot auto-merge",
+                 "amannn/action-semantic-pull-request": "PR title lint", "actions/add-to-project": "project automation",
+                 "pozil/auto-assign-issue": "auto assign", "kentaro-m/auto-assign-action": "auto assign"}
+UPSTREAM_NAMES = re.compile(r"(^|[-_/.])(cla|stale|labeler|label|lock|triage|greetings?|welcome|close[-_]?issues?|"
+                            r"auto[-_]?assign|release[-_]?drafter)([-_.]|$)", re.I)
+EXTERNAL_FILES = {"vercel.json": "Vercel", "netlify.toml": "Netlify", "wrangler.toml": "Cloudflare",
+                  "wrangler.json": "Cloudflare", "wrangler.jsonc": "Cloudflare", "firebase.json": "Firebase",
+                  "render.yaml": "Render", "fly.toml": "Fly.io", "app.yaml": "App Engine", "Procfile": "Heroku"}
+
+
+def _filter_rx(pat: str) -> re.Pattern:
+    """GitHub Actions filter pattern: `**`, `*`, `?` and `+` (quantifiers on the preceding character), `[...]`."""
+    rx, i = "", 0
+    while i < len(pat):
+        c = pat[i]
+        if pat.startswith("**", i):
+            rx += ".*"
+            i += 2
+            continue
+        if c == "*":
+            rx += "[^/]*"
+        elif c in "?+":
+            rx += c
+        elif c == "[":
+            j = pat.find("]", i)
+            rx += pat[i:j + 1] if j > i else re.escape(c)
+            i = j if j > i else i
+        else:
+            rx += re.escape(c)
+        i += 1
+    return re.compile("^" + rx + "$")
+
+
+def _match_any(patterns, value: str) -> bool:
+    pats = [patterns] if isinstance(patterns, str) else list(patterns or [])
+    hit = False
+    for p in pats:
+        p = str(p)
+        neg = p.startswith("!")
+        if _filter_rx(p[1:] if neg else p).match(value):
+            hit = not neg
+    return hit
+
+
+def _on(doc: dict) -> dict:
+    on = doc.get("on", doc.get(True))
+    if isinstance(on, str):
+        return {on: None}
+    if isinstance(on, list):
+        return {str(e): None for e in on}
+    return dict(on) if isinstance(on, dict) else {}
+
+
+def push_triggered(spec, branch: str, changed) -> bool:
+    """Would a merge commit on `branch` touching only `changed` paths start this `on.push`?"""
+    spec = spec if isinstance(spec, dict) else {}
+    br, bri = spec.get("branches"), spec.get("branches-ignore")
+    if br is None and bri is None and (spec.get("tags") is not None or spec.get("tags-ignore") is not None):
+        return False
+    if br is not None and not _match_any(br, branch):
+        return False
+    if bri is not None and _match_any(bri, branch):
+        return False
+    paths, ign = spec.get("paths"), spec.get("paths-ignore")
+    if paths is not None:
+        return any(_match_any(paths, c) for c in changed)
+    if ign is not None:
+        return not all(_match_any(ign, c) for c in changed)
+    return True
+
+
+def _walk_steps(doc: dict):
+    for name, job in (doc.get("jobs") or {}).items():
+        if not isinstance(job, dict):
+            continue
+        yield name, job, None
+        for st in job.get("steps") or []:
+            if isinstance(st, dict):
+                yield name, job, st
+
+
+def workflow_facts(path: str, text: str, default_branch: str, changed=POLISH_PATHS, repo: str = "",
+                   resolver: Resolver | None = None) -> dict:
+    try:
+        doc = load_yaml_text(text) or {}
+    except Exception as exc:  # a malformed workflow is reported, never fixed
+        return {"path": path, "error": f"yaml: {str(exc)[:120]}", "events": []}
+    doc = doc if isinstance(doc, dict) else {}
+    on = _on(doc)
+    deploy, upstream, envs = [], [], []
+    guards = set()
+    for _jname, job, st in _walk_steps(doc):
+        if st is None:
+            env = job.get("environment")
+            if env:
+                envs.append(env.get("name") if isinstance(env, dict) else str(env))
+            cond = str(job.get("if") or "")
+        else:
+            uses = str(st.get("uses") or "").lower()
+            run = str(st.get("run") or "")
+            cond = str(st.get("if") or "")
+            deploy += [f"uses {uses}" for d in DEPLOY_USES if uses.startswith(d)]
+            if DEPLOY_RUN.search(run):
+                deploy.append(f"run {DEPLOY_RUN.search(run).group(0)[:40]}")
+            upstream += [f"{label} ({uses})" for key, label in UPSTREAM_USES.items() if uses.startswith(key)]
+        for m in re.finditer(r"github\.repository(_owner)?\s*==\s*['\"]([^'\"]+)['\"]", cond):
+            guards.add(m.group(2))
+    perms = json.dumps(doc.get("permissions") or {}) + json.dumps([j.get("permissions") for _, j, s in _walk_steps(doc)
+                                                                  if s is None])
+    if '"pages": "write"' in perms:
+        deploy.append("permissions pages: write")
+    if envs:
+        deploy.append("environment " + ", ".join(sorted(set(map(str, envs)))))
+    name = str(doc.get("name") or PurePosixPath(path).name)
+    if not deploy and re.search(r"(deploy|publish|pages|release)", f"{name} {PurePosixPath(path).stem}", re.I):
+        deploy.append("named deploy/publish/release/pages")
+    if not upstream and UPSTREAM_NAMES.search(PurePosixPath(path).stem):
+        upstream.append(f"named {PurePosixPath(path).stem}")
+    def ours(g: str) -> bool:  # `github.repository[_owner] == '...'` names this repository or its org, under any login
+        if resolver is not None and "/" in g and "/" in repo:
+            return resolver.slug(g).lower() == resolver.slug(repo).lower()
+        if resolver is not None and "/" not in g:
+            return resolver.same(g, repo.split("/")[0])
+        return g.lower() in (repo.lower(), repo.split("/")[0].lower())
+    guarded = bool(guards) and not any(ours(g) for g in guards)
+    return {"path": path, "name": name, "events": sorted(on), "push": "push" in on,
+            "merge_triggers": "push" in on and push_triggered(on.get("push"), default_branch, changed),
+            "workflow_run": list(((on.get("workflow_run") or {}) or {}).get("workflows") or []) if isinstance(
+                on.get("workflow_run"), dict) else [],
+            "schedule": "schedule" in on, "deploy": sorted(set(deploy)), "upstream": sorted(set(upstream)),
+            "environments": sorted(set(map(str, envs))), "guarded_to": sorted(guards), "guarded": guarded}
+
+
+def _norm_runs(obj) -> list[dict]:
+    if isinstance(obj, dict):
+        obj = obj.get("workflow_runs") or obj.get("runs") or []
+    out = []
+    for r in obj or []:
+        if not isinstance(r, dict):
+            continue
+        out.append({"workflow": r.get("workflowName") or r.get("name") or "",
+                    "path": (r.get("path") or "").split("@")[0],
+                    "workflow_id": r.get("workflow_id") or r.get("workflowDatabaseId"),
+                    "branch": r.get("head_branch") or r.get("headBranch"), "event": r.get("event"),
+                    "status": r.get("status"), "conclusion": r.get("conclusion") or None,
+                    "created_at": r.get("created_at") or r.get("createdAt") or "",
+                    "sha": r.get("head_sha") or r.get("headSha"),
+                    "url": r.get("html_url") or r.get("url")})
+    return out
+
+
+def _norm_workflows(obj) -> list[dict]:
+    if isinstance(obj, dict):
+        obj = obj.get("workflows") or []
+    return [{"id": w.get("id"), "name": w.get("name"), "path": w.get("path"), "state": w.get("state"),
+             "badge_url": w.get("badge_url")} for w in obj or [] if isinstance(w, dict)]
+
+
+def readme_ci_badges(readme: str) -> list[str]:
+    """Workflow files whose status badge the README shows."""
+    return sorted(set(re.findall(r"/actions/workflows/([^/\s\"')]+?\.ya?ml)/badge\.svg", readme or "")))
+
+
+def actions_report(meta: dict, *, runs=None, workflows=None, workflow_files: dict | None = None, readme: str = "",
+                   root_files=(), pages: dict | None = None, resolver: Resolver | None = None,
+                   changed=POLISH_PATHS, approval_ids: dict | None = None) -> dict:
+    """Per-repo Actions health for the orchestrator: red badges, upstream-only automation in forks, and what a
+    README merge would start (deploys first: RP-01)."""
+    owner, repo = meta.get("owner", "unknown"), meta.get("repo", "unknown")
+    full = f"{current_login(resolver, owner)}/{repo}"
+    branch = meta.get("default_branch") or "main"
+    runs_n, wfs = _norm_runs(runs), _norm_workflows(workflows)
+    files = dict(workflow_files or {})
+    by_path: dict[str, dict] = {}
+    for w in wfs:
+        if w.get("path"):
+            by_path.setdefault(w["path"], {}).update(api=w)
+    for p, text in files.items():
+        by_path.setdefault(p, {})["facts"] = workflow_facts(p, text, branch, changed, full, resolver)
+    name_to_path = {(v.get("api") or {}).get("name") or (v.get("facts") or {}).get("name"): p for p, v in by_path.items()}
+    id_to_path = {(v.get("api") or {}).get("id"): p for p, v in by_path.items() if (v.get("api") or {}).get("id")}
+    for r in runs_n:
+        p = r["path"] or id_to_path.get(r["workflow_id"]) or name_to_path.get(r["workflow"])
+        if not p:
+            p = f"(dynamic) {r['workflow']}"
+        by_path.setdefault(p, {}).setdefault("runs", []).append(r)
+    fork = bool(meta.get("fork")) or repo.endswith("-fork")
+    parent = (meta.get("parent") or {}).get("full_name") if isinstance(meta.get("parent"), dict) else meta.get("parent")
+    parent_owner = parent.split("/")[0] if parent else None
+    upstream_fork = fork and not (parent_owner and in_estate(resolver, parent_owner))
+    badges = readme_ci_badges(readme)
+    rows, deploy_rows, proposals, jobs, logs = [], [], [], [], []
+    push_names = set()
+    for p, v in by_path.items():
+        f = v.get("facts") or {}
+        if f.get("merge_triggers"):
+            push_names.add(f.get("name"))
+            push_names.add((v.get("api") or {}).get("name"))
+    for p, v in sorted(by_path.items()):
+        api, f = v.get("api") or {}, v.get("facts") or {}
+        on_branch = [r for r in v.get("runs") or [] if r["branch"] == branch]
+        on_branch.sort(key=lambda r: r["created_at"], reverse=True)
+        done = [r for r in on_branch if r["status"] in (None, "completed")]
+        latest = done[0] if done else None
+        concl = (latest or {}).get("conclusion") or ("pending" if on_branch else "none")
+        state = api.get("state") or ("unknown" if not api else None)
+        flags = []
+        if concl in RED:
+            flags.append("ci-red")
+        if state in ("disabled_manually", "disabled_inactivity", "disabled_fork"):
+            flags.append(state)
+        chained = [n for n in f.get("workflow_run") or [] if n in push_names]
+        triggers = []
+        if f.get("merge_triggers"):
+            triggers.append("push")
+        if chained:
+            triggers.append("workflow_run:" + ",".join(chained))
+        if f.get("schedule"):
+            triggers.append("schedule")
+        fname = PurePosixPath(p).name
+        badge = fname in badges
+        if badge and concl != "success":
+            flags.append("badge-red" if concl in RED else "badge-unknown")
+        is_deploy = bool(f.get("deploy"))
+        if is_deploy and (f.get("merge_triggers") or chained):
+            flags.append("deploy-on-merge")
+            deploy_rows.append({"repo": full, "workflow": p, "trigger": "+".join(triggers),
+                                "environment": ",".join(f.get("environments") or []) or "-",
+                                "external": "-", "suppressed_by_skip_ci": True})
+        if is_deploy and f.get("schedule"):
+            deploy_rows.append({"repo": full, "workflow": p, "trigger": "schedule",
+                                "environment": ",".join(f.get("environments") or []) or "-", "external": "-",
+                                "suppressed_by_skip_ci": False})
+        upstream = upstream_fork and not f.get("guarded") and state not in ("disabled_manually", "disabled_fork") and (
+            bool(f.get("upstream")) or (f.get("schedule") and concl in RED))
+        if upstream:
+            flags.append("upstream-only")
+            # the file name, never the numeric id: the guard matches the workflow-toggle approval's detail (the
+            # workflow file) against this argument (scripts/guard.py B5)
+            wid = fname
+            reason = ", ".join(f.get("upstream") or ["failing upstream schedule"])
+            jid = job_id("p0", "workflow-toggle", full, fname)
+            job = writer_job(jid, "3", "workflow-toggle", full, ["gh", "workflow", "disable", str(wid), "-R", full],
+                             f"Disable upstream-only automation in a kept fork ({reason}); never edit the workflow "
+                             "file (RP-06, CQ-13, q79).", (approval_ids or {}).get(fname) or (approval_ids or {}).get(p))
+            (jobs if job.get("approval_id") else proposals).append(job)
+        rows.append({"path": p, "name": f.get("name") or api.get("name") or v.get("runs", [{}])[0].get("workflow"),
+                     "state": state, "latest": concl, "latest_at": (latest or {}).get("created_at"),
+                     "latest_url": (latest or {}).get("url"), "events": f.get("events") or [],
+                     "merge_triggers": triggers, "deploy": f.get("deploy") or [], "upstream": f.get("upstream") or [],
+                     "guarded_to": f.get("guarded_to") or [], "badge": badge, "flags": flags,
+                     **({"error": f["error"]} if f.get("error") else {})})
+    externals = sorted({EXTERNAL_FILES[n] for n in root_files if n in EXTERNAL_FILES})
+    for ext in externals:
+        deploy_rows.append({"repo": full, "workflow": "-", "trigger": "external integration", "environment": "-",
+                            "external": ext, "suppressed_by_skip_ci": False})
+    has_pages_wf = any("uses actions/deploy-pages" in (r["deploy"] or []) for r in rows)
+    pages_src = (pages or {}).get("source") or {}
+    if (pages or {}).get("build_type") == "legacy" or (meta.get("has_pages") and not pages and not has_pages_wf):
+        if not pages or pages_src.get("branch") in (None, branch):
+            deploy_rows.append({"repo": full, "workflow": "pages-build-deployment", "trigger": "branch-source Pages",
+                                "environment": "github-pages", "external": "GitHub Pages" if pages else
+                                "GitHub Pages (assumed: has_pages, no Pages workflow)", "suppressed_by_skip_ci": False})
+    if any("ci-red" in r["flags"] for r in rows):
+        logs.append("ci-red")
+    if any(r["flags"] and set(r["flags"]) & {"disabled_manually", "disabled_inactivity"} for r in rows):
+        logs.append("workflow-disabled")
+    if proposals or jobs:
+        logs.append("workflow-toggle")
+    merge_runs = [r for r in rows if r["merge_triggers"] and set(r["merge_triggers"]) - {"schedule"}]
+    not_suppressed = [d for d in deploy_rows if not d["suppressed_by_skip_ci"]]
+    ci_ok = {r["path"]: r["latest"] == "success" for r in rows}
+    for b in badges:  # a README badge with no run data is never shown as green (STANDARD §7.2 badge 4)
+        if not any(PurePosixPath(p).name == b for p in ci_ok):
+            ci_ok[f".github/workflows/{b}"] = False
+            logs.append("needs-input:ci-status")
+    if not by_path:
+        logs.append("needs-input:workflows")
+    post = []
+    if any(d["suppressed_by_skip_ci"] for d in deploy_rows) or not_suppressed:
+        post = [["gh", "api", f"repos/{full}/actions/runs?event=push&per_page=1"],
+                ["gh", "api", f"repos/{full}/deployments?per_page=1"]]
+    red = any("ci-red" in r["flags"] or "badge-red" in r["flags"] for r in rows)
+    return {"result": "fail" if red else ("needs-input" if not by_path else
+                                         ("warn" if deploy_rows or proposals else "pass")),
+            "repo": full, "default_branch": branch, "fork": fork, "upstream_fork": upstream_fork, "parent": parent,
+            "workflows": rows, "ci_badge_allowed": ci_ok, "readme_badges": badges,
+            "redeploy": {"merge_starts": [r["path"] for r in merge_runs], "deploy_on_merge": deploy_rows,
+                         "not_suppressed_by_skip_ci": not_suppressed,
+                         "avoid_redeploy": bool(deploy_rows),
+                         "merge_subject": "<PR title> [skip ci]",  # always (STANDARD §10.3; RP-01)
+                         "post_merge_checks": post},
+            "proposals": proposals, "jobs": jobs,
+            "tsv": {"actions-health": [[full, r["path"], r["state"] or "-", r["latest"], r["latest_at"] or "-",
+                                        ",".join(r["flags"]) or "-"] for r in rows],
+                    "deploy-on-push": [[d["repo"], d["workflow"], d["trigger"], d["environment"], d["external"]]
+                                       for d in deploy_rows]},
+            "logs": logs}
+
+
+# =====================================================================================================
+# images (RP-03, RP-10)
+# =====================================================================================================
+IMG_LIMIT, EXAMPLE_LIMIT, EXAMPLE_WIDTH = 300_000, 600_000, 2600
+PROTECTED_DIRS = ("public", "static", "src", "results", "notebooks")
+EXEMPT_LOGOS = {  # STANDARD §9.2 brand pair (R9), exempt from the image weight rule
+    "a5c3c4ef55336ed4b883d3bc3bb6e1e942b836469bd2b2933bc8cc230b321621",
+    "0dc00c0e5159518ff1d552b7052293b4e545ddd35be489e6d114e3ea64db27ec"}
+
+
+def _is_example(rel: str) -> bool:
+    return rel.startswith("assets/examples/") or bool(re.search(r"(^|/)example[^/]*\.(png|jpe?g|webp|gif)$", rel, re.I))
+
+
+def _png_lossless(data: bytes) -> tuple[bytes | None, str]:
+    """A pixel-identical re-encode (zlib 9, filter search) to estimate what `oxipng -o4 --strip safe` saves."""
+    from PIL import Image
+    try:
+        im = Image.open(io.BytesIO(data))
+        im.load()
+    except Exception as exc:  # unreadable images are reported, not fixed
+        return None, f"unreadable: {str(exc)[:80]}"
+    frames = getattr(im, "n_frames", 1)
+    if getattr(im, "is_animated", False) or frames > 1:  # a re-save keeps one frame: no candidate (fail closed)
+        return None, f"animated: {frames} frames; no lossless candidate (a re-encode would keep only the first frame)"
+    b = io.BytesIO()
+    kw = {"optimize": True}
+    if im.info.get("icc_profile"):
+        kw["icc_profile"] = im.info["icc_profile"]
+    if im.mode == "P" and "transparency" in im.info:
+        kw["transparency"] = im.info["transparency"]
+    im.save(b, "PNG", **kw)
+    new = b.getvalue()
+    back = Image.open(io.BytesIO(new))
+    back.load()
+    if back.mode != im.mode or back.size != im.size or back.tobytes() != im.tobytes():
+        return None, "re-encode not pixel-identical"
+    return new, "ok"
+
+
+def _dark_theme(rel: str, data: bytes) -> str | None:
+    """RP-10 static heuristics: content that may vanish on GitHub's dark page."""
+    low = rel.lower()
+    if low.endswith(".svg"):
+        text = data.decode("utf-8", "replace")
+        fills = re.findall(r"(?:fill|stroke)\s*[:=]\s*[\"']?(#[0-9a-fA-F]{6}|#[0-9a-fA-F]{3}\b|black)", text)
+        from .color import luminance
+        dark = [f for f in fills if f == "black" or luminance(f) < 0.05]
+        has_bg = re.search(r"<rect[^>]*(width=[\"']100%|x=[\"']0)", text) or "prefers-color-scheme" in text
+        if dark and not has_bg and len(dark) * 2 >= len(fills):
+            return "svg: dark fills and no background rect or prefers-color-scheme"
+        return None
+    if not low.endswith((".png", ".gif", ".webp")):
+        return None
+    from PIL import Image
+    try:
+        im = Image.open(io.BytesIO(data))
+        im.thumbnail((256, 256))
+        im = im.convert("RGBA")
+    except Exception:  # unreadable images are reported elsewhere
+        return None
+    px = _px(im)
+    clear = sum(1 for p in px if p[3] < 128)
+    ink = [p for p in px if p[3] >= 128]
+    if not ink or clear / len(px) <= 0.30:
+        return None
+    lum = sum(0.2126 * p[0] + 0.7152 * p[1] + 0.0722 * p[2] for p in ink) / len(ink)
+    return f"png: {clear / len(px):.0%} transparent, mean ink luminance {lum:.0f} < 80" if lum < 80 else None
+
+
+def _mermaid_flags(text: str) -> list[int]:
+    out, inside = [], False
+    for n, ln in enumerate(text.splitlines(), 1):
+        s = ln.strip()
+        if s.startswith("```mermaid") or s.startswith("~~~mermaid"):
+            inside = True
+            continue
+        if inside and s.startswith(("```", "~~~")):
+            inside = False
+            continue
+        if inside and re.search(r"\b(classDef|style)\b", s) and "fill:" in s and "color:" not in s:
+            out.append(n)
+    return out
+
+
+def images_report(tree: Tree, files: list[str], *, new_paths: set[str] | None = None, approval_id: str | None = None,
+                  out_dir: str | Path | None = None, fetcher: Fetcher | None = None) -> dict:
+    """README and docs image budget (RP-03): bytes, pixels, alt text; lossless proposals; lossy only with an
+    approval; dark-theme flags (RP-10)."""
+    from PIL import Image
+    refs: dict[str, dict] = {}
+    remote, alt_missing, mermaid = [], [], []
+    for f in files:
+        text = tree.read(f) or ""
+        for n in _mermaid_flags(text):
+            mermaid.append({"file": f, "line": n, "flag": "mermaid fill without color"})
+        for ln in extract_links(text):
+            target = ln["target"].strip()
+            is_img = ln["image"] or urllib.parse.urlsplit(target).path.lower().endswith(IMG_EXT)
+            if not is_img or target.startswith("data:"):
+                continue
+            if ln["image"] and ln["syntax"] in ("markdown", "html-img") and not (ln.get("alt") or "").strip():
+                alt_missing.append({"file": f, "line": ln["line"], "target": target})
+            if re.match(r"^(https?:)?//", target, re.I):
+                remote.append({"file": f, "line": ln["line"], "target": target})
+                continue
+            path = urllib.parse.unquote(target.split("#")[0].split("?")[0])
+            rel, _ = _resolve(f, path)
+            if rel is None:
+                continue
+            refs.setdefault(rel, {"path": rel, "referenced_from": []})["referenced_from"].append(f"{f}:{ln['line']}")
+    rows, plan, needs_approval, logs = [], [], [], []
+    for rel, row in sorted(refs.items()):
+        data = tree.read_bytes(rel)
+        if data is None:
+            rows.append(dict(row, status="missing"))
+            continue
+        row["bytes"] = len(data)
+        row["sha256"] = hashlib.sha256(data).hexdigest()
+        try:
+            if rel.lower().endswith(".svg"):
+                m = re.search(r"<svg[^>]*\bwidth=[\"']?([\d.]+)[^>]*\bheight=[\"']?([\d.]+)", data.decode("utf-8", "replace"))
+                row["px"] = [round(float(m.group(1))), round(float(m.group(2)))] if m else None
+                row["format"] = "SVG"
+            else:
+                im = Image.open(io.BytesIO(data))
+                row["px"], row["format"] = list(im.size), im.format
+        except Exception:  # an image PIL cannot open is reported as such
+            row["format"] = "unreadable"
+        example = _is_example(rel)
+        limit = EXAMPLE_LIMIT if example else IMG_LIMIT
+        row["limit"] = limit
+        row["new"] = rel in (new_paths or set())
+        row["protected"] = any(seg in PROTECTED_DIRS for seg in rel.split("/")[:-1])
+        flags = []
+        if row["sha256"] in EXEMPT_LOGOS:
+            flags.append("exempt:brand-logo")
+        elif len(data) > limit:
+            flags.append("fail:image-weight" if row["new"] else "warn:image-weight")
+        if example and (row.get("px") or [0])[0] > EXAMPLE_WIDTH:
+            flags.append("warn:example-width")
+        dark = _dark_theme(rel, data)
+        if dark:
+            flags.append("warn:dark-theme")
+            row["dark_theme"] = dark
+        row["flags"] = flags
+        over = any(fl.endswith("image-weight") for fl in flags)
+        if over and not row["protected"]:
+            fmt = (row.get("format") or "").upper()
+            if fmt == "PNG":
+                new, why = _png_lossless(data)
+                saved = len(data) - len(new) if new else 0
+                row["lossless"] = {"bytes": len(new) if new else None, "saved": saved, "check": why}
+                plan.append({"path": rel, "kind": "lossless", "argv": ["oxipng", "-o4", "--strip", "safe", rel],
+                             "estimate_bytes": len(new) if new else None, "meets_limit": bool(new) and len(new) <= limit,
+                             "note": "identical pixels, same path (STANDARD §10.3)"})
+                if out_dir and new and saved > 0:
+                    dest = Path(out_dir) / rel
+                    dest.parent.mkdir(parents=True, exist_ok=True)
+                    dest.write_bytes(new)
+                    row["lossless"]["candidate"] = str(dest)
+                fits = bool(new) and len(new) <= limit
+            elif fmt == "GIF":
+                plan.append({"path": rel, "kind": "lossless", "argv": ["gifsicle", "-O3", "--batch", rel],
+                             "estimate_bytes": None, "meets_limit": None, "note": "identical frames, same path"})
+                fits = False
+            else:
+                fits = False
+            if not fits:
+                lossy = {"path": rel, "kind": "lossy", "approval": "lossy-image", "bytes": len(data), "limit": limit,
+                         "argv": (["pngquant", "--quality", "80-95", "--skip-if-larger", "--force", "--ext", ".png", rel]
+                                  if fmt == "PNG" else ["cwebp", "-q", "85", rel, "-o", rel + ".webp"]),
+                         "note": "lossy recompression needs a per-repo lossy-image approval (q69)"}
+                if approval_id:
+                    plan.append(dict(lossy, approval_id=approval_id))
+                else:
+                    needs_approval.append(lossy)
+        elif over:
+            row["note"] = "under public/, static/, src/, results/ or notebooks/: never touched (STANDARD §10.3)"
+        rows.append(row)
+    if fetcher is not None:
+        for r in remote:
+            res = fetcher.check(r["target"] if not r["target"].startswith("//") else "https:" + r["target"])
+            r["http"] = res.get("status")
+    fails = [r for r in rows if any(f.startswith("fail:") for f in r.get("flags", []))] + \
+        [r for r in rows if r.get("status") == "missing"]
+    warns = [r for r in rows if any(f.startswith("warn:") for f in r.get("flags", []))]
+    if any("image-weight" in f for r in rows for f in r.get("flags", [])):
+        logs.append("warn:image-weight" if not fails else "image-weight")
+    if any("warn:dark-theme" in r.get("flags", []) for r in rows) or mermaid:
+        logs.append("warn:dark-theme")
+    if alt_missing:
+        logs.append("warn:alt-missing")
+    return {"result": "fail" if fails else ("warn" if warns or alt_missing or mermaid else "pass"),
+            "images": rows, "remote": remote, "alt_missing": alt_missing, "mermaid": mermaid, "plan": plan,
+            "needs_approval": needs_approval, "logs": logs}
+
+
+def new_files(tree: Tree, base_ref: str | None) -> set[str]:
+    """Files the run adds: not in `base_ref` (default HEAD) or untracked."""
+    if not tree.git:
+        return set()
+    out = tree._git("ls-tree", "-r", "--name-only", "-z", base_ref or "HEAD")
+    if out is None:
+        return set(tree.files)
+    return set(tree.files) - {f for f in out.split("\0") if f}
+
+
+# =====================================================================================================
+# sidebar (RP-05)
+# =====================================================================================================
+SIDEBAR_BOXES = ("releases", "packages", "deployments")
+
+
+def _count(v) -> int | None:
+    if v is None:
+        return None
+    if isinstance(v, bool):
+        return int(v)
+    if isinstance(v, (int, float)):
+        return int(v)
+    if isinstance(v, list):
+        return len(v)
+    if isinstance(v, dict):
+        for k in ("total_count", "totalCount"):  # REST and GraphQL counts win over a (possibly paged) list
+            n = v.get(k)
+            if isinstance(n, int) and not isinstance(n, bool):
+                return n
+            if isinstance(n, str) and n.isdigit():
+                return int(n)
+        for k in ("environments", "releases", "deployments", "packages", "items", "nodes"):
+            if isinstance(v.get(k), list):
+                return len(v[k])
+    return None
+
+
+def packages_by_repo(packages, resolver: Resolver | None = None) -> dict[str, int]:
+    """Org package listings (`gh api orgs/<org>/packages?package_type=...`, one or many) keyed by OWNER/REPO, owners
+    folded through the resolver so a renamed org's packages still map to its repositories."""
+    out: dict[str, int] = {}
+    items = packages if isinstance(packages, list) else (packages or {}).get("packages") or []
+    for p in items:
+        if isinstance(p, list):
+            for k, v in packages_by_repo(p, resolver).items():
+                out[k] = out.get(k, 0) + v
+            continue
+        full = ((p or {}).get("repository") or {}).get("full_name")
+        if not full:
+            continue
+        o, r = full.split("/", 1)
+        key = f"{current_login(resolver, o).lower()}/{r.lower()}"
+        out[key] = out.get(key, 0) + 1
+    return out
+
+
+def sidebar_plan(meta: dict, facts: dict, *, resolver: Resolver | None = None, packages: dict | None = None,
+                 current: dict | None = None, phase="3.3") -> dict:
+    """Target state of the About "Include in the home page" boxes (decision 7, STANDARD §10.1) and the browser job
+    that sets them. GitHub's default shows all three; only repos whose target differs get a job."""
+    owner, repo = meta.get("owner", "unknown"), meta.get("repo", "unknown")
+    cur_owner = current_login(resolver, owner)
+    full = f"{cur_owner}/{repo}"
+    counts = {b: _count(facts.get(b)) for b in SIDEBAR_BOXES}
+    if counts["packages"] is None and packages is not None:
+        key = f"{cur_owner.lower()}/{repo.lower()}"
+        counts["packages"] = packages.get(key, 0)
+    target = {b: (None if counts[b] is None else counts[b] > 0) for b in SIDEBAR_BOXES}
+    unknown = [b for b in SIDEBAR_BOXES if target[b] is None]
+    default = {b: True for b in SIDEBAR_BOXES}
+    base_state = {b: (current or {}).get(b, default[b]) for b in SIDEBAR_BOXES}
+    differs = [b for b in SIDEBAR_BOXES if target[b] is not None and target[b] != base_state[b]]
+    has_pages = bool(facts.get("has_pages", meta.get("has_pages")))
+    public = meta.get("visibility", "public") == "public"
+    row = {"repo": full, **{b: counts[b] for b in SIDEBAR_BOXES}, "environments": _count(facts.get("environments")),
+           **{f"show_{b}": target[b] for b in SIDEBAR_BOXES}, "has_pages": has_pages,
+           "differs_from_default": bool(differs), "unknown": unknown}
+    logs = [f"needs-input:sidebar-facts:{b}" for b in unknown]
+    job = None
+    if differs and not unknown:
+        word = {True: "checked", False: "unchecked"}
+        steps = [f"Open https://github.com/{full} while signed in as an owner of {cur_owner}.",
+                 "In the right-hand column, click the gear icon next to the \"About\" heading; the \"Edit repository "
+                 "details\" dialog opens.",
+                 "Do not change Description, Website or Topics in this dialog; the writer sets them."]
+        if has_pages:
+            steps.append("Tick \"Use your GitHub Pages website\" only if the Website field already holds this "
+                         "repository's GitHub Pages URL; otherwise leave it as it is.")
+        for b in SIDEBAR_BOXES:
+            label = b.capitalize()
+            steps.append(f"Under \"Include in the home page\", make sure \"{label}\" is {word[target[b]]} "
+                         f"({counts[b]} {b} found).")
+        steps.append("Click \"Save changes\".")
+        if public:
+            steps.append(f"Verify signed out (or with `curl -s https://github.com/{full}`): the page shows neither "
+                         "\"No releases published\" nor \"No packages published\".")
+        else:
+            steps.append("Private repository: keep the screenshot of the About column for the per-org sample.")
+        job = browser_job(job_id(f"p{phase}", "sidebar", full), phase, full, f"https://github.com/{full}",
+                          "about-sidebar", steps,
+                          "About sidebar: Releases, Packages and Deployments shown only where they exist (UD 7, RP-05; "
+                          "STANDARD §10.1, §12.4).")
+    tsv = [full] + ["?" if counts[b] is None else str(counts[b]) for b in SIDEBAR_BOXES] + \
+        ["?" if target[b] is None else ("show" if target[b] else "hide") for b in SIDEBAR_BOXES] + \
+        ["yes" if differs else "no"]
+    return {"result": "needs-input" if unknown else ("proposal" if job else "pass"), "row": row, "tsv": tsv,
+            "job": job, "logs": logs}
+
+
+SIDEBAR_TSV_HEADER = ["repo", "releases", "packages", "deployments", "releases_box", "packages_box", "deployments_box",
+                      "differs_from_default"]
+
+
+# =====================================================================================================
+# icon (RT-04): prompt file, normalize, QA
+# =====================================================================================================
+ICON_PX, ICON_BUDGET = 1024, 300_000
+LIVE_MARGIN = round(82 * ICON_PX / 500)  # 168: the avatar live area (a.3) at 1024 px
+LIVE = ICON_PX - 2 * LIVE_MARGIN          # 688
+KEY_DE, CONTENT_DE = 6.0, 12.0
+ART_FAMILY = {"completetech": "CompleteTech core", "ai-ascension": "AI-Ascension", "jev-engineering": "Jev",
+              "jevplay-games": "Jev", "libreevolve": "LibreEvolve", "touchedbyanagent": "TouchedByAnAgent",
+              "romgenie": "romgenie utility"}
+ART_OWNER = {"CompleteDotTech": ("Founder", None), "Pick-Your-AI": ("Pick Your AI", None),
+             "Jev-Engineering": ("Jev", "Jev-Engineering"), "jevplay-games": ("Jev", "jevplay-games"),
+             "Jevelopers-neatHack-2026": ("Jev", "Jevelopers")}
+WRITER_SLOTS = ("GLYPH_NAME", "GLYPH_DESCRIPTION", "SPARK_PLACEMENT", "SIZE_CLASS")
+SIZE_CLASSES = {
+    "WIDE": "the glyph spans close to the full 688 px width and is about 430 to 560 px tall",
+    "TALL": "spans close to the full 688 px height and is about 400 to 600 px wide",
+    "SQUARE": "a squarish glyph about 600 to 660 px on each side",
+    "DIAGONAL": "the mass runs corner to corner inside a 656 × 656 px box"}
+HEX = r"`(#[0-9A-Fa-f]{6})`"
+
+
+def load_art_direction(path=None) -> str:
+    p = Path(path) if path else DEFAULT_ART_DIRECTION
+    if not p.is_file():
+        raise NeedsInput("art-direction", f"art direction not found: {p} (pass --art-direction FILE to use another file)")
+    return p.read_text(encoding="utf-8")
+
+
+def _section(text: str, head: str) -> str:
+    m = re.search(rf"^## {re.escape(head)}.*?$(.*?)(?=^## |\Z)", text, re.M | re.S)
+    return m.group(1) if m else ""
+
+
+def palette_rows(text: str) -> list[dict]:
+    """Rows of the (b) family palette table: family, role, name, hex values and notes."""
+    rows, fam = [], ""
+    for ln in _section(text, "(b) Family palette").splitlines():
+        cells = [c.strip() for c in ln.strip().strip("|").split("|")]
+        if len(cells) < 4 or not ln.lstrip().startswith("|") or set(cells[0]) <= set("-: ") and cells[0]:
+            continue
+        if cells[0] in ("Family",):
+            continue
+        fam = re.sub(r"\*\*|\(.*?\)", "", cells[0]).strip() or fam
+        rows.append({"family": fam, "role": cells[1], "name": cells[2], "hex": re.findall(HEX, cells[3]),
+                     "notes": cells[4] if len(cells) > 4 else ""})
+    return rows
+
+
+def family_colours(text: str, owner: str, family: str, aliases=()) -> dict:
+    """The family palette for the org: its ART_OWNER row under any of its logins (`aliases`, CQ-03), else the family's."""
+    owners = {k.lower(): v for k, v in ART_OWNER.items()}
+    fam, prefix = next((owners[a.lower()] for a in (owner, *aliases) if a and a.lower() in owners),
+                       (ART_FAMILY.get(family), None))
+    rows = [r for r in palette_rows(text) if fam and r["family"].lower().startswith(fam.lower())]
+    if prefix:
+        own = [r for r in rows if r["role"].lower().startswith(prefix.lower())]
+        rows = own + [r for r in rows if r["role"].lower().startswith("light-surface")]
+    out: dict = {"family_label": fam}
+
+    def note(r, key):
+        m = re.search(rf"{key} `(#[0-9A-Fa-f]{{6}})`", r["notes"] if r else "")
+        return m.group(1) if m else None
+    line = next((r for r in rows if re.search(r"\bline\b", r["role"], re.I) and "second" not in r["role"].lower()
+                 and r["hex"]), None)
+    spark = next((r for r in rows if re.search(r"\bspark\b", r["role"], re.I) and "light-surface" not in r["role"].lower()
+                  and r["hex"]), None)
+    glow_row = next((r for r in rows if r["role"].lower() == "glow" and r["hex"]), None)
+    if line:
+        out.update(LINE_NAME=line["name"], LINE_HEX=line["hex"][0], CORE_HEX=note(line, "core"),
+                   GLOW_HEX=note(line, "glow") or (glow_row["hex"][0] if glow_row else None))
+    if spark:
+        out.update(SPARK_NAME=spark["name"], SPARK_HEX=spark["hex"][0], SPARK_CORE_HEX=note(spark, "centre"),
+                   SPARK_BLOOM_HEX=note(spark, "bloom"))
+    ink = next((r for r in rows if r["role"].lower().startswith("light-surface")), None)
+    out["INK"] = ink["hex"] if ink else []
+    return out
+
+
+def org_glyph(text: str, owner: str) -> str | None:
+    for ln in _section(text, "(c) All 28 accounts").splitlines():
+        cells = [c.strip() for c in ln.strip().strip("|").split("|")]
+        if len(cells) >= 6 and cells[1].split(" (")[0].lower() == owner.lower():
+            return cells[5]
+    return None
+
+
+def icon_colours(ctx, text: str, org: dict, resolver: Resolver, *, require_palette: bool = True) -> dict:
+    """Keep estate palettes explicit; the bundled template uses the committed brand tokens."""
+    family = org_style(resolver, ctx.brand, ctx.owner)["name"]
+    colours = family_colours(text, org["brand_key"], family, resolver.aliases(ctx.owner))
+    if _section(text, "Repository glyph prompt template") and not _section(text, "(b) Family palette"):
+        tokens = ctx.style["tokens"]
+        missing = [key for key in ("icon_ink", "icon_spark") if not tokens.get(key)]
+        if missing:
+            if not require_palette:
+                return colours
+            raise NeedsInput("icon-palette", "selected brand config needs " + ", ".join(missing) +
+                             " tokens for the bundled prompt; add them or pass --art-direction FILE "
+                             "with a family palette")
+        colours.update(family_label=family, LINE_NAME="family icon ink", LINE_HEX=tokens["icon_ink"],
+                       CORE_HEX=tokens["title"], GLOW_HEX=tokens["accent_mid"],
+                       SPARK_NAME="family icon spark", SPARK_HEX=tokens["icon_spark"],
+                       SPARK_CORE_HEX=tokens["title"], SPARK_BLOOM_HEX=tokens["icon_spark"],
+                       INK=[tokens["icon_ink"], tokens["icon_spark"]])
+    return colours
+
+
+def seed_for(text: str, owner: str | list[str], family: str) -> str | None:
+    """The org's seed (any of its logins, CQ-03), else the family's."""
+    m = re.search(r"seeds \(([^)]*)\)", text)
+    if not m:
+        return None
+    seeds = dict((k.strip(), v) for k, v in re.findall(r"([A-Za-z][\w-]*)\s+`?(\d{3,5})`?", m.group(1)))
+    for key in (*([owner] if isinstance(owner, str) else owner), {"completetech": "CompleteTech"}.get(family), family):
+        for k, v in seeds.items():
+            if key and k.lower() == str(key).lower():
+                return v
+    return None
+
+
+def _template(text: str, section: str) -> str | None:
+    m = re.search(r"```text\n(.*?)\n```", _section(text, section), re.S)
+    return m.group(1) if m else None
+
+
+def icon_prompt(ctx, resolver: Resolver, art_text: str, glyph: dict | None = None, option: str = "A",
+                language: str | None = None, skill_art: str | None = None) -> dict:
+    """The Codex prompt for a repository icon (f.3 option A: the (d) template with "repo icon" for "avatar"; option
+    B: the illustration template on the light card). The tool fills every mechanical slot from the art direction and
+    the repository's facts; the glyph itself is the writer's (needs-writer until `glyph` supplies it)."""
+    glyph = {k.upper(): v for k, v in (glyph or {}).items() if v}
+    owner, repo = ctx.owner, ctx.repo
+    org = org_row(resolver, ctx.brand, owner, require=True)
+    org["canonical"], org["current"] = org["brand_key"], current_login(resolver, owner)
+    family = org_style(resolver, ctx.brand, owner)["name"]
+    logins = [org["canonical"], *resolver.aliases(owner)]  # ART_DIRECTION may name the org by any of its logins (CQ-03)
+    colours = icon_colours(ctx, art_text, org, resolver, require_palette=option.upper() == "A")
+    org_mark = next((g for g in (org_glyph(art_text, x) for x in logins) if g), None)
+    facts = {"repository": f"{org['current']}/{repo}", "description": ctx.meta.get("description") or "",
+             "type": ctx.det.get("type"), "category": ctx.det.get("category"), "topics": ctx.meta.get("topics") or [],
+             "language": language or ctx.meta.get("language"), "product": ctx.facts.h1(), "family": family,
+             "org_glyph": org_mark}
+    missing: list[str] = []
+    if option.upper() == "B":
+        tpl = _template(skill_art or "", "Prompt template for illustrations")
+        if not tpl:
+            raise NeedsInput("art-direction", "references/art-direction.md has no illustration template")
+        lock = None
+        names = {family, family.replace("-", " "), org["canonical"].lower(), str(org.get("display_name") or "").lower()}
+        for ln in (skill_art or "").splitlines():
+            cells = [c.strip() for c in ln.strip().strip("|").split("|")]
+            if len(cells) == 2 and cells[0].lower() in names:
+                lock = cells[1]
+        adds = dict(re.findall(r"(Security|TCG|Discord orgs|jevplay-games|TouchedByAnAgent) `([^`]*)`",
+                               (re.search(r"Family additions:(.*)", skill_art or "") or re.match("", "")).group(0)))
+        add_map = {"completetech-security": "Security", "completetech-pokemon": "TCG", "completetech-tcg": "TCG",
+                   "completetech-discordapps": "Discord orgs", "completetechdiscord-games": "Discord orgs",
+                   "jevplay-games": "jevplay-games", "touchedbyanagent": "TouchedByAnAgent"}
+        add_names = {"completetech security": "Security", "completetech tcg": "TCG",
+                     "completetech discord apps": "Discord orgs", "completetech discord games": "Discord orgs",
+                     "jevplay.games": "jevplay-games", "touched by an agent": "TouchedByAnAgent"}
+        # any login of the org (CQ-03), else its display name, so a re-keyed brand.yaml row keeps its negatives
+        add_key = next((add_map[a.lower()] for a in logins if a and a.lower() in add_map), None) or \
+            add_names.get(str(org.get("display_name") or "").lower())
+        if add_key and not adds.get(add_key):
+            # a trademark family whose negatives cannot be found: never a prompt without them (fail closed)
+            raise NeedsInput("family-additions", f"{org['current']}: references/art-direction.md has no {add_key} "
+                                                 "family addition (trademark negatives)")
+        pal = re.search(r"CompleteTech palette: `([^`]*)`; highlight line `([^`]*)`", skill_art or "")
+        card = ctx.style["tokens"]["card_fill"]
+        prompt = tpl.replace("FAMILY STYLE LOCK, VERBATIM", lock or "{STYLE_LOCK}")
+        prompt = prompt.replace("Square 1024x1024 | Wide 1536x1024", "Square 1024x1024")
+        prompt = prompt.replace("untextured BG background", f"untextured {card} background")
+        if family == "completetech" and pal:
+            prompt = prompt.replace("PALETTE. HIGHLIGHT LINE", f"{pal.group(1)}. {pal.group(2)}")
+        prompt = prompt.replace("One sentence: the single hero object or scene that represents the repository or "
+                                "org's function.", glyph.get("SUBJECT") or "{SUBJECT}")
+        prompt = re.sub(r"3–5 objects\.[^\n]*", glyph.get("OBJECTS") or "{OBJECTS}", prompt)
+        prompt = prompt.replace("FAMILY ADDITIONS", " ".join(x for x in (adds.get(add_key), glyph.get("EXTRA_NEGATIVES"))
+                                                             if x)).rstrip()
+        prompt = prompt.replace("[STYLE LOCK — FAMILY]", f"[STYLE LOCK — {colours.get('family_label') or family}]")
+    else:
+        tpl = _template(art_text, "(d) Shared prompt template") or \
+            _template(art_text, "Repository glyph prompt template")
+        if not tpl:
+            raise NeedsInput("art-direction", "selected art direction has no (d) Shared prompt template "
+                             "or Repository glyph prompt template")
+        seed = seed_for(art_text, logins, family)
+        slots = {k: colours.get(k) for k in ("LINE_NAME", "LINE_HEX", "CORE_HEX", "GLOW_HEX", "SPARK_NAME", "SPARK_HEX",
+                                              "SPARK_CORE_HEX", "SPARK_BLOOM_HEX")}
+        slots.update(ACCOUNT=f"{org['current']}/{repo}", KIND="repository", CIRCLE_CLAUSE="",
+                     CROP="repository icon, shown inside the light card of the README hero banner, the repo card and the "
+                          "social preview", SECONDARY_LIGHT="", SECONDARY_LINE="", SPARK_D="94", SPARK_CORE_D="37",
+                     TEXT_RULE="Any text, letters, numbers or words",
+                     SEED=seed or "not set",
+                     SEED_INSTRUCTION=f"Use seed {seed} when supported." if seed else "Use the tool's default seed.",
+                     STYLE_REFERENCES="the three approved pilot renders from art/golden/neon-night/.",
+                     BRAND_REFERENCE=f"Org avatar art/reference/avatars/{org['canonical']}.png for family consistency "
+                                     "only: do not copy its glyph; this repository's silhouette must differ from it at "
+                                     "48 px (f.3).")
+        if slots.get("SPARK_NAME"):
+            slots["SPARK_EXCLUSIVITY"] = f" and the only element in {slots['SPARK_NAME']}"
+        if slots.get("GLOW_HEX"):
+            slots["POOL"] = (f"one very soft round pool of {slots['GLOW_HEX']} light at about 10% strength, about 880 px "
+                             "across, centred behind the glyph and fading to nothing well before the edges")
+        size = str(glyph.get("SIZE_CLASS") or "").upper()
+        if size in SIZE_CLASSES:
+            slots["SIZE_CLASS"] = f"{size}: {SIZE_CLASSES[size]}"
+        for k in ("GLYPH_NAME", "GLYPH_DESCRIPTION", "SPARK_PLACEMENT"):
+            if glyph.get(k):
+                slots[k] = glyph[k]
+        neg = f"Do not draw the {org['canonical']} org glyph ({org_mark})." if org_mark else ""
+        slots["EXTRA_NEGATIVES"] = " ".join(x for x in (glyph.get("EXTRA_NEGATIVES"), neg) if x)
+        prompt = re.sub(r"\(a\) Geometry:.*?(?= \(b\) Style:)",
+                        "(a) Geometry: none yet; this glyph is new, so section 7 is the geometry and the lock pass "
+                        "traces the chosen candidate into the compositor.", tpl, flags=re.S)
+        prompt = re.sub(r"output art/out/avatars/\S+", f"output art/out/icons/{org['current']}/{repo}-1024-c{{1..4}}.png",
+                        prompt)
+        prompt = re.sub(r"The pipeline downsamples your image[^.]*\.",
+                        "The lock pass traces your image into the compositor, which renders the flat 1024 × 1024 px "
+                        "assets/icon.png in the family light-surface inks.", prompt)
+        prompt = prompt.replace("NEON NIGHT AVATAR", "NEON NIGHT REPO ICON")
+        prompt = re.sub(r"\bavatars\b", "repo icons", prompt)
+        prompt = re.sub(r"\bavatar\b", "repo icon", prompt)
+        prompt = prompt.replace("It is one of 28 repo icons in a single matched family",
+                                "It joins the 28 Neon Night avatars and its sibling repo icons as one matched family")
+        prompt = prompt.replace("(identical in all 28 repo icons)", "(identical to the Neon Night avatars)")
+        prompt = prompt.replace("same model and version for all 28", "same model and version as the avatar set")
+        for k, v in slots.items():
+            if v is not None:
+                prompt = prompt.replace("{" + k + "}", str(v))
+    missing = sorted(set(re.findall(r"\{([A-Z_]+)\}", prompt)))
+    ink = colours.get("INK") or []
+    return {"prompt": prompt, "missing": missing, "facts": facts, "option": option.upper(),
+            "render": {"ink": ink[0] if ink else None, "spark": ink[1] if len(ink) > 1 else None,
+                       "size": [ICON_PX, ICON_PX], "live_area": [LIVE_MARGIN, LIVE_MARGIN, ICON_PX - LIVE_MARGIN,
+                                                                 ICON_PX - LIVE_MARGIN], "budget": ICON_BUDGET}}
+
+
+def prompt_markdown(res: dict) -> str:
+    f, r = res["facts"], res["render"]
+    rows = "\n".join(f"| {k.replace('_', ' ').capitalize()} | {', '.join(v) if isinstance(v, list) else (v or '-')} |"
+                     for k, v in f.items())
+    return (f"# Repo icon prompt: {f['repository']}\n\n"
+            f"- Standard {STANDARD}; github-showcase-skill {__version__}; option {res['option']} (q59); decision 12.\n"
+            f"- Output `assets/icon.png`: {ICON_PX} × {ICON_PX} PNG RGBA, transparent, at most {ICON_BUDGET // 1000} KB, "
+            "no text, one file for both GitHub themes (decision 21; no `-dark` or `-light` sibling).\n"
+            f"- Render (lock pass): flat body in the light-surface ink {r['ink'] or '(see ART_DIRECTION (b))'}, spark in "
+            f"{r['spark'] or '(see ART_DIRECTION (b))'}, no tile and no glow, centred in the live area "
+            f"{r['live_area']}.\n"
+            "- Then: `showcase.py content icon normalize --in <candidate.png>` and `showcase.py content icon check`.\n\n"
+            "## Repository facts\n\n| Fact | Value |\n|---|---|\n" + rows + "\n\n## Prompt\n\n```text\n" +
+            res["prompt"] + "\n```\n")
+
+
+def _lab_cache():
+    from .color import lab
+    cache: dict = {}
+
+    def get(rgb):
+        v = cache.get(rgb)
+        if v is None:
+            v = cache[rgb] = lab(rgb)
+        return v
+    return get
+
+
+def _px(im) -> list:
+    """Pixel values in raster order (Pillow 13 deprecates getdata for get_flattened_data)."""
+    get = getattr(im, "get_flattened_data", None)
+    return list(get() if get else im.getdata())
+
+
+def _de(a, b) -> float:
+    return ((a[0] - b[0]) ** 2 + (a[1] - b[1]) ** 2 + (a[2] - b[2]) ** 2) ** 0.5
+
+
+def normalize_icon(img, ground: str = "auto", card: str | None = None, pixel_art: bool = False):
+    """(1024 px RGBA or RGB image, info). Transparent icons are keyed (ΔE ≤ 6 from the ground, 2 px feather),
+    trimmed to their alpha box and fitted to the 688 px live area; an icon with its own opaque ground (an avatar-style
+    night tile) is kept full-bleed (`ground="keep"`)."""
+    from PIL import Image, ImageFilter
+    from .color import rgb as hexrgb
+    from .iconbox import corner_ground, native_pixels
+    im = img.convert("RGBA")
+    info: dict = {"source_px": list(im.size)}
+    corners = [im.getpixel(p) for p in ((0, 0), (im.width - 1, 0), (0, im.height - 1), (im.width - 1, im.height - 1))]
+    has_alpha = any(c[3] < 255 for c in corners)
+    gnd = None if has_alpha else corner_ground(im)
+    mode = ground
+    if mode == "auto":
+        if has_alpha:
+            mode = "transparent"
+        elif gnd is None:
+            raise ArtFail("icon-ground", "corners are neither transparent nor one opaque ground")
+        else:
+            lab = _lab_cache()
+            near_card = card is not None and _de(lab(hexrgb(gnd)), lab(hexrgb(card))) <= CONTENT_DE
+            mode = "transparent" if near_card else "keep"
+    info["mode"] = mode
+    if mode == "keep":
+        if gnd is None:
+            raise ArtFail("icon-ground", "--ground keep needs four opaque corners of one colour")
+        side = max(im.size)
+        sq = Image.new("RGBA", (side, side), hexrgb(gnd) + (255,))
+        sq.paste(im, ((side - im.width) // 2, (side - im.height) // 2))
+        out = sq.convert("RGB").resize((ICON_PX, ICON_PX), Image.LANCZOS)
+        info.update(ground=gnd)
+        return out, info
+    if not has_alpha:
+        if gnd is None:
+            raise ArtFail("icon-ground", "no transparent or uniform ground to key out")
+        lab = _lab_cache()
+        g = lab(hexrgb(gnd))
+        src = _px(im)
+        mask = Image.new("L", im.size)
+        mask.putdata([0 if _de(lab(p[:3]), g) <= KEY_DE else 255 for p in src])
+        alpha = _min(mask, mask.filter(ImageFilter.GaussianBlur(2)))  # 2 px feather inside the edge, no ground halo
+        gr, gg, gb = hexrgb(gnd)
+        rgba = []
+        for p, a in zip(src, _px(alpha)):
+            if a == 0:
+                rgba.append((0, 0, 0, 0))
+            elif a == 255:
+                rgba.append((p[0], p[1], p[2], 255))
+            else:  # decontaminate the ground out of the feathered edge
+                k = a / 255
+                rgba.append(tuple(max(0, min(255, round((c - gc * (1 - k)) / k))) for c, gc in
+                                  ((p[0], gr), (p[1], gg), (p[2], gb))) + (a,))
+        im = Image.new("RGBA", im.size)
+        im.putdata(rgba)
+        info.update(keyed_from=gnd)
+    box = im.getchannel("A").point(lambda v: 255 if v > 8 else 0).getbbox()
+    if not box:
+        raise ArtFail("icon-empty", "nothing left after keying the ground")
+    im = im.crop(box)
+    native = native_pixels(im) if pixel_art else None
+    canvas = Image.new("RGBA", (ICON_PX, ICON_PX), (0, 0, 0, 0))
+    if native is not None:
+        k = max(1, LIVE // max(native.size))
+        im = native.resize((native.width * k, native.height * k), Image.NEAREST)
+        info["resample"] = f"nearest x{k}"
+    else:
+        k = LIVE / max(im.size)
+        im = im.resize((max(1, round(im.width * k)), max(1, round(im.height * k))), Image.LANCZOS)
+        info["resample"] = "lanczos"
+    canvas.alpha_composite(im, ((ICON_PX - im.width) // 2, (ICON_PX - im.height) // 2))
+    info["trim_box"] = list(box)
+    return canvas, info
+
+
+def _min(a, b):
+    from PIL import ImageChops
+    return ImageChops.darker(a, b)
+
+
+def icon_bytes(img) -> tuple[bytes, list[str]]:
+    from .scene import png_bytes
+    data = png_bytes(img)
+    logs = []
+    if len(data) > ICON_BUDGET and img.mode == "RGBA":
+        q = img.quantize(256, method=2)  # fast octree keeps alpha
+        b = io.BytesIO()
+        q.save(b, "PNG", optimize=True)
+        data = b.getvalue()
+        logs.append("icon-quantized")
+    if len(data) > ICON_BUDGET:
+        raise ArtFail("icon-budget", f"{len(data)} bytes > {ICON_BUDGET}")
+    return data, logs
+
+
+def _dhash(img, size: int = 16) -> int:
+    from PIL import Image
+    g = img.convert("RGBA")
+    bg = Image.new("RGBA", g.size, (255, 255, 255, 255))
+    bg.alpha_composite(g)
+    s = bg.convert("L").resize((size + 1, size), Image.LANCZOS)
+    px = _px(s)
+    bits = 0
+    for y in range(size):
+        for x in range(size):
+            bits = (bits << 1) | (px[y * (size + 1) + x] > px[y * (size + 1) + x + 1])
+    return bits
+
+
+def icon_qa(data: bytes, *, card: str, ink: list[str] | None = None, org_mark: Path | None = None,
+            siblings: list[str] | None = None) -> dict:
+    """Automated icon checks (f.3, art QA): size, budget, alpha, live area, coverage, contrast on the card, family
+    inks, not the org glyph, one file. OCR and the 48 px set sheet stay manual."""
+    from PIL import Image
+    from .color import contrast, hexstr, rgb as hexrgb
+    from .pnglint import validate_png
+    checks: list[dict] = []
+
+    def add(name, ok, detail="", level="fail"):
+        checks.append({"check": name, "result": "pass" if ok else level, "detail": detail})
+    try:
+        w, h, colour = validate_png(data)
+    except ValueError as exc:
+        add("png", False, str(exc))
+        return {"result": "fail", "checks": checks}
+    add("png", True)
+    add("size", (w, h) == (ICON_PX, ICON_PX), f"{w}x{h}")
+    add("bytes", len(data) <= ICON_BUDGET, f"{len(data)} <= {ICON_BUDGET}")
+    im = Image.open(io.BytesIO(data))
+    im.load()
+    rgba = im.convert("RGBA")
+    alpha = rgba.getchannel("A")
+    transparent = colour in (4, 6) or (colour == 3 and "transparency" in im.info)
+    lab = _lab_cache()
+    if transparent:
+        corners = [alpha.crop((x, y, x + 16, y + 16)).getextrema()[1] for x, y in
+                   ((0, 0), (w - 16, 0), (0, h - 16), (w - 16, h - 16))]
+        add("transparent-corners", max(corners) == 0, f"max corner alpha {max(corners)}")
+        box = alpha.point(lambda v: 255 if v > 8 else 0).getbbox()
+        ink_px = [p for p in _px(rgba.resize((256, 256))) if p[3] >= 200]
+        coverage = sum(1 for v in _px(alpha.resize((256, 256))) if v > 128) / 65536
+    else:
+        from .iconbox import corner_ground
+        g = corner_ground(rgba)
+        add("opaque-ground", g is not None, g or "corners differ")
+        gl = lab(hexrgb(g)) if g else None
+        small = rgba.convert("RGB").resize((256, 256))
+        diff = Image.new("L", small.size)
+        diff.putdata([255 if gl and _de(lab(p), gl) > CONTENT_DE else 0 for p in _px(small)])
+        b = diff.getbbox()
+        box = tuple(round(v * w / 256) for v in b) if b else None
+        ink_px = [p + (255,) for p, d in zip(_px(small), _px(diff)) if d]
+        coverage = len(ink_px) / 65536
+        card = g or card
+    tol = 4
+    inside = bool(box) and box[0] >= LIVE_MARGIN - tol and box[1] >= LIVE_MARGIN - tol and \
+        box[2] <= ICON_PX - LIVE_MARGIN + tol and box[3] <= ICON_PX - LIVE_MARGIN + tol
+    add("live-area", inside, f"content box {list(box) if box else None}, live area {LIVE_MARGIN}..{ICON_PX - LIVE_MARGIN}")
+    span = max(box[2] - box[0], box[3] - box[1]) if box else 0
+    add("fills-live-area", span >= 0.75 * LIVE, f"longest side {span} px of {LIVE}", level="warn")
+    add("coverage", 0.03 <= coverage <= 0.45, f"{coverage:.1%} of the canvas", level="warn")
+    dom = None
+    if ink_px:
+        counts: dict = {}
+        for p in ink_px:
+            key = (p[0] // 16 * 16 + 8, p[1] // 16 * 16 + 8, p[2] // 16 * 16 + 8)
+            counts[key] = counts.get(key, 0) + 1
+        dom = hexstr(max(counts, key=counts.get))
+        cr = contrast(dom, card)
+        add("contrast-on-card", cr >= 3.0, f"dominant ink {dom} on {card}: {cr:.2f}:1 (>= 3:1)")
+        if ink:
+            near = min(_de(lab(hexrgb(dom)), lab(hexrgb(x))) for x in ink)
+            add("family-ink", near <= 12, f"dominant ink {dom}, nearest family ink ΔE {near:.1f}", level="warn")
+    else:
+        add("contrast-on-card", False, "no opaque ink")
+    if org_mark and Path(org_mark).is_file() and Path(org_mark).stat().st_size > 0:
+        try:
+            mk = Image.open(org_mark)
+            mk.load()
+            d = bin(_dhash(rgba) ^ _dhash(mk)).count("1")
+            add("not-org-glyph", d > 24, f"dHash distance {d} to {Path(org_mark).name}")
+        except Exception as exc:  # an unreadable org mark cannot be compared
+            add("not-org-glyph", True, f"org mark unreadable: {str(exc)[:60]}", level="warn")
+    bad = [s for s in siblings or [] if re.search(r"icon[-_.](dark|light)\.", s, re.I)]
+    add("one-file", not bad, ", ".join(bad) or "no -dark or -light sibling (decision 21)")
+    checks.append({"check": "no-text", "result": "manual", "detail": "OCR and the 48 px org sheet are reviewed (f.3, g)"})
+    res = "fail" if any(c["result"] == "fail" for c in checks) else (
+        "warn" if any(c["result"] == "warn" for c in checks) else "pass")
+    return {"result": res, "checks": checks, "dominant_ink": dom}
+
+
+# =====================================================================================================
+# CLI (`showcase.py content ...`): wired by showcase.py with `content.add_parser(sub, <showcase module>)`
+# =====================================================================================================
+ACTIONS = ("social", "icon", "links", "linguist", "actions", "images", "sidebar")
+
+
+def register(sub) -> None:
+    """showcase.py wires `content` with register(sub), like `org` and `project`."""
+    add_parser(sub)
+
+
+def add_parser(sub, cli=None):
+    """Register `content {social,icon,links,linguist,actions,images,sidebar}` on showcase.py's subparsers. `cli` is the
+    showcase module (its context, repo_dir and cmd_social helpers); by default the running showcase.py."""
+    import argparse
+    common = argparse.ArgumentParser(add_help=False)
+    common.add_argument("--report", help="also write the JSON result to this file")
+    common.add_argument("--registry", help="registry/estate.yaml (default: the bundle's, when present)")
+    common.add_argument("--approved", help="decisions/approved.tsv (approved org renames, CQ-03)")
+    common.add_argument("--approved-yaml", help="decisions/APPROVED_ACTIONS.yaml")
+    common.add_argument("--actions", help="decisions/estate-actions.json")
+    common.add_argument("--jobs", help="append the writer jobs (JSON lines) to FILE")
+    s = sub.add_parser("content", help="content checks and proposals: social, icon, links, linguist, actions, images, "
+                                       "sidebar (read-only; emits diffs, gh argv and writer jobs)")
+    cs = s.add_subparsers(dest="content_action", required=True, metavar="<action>")
+
+    a = cs.add_parser("social", parents=[common], help="1280x640 repo social preview (R10; same options and file as the deprecated "
+                                                    "social-preview), plus the browser upload job")
+    a.add_argument("--out")
+    a.add_argument("--title")
+    a.add_argument("--icon")
+    a.add_argument("--allow-unmeasured", action="store_true")
+    a.add_argument("--allow-hold", action="store_true")
+    a.add_argument("--job", action="store_true", help="also emit the writer browser job that uploads it")
+
+    a = cs.add_parser("icon", parents=[common], help="repo icon (RT-04): prompt file, normalize a candidate, QA check")
+    a.add_argument("icon_action", choices=("prompt", "normalize", "check"))
+    a.add_argument("--option", choices=("A", "B"), default="A", help="q59 option: A Neon Night glyph, B isometric")
+    a.add_argument("--glyph", help="YAML/JSON with the writer's glyph_name, glyph_description, spark_placement, "
+                                   "size_class (option B: subject, objects)")
+    a.add_argument("--art-direction", help="art direction file (default: the skill's references/art-direction.md)")
+    a.add_argument("--in", dest="src", help="normalize: the returned candidate PNG")
+    a.add_argument("--ground", choices=("auto", "transparent", "keep"), default="auto")
+    a.add_argument("--out", help="prompt: the prompt file (art/prompts/<org>/<repo>/icon.md); normalize: the icon "
+                                 "(default assets/icon.png in the checkout); check: the icon to check")
+    a.add_argument("--preview", help="normalize: also write a 48 px preview on the card colour")
+    a.add_argument("--allow-hold", action="store_true", help="work on a family that is on hold (as banner and card)")
+
+    a = cs.add_parser("links", parents=[common], help="CQ-04: relative links, anchors and remote targets")
+    a.add_argument("files", nargs="*", help="Markdown files (default: displayed README, docs/**, .github/*.md, profile)")
+    a.add_argument("--readme-path", help="the README GitHub displays (GET /repos/{o}/{r}/readme .path)")
+    a.add_argument("--base-ref", help="git ref of the base: only breakage this change introduces fails")
+    a.add_argument("--online", action="store_true", help="cached §10.2 GET of remote URLs and gh full_name checks")
+    a.add_argument("--cache", help="remote-check cache file (JSON)")
+    a.add_argument("--max-remote", type=int, default=300)
+    a.add_argument("--delay", type=float, default=1.0, help="seconds between requests to one host")
+    a.add_argument("--strict", action="store_true", help="fail on any broken link, even without --base-ref")
+    a.add_argument("--diff", action="store_true", help="print the proposals as a unified diff (never applied)")
+
+    a = cs.add_parser("linguist", parents=[common], help="RP-07: paths that distort the language bar")
+    a.add_argument("--min-share", type=float, default=0.02)
+    a.add_argument("--language", help="a registry `language:` override for the chip")
+
+    a = cs.add_parser("actions", parents=[common], help="RP-06/RP-01: Actions health and merge side effects")
+    a.add_argument("--runs", help="`gh run list --json ...` output or REST actions/runs JSON")
+    a.add_argument("--workflows", help="REST actions/workflows JSON or `gh workflow list --json id,name,path,state`")
+    a.add_argument("--pages", help="REST repos/{o}/{r}/pages JSON")
+    a.add_argument("--changed", nargs="*", help="paths the merge changes (default: the estate polish set)")
+    a.add_argument("--approval", action="append", default=[], metavar="WORKFLOW=ID",
+                   help="approved workflow-toggle id for a workflow file (q79)")
+
+    a = cs.add_parser("images", parents=[common], help="RP-03/RP-10: README image budget and dark-theme flags")
+    a.add_argument("files", nargs="*")
+    a.add_argument("--readme-path")
+    a.add_argument("--base-ref", help="images not in this ref are new (default HEAD)")
+    a.add_argument("--approval-id", help="per-repo lossy-image approval id (q69)")
+    a.add_argument("--out-dir", help="write pixel-identical optimized candidates here for review")
+    a.add_argument("--online", action="store_true")
+
+    a = cs.add_parser("sidebar", parents=[common], help="RP-05: About sidebar target and browser job")
+    a.add_argument("--facts", required=True, help="JSON: releases, deployments, environments, packages (per repo, or "
+                                                  "keyed by OWNER/REPO for many)")
+    a.add_argument("--packages", action="append", default=[], help="org packages JSON (repeatable)")
+    a.add_argument("--current", help="JSON of known current box states (skip no-ops)")
+    a.add_argument("--repo", dest="only", help="OWNER/REPO filter for an estate facts file")
+    s.set_defaults(func=lambda args: cmd_content(args, cli))
+    return s
+
+
+def _load_json(path, flag: str):
+    if not path:
+        return None
+    try:
+        return json.loads(Path(path).read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        raise ShowcaseError(f"cannot read {flag} {path}: {exc}", log="usage")
+
+
+def _cli():
+    import sys
+    main = sys.modules.get("__main__")
+    if main is not None and hasattr(main, "context") and hasattr(main, "cmd_social"):
+        return main
+    import showcase  # scripts/ is on sys.path when ctshowcase is imported from showcase.py or the tests
+    return showcase
+
+
+def _owner_repo(args, cli, rd: Path | None) -> tuple[str | None, str | None, dict]:
+    from .meta import from_repo_dir, load_file
+    if args.meta:
+        m = load_file(args.meta)
+        return m.get("owner"), m.get("repo"), m
+    if rd is not None:
+        m = from_repo_dir(rd)
+        return m.get("owner"), m.get("repo"), m
+    return None, None, {}
+
+
+def _resolver(args, cli):
+    if getattr(args, "_content_resolver", None) is None:
+        args._content_resolver = load_resolver(cli.brand(args), args.registry, args.approved, args.approved_yaml,
+                                               args.actions)
+    return args._content_resolver
+
+
+def _ctx(args, cli, resolver):
+    """RepoContext with the org row and style taken through the resolver (a renamed org keeps its row)."""
+    ctx = cli.context(args)
+    key = resolver.brand_key(ctx.owner)
+    if key and key != ctx.owner and not ctx.org.get("known"):
+        ctx.org = org_row(resolver, ctx.brand, ctx.owner)
+        ctx.style = org_style(resolver, ctx.brand, ctx.owner)
+        ctx.logs = [x for x in ctx.logs if x != "needs-input:org-row"]
+        ctx.log(f"org-alias:{key}")
+    return ctx
+
+
+def _finish(args, obj: dict, code: int):
+    jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
+    from .signoff import stamp
+    stamp(jobs)  # before any serialization (--jobs, --report): a no-op unless --require-t3-signoff
+    if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
+        from .records import append
+        append(args.jobs, jobs)
+        obj["jobs_file"] = str(args.jobs)
+    if getattr(args, "report", None):
+        p = Path(args.report)
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(json.dumps(obj, indent=1, ensure_ascii=False, default=str) + "\n", encoding="utf-8")
+    return obj, code
+
+
+def _code(result: str) -> int:
+    return CHECK_FAILED if result in ("fail", "needs-writer") else OK
+
+
+def cmd_content(args, cli=None):
+    cli = cli or _cli()
+    act = args.content_action
+    resolver = _resolver(args, cli)
+    head = {"command": "content", "action": act}
+    if act == "social":
+        owner, srepo, _ = _owner_repo(args, cli, None)
+        if owner:
+            resolver.check_owner(owner, allow_hold=args.allow_hold, repo=srepo)
+        obj, code = cli.cmd_social(args)
+        obj = dict(head, **{k: v for k, v in obj.items() if k != "command"}, alias_of="social-preview")
+        if args.job and obj.get("result") == "ok":
+            ctx = _ctx(args, cli, resolver)
+            job = social_job(ctx, resolver, obj["out"])
+            if job and obj.get("footer") != f"github.com/{job['repo']}":
+                # the image names another login than the repository it would be uploaded to (an approved rename the
+                # render did not see): never upload it; re-render once the image names the current login
+                obj["result"], code = "needs-input", CHECK_FAILED
+                obj["logs"] = list(obj.get("logs") or []) + ["needs-input:social-login"]
+                job = None
+            obj["job"] = job
+        return _finish(args, obj, code)
+    if act in ("links", "images"):
+        rd = cli.repo_dir(args)
+        if rd is None:
+            raise ShowcaseError(f"content {act} needs a checkout (--repo-dir)", log="usage")
+        owner, repo, _ = _owner_repo(args, cli, rd)
+        if owner:
+            resolver.check_owner(owner, repo=repo)
+        tree = Tree(rd)
+        readme = displayed_readme(tree, args.readme_path)
+        files = list(args.files) or markdown_files(tree, readme)
+        missing = [f for f in files if not tree.is_file(f)]
+        if missing:
+            raise ShowcaseError(f"not in the checkout: {', '.join(missing)}", log="usage")
+        if not files:  # the wrong directory (no README, no docs) must not read as a clean pass
+            raise NeedsInput("readme", f"content {act}: {rd} has no README or Markdown file to check (run it inside the "
+                                       "target checkout, or pass --repo-dir or FILE ...)")
+        head.update(owner=owner, repo=repo, readme=readme)
+        if act == "links":
+            fetcher = Fetcher(args.cache, delay=args.delay, max_requests=args.max_remote) if args.online else None
+            base = Tree(rd, args.base_ref) if args.base_ref else None
+            res = links_report(tree, files, resolver=resolver, fetcher=fetcher, online=args.online, base=base,
+                               strict=args.strict, self_slug=(owner, repo) if owner and repo else None)
+            if fetcher:
+                fetcher.save()
+                res["requests"] = fetcher.requests
+            if args.diff:
+                res["diff"] = proposal_diff(tree, res["proposals"])
+            obj = dict(head, **res)
+        else:
+            fetcher = Fetcher(None) if args.online else None
+            res = images_report(tree, files, new_paths=new_files(tree, args.base_ref), approval_id=args.approval_id,
+                                out_dir=args.out_dir, fetcher=fetcher)
+            obj = dict(head, **res)
+        return _finish(args, obj, _code(obj["result"]))
+    if act == "linguist":
+        ctx = _ctx(args, cli, resolver)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
+        tree = Tree(ctx.repo_dir) if ctx.repo_dir else None
+        override = dict(ctx.override)
+        if args.language:
+            override["language"] = args.language
+        res = linguist_report(ctx.meta, tree, override=override, min_share=args.min_share)
+        return _finish(args, {**head, "owner": ctx.owner, "repo": ctx.repo, **res, "logs": ctx.logs + res["logs"]}, OK)
+    if act == "actions":
+        ctx = _ctx(args, cli, resolver)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
+        wf_files, root_files, readme = {}, (), ""
+        if ctx.repo_dir:
+            tree = Tree(ctx.repo_dir)
+            wf_files = {f: tree.read(f) or "" for f in sorted(tree.files)
+                        if re.match(r"^\.github/workflows/[^/]+\.ya?ml$", f)}
+            root_files = [f for f in tree.files if "/" not in f]
+            rp = displayed_readme(tree)
+            readme = tree.read(rp) if rp else ""
+        else:
+            readme = ctx.meta.get("readme_head") or ""
+            root_files = [f for f in ctx.meta.get("files") or [] if "/" not in f]
+        approvals = dict(x.split("=", 1) for x in args.approval if "=" in x)
+        res = actions_report(ctx.meta, runs=_load_json(args.runs, "--runs"),
+                             workflows=_load_json(args.workflows, "--workflows"), workflow_files=wf_files,
+                             readme=readme, root_files=root_files, pages=_load_json(args.pages, "--pages"),
+                             resolver=resolver, changed=tuple(args.changed) if args.changed else POLISH_PATHS,
+                             approval_ids=approvals)
+        obj = dict(head, owner=ctx.owner, **{k: v for k, v in res.items() if k != "logs"}, logs=ctx.logs + res["logs"])
+        return _finish(args, obj, _code(res["result"]))
+    if act == "sidebar":
+        return _finish(args, *_cmd_sidebar(args, cli, resolver, head))
+    if act == "icon":
+        return _finish(args, *_cmd_icon(args, cli, resolver, head))
+    raise ShowcaseError(f"unknown content action {act}", log="usage")
+
+
+def social_job(ctx, resolver: Resolver, out: str) -> dict | None:
+    """Browser job for the repository social preview upload (STANDARD §12.4; public T1/T2 repos only)."""
+    if not ctx.social_applicable():
+        return None
+    full = f"{current_login(resolver, ctx.owner)}/{ctx.repo}"
+    steps = [f"Open https://github.com/{full}/settings (the General page).",
+             "Scroll to \"Social preview\" and click \"Edit\", then \"Upload an image…\".",
+             f"Choose the file {out} from the repository checkout and confirm the dialog.",
+             "Wait until the preview shows the new image; do not change any other setting on this page.",
+             f"Verify with the read-only query: gh api graphql -f query='{{repository(owner:\"{full.split('/')[0]}\","
+             f"name:\"{ctx.repo}\"){{usesCustomOpenGraphImage openGraphImageUrl}}}}' (usesCustomOpenGraphImage is true)."]
+    return browser_job(job_id("p5", "social-preview", full), "5", full, f"https://github.com/{full}/settings",
+                       "social-preview", steps, "Upload the repository social preview (R10; STANDARD §9.5, §12.4).")
+
+
+def _cmd_sidebar(args, cli, resolver, head):
+    facts = _load_json(args.facts, "--facts") or {}
+    pk = None
+    if args.packages:
+        pk = {}
+        for p in args.packages:
+            for k, v in packages_by_repo(_load_json(p, "--packages"), resolver).items():
+                pk[k] = pk.get(k, 0) + v
+    current = _load_json(args.current, "--current") or {}
+    keyed = isinstance(facts, dict) and facts and all(isinstance(k, str) and "/" in k for k in facts)
+    if not keyed:
+        ctx = _ctx(args, cli, resolver)
+        resolver.check_owner(ctx.owner, repo=ctx.repo)
+        res = sidebar_plan(ctx.meta, facts, resolver=resolver, packages=pk,
+                           current=current.get(f"{ctx.owner}/{ctx.repo}") or current or None)
+        obj = dict(head, owner=ctx.owner, repo=ctx.repo, **{k: v for k, v in res.items() if k != "logs"},
+                   jobs=[res["job"]] if res["job"] else [], tsv_header=SIDEBAR_TSV_HEADER, logs=ctx.logs + res["logs"])
+        return obj, OK
+    rows, jobs, logs, skipped, unknown = [], [], [], [], 0
+    for full, f in sorted(facts.items()):
+        o, r = full.split("/", 1)
+        if args.only and not (resolver.same(o, args.only.split("/")[0]) and r.lower() == args.only.split("/")[1].lower()):
+            continue
+        try:
+            resolver.check_owner(o, repo=r)
+        except Refused as exc:
+            if str(exc.log or "").startswith("t3-signoff:"):
+                raise  # a sign-off refusal must reach the exit-2 handler, never read as a pass with the repo skipped
+            skipped.append({"repo": full, "why": exc.log})
+            continue
+        meta = dict((f or {}).get("meta") or {}, owner=o, repo=r)
+        meta.setdefault("visibility", (f or {}).get("visibility", "public"))
+        res = sidebar_plan(meta, f or {}, resolver=resolver, packages=pk, current=current.get(full))
+        rows.append(res["tsv"])
+        if res["job"]:
+            jobs.append(res["job"])
+        unknown += res["result"] == "needs-input"
+        logs += [f"{full}:{x}" for x in res["logs"]]
+    # a repository whose facts are incomplete gets no job; the batch must say so instead of reading as a pass
+    result = "proposal" if jobs else ("needs-input" if unknown else "pass")
+    obj = dict(head, result=result, repos=len(rows), needs_input=unknown, tsv_header=SIDEBAR_TSV_HEADER, tsv=rows,
+               jobs=jobs, skipped=skipped, logs=logs)
+    return obj, OK
+
+
+def _cmd_icon(args, cli, resolver, head):
+    from PIL import Image
+    ctx = _ctx(args, cli, resolver)
+    resolver.check_owner(ctx.owner, repo=ctx.repo)
+    # decision 12: the same applicability as banner, card, lint all and doctor (RepoContext.art_status); only
+    # watching-org forks and a placeholder org's `.github` are exempt. Forks outside the watching org, backups and
+    # `.github` repositories need their own icon. The resolver also sees the renames and placeholders passed here.
+    why = ctx.art_status()["icon"]
+    if resolver.owner_status(ctx.owner) == "watching":  # only its forks are exempt; its `.github` needs an icon
+        why = "exempt:watching-fork" if ctx.is_fork else \
+            why if ctx.repo == ".github" else "hold:watching-non-fork"
+    elif ctx.repo == ".github" and resolver.is_placeholder(ctx.owner):
+        why = "exempt:placeholder-org"
+    if why and why.startswith("exempt"):
+        return dict(head, owner=ctx.owner, repo=ctx.repo, result="exempt", logs=[why]), OK
+    if why == "t3-signoff":
+        raise Refused(f"{ctx.owner} is T3; needs co-owner sign-off", log="t3-signoff")
+    if why and why.startswith("hold") and not getattr(args, "allow_hold", False):  # a family on hold (brand.yaml style
+        # `hold`) or a watching-org non-fork (`hold:watching-non-fork`), as banner and card refuse
+        raise ShowcaseError(f"{ctx.owner}/{ctx.repo} is held ({why}); pass --allow-hold", log=why)
+    head.update(owner=ctx.owner, repo=ctx.repo, icon_action=args.icon_action)
+    card = ctx.style["tokens"]["card_fill"]
+    org = org_row(resolver, ctx.brand, ctx.owner)
+    mark = ctx.brand.asset(org.get("mark"))
+    if args.icon_action == "prompt":
+        art = load_art_direction(args.art_direction)
+        glyph = None
+        if args.glyph:
+            try:
+                glyph = load_yaml_text(Path(args.glyph).read_text(encoding="utf-8")) or {}
+            except OSError as exc:
+                raise ShowcaseError(f"cannot read --glyph {args.glyph}: {exc}", log="usage")
+        lang = None
+        if ctx.repo_dir or ctx.meta.get("files"):
+            try:
+                lang = linguist_report(ctx.meta, Tree(ctx.repo_dir) if ctx.repo_dir else None,
+                                       override=ctx.override)["primary"]["language"]
+            except NeedsInput:
+                lang = None
+        skill_art = SKILL_ART_DIRECTION.read_text(encoding="utf-8") if args.option == "B" else None
+        res = icon_prompt(ctx, resolver, art, glyph, args.option, lang, skill_art)
+        md = prompt_markdown(res)
+        result = "needs-writer" if res["missing"] else "ok"
+        out = None
+        if args.out and not res["missing"]:
+            out = Path(args.out)
+            out.parent.mkdir(parents=True, exist_ok=True)
+            out.write_text(md, encoding="utf-8")
+        logs = ctx.logs + ([f"needs-writer:{s}" for s in res["missing"]])
+        obj = dict(head, result=result, out=str(out) if out else None, missing=res["missing"], facts=res["facts"],
+                   render=res["render"], prompt=res["prompt"], markdown=None if out else md, logs=logs,
+                   note="The glyph is the writer's: fill glyph_name, glyph_description, spark_placement and size_class "
+                        "(--glyph FILE) and re-run until the result is ok; nothing is written before then.")
+        return obj, _code(result)
+    ink = []
+    try:
+        art = load_art_direction(args.art_direction)
+        ink = icon_colours(ctx, art, org, resolver).get("INK") or []
+    except NeedsInput as exc:
+        ctx.log(exc.log)
+    rd = ctx.repo_dir
+    siblings = [p.name for p in (rd / "assets").glob("icon*")] if rd and (rd / "assets").is_dir() else []
+    if args.icon_action == "normalize":
+        if not args.src:
+            raise ShowcaseError("content icon normalize needs --in CANDIDATE.png", log="usage")
+        src = Image.open(args.src)
+        src.load()
+        img, info = normalize_icon(src, args.ground, card, pixel_art=bool(ctx.style.get("icon_pixel_art")))
+        data, qlogs = icon_bytes(img)
+        qa = icon_qa(data, card=card, ink=ink, org_mark=mark, siblings=siblings)
+        out = Path(args.out) if args.out else cli.default_out(args, "assets/icon.png")
+        if qa["result"] == "fail":
+            return dict(head, result="fail", out=None, info=info, qa=qa, logs=ctx.logs + qlogs + ["art-fail:icon-qa"],
+                        note="nothing written"), CHECK_FAILED
+        cli.write_bytes(out, data)
+        if args.preview:
+            prev = Image.new("RGBA", (48, 48), _hex_rgba(card))
+            prev.alpha_composite(img.convert("RGBA").resize((48, 48), Image.LANCZOS))
+            cli.write_bytes(Path(args.preview), _png(prev.convert("RGB")))
+        return dict(head, result=qa["result"], out=str(out), bytes=len(data),
+                    sha256=hashlib.sha256(data).hexdigest(), info=info, qa=qa, logs=ctx.logs + qlogs), OK
+    path = Path(args.out) if args.out else (rd / "assets" / "icon.png" if rd else None)
+    if path is None or not path.is_file():
+        return dict(head, result="fail", file=str(path) if path else None, logs=ctx.logs + ["needs-input:repo-icon"]), \
+            CHECK_FAILED
+    qa = icon_qa(path.read_bytes(), card=card, ink=ink, org_mark=mark, siblings=siblings)
+    return dict(head, result=qa["result"], file=str(path), qa=qa, logs=ctx.logs), _code(qa["result"])
+
+
+def _hex_rgba(value: str) -> tuple[int, int, int, int]:
+    from .color import rgba
+    return rgba(value)
+
+
+def _png(img) -> bytes:
+    from .scene import png_bytes
+    return png_bytes(img)
+
+
+def main(argv=None) -> int:
+    """Standalone entry (`python -m ctshowcase.content ...` from scripts/) until showcase.py registers `content`."""
+    import argparse
+    import sys
+    cli = _cli()
+    p = cli.parser()
+    sub = next(a for a in p._actions if isinstance(a, argparse._SubParsersAction))
+    if "content" not in sub.choices:
+        add_parser(sub, cli)
+    args = p.parse_args(argv)
+    if args.format is None:
+        args.format = "text" if args.command in cli.GENERATORS else "json"
+    try:
+        obj, code = args.func(args)
+    except ShowcaseError as exc:
+        obj = {"command": args.command, "result": "refused" if exc.code == 2 and exc.log in ("hold", "t3-signoff", "exempt")
+               else exc.log.split(":")[0], "error": str(exc), "logs": [exc.log]}
+        code = exc.code
+        if args.format == "text" and not args.quiet:
+            print(f"{args.command}: {exc}", file=sys.stderr)
+            return code
+    if obj is not None:
+        cli.emit(args, obj)
+    return code
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 76f1756..de5fe9a 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -1,184 +1,189 @@
-"""Opt-in T3 sign-off verification (`--require-t3-signoff`, env SHOWCASE_REQUIRE_T3_SIGNOFF=1; issue 23).
-
-Off by default: nothing here runs and `--allow-t3` keeps its original meaning (tests/test_allow_t3_global.py).
-When on, `--allow-t3` is honoured only while the estate bundle holds a valid, unexpired sign-off record for the
-owner (and the repository when the record is scoped). The bundle is read, never copied: `decisions/t3-signoffs.yaml`
-under `estate_root()` (env SHOWCASE_ESTATE_ROOT)::
-
-    signoffs:
-      - id: t3s-001            # carried onto writer jobs as `signoff_id` (and `approval_id` when none else is set)
-        owner: Example-Co-Owned   # any login of the org (renames resolve through the aliases the gate passes in)
-        repos: ["*"]           # "*" or repository names / OWNER/NAME; absent or empty matches nothing (fail closed)
-        approved: true
-        expires: 2099-12-31    # required: a record with no parsable date never validates
-
-Refusals are exit 2 with log `t3-signoff:missing` (no approved record for the owner), `t3-signoff:expired` (every
-matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none covers the repository; an
-owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are refused before this runs.
-"""
-from __future__ import annotations
-
-import datetime as _dt
-import os
-from pathlib import Path
-
-from .errors import Refused
-
-SIGNOFF_FILE = "t3-signoffs.yaml"
-_REQUIRE = False
-_GRANTED: dict[str, list[dict]] = {}  # lowercase login -> the records that granted it, for stamping this run's writer jobs
-_ALIASES: dict[str, set[str]] = {}  # lowercase login -> every login of its org, filled by Resolver.aliases under the flag
-
-
-def env_required() -> bool:
-    return os.environ.get("SHOWCASE_REQUIRE_T3_SIGNOFF", "").strip().lower() in ("1", "true", "yes", "on")
-
-
-def set_required(value: bool) -> None:
-    global _REQUIRE
-    _REQUIRE = bool(value)
-
-
-def required() -> bool:
-    return _REQUIRE
-
-
-def reset() -> None:
-    _GRANTED.clear()
-    _ALIASES.clear()
-
-
-def register_aliases(logins: list[str]) -> None:
-    """Remember that these logins name one org, so a record under a former login still matches wherever the owner is
-    re-checked (doctor rows, org and project helpers) without each caller passing the aliases again."""
-    group = {x.lower() for x in logins if x}
-    for x in list(group):
-        group |= _ALIASES.get(x, set())
-    for x in group:
-        _ALIASES[x] = group
-
-
-def _expand(owners: list[str]) -> list[str]:
-    out = {o.lower() for o in owners if o}
-    for o in list(out):
-        out |= _ALIASES.get(o, set())
-    return sorted(out)
-
-
-def load_records(root: Path | None = None) -> list[dict]:
-    from .config import load_yaml_text
-    from .resolver import estate_root
-    root = root or estate_root()
-    path = root / "decisions" / SIGNOFF_FILE if root else None
-    if not path or not path.is_file():
-        return []
-    data = load_yaml_text(path.read_text(encoding="utf-8"))
-    items = data.get("signoffs") if isinstance(data, dict) else data
-    return [r for r in items or [] if isinstance(r, dict)]
-
-
-def _expiry(rec: dict) -> _dt.date | None:
-    v = rec.get("expires")
-    if isinstance(v, _dt.datetime):
-        return v.date()
-    if isinstance(v, _dt.date):
-        return v
-    # the whole value must parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
-    try:
-        return _dt.date.fromisoformat(str(v).strip())
-    except ValueError:
-        pass
-    try:
-        return _dt.datetime.fromisoformat(str(v).strip()).date()
-    except ValueError:
-        return None
-
-
-def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
-    """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
-    (the requested owner and its org aliases) as well as the name. A malformed `repos` (not a string or a list of
-    strings) covers nothing, so it surfaces as t3-signoff:scope instead of an uncaught exception."""
-    repos = rec.get("repos")
-    if isinstance(repos, str):
-        repos = [repos]
-    if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
-        return False
-    if "*" in repos:
-        return True
-    name = (repo or "").split("/")[-1].lower()
-    if not name:
-        return False
-    mine = {x.lower() for x in logins or []}
-    for r in repos:
-        head, _, tail = r.rpartition("/")
-        if tail.lower() != name:
-            continue
-        if not head or head.lower() in mine or logins is None:
-            return True
-    return False
-
-
-def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
-             records: list[dict] | None = None) -> tuple[dict | None, str | None]:
-    """(record, None) when signed off, else (None, 'missing' | 'expired' | 'scope')."""
-    today = today or _dt.date.today()
-    logins = {o.lower() for o in owners if o}
-    recs = load_records() if records is None else records
-    logins = set(_expand(list(logins)))
-    # a record with no id cannot be carried onto writer jobs, so it never authorizes anything
-    mine = [r for r in recs if r.get("approved") is True and str(r.get("id") or "").strip()
-            and str(r.get("owner") or "").lower() in logins]
-    if not mine:
-        return None, "missing"
-    scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
-    if not scoped:
-        return None, "scope"
-    live = [r for r in scoped if (_expiry(r) or _dt.date.min) >= today]
-    if not live:
-        return None, "expired"
-    return live[0], None
-
-
-def granted(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> bool:
-    """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
-    if not _REQUIRE:
-        return True
-    rec, _ = evaluate([owner, *(aliases or [])], repo)  # evaluate also expands the aliases Resolver.aliases registered
-    return rec is not None
-
-
-def require(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
-    """Gate for a requested `--allow-t3`: the record, or Refused (exit 2) logged t3-signoff:<why>. No-op when off."""
-    if not _REQUIRE:
-        return None
-    logins = [owner, *(aliases or [])]
-    rec, why = evaluate(logins, repo)
-    if rec is None:
-        raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
-                      f"no valid sign-off record ({why})", log=f"t3-signoff:{why}")
-    for login in _expand(logins):
-        _GRANTED.setdefault(login, []).append(rec)
-    return rec
-
-
-def record_for(owner: str, repo: str | None = None) -> dict | None:
-    for rec in _GRANTED.get((owner or "").lower(), []):
-        if _covers(rec, repo, _expand([owner or ""])):
-            return rec
-    return None
-
-
-def stamp(jobs):
-    """Under the flag, writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set)."""
-    if not _REQUIRE or not _GRANTED:
-        return jobs
-    for j in jobs or []:
-        if not isinstance(j, dict) or "phase" not in j:
-            continue
-        full = str(j.get("repo") or "")
-        owner = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
-        rec = record_for(str(owner), full or None)
-        if rec is not None and rec.get("id"):
-            j["signoff_id"] = str(rec["id"])
-            j.setdefault("approval_id", str(rec["id"]))
-    return jobs
+"""Opt-in T3 sign-off verification (`--require-t3-signoff`, env SHOWCASE_REQUIRE_T3_SIGNOFF=1; issue 23).
+
+Off by default: nothing here runs and `--allow-t3` keeps its original meaning (tests/test_allow_t3_global.py).
+When on, `--allow-t3` is honoured only while the estate bundle holds a valid, unexpired sign-off record for the
+owner (and the repository when the record is scoped). The bundle is read, never copied: `decisions/t3-signoffs.yaml`
+under `estate_root()` (env SHOWCASE_ESTATE_ROOT)::
+
+    signoffs:
+      - id: t3s-001            # carried onto writer jobs as `signoff_id` (and `approval_id` when none else is set)
+        owner: Example-Co-Owned   # any login of the org (renames resolve through the aliases the gate passes in)
+        repos: ["*"]           # "*" or repository names / OWNER/NAME; absent or empty matches nothing (fail closed)
+        approved: true
+        expires: 2099-12-31    # required: a record with no parsable date never validates
+
+Refusals are exit 2 with log `t3-signoff:missing` (no approved record for the owner), `t3-signoff:expired` (every
+matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none covers the repository; an
+owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are refused before this runs.
+"""
+from __future__ import annotations
+
+import datetime as _dt
+import os
+from pathlib import Path
+
+from .errors import Refused
+
+SIGNOFF_FILE = "t3-signoffs.yaml"
+_REQUIRE = False
+_GRANTED: dict[str, list[dict]] = {}  # lowercase login -> the records that granted it, for stamping this run's writer jobs
+_ALIASES: dict[str, set[str]] = {}  # lowercase login -> every login of its org, filled by Resolver.aliases under the flag
+
+
+def env_required() -> bool:
+    return os.environ.get("SHOWCASE_REQUIRE_T3_SIGNOFF", "").strip().lower() in ("1", "true", "yes", "on")
+
+
+def set_required(value: bool) -> None:
+    global _REQUIRE
+    _REQUIRE = bool(value)
+
+
+def required() -> bool:
+    return _REQUIRE
+
+
+def reset() -> None:
+    _GRANTED.clear()
+    _ALIASES.clear()
+
+
+def register_aliases(logins: list[str]) -> None:
+    """Remember that these logins name one org, so a record under a former login still matches wherever the owner is
+    re-checked (doctor rows, org and project helpers) without each caller passing the aliases again."""
+    group = {x.lower() for x in logins if x}
+    for x in list(group):
+        group |= _ALIASES.get(x, set())
+    for x in group:
+        _ALIASES[x] = group
+
+
+def _expand(owners: list[str]) -> list[str]:
+    out = {o.lower() for o in owners if o}
+    for o in list(out):
+        out |= _ALIASES.get(o, set())
+    return sorted(out)
+
+
+def load_records(root: Path | None = None) -> list[dict]:
+    from .config import load_yaml_text
+    from .resolver import estate_root
+    root = root or estate_root()
+    path = root / "decisions" / SIGNOFF_FILE if root else None
+    if not path or not path.is_file():
+        return []
+    try:
+        data = load_yaml_text(path.read_text(encoding="utf-8"))
+    except Exception:  # invalid YAML or unreadable file: no usable records, so the gate refuses (t3-signoff:missing)
+        return []
+    items = data.get("signoffs") if isinstance(data, dict) else data
+    if not isinstance(items, list):  # `signoffs: 7` and similar: fail closed instead of raising TypeError
+        return []
+    return [r for r in items if isinstance(r, dict)]
+
+
+def _expiry(rec: dict) -> _dt.date | None:
+    v = rec.get("expires")
+    if isinstance(v, _dt.datetime):
+        return v.date()
+    if isinstance(v, _dt.date):
+        return v
+    # the whole value must parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
+    try:
+        return _dt.date.fromisoformat(str(v).strip())
+    except ValueError:
+        pass
+    try:
+        return _dt.datetime.fromisoformat(str(v).strip()).date()
+    except ValueError:
+        return None
+
+
+def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
+    """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
+    (the requested owner and its org aliases) as well as the name. A malformed `repos` (not a string or a list of
+    strings) covers nothing, so it surfaces as t3-signoff:scope instead of an uncaught exception."""
+    repos = rec.get("repos")
+    if isinstance(repos, str):
+        repos = [repos]
+    if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
+        return False
+    if "*" in repos:
+        return True
+    name = (repo or "").split("/")[-1].lower()
+    if not name:
+        return False
+    mine = {x.lower() for x in logins or []}
+    for r in repos:
+        head, _, tail = r.rpartition("/")
+        if tail.lower() != name:
+            continue
+        if not head or head.lower() in mine or logins is None:
+            return True
+    return False
+
+
+def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
+             records: list[dict] | None = None) -> tuple[dict | None, str | None]:
+    """(record, None) when signed off, else (None, 'missing' | 'expired' | 'scope')."""
+    today = today or _dt.date.today()
+    logins = {o.lower() for o in owners if o}
+    recs = load_records() if records is None else records
+    logins = set(_expand(list(logins)))
+    # a record with no id cannot be carried onto writer jobs, so it never authorizes anything
+    mine = [r for r in recs if r.get("approved") is True and str(r.get("id") or "").strip()
+            and str(r.get("owner") or "").lower() in logins]
+    if not mine:
+        return None, "missing"
+    scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
+    if not scoped:
+        return None, "scope"
+    live = [r for r in scoped if (_expiry(r) or _dt.date.min) >= today]
+    if not live:
+        return None, "expired"
+    return live[0], None
+
+
+def granted(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> bool:
+    """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
+    if not _REQUIRE:
+        return True
+    rec, _ = evaluate([owner, *(aliases or [])], repo)  # evaluate also expands the aliases Resolver.aliases registered
+    return rec is not None
+
+
+def require(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
+    """Gate for a requested `--allow-t3`: the record, or Refused (exit 2) logged t3-signoff:<why>. No-op when off."""
+    if not _REQUIRE:
+        return None
+    logins = [owner, *(aliases or [])]
+    rec, why = evaluate(logins, repo)
+    if rec is None:
+        raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
+                      f"no valid sign-off record ({why})", log=f"t3-signoff:{why}")
+    for login in _expand(logins):
+        _GRANTED.setdefault(login, []).append(rec)
+    return rec
+
+
+def record_for(owner: str, repo: str | None = None) -> dict | None:
+    for rec in _GRANTED.get((owner or "").lower(), []):
+        if _covers(rec, repo, _expand([owner or ""])):
+            return rec
+    return None
+
+
+def stamp(jobs):
+    """Under the flag, writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set)."""
+    if not _REQUIRE or not _GRANTED:
+        return jobs
+    for j in jobs or []:
+        if not isinstance(j, dict) or "phase" not in j:
+            continue
+        full = str(j.get("repo") or "")
+        owner = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
+        rec = record_for(str(owner), full or None)
+        if rec is not None and rec.get("id"):
+            j["signoff_id"] = str(rec["id"])
+            j.setdefault("approval_id", str(rec["id"]))
+    return jobs
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 10dd3be..487a9c2 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,293 +1,334 @@
-"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the estate bundle.
-
-Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
-tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
-"""
-from __future__ import annotations
-
-import json
-import os
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-ROOT = Path(__file__).resolve().parents[1]
-sys.path.insert(0, str(ROOT / "scripts"))
-SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
-META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
-OWNER = "Pick-Your-AI"
-
-
-def _bundle(tmp_path, records):
-    d = tmp_path / "bundle" / "decisions"
-    d.mkdir(parents=True)
-    lines = ["signoffs:"]
-    for r in records:
-        lines.append(f"  - id: {r['id']}")
-        lines.append(f"    owner: {r.get('owner', OWNER)}")
-        lines.append(f"    repos: {json.dumps(r.get('repos', ['*']))}")
-        lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
-        lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
-    (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
-    return tmp_path / "bundle"
-
-
-def _run(tmp_path, bundle, *argv, owner=OWNER, env=None):
-    meta = tmp_path / "meta.json"
-    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
-    e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
-    e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
-    e.update(env or {})
-    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=e,
-                          capture_output=True, text=True, encoding="utf-8")
-
-
-def _out(r):
-    return r.stdout + r.stderr
-
-
-def test_missing_record_refuses(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
-
-
-def test_unapproved_record_counts_as_missing(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-9", "approved": False}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
-
-
-def test_expired_record_refuses(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-1", "expires": "2020-01-01"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
-
-
-def test_record_scoped_to_other_repo_refuses(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-2", "repos": ["some-other-repo"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
-
-
-def test_valid_wildcard_and_repo_scoped_records_are_honoured(tmp_path):
-    for repos in (["*"], ["northwind-synthetic"], [f"{OWNER}/northwind-synthetic"]):
-        b = _bundle(tmp_path / "_".join(repos).replace("/", "_").replace("*", "star"), [{"id": "t3s-3", "repos": repos}])
-        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-        assert r.returncode != 2 and "t3-signoff" not in _out(r), (repos, _out(r))
-
-
-def test_env_var_is_equivalent_to_the_flag(tmp_path):
-    b = _bundle(tmp_path, [])
-    r = _run(tmp_path, b, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "1"})
-    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
-
-
-# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
-def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
-    assert r.returncode == 2 and "t3-signoff" in _out(r)
-
-
-# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
-def test_default_is_unchanged_without_the_new_flag(tmp_path):
-    """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
-    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
-
-
-def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-5", "owner": "BunsDev"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe", owner="BunsDev")
-    assert r.returncode == 2, _out(r)
-    assert "t3-signoff" not in _out(r) or "exempt" in _out(r)
-
-
-def test_doctor_shows_the_signoff_id(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-7", "expires": "2099-01-02"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
-    row = json.loads(r.stdout)
-    assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
-    plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", "json")
-    assert "signoff_id" not in json.loads(plain.stdout)  # off by default: the row is unchanged
-
-
-def test_writer_jobs_carry_the_signoff_id(tmp_path):
-    from ctshowcase import signoff
-    from ctshowcase.records import append
-    rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-    signoff.set_required(True)
-    try:
-        signoff._GRANTED[OWNER.lower()] = [rec]
-        out = tmp_path / "jobs.jsonl"
-        append(out, [{"id": "a", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/x", "argv": []},
-                     {"id": "b", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/y", "argv": [],
-                      "approval_id": "ent-009"},
-                     {"id": "c", "phase": "p", "kind": "repo-settings", "repo": "Other-Org/z", "argv": []}])
-        a, b, c = (json.loads(x) for x in out.read_text(encoding="utf-8").splitlines())
-        assert a["signoff_id"] == "t3s-8" and a["approval_id"] == "t3s-8"
-        assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # an existing approval is kept
-        assert "signoff_id" not in c
-    finally:
-        signoff.set_required(False)
-        signoff.reset()
-
-
-def test_jobs_are_untouched_without_the_flag(tmp_path):
-    from ctshowcase import signoff
-    from ctshowcase.records import append
-    signoff._GRANTED[OWNER.lower()] = {"id": "t3s-8", "repos": ["*"]}
-    try:
-        out = tmp_path / "jobs.jsonl"
-        append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
-        assert "signoff_id" not in json.loads(out.read_text(encoding="utf-8"))
-    finally:
-        signoff.reset()
-
-
-def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
-    from ctshowcase import signoff
-    import showcase
-    showcase.main(["--require-t3-signoff", "config"])
-    capsys.readouterr()
-    assert signoff.required() is False and not signoff._GRANTED
-
-
-@pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
-def test_evaluate_scope_rules(repo, expect):
-    from ctshowcase import signoff
-    recs = [{"id": "s", "owner": OWNER, "repos": ["a", f"{OWNER}/b"], "approved": True, "expires": "2099-01-01"}]
-    rec, why = signoff.evaluate([OWNER], repo, records=recs)
-    assert why == expect and (rec is None) == (expect is not None)
-
-
-# --- review round: repository scope threading, ids, aliases, project gate, doctor renderers ---------------------
-
-@pytest.mark.parametrize("argv", [("labels", "--plan"), ("content", "linguist"), ("content", "actions")])
-def test_repo_scoped_record_is_honoured_by_repository_commands(tmp_path, argv):
-    """Regression: only gate_owner/doctor passed the repo, so a repo-scoped record hit t3-signoff:scope elsewhere."""
-    b = _bundle(tmp_path, [{"id": "t3s-9", "repos": ["northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", *argv)
-    assert "t3-signoff" not in _out(r), _out(r)
-    other = _bundle(tmp_path / "o", [{"id": "t3s-9", "repos": ["some-other-repo"]}])
-    r = _run(tmp_path, other, "--require-t3-signoff", "--allow-t3", *argv)
-    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
-
-
-def test_record_without_an_id_never_authorizes(tmp_path):
-    from ctshowcase import signoff
-    rec = {"owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-    assert signoff.evaluate([OWNER], None, records=[rec]) == (None, "missing")
-    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="  ")]) == (None, "missing")
-    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="t3s-1")])[1] is None
-
-
-def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
-    """A record under a former login must satisfy the secondary helpers (config/org/project/doctor), not just the gate."""
-    from ctshowcase import signoff
-    from ctshowcase.config import set_t3_signed_off, t3_signed_off
-    from ctshowcase.org import _t3_granted as org_granted
-    from ctshowcase.project import _t3_granted as project_granted
-    b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
-    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
-    signoff.set_required(True)
-    set_t3_signed_off(True)
-    try:
-        assert not t3_signed_off("New-Login")  # nothing links the logins yet
-        signoff.register_aliases(["New-Login", "Old-Login"])  # what Resolver.aliases does under the flag
-        assert t3_signed_off("New-Login") and org_granted("New-Login") and project_granted("New-Login")
-    finally:
-        set_t3_signed_off(False)
-        signoff.set_required(False)
-        signoff.reset()
-
-
-def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monkeypatch):
-    from ctshowcase import signoff
-    from ctshowcase.errors import Refused
-    from ctshowcase.project import _gate_target
-    from ctshowcase.resolver import Resolver
-    from ctshowcase.config import Brand
-    brand = Brand({"owners": {"t3": [OWNER]}}, ROOT / "references" / "brand.yaml")
-    resolver = Resolver(brand, {}, None)
-    signoff.set_required(True)
-    try:
-        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "ok", [{"id": "t3s-11"}])))
-        assert _gate_target(resolver, OWNER, allow_t3=True) == OWNER
-        assert signoff.record_for(OWNER, None)["id"] == "t3s-11"  # so stamp() can put it on the writer job
-        signoff.reset()
-        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "old", [{"id": "t3s-12", "expires": "2000-01-01"}])))
-        with pytest.raises(Refused) as exc:
-            _gate_target(resolver, OWNER, allow_t3=True)
-        assert exc.value.log == "t3-signoff:expired"
-    finally:
-        signoff.set_required(False)
-        signoff.reset()
-
-
-def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-13"}])
-    for fmt in ("tsv", "md"):
-        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
-        assert "t3s-13" in r.stdout, _out(r)
-        plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
-        assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged
-
-
-# --- review round 2: evidence for each fixed finding (synthetic records only) ---
-
-def _raw_bundle(tmp_path, body):
-    d = tmp_path / "bundle" / "decisions"
-    d.mkdir(parents=True)
-    (d / "t3-signoffs.yaml").write_text("signoffs:\n" + body, encoding="utf-8")
-    return tmp_path / "bundle"
-
-
-def test_doctor_without_allow_t3_still_reports_hold_under_the_flag(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "doctor", "--format", "json")
-    assert r.returncode in (0, 1) and "t3-signoff:missing" not in _out(r), _out(r)
-    assert "hold" in _out(r)
-
-
-def test_qualified_scope_for_another_owner_refuses(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-4", "repos": ["Other-Org/northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
-
-
-def test_garbage_expiry_never_validates(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-5", "expires": "2099-12-31garbage"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
-
-
-def test_malformed_repos_refuses_instead_of_raising(tmp_path):
-    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n    expires: 2099-12-31\n")
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:scope" in _out(r) and "Traceback" not in _out(r), _out(r)
-
-
-def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
-    b = _bundle(tmp_path, [{"id": "t3s-7", "repos": ["northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
-    assert "t3-signoff" not in _out(r), _out(r)
-
-
-def test_report_jobs_carry_signoff_id(tmp_path):
-    from ctshowcase import signoff
-    signoff.reset()
-    signoff.set_required(True)
-    try:
-        rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-        signoff._GRANTED[OWNER.lower()] = [rec]
-        from ctshowcase.content import _finish
-        import argparse
-        rp = tmp_path / "report.json"
-        _finish(argparse.Namespace(jobs=None, report=str(rp)),
-                {"job": {"phase": 3, "org": OWNER, "repo": f"{OWNER}/northwind-synthetic"}}, 0)
-        saved = json.loads(rp.read_text(encoding="utf-8"))["job"]
-        assert saved["signoff_id"] == "t3s-8" and saved["approval_id"] == "t3s-8"
-    finally:
-        signoff.set_required(False)
-        signoff.reset()
+"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the estate bundle.
+
+Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
+tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+OWNER = "Pick-Your-AI"
+
+
+def _bundle(tmp_path, records):
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    lines = ["signoffs:"]
+    for r in records:
+        lines.append(f"  - id: {r['id']}")
+        lines.append(f"    owner: {r.get('owner', OWNER)}")
+        lines.append(f"    repos: {json.dumps(r.get('repos', ['*']))}")
+        lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
+        lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
+    (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
+    return tmp_path / "bundle"
+
+
+def _run(tmp_path, bundle, *argv, owner=OWNER, env=None):
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
+    e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
+    e.update(env or {})
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=e,
+                          capture_output=True, text=True, encoding="utf-8")
+
+
+def _out(r):
+    return r.stdout + r.stderr
+
+
+def test_missing_record_refuses(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_unapproved_record_counts_as_missing(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-9", "approved": False}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_expired_record_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-1", "expires": "2020-01-01"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
+
+
+def test_record_scoped_to_other_repo_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-2", "repos": ["some-other-repo"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_valid_wildcard_and_repo_scoped_records_are_honoured(tmp_path):
+    for repos in (["*"], ["northwind-synthetic"], [f"{OWNER}/northwind-synthetic"]):
+        b = _bundle(tmp_path / "_".join(repos).replace("/", "_").replace("*", "star"), [{"id": "t3s-3", "repos": repos}])
+        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+        assert r.returncode != 2 and "t3-signoff" not in _out(r), (repos, _out(r))
+
+
+def test_env_var_is_equivalent_to_the_flag(tmp_path):
+    b = _bundle(tmp_path, [])
+    r = _run(tmp_path, b, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "1"})
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
+def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
+    assert r.returncode == 2 and "t3-signoff" in _out(r)
+
+
+# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
+def test_default_is_unchanged_without_the_new_flag(tmp_path):
+    """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
+    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+
+
+def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-5", "owner": "BunsDev"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe", owner="BunsDev")
+    assert r.returncode == 2, _out(r)
+    assert "t3-signoff" not in _out(r) or "exempt" in _out(r)
+
+
+def test_doctor_shows_the_signoff_id(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-7", "expires": "2099-01-02"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
+    row = json.loads(r.stdout)
+    assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
+    plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", "json")
+    assert "signoff_id" not in json.loads(plain.stdout)  # off by default: the row is unchanged
+
+
+def test_writer_jobs_carry_the_signoff_id(tmp_path):
+    from ctshowcase import signoff
+    from ctshowcase.records import append
+    rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+    signoff.set_required(True)
+    try:
+        signoff._GRANTED[OWNER.lower()] = [rec]
+        out = tmp_path / "jobs.jsonl"
+        append(out, [{"id": "a", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/x", "argv": []},
+                     {"id": "b", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/y", "argv": [],
+                      "approval_id": "ent-009"},
+                     {"id": "c", "phase": "p", "kind": "repo-settings", "repo": "Other-Org/z", "argv": []}])
+        a, b, c = (json.loads(x) for x in out.read_text(encoding="utf-8").splitlines())
+        assert a["signoff_id"] == "t3s-8" and a["approval_id"] == "t3s-8"
+        assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # an existing approval is kept
+        assert "signoff_id" not in c
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_jobs_are_untouched_without_the_flag(tmp_path):
+    from ctshowcase import signoff
+    from ctshowcase.records import append
+    signoff._GRANTED[OWNER.lower()] = {"id": "t3s-8", "repos": ["*"]}
+    try:
+        out = tmp_path / "jobs.jsonl"
+        append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
+        assert "signoff_id" not in json.loads(out.read_text(encoding="utf-8"))
+    finally:
+        signoff.reset()
+
+
+def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
+    from ctshowcase import signoff
+    import showcase
+    showcase.main(["--require-t3-signoff", "config"])
+    capsys.readouterr()
+    assert signoff.required() is False and not signoff._GRANTED
+
+
+@pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
+def test_evaluate_scope_rules(repo, expect):
+    from ctshowcase import signoff
+    recs = [{"id": "s", "owner": OWNER, "repos": ["a", f"{OWNER}/b"], "approved": True, "expires": "2099-01-01"}]
+    rec, why = signoff.evaluate([OWNER], repo, records=recs)
+    assert why == expect and (rec is None) == (expect is not None)
+
+
+# --- review round: repository scope threading, ids, aliases, project gate, doctor renderers ---------------------
+
+@pytest.mark.parametrize("argv", [("labels", "--plan"), ("content", "linguist"), ("content", "actions")])
+def test_repo_scoped_record_is_honoured_by_repository_commands(tmp_path, argv):
+    """Regression: only gate_owner/doctor passed the repo, so a repo-scoped record hit t3-signoff:scope elsewhere."""
+    b = _bundle(tmp_path, [{"id": "t3s-9", "repos": ["northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", *argv)
+    assert "t3-signoff" not in _out(r), _out(r)
+    other = _bundle(tmp_path / "o", [{"id": "t3s-9", "repos": ["some-other-repo"]}])
+    r = _run(tmp_path, other, "--require-t3-signoff", "--allow-t3", *argv)
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_record_without_an_id_never_authorizes(tmp_path):
+    from ctshowcase import signoff
+    rec = {"owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+    assert signoff.evaluate([OWNER], None, records=[rec]) == (None, "missing")
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="  ")]) == (None, "missing")
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="t3s-1")])[1] is None
+
+
+def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
+    """A record under a former login must satisfy the secondary helpers (config/org/project/doctor), not just the gate."""
+    from ctshowcase import signoff
+    from ctshowcase.config import set_t3_signed_off, t3_signed_off
+    from ctshowcase.org import _t3_granted as org_granted
+    from ctshowcase.project import _t3_granted as project_granted
+    b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
+    signoff.set_required(True)
+    set_t3_signed_off(True)
+    try:
+        assert not t3_signed_off("New-Login")  # nothing links the logins yet
+        signoff.register_aliases(["New-Login", "Old-Login"])  # what Resolver.aliases does under the flag
+        assert t3_signed_off("New-Login") and org_granted("New-Login") and project_granted("New-Login")
+    finally:
+        set_t3_signed_off(False)
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    from ctshowcase.errors import Refused
+    from ctshowcase.project import _gate_target
+    from ctshowcase.resolver import Resolver
+    from ctshowcase.config import Brand
+    brand = Brand({"owners": {"t3": [OWNER]}}, ROOT / "references" / "brand.yaml")
+    resolver = Resolver(brand, {}, None)
+    signoff.set_required(True)
+    try:
+        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "ok", [{"id": "t3s-11"}])))
+        assert _gate_target(resolver, OWNER, allow_t3=True) == OWNER
+        assert signoff.record_for(OWNER, None)["id"] == "t3s-11"  # so stamp() can put it on the writer job
+        signoff.reset()
+        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "old", [{"id": "t3s-12", "expires": "2000-01-01"}])))
+        with pytest.raises(Refused) as exc:
+            _gate_target(resolver, OWNER, allow_t3=True)
+        assert exc.value.log == "t3-signoff:expired"
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-13"}])
+    for fmt in ("tsv", "md"):
+        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
+        assert "t3s-13" in r.stdout, _out(r)
+        plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
+        assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged
+
+
+# --- review round 2: evidence for each fixed finding (synthetic records only) ---
+
+def _raw_bundle(tmp_path, body):
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    (d / "t3-signoffs.yaml").write_text("signoffs:\n" + body, encoding="utf-8")
+    return tmp_path / "bundle"
+
+
+def test_doctor_without_allow_t3_still_reports_hold_under_the_flag(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "doctor", "--format", "json")
+    assert r.returncode in (0, 1) and "t3-signoff:missing" not in _out(r), _out(r)
+    assert "hold" in _out(r)
+
+
+def test_qualified_scope_for_another_owner_refuses(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-4", "repos": ["Other-Org/northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
+
+
+def test_garbage_expiry_never_validates(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-5", "expires": "2099-12-31garbage"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
+
+
+def test_malformed_repos_refuses_instead_of_raising(tmp_path):
+    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n    expires: 2099-12-31\n")
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:scope" in _out(r) and "Traceback" not in _out(r), _out(r)
+
+
+def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-7", "repos": ["northwind-synthetic"]}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    assert "t3-signoff" not in _out(r), _out(r)
+
+
+def test_report_jobs_carry_signoff_id(tmp_path):
+    from ctshowcase import signoff
+    signoff.reset()
+    signoff.set_required(True)
+    try:
+        rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
+        signoff._GRANTED[OWNER.lower()] = [rec]
+        from ctshowcase.content import _finish
+        import argparse
+        rp = tmp_path / "report.json"
+        _finish(argparse.Namespace(jobs=None, report=str(rp)),
+                {"job": {"phase": 3, "org": OWNER, "repo": f"{OWNER}/northwind-synthetic"}}, 0)
+        saved = json.loads(rp.read_text(encoding="utf-8"))["job"]
+        assert saved["signoff_id"] == "t3s-8" and saved["approval_id"] == "t3s-8"
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+# --- review round 3 ---
+
+def test_hold_owner_is_refused_even_with_a_record(tmp_path, monkeypatch):
+    """No shipped owner is on HOLD, so build one in-process: a valid `*` record must not lift hold (Brand and Resolver)."""
+    from ctshowcase import signoff
+    from ctshowcase.config import Brand
+    from ctshowcase.errors import Refused
+    from ctshowcase.resolver import Resolver
+    brand = Brand({"owners": {"hold": ["Held-Co"]}}, ROOT / "references" / "brand.yaml")
+    resolver = Resolver(brand, {}, None)
+    b = _bundle(tmp_path, [{"id": "t3s-h", "owner": "Held-Co", "repos": ["*"]}])
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
+    signoff.set_required(True)
+    try:
+        for check in (brand.check_owner, resolver.check_owner):
+            with pytest.raises(Refused) as exc:
+                check("Held-Co", allow_t3=True)
+            assert exc.value.log == "hold"
+    finally:
+        signoff.set_required(False)
+        signoff.reset()
+
+
+@pytest.mark.parametrize("body", ["signoffs: 7\n", "signoffs: [unclosed\n", "- not: [valid\n"])
+def test_malformed_signoff_file_refuses_instead_of_raising(tmp_path, body):
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    (d / "t3-signoffs.yaml").write_text(body, encoding="utf-8")
+    r = _run(tmp_path, tmp_path / "bundle", "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r) and "Traceback" not in _out(r), _out(r)
+
+
+@pytest.mark.parametrize("records,why", [([], "missing"), ([{"id": "t3s-x", "expires": "2000-01-01"}], "expired")])
+def test_keyed_sidebar_batch_does_not_swallow_signoff_refusals(tmp_path, records, why):
+    facts = tmp_path / "facts.json"
+    facts.write_text(json.dumps({f"{OWNER}/northwind-synthetic": {}}), encoding="utf-8")
+    r = _run(tmp_path, _bundle(tmp_path, records), "--require-t3-signoff", "--allow-t3",
+             "content", "sidebar", "--facts", str(facts))
+    assert r.returncode == 2 and f"t3-signoff:{why}" in _out(r), _out(r)

From 6d9e42aeff70649c37f9c054b58dfa2a93418ba1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 08:59:07 -0400
Subject: [PATCH 16/79] Explicit sign-off record file, record schema, instant
 expiry, copy-on-write grants, stamped change records (#23, #24, #26)

- --t3-signoff-file PATH / SHOWCASE_T3_SIGNOFF_FILE: no default location (the canonical
  bundle path is the maintainer's choice); strict mode without a file refuses t3-signoff:no-file.
- references/t3-signoff.schema.json + references/t3-signoff.md: id, owner, repos, approved,
  approver, approved_on, expires, note. Records breaking it refuse t3-signoff:invalid with the
  first problem instead of a silent t3-signoff:missing. Synthetic fixtures under tests/fixtures.
- Timestamp expiries compare as aware instants; naive timestamps are invalid; date expiries stay
  inclusive through that day.
- Grants and aliases are copy-on-write ContextVar values, so inherited asyncio contexts no longer
  leak a child's grant into the parent.
- Change records get signoff_id (no approval_id), in --records files and JSON output; star-List
  jobs that org pins plans on the personal account carry the T3 org's sign-off explicitly.
- Docs: SKILL.md, CHANGELOG, constraints.md, ONBOARDING.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |   2 +-
 ONBOARDING.md                          |   2 +-
 SKILL.md                               |   6 +-
 references/constraints.md              |   2 +-
 references/t3-signoff.md               |  50 ++++++
 references/t3-signoff.schema.json      |  47 +++++
 scripts/ctshowcase/org.py              |  11 ++
 scripts/ctshowcase/records.py          |   2 +-
 scripts/ctshowcase/signoff.py          | 240 +++++++++++++++++--------
 scripts/showcase.py                    |  16 +-
 tests/fixtures/t3-signoff/invalid.yaml |  43 +++++
 tests/fixtures/t3-signoff/valid.yaml   |  17 ++
 tests/test_allow_t3_docs.py            |   2 +-
 tests/test_t3_signoff_require.py       | 219 +++++++++++++++++++---
 14 files changed, 557 insertions(+), 102 deletions(-)
 create mode 100644 references/t3-signoff.md
 create mode 100644 references/t3-signoff.schema.json
 create mode 100644 tests/fixtures/t3-signoff/invalid.yaml
 create mode 100644 tests/fixtures/t3-signoff/valid.yaml

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 30f627a..eccd758 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the estate bundle's `decisions/t3-signoffs.yaml` holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). Otherwise the command exits 2 with `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set) and `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; change records carry `signoff_id`; `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/ONBOARDING.md b/ONBOARDING.md
index 2319c70..89465dd 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -68,7 +68,7 @@ For a multi-skill handoff, preserve the source facts, artifact paths, `logs[]` c
 
 ## Safety and permissions
 
-The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
+The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the opt-in `--require-t3-signoff --t3-signoff-file PATH` also checks that claim against a sign-off record file ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
 
 ## Troubleshooting and verification
 
diff --git a/SKILL.md b/SKILL.md
index f6d44da..e4c992a 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -73,7 +73,7 @@ Run every command **from inside the target repository's checkout**, with the ski
 
 | Step | Command | Gate |
 |---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. With the opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`), `--allow-t3` also needs a valid, unexpired record in the estate bundle's `decisions/t3-signoffs.yaml` (`id`, `owner`, `repos` as names or `*`, `approved`, `expires`), else exit 2 with `t3-signoff:missing|expired|scope`. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. With the opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`), `--allow-t3` also needs a valid, unexpired record in the file named by the global `--t3-signoff-file PATH` (or `SHOWCASE_T3_SIGNOFF_FILE`; no default location until the maintainer chooses one), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope`. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
 | 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
 | 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
 | 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) tightens it: `--allow-t3` is then honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope`; repository `doctor` stays read-only and shows the record as `signoff_id`.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) tightens it: `--allow-t3` is then honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when no `--t3-signoff-file` is given, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)); writer jobs then carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` stays read-only and shows the record as `signoff_id`. The record file is read, never copied; its canonical place in the estate bundle is still the maintainer's choice, so it is always named explicitly.
 
 ## Orgs, Projects, the Enterprise and Content
 
@@ -165,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/constraints.md b/references/constraints.md
index aeb2d6b..49d526a 100644
--- a/references/constraints.md
+++ b/references/constraints.md
@@ -26,7 +26,7 @@ Condensed from `ct-std-v1` §10 and §12. The skill proposes; a single serialize
 1. **One serialized writer queue** for every REST call, git push and UI write. Planners and this skill emit change records.
 2. **Change record:** `{std, owner, repo, kind: api|file|ui, target, before_sha256, after, rule}`. The writer rejects a record whose `before` no longer matches the live state. Commands that propose writes take `--records FILE`.
 3. **Diff first.** GET, compute the delta, write only the delta, GET again to verify. Never write a value that is already equal.
-4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff`, `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
+4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (with the opt-in `--require-t3-signoff`: `t3-signoff:no-file|missing|invalid|expired|scope`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
 5. **Never commit logs** or the moves list to a public repository: they name private repositories.
 
 ## Content commits
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
new file mode 100644
index 0000000..a516ccd
--- /dev/null
+++ b/references/t3-signoff.md
@@ -0,0 +1,50 @@
+# T3 sign-off records (`--require-t3-signoff`)
+
+`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
+
+## Where the file lives
+
+Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
+
+## Format
+
+The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`), and a test keeps the two in step.
+
+```yaml
+signoffs:
+  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
+    owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
+    repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
+    approved: true             # a boolean; only true grants
+    approver: example-co-owner # who signed off
+    approved_on: 2026-01-15    # the date they signed off
+    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
+    note: "optional free text"
+```
+
+| Field | Required | Rule |
+|---|---|---|
+| `id` | yes | non-empty string |
+| `owner` | yes | non-empty string |
+| `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
+| `approved` | yes | boolean (`"true"` as a string is invalid) |
+| `approver` | yes | non-empty string |
+| `approved_on` | yes | date `YYYY-MM-DD` |
+| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
+| `note` | no | string |
+
+No other fields are allowed.
+
+## Refusals
+
+Each refusal exits 2 with result `refused`.
+
+| Log | Meaning |
+|---|---|
+| `t3-signoff:no-file` | the flag is on but no record file was given |
+| `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file) |
+| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
+| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
+| `t3-signoff:expired` | every covering record is past `expires` |
+
+Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
diff --git a/references/t3-signoff.schema.json b/references/t3-signoff.schema.json
new file mode 100644
index 0000000..17ea440
--- /dev/null
+++ b/references/t3-signoff.schema.json
@@ -0,0 +1,47 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/CompleteTech-Skills/github-showcase-skill/references/t3-signoff.schema.json",
+  "title": "T3 co-owner sign-off records",
+  "description": "The file that --require-t3-signoff reads (passed with --t3-signoff-file or SHOWCASE_T3_SIGNOFF_FILE). Dates are written as YAML dates or ISO 8601 strings; validate after converting YAML dates to ISO strings. See references/t3-signoff.md.",
+  "type": "object",
+  "required": ["signoffs"],
+  "additionalProperties": false,
+  "properties": {
+    "signoffs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/record" }
+    }
+  },
+  "$defs": {
+    "nonEmpty": { "type": "string", "pattern": "\\S" },
+    "date": { "type": "string", "pattern": "^\\d{4}-\\d{2}-\\d{2}$" },
+    "awareTimestamp": {
+      "type": "string",
+      "pattern": "^\\d{4}-\\d{2}-\\d{2}[T ]\\d{2}:\\d{2}(:\\d{2}(\\.\\d+)?)?(Z|[+-]\\d{2}:?\\d{2})$"
+    },
+    "record": {
+      "type": "object",
+      "required": ["id", "owner", "repos", "approved", "approver", "approved_on", "expires"],
+      "additionalProperties": false,
+      "properties": {
+        "id": { "$ref": "#/$defs/nonEmpty", "description": "Carried onto writer jobs and change records as signoff_id." },
+        "owner": { "$ref": "#/$defs/nonEmpty", "description": "Any login of the T3 org; renamed logins resolve through its aliases." },
+        "repos": {
+          "description": "\"*\" for every repository and owner-wide actions, or repository names / OWNER/NAME.",
+          "oneOf": [
+            { "$ref": "#/$defs/nonEmpty" },
+            { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/nonEmpty" } }
+          ]
+        },
+        "approved": { "type": "boolean", "description": "Only true grants; false is kept for the audit trail." },
+        "approver": { "$ref": "#/$defs/nonEmpty", "description": "Who signed off." },
+        "approved_on": { "$ref": "#/$defs/date", "description": "The date of the sign-off." },
+        "expires": {
+          "description": "A date (valid through that day) or a timestamp with a UTC offset (valid before that instant).",
+          "oneOf": [ { "$ref": "#/$defs/date" }, { "$ref": "#/$defs/awareTimestamp" } ]
+        },
+        "note": { "type": ["string", "null"] }
+      }
+    }
+  }
+}
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 5f1396f..740a81f 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -1525,6 +1525,17 @@ def _estate_list_targets(estate: Estate, nodes: list[dict], *, allow_t3: bool =
 
 def star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = None, repo_ids: dict | None = None,
                    planned_new: int | None = None, allow_t3: bool = False) -> dict:
+    """See _star_list_plan. Its jobs target the personal account (USER_LOGIN), not the org, so under
+    --require-t3-signoff the org's grant is carried onto them explicitly (target-based stamping would miss it)."""
+    from . import signoff
+    out = _star_list_plan(estate, org, lists_capture=lists_capture, repo_ids=repo_ids, planned_new=planned_new,
+                          allow_t3=allow_t3)
+    signoff.stamp(out.get("jobs"), owner=estate.resolver.canonical(org))
+    return out
+
+
+def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = None, repo_ids: dict | None = None,
+                    planned_new: int | None = None, allow_t3: bool = False) -> dict:
     """Per-org star List (decision 14, SOC-01): read the existing lists first, reuse a same-named list, keep the 32-list
     cap, and add each favorite with the **union** of its current lists, this one and every other estate org's star List
     that also takes it (never only the new id). A capture whose lists or List items are cut short proves nothing about
diff --git a/scripts/ctshowcase/records.py b/scripts/ctshowcase/records.py
index c4e8f54..5540ea0 100644
--- a/scripts/ctshowcase/records.py
+++ b/scripts/ctshowcase/records.py
@@ -21,7 +21,7 @@ def append(path: str | Path | None, recs: list[dict]) -> None:
     if not path or not recs:
         return
     from .signoff import stamp
-    stamp(recs)  # only under --require-t3-signoff: writer jobs of a signed-off T3 owner carry signoff_id
+    stamp(recs)  # only under --require-t3-signoff: jobs and change records of a signed-off T3 owner carry signoff_id
     p = Path(path)
     p.parent.mkdir(parents=True, exist_ok=True)
     with p.open("a", encoding="utf-8") as fh:
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index cda6897..9da5650 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -1,20 +1,28 @@
 """Opt-in T3 sign-off verification (`--require-t3-signoff`, env SHOWCASE_REQUIRE_T3_SIGNOFF=1; issue 23).
 
 Off by default: nothing here runs and `--allow-t3` keeps its original meaning (tests/test_allow_t3_global.py).
-When on, `--allow-t3` is honoured only while the estate bundle holds a valid, unexpired sign-off record for the
-owner (and the repository when the record is scoped). The bundle is read, never copied: `decisions/t3-signoffs.yaml`
-under `estate_root()` (env SHOWCASE_ESTATE_ROOT)::
+When on, `--allow-t3` is honoured only while the sign-off record file holds a valid, unexpired record for the owner
+(and the repository when the record is scoped). The file is passed explicitly with the global `--t3-signoff-file PATH`
+(env SHOWCASE_T3_SIGNOFF_FILE). There is deliberately no default location: issue 24 leaves the canonical path inside
+the estate bundle to the maintainer, so the tool never picks one (tests/test_t3_signoff_require.py
+::test_no_record_file_refuses_without_a_default). The file is read, never copied. Format (the contract is
+references/t3-signoff.schema.json, described in references/t3-signoff.md)::
 
     signoffs:
-      - id: t3s-001            # carried onto writer jobs as `signoff_id` (and `approval_id` when none else is set)
-        owner: Example-Co-Owned   # any login of the org (renames resolve through the aliases the gate passes in)
-        repos: ["*"]           # "*" or repository names / OWNER/NAME; absent or empty matches nothing (fail closed)
+      - id: t3s-001                 # carried onto writer jobs and change records as `signoff_id`
+        owner: Example-Co-Owned     # any login of the org (renames resolve through the aliases the gate passes in)
+        repos: ["*"]                # "*" or repository names / OWNER/NAME; absent or empty matches nothing
         approved: true
-        expires: 2099-12-31    # required: a record with no parsable date never validates
-
-Refusals are exit 2 with log `t3-signoff:missing` (no approved record for the owner), `t3-signoff:expired` (every
-matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none covers the repository; an
-owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are refused before this runs.
+        approver: example-co-owner  # who signed off (audit)
+        approved_on: 2026-01-15     # when they signed off (audit)
+        expires: 2099-12-31         # a date (valid through that day) or a timestamp with a UTC offset
+        note: "optional free text"
+
+Refusals are exit 2 with log `t3-signoff:no-file` (no record file was given), `t3-signoff:missing` (no approved record
+for the owner), `t3-signoff:invalid` (the owner's records all break the schema; the error names the first problem),
+`t3-signoff:expired` (every matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none
+covers the repository; an owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are
+refused before this runs.
 """
 from __future__ import annotations
 
@@ -25,18 +33,20 @@
 
 from .errors import Refused
 
-# Default record location inside the estate bundle. Issue 23 leaves the canonical path to the maintainer; this name is
-# the working default. If they pick another, change it here and in SKILL.md, CHANGELOG.md and the --require-t3-signoff help.
-SIGNOFF_FILE = "t3-signoffs.yaml"
+FILE_ENV = "SHOWCASE_T3_SIGNOFF_FILE"
 
 # All sign-off state is context-local, like `--allow-t3` itself (config._T3_SIGNED_OFF, issue 28): one thread's or
-# asyncio task's --require-t3-signoff, grants and aliases never leak into another's owner gate
+# asyncio task's --require-t3-signoff, record file, grants and aliases never leak into another's owner gate
 # (tests/test_t3_signoff_require.py::test_signoff_state_is_context_local). showcase.main() opens a fresh run state
 # and restores the enclosing one on every exit.
 _REQUIRE: ContextVar[bool] = ContextVar("ctshowcase_t3_signoff_required", default=False)
+_FILE: ContextVar[str | None] = ContextVar("ctshowcase_t3_signoff_file", default=None)
 # (granted, aliases): lowercase login -> the records that granted it, for stamping this run's writer jobs; and
 # lowercase login -> every login of its org, filled by Resolver.aliases under the flag. None until first use.
-_RUN: ContextVar[tuple[dict[str, list[dict]], dict[str, set[str]]] | None] = ContextVar(
+# Copy-on-write: every update builds new dicts and sets them, so a context that inherited this value (an asyncio task,
+# contextvars.copy_context().run) never mutates its parent's grants
+# (tests/test_t3_signoff_require.py::test_child_context_grant_does_not_leak_into_parent).
+_RUN: ContextVar[tuple[dict[str, tuple[dict, ...]], dict[str, frozenset[str]]] | None] = ContextVar(
     "ctshowcase_t3_signoff_run", default=None)
 
 
@@ -57,22 +67,41 @@ def required() -> bool:
     return _REQUIRE.get()
 
 
-def _run_state() -> tuple[dict[str, list[dict]], dict[str, set[str]]]:
+def set_file(path: str | Path | None) -> Token:
+    """Set this context's `--t3-signoff-file` (None: fall back to env SHOWCASE_T3_SIGNOFF_FILE, else no file)."""
+    return _FILE.set(str(path) if path else None)
+
+
+def reset_file(token: Token) -> None:
+    _FILE.reset(token)
+
+
+def record_file() -> Path | None:
+    v = _FILE.get() or os.environ.get(FILE_ENV, "").strip()
+    return Path(v) if v else None
+
+
+def _run_state() -> tuple[dict[str, tuple[dict, ...]], dict[str, frozenset[str]]]:
     state = _RUN.get()
-    if state is None:  # no shared mutable default: each context gets its own dicts on first use
-        state = ({}, {})
-        _RUN.set(state)
-    return state
+    return state if state is not None else ({}, {})
 
 
-def _granted() -> dict[str, list[dict]]:
-    return _run_state()[0]
+def _granted() -> dict[str, tuple[dict, ...]]:
+    """Read-only view of this context's grants (a fresh dict; writes go through _grant)."""
+    return dict(_run_state()[0])
 
 
-def _aliases() -> dict[str, set[str]]:
+def _aliases() -> dict[str, frozenset[str]]:
     return _run_state()[1]
 
 
+def _grant(login: str, rec: dict) -> None:
+    granted, aliases = _run_state()
+    new = dict(granted)
+    new[login] = (*new.get(login, ()), rec)
+    _RUN.set((new, aliases))
+
+
 def reset() -> Token:
     """Start empty grants and aliases in this context. New dicts, so an enclosing run's state is untouched;
     the token restores it (restore)."""
@@ -86,27 +115,28 @@ def restore(token: Token) -> None:
 def register_aliases(logins: list[str]) -> None:
     """Remember that these logins name one org, so a record under a former login still matches wherever the owner is
     re-checked (doctor rows, org and project helpers) without each caller passing the aliases again."""
-    aliases = _aliases()
+    granted, aliases = _run_state()
     group = {x.lower() for x in logins if x}
     for x in list(group):
-        group |= aliases.get(x, set())
+        group |= aliases.get(x, frozenset())
+    new = dict(aliases)
     for x in group:
-        aliases[x] = group
+        new[x] = frozenset(group)
+    _RUN.set((granted, new))
 
 
 def _expand(owners: list[str]) -> list[str]:
     aliases = _aliases()
     out = {o.lower() for o in owners if o}
     for o in list(out):
-        out |= aliases.get(o, set())
+        out |= aliases.get(o, frozenset())
     return sorted(out)
 
 
-def load_records(root: Path | None = None) -> list[dict]:
+def load_records(path: str | Path | None = None) -> list[dict]:
+    """Records from PATH, else from this run's `--t3-signoff-file` / SHOWCASE_T3_SIGNOFF_FILE. No file: []."""
     from .config import load_yaml_text
-    from .resolver import estate_root
-    root = root or estate_root()
-    path = root / "decisions" / SIGNOFF_FILE if root else None
+    path = Path(path) if path else record_file()
     if not path or not path.is_file():
         return []
     try:
@@ -119,21 +149,97 @@ def load_records(root: Path | None = None) -> list[dict]:
     return [r for r in items if isinstance(r, dict)]
 
 
-def _expiry(rec: dict) -> _dt.date | None:
-    v = rec.get("expires")
+def _parse_when(v) -> _dt.date | _dt.datetime | None:
+    """A date, or a timezone-aware timestamp. A naive timestamp is ambiguous, so it never parses (fail closed)."""
     if isinstance(v, _dt.datetime):
-        return v.date()
+        return v if v.tzinfo is not None else None
     if isinstance(v, _dt.date):
         return v
+    if not isinstance(v, str):
+        return None
+    s = v.strip()
     # the whole value must parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
     try:
-        return _dt.date.fromisoformat(str(v).strip())
+        return _dt.date.fromisoformat(s)
     except ValueError:
         pass
     try:
-        return _dt.datetime.fromisoformat(str(v).strip()).date()
+        ts = _dt.datetime.fromisoformat(s)
     except ValueError:
         return None
+    return ts if ts.tzinfo is not None else None
+
+
+def _expiry(rec: dict) -> _dt.date | _dt.datetime | None:
+    return _parse_when(rec.get("expires"))
+
+
+def problems(rec: dict) -> list[str]:
+    """What breaks references/t3-signoff.schema.json in one record ([] when it conforms). Kept in step with the schema
+    by tests/test_t3_signoff_require.py::test_schema_and_problems_agree_on_the_fixtures."""
+    out = []
+    for key in ("id", "owner", "approver"):
+        if not isinstance(rec.get(key), str) or not rec[key].strip():
+            out.append(f"{key}: needs a non-empty string")
+    repos = rec.get("repos")
+    if not (isinstance(repos, str) and repos.strip()) and not (
+            isinstance(repos, list) and repos and all(isinstance(x, str) and x.strip() for x in repos)):
+        out.append("repos: needs '*', a repository name or a non-empty list of them")
+    if not isinstance(rec.get("approved"), bool):
+        out.append("approved: needs true or false (a boolean, not a string)")
+    approved_on = _parse_when(rec.get("approved_on"))
+    if approved_on is None or isinstance(approved_on, _dt.datetime):
+        out.append("approved_on: needs a date (YYYY-MM-DD)")
+    if _expiry(rec) is None:
+        out.append("expires: needs a date (YYYY-MM-DD) or a timestamp with a UTC offset")
+    if "note" in rec and rec["note"] is not None and not isinstance(rec["note"], str):
+        out.append("note: needs a string")
+    extra = sorted(set(rec) - {"id", "owner", "repos", "approved", "approver", "approved_on", "expires", "note"})
+    if extra:
+        out.append("unknown field(s): " + ", ".join(map(str, extra)))
+    return out
+
+
+def _live(rec: dict, now: _dt.datetime) -> bool:
+    """A date expiry is valid through the end of that day (inclusive, local calendar day, as before); a timestamp
+    expiry is valid only strictly before that instant, compared timezone-aware (a record expiring at
+    2026-10-30T00:00:00+00:00 is dead at 2026-10-30T12:44Z)."""
+    exp = _expiry(rec)
+    if isinstance(exp, _dt.datetime):
+        return exp > now
+    if isinstance(exp, _dt.date):
+        return exp >= now.astimezone().date()
+    return False
+
+
+def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
+             records: list[dict] | None = None, now: _dt.datetime | None = None) -> tuple[dict | None, str | None]:
+    """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<problem>' | 'expired' | 'scope').
+    `today` (a date) is kept for callers that only care about date expiries; `now` is an aware instant."""
+    if now is None:
+        now = _dt.datetime.now(_dt.timezone.utc)
+        if today is not None:  # start of that local day, so date expiries compare exactly as before
+            now = _dt.datetime.combine(today, _dt.time.min).astimezone()
+    if records is None:
+        if record_file() is None:
+            return None, "no-file"
+        records = load_records()
+    logins = set(_expand([o for o in owners if o]))
+    ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
+    valid = [r for r in ours if not problems(r)]
+    mine = [r for r in valid if r.get("approved") is True]
+    if not mine:
+        bad = [r for r in ours if problems(r)]
+        if bad:  # a malformed record never authorizes, and the refusal says why instead of a silent 'missing'
+            return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0])[0]}"
+        return None, "missing"
+    scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
+    if not scoped:
+        return None, "scope"
+    live = [r for r in scoped if _live(r, now)]
+    if not live:
+        return None, "expired"
+    return live[0], None
 
 
 def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
@@ -160,27 +266,6 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
     return False
 
 
-def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
-             records: list[dict] | None = None) -> tuple[dict | None, str | None]:
-    """(record, None) when signed off, else (None, 'missing' | 'expired' | 'scope')."""
-    today = today or _dt.date.today()
-    logins = {o.lower() for o in owners if o}
-    recs = load_records() if records is None else records
-    logins = set(_expand(list(logins)))
-    # a record with no id cannot be carried onto writer jobs, so it never authorizes anything
-    mine = [r for r in recs if r.get("approved") is True and str(r.get("id") or "").strip()
-            and str(r.get("owner") or "").lower() in logins]
-    if not mine:
-        return None, "missing"
-    scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
-    if not scoped:
-        return None, "scope"
-    live = [r for r in scoped if (_expiry(r) or _dt.date.min) >= today]
-    if not live:
-        return None, "expired"
-    return live[0], None
-
-
 def granted(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> bool:
     """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
     if not required():
@@ -196,31 +281,46 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
     logins = [owner, *(aliases or [])]
     rec, why = evaluate(logins, repo)
     if rec is None:
+        code, _, detail = (why or "missing").partition(":")
+        hint = " (pass --t3-signoff-file PATH or set SHOWCASE_T3_SIGNOFF_FILE)" if code == "no-file" else ""
         raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
-                      f"no valid sign-off record ({why})", log=f"t3-signoff:{why}")
+                      f"no valid sign-off record ({code}{': ' + detail.strip() if detail else ''}){hint}",
+                      log=f"t3-signoff:{code}")
     for login in _expand(logins):
-        _granted().setdefault(login, []).append(rec)
+        _grant(login, rec)
     return rec
 
 
 def record_for(owner: str, repo: str | None = None) -> dict | None:
-    for rec in _granted().get((owner or "").lower(), []):
+    for rec in _granted().get((owner or "").lower(), ()):
         if _covers(rec, repo, _expand([owner or ""])):
             return rec
     return None
 
 
-def stamp(jobs):
-    """Under the flag, writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set)."""
+def stamp(items, owner: str | None = None):
+    """Under the flag, carry the granting sign-off onto this run's output:
+
+    - writer jobs (dicts with `phase`) for a signed-off T3 owner get `signoff_id`, and `approval_id` when none is set;
+    - change records (records.record(): dicts with `std`, `owner` and `repo`, no `phase`) get `signoff_id` only, since
+      they are not writer jobs and carry no approval_id.
+
+    `owner` names the gated owner explicitly when a job's target is another account (the star-List jobs of a T3 org's
+    `org pins` run as the personal account, org.star_list_plan); without it the owner is read from the item. An item
+    that already carries a `signoff_id` is left as it is."""
     if not required() or not _granted():
-        return jobs
-    for j in jobs or []:
-        if not isinstance(j, dict) or "phase" not in j:
+        return items
+    for j in items or []:
+        if not isinstance(j, dict) or "signoff_id" in j:
+            continue
+        is_job = "phase" in j
+        if not is_job and not ("std" in j and "owner" in j and "repo" in j):
             continue
         full = str(j.get("repo") or "")
-        owner = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
-        rec = record_for(str(owner), full or None)
+        who = owner or j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
+        rec = record_for(str(who), full or None)
         if rec is not None and rec.get("id"):
             j["signoff_id"] = str(rec["id"])
-            j.setdefault("approval_id", str(rec["id"]))
-    return jobs
+            if is_job:
+                j.setdefault("approval_id", str(rec["id"]))
+    return items
diff --git a/scripts/showcase.py b/scripts/showcase.py
index f1c27d1..2ba15c1 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -952,8 +952,12 @@ def parser() -> argparse.ArgumentParser:
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2)")
     p.add_argument("--require-t3-signoff", action="store_true",
                    help="opt-in (env SHOWCASE_REQUIRE_T3_SIGNOFF=1): honour --allow-t3 only when a valid, unexpired sign-off record "
-                        "in the estate bundle (decisions/t3-signoffs.yaml) covers the owner and repository; otherwise exit 2 "
-                        "(t3-signoff:missing|expired|scope). Default off: --allow-t3 behaves as before")
+                        "in --t3-signoff-file covers the owner and repository; otherwise exit 2 "
+                        "(t3-signoff:no-file|missing|invalid|expired|scope). Default off: --allow-t3 behaves as before")
+    p.add_argument("--t3-signoff-file", metavar="PATH",
+                   help="the sign-off record file --require-t3-signoff reads (env SHOWCASE_T3_SIGNOFF_FILE; format: "
+                        "references/t3-signoff.md). There is no default location: the canonical path in the estate bundle "
+                        "is still the maintainer's choice, so the file must be named explicitly")
     p.add_argument("--version", action="version", version=f"%(prog)s {__version__} ({STANDARD})")
     sub = p.add_subparsers(dest="command", required=True, metavar="<command>")
 
@@ -1201,11 +1205,13 @@ def main(argv=None) -> int:
     from ctshowcase import signoff
     token = set_t3_signed_off(t3_signed_off())
     required_token = signoff.set_required(signoff.required())
+    file_token = signoff.set_file(signoff._FILE.get())
     run_token = signoff.reset()
     try:
         return _main(argv)
     finally:
         signoff.restore(run_token)
+        signoff.reset_file(file_token)
         signoff.reset_required(required_token)
         reset_t3_signed_off(token)
 
@@ -1234,6 +1240,7 @@ def _main(argv=None) -> int:
     set_t3_signed_off(getattr(args, "allow_t3", False))
     from ctshowcase import signoff
     signoff.set_required(getattr(args, "require_t3_signoff", False) or signoff.env_required())
+    signoff.set_file(getattr(args, "t3_signoff_file", None))
     if args.format is None:
         args.format = "text" if args.command in GENERATORS else "json"
     try:
@@ -1253,8 +1260,9 @@ def _main(argv=None) -> int:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
     if obj is not None:
-        if signoff.required() and isinstance(obj.get("jobs"), list):
-            signoff.stamp(obj["jobs"])
+        for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
+            if signoff.required() and isinstance(obj.get(key), list):
+                signoff.stamp(obj[key])
         emit(args, obj)
     return code
 
diff --git a/tests/fixtures/t3-signoff/invalid.yaml b/tests/fixtures/t3-signoff/invalid.yaml
new file mode 100644
index 0000000..dbbd7d9
--- /dev/null
+++ b/tests/fixtures/t3-signoff/invalid.yaml
@@ -0,0 +1,43 @@
+# Synthetic, deliberately malformed sign-off records (tests only). Each breaks exactly one schema rule.
+signoffs:
+  - id: t3s-bad-approved-string
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: "true"
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+  - owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+  - id: t3s-bad-no-approver
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+  - id: t3s-bad-naive-timestamp
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: "2099-12-31T00:00:00"
+  - id: t3s-bad-empty-repos
+    owner: Pick-Your-AI
+    repos: []
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+  - id: t3s-bad-extra-field
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+    approvd_by: typo
diff --git a/tests/fixtures/t3-signoff/valid.yaml b/tests/fixtures/t3-signoff/valid.yaml
new file mode 100644
index 0000000..5210caf
--- /dev/null
+++ b/tests/fixtures/t3-signoff/valid.yaml
@@ -0,0 +1,17 @@
+# Synthetic sign-off records (tests only; never real approvals). Owner Pick-Your-AI is the brand.yaml T3 owner.
+signoffs:
+  - id: t3s-fixture-all
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+    note: "synthetic fixture"
+  - id: t3s-fixture-one
+    owner: Pick-Your-AI
+    repos: northwind-synthetic
+    approved: false
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: "2099-12-31T23:59:59+00:00"
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index c1579cd..b66a8b2 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -66,7 +66,7 @@ def test_help_text_matches_docs():
     assert result.returncode == 0, result.stderr
     assert "--allow-t3" in result.stdout
     # issue 23 adds the opt-in --require-t3-signoff right after --allow-t3; the synopsis must keep up with --help
-    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff] [--version]"
+    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
     help_usage = " ".join(result.stdout.split())
     skill = _read("SKILL.md")
     ref = skill[skill.index("## Command Reference"):]
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 7159bd2..42d4df1 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,4 +1,5 @@
-"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the estate bundle.
+"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
+`--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE). There is no default location (the maintainer has not chosen one).
 
 Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
 tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
@@ -29,6 +30,8 @@ def _bundle(tmp_path, records):
         lines.append(f"    owner: {r.get('owner', OWNER)}")
         lines.append(f"    repos: {json.dumps(r.get('repos', ['*']))}")
         lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
+        lines.append(f"    approver: {r.get('approver', 'synthetic-co-owner')}")
+        lines.append(f"    approved_on: {r.get('approved_on', '2026-01-15')}")
         lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
     (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
     return tmp_path / "bundle"
@@ -39,11 +42,17 @@ def _run(tmp_path, bundle, *argv, owner=OWNER, env=None):
     meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
     e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
     e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
+    e.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
     e.update(env or {})
-    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=e,
+    rec = ["--t3-signoff-file", str(_file(bundle))] if bundle is not None else []
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *rec, *argv], cwd=ROOT, env=e,
                           capture_output=True, text=True, encoding="utf-8")
 
 
+def _file(bundle):
+    return Path(bundle) / "decisions" / "t3-signoffs.yaml"
+
+
 def _out(r):
     return r.stdout + r.stderr
 
@@ -119,7 +128,7 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
     rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
     signoff.set_required(True)
     try:
-        signoff._granted()[OWNER.lower()] = [rec]
+        signoff._grant(OWNER.lower(), rec)
         out = tmp_path / "jobs.jsonl"
         append(out, [{"id": "a", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/x", "argv": []},
                      {"id": "b", "phase": "p", "kind": "repo-settings", "repo": f"{OWNER}/y", "argv": [],
@@ -137,7 +146,7 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
 def test_jobs_are_untouched_without_the_flag(tmp_path):
     from ctshowcase import signoff
     from ctshowcase.records import append
-    signoff._granted()[OWNER.lower()] = {"id": "t3s-8", "repos": ["*"]}
+    signoff._grant(OWNER.lower(), {"id": "t3s-8", "repos": ["*"]})
     try:
         out = tmp_path / "jobs.jsonl"
         append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
@@ -157,7 +166,8 @@ def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
 @pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
 def test_evaluate_scope_rules(repo, expect):
     from ctshowcase import signoff
-    recs = [{"id": "s", "owner": OWNER, "repos": ["a", f"{OWNER}/b"], "approved": True, "expires": "2099-01-01"}]
+    recs = [{"id": "s", "owner": OWNER, "repos": ["a", f"{OWNER}/b"], "approved": True, "approver": "x",
+             "approved_on": "2026-01-01", "expires": "2099-01-01"}]
     rec, why = signoff.evaluate([OWNER], repo, records=recs)
     assert why == expect and (rec is None) == (expect is not None)
 
@@ -177,9 +187,12 @@ def test_repo_scoped_record_is_honoured_by_repository_commands(tmp_path, argv):
 
 def test_record_without_an_id_never_authorizes(tmp_path):
     from ctshowcase import signoff
-    rec = {"owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-    assert signoff.evaluate([OWNER], None, records=[rec]) == (None, "missing")
-    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="  ")]) == (None, "missing")
+    rec = {"owner": OWNER, "repos": ["*"], "approved": True, "approver": "x", "approved_on": "2026-01-01",
+           "expires": "2099-12-31"}
+    # a record with no usable id breaks the schema: refused as invalid (it never authorizes), not silently missing
+    assert signoff.evaluate([OWNER], None, records=[rec])[0] is None
+    assert signoff.evaluate([OWNER], None, records=[rec])[1].startswith("invalid:")
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, id="  ")])[1].startswith("invalid:")
     assert signoff.evaluate([OWNER], None, records=[dict(rec, id="t3s-1")])[1] is None
 
 
@@ -190,7 +203,7 @@ def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
     from ctshowcase.org import _t3_granted as org_granted
     from ctshowcase.project import _t3_granted as project_granted
     b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
-    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(b)))
     signoff.set_required(True)
     set_t3_signed_off(True)
     try:
@@ -213,11 +226,11 @@ def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monke
     resolver = Resolver(brand, {}, None)
     signoff.set_required(True)
     try:
-        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "ok", [{"id": "t3s-11"}])))
+        monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path / "ok", [{"id": "t3s-11"}]))))
         assert _gate_target(resolver, OWNER, allow_t3=True) == OWNER
         assert signoff.record_for(OWNER, None)["id"] == "t3s-11"  # so stamp() can put it on the writer job
         signoff.reset()
-        monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path / "old", [{"id": "t3s-12", "expires": "2000-01-01"}])))
+        monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path / "old", [{"id": "t3s-12", "expires": "2000-01-01"}]))))
         with pytest.raises(Refused) as exc:
             _gate_target(resolver, OWNER, allow_t3=True)
         assert exc.value.log == "t3-signoff:expired"
@@ -259,13 +272,15 @@ def test_qualified_scope_for_another_owner_refuses(tmp_path):
 def test_garbage_expiry_never_validates(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-5", "expires": "2099-12-31garbage"}])
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "expires" in _out(r), _out(r)
 
 
 def test_malformed_repos_refuses_instead_of_raising(tmp_path):
-    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n    expires: 2099-12-31\n")
+    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n"
+                              "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "t3-signoff:scope" in _out(r) and "Traceback" not in _out(r), _out(r)
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "repos" in _out(r), _out(r)
+    assert "Traceback" not in _out(r), _out(r)
 
 
 def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
@@ -280,7 +295,7 @@ def test_report_jobs_carry_signoff_id(tmp_path):
     signoff.set_required(True)
     try:
         rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-        signoff._granted()[OWNER.lower()] = [rec]
+        signoff._grant(OWNER.lower(), rec)
         from ctshowcase.content import _finish
         import argparse
         rp = tmp_path / "report.json"
@@ -304,7 +319,7 @@ def test_hold_owner_is_refused_even_with_a_record(tmp_path, monkeypatch):
     brand = Brand({"owners": {"hold": ["Held-Co"]}}, ROOT / "references" / "brand.yaml")
     resolver = Resolver(brand, {}, None)
     b = _bundle(tmp_path, [{"id": "t3s-h", "owner": "Held-Co", "repos": ["*"]}])
-    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(b))
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(b)))
     signoff.set_required(True)
     try:
         for check in (brand.check_owner, resolver.check_owner):
@@ -345,7 +360,7 @@ def test_signoff_state_is_context_local(tmp_path, monkeypatch):
     from ctshowcase import signoff
     from ctshowcase.config import Brand, reset_t3_signed_off, set_t3_signed_off
     from ctshowcase.errors import Refused
-    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path, [])))
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path, []))))
     brand = Brand({"owners": {"t3": [OWNER]}}, ROOT / "references" / "brand.yaml")
     barrier = threading.Barrier(2, timeout=10)
     out: dict[str, tuple] = {}
@@ -356,7 +371,7 @@ def worker(name, strict):
         run = signoff.reset()
         try:
             if not strict:
-                signoff._granted()["someone-else"] = [{"id": "t3s-lax"}]
+                signoff._grant("someone-else", {"id": "t3s-lax"})
             barrier.wait()  # both states are live at once
             try:
                 result = ("passed", brand.check_owner(OWNER, allow_t3=True))
@@ -386,10 +401,174 @@ def test_main_restores_an_enclosing_runs_signoff_state(tmp_path, capsys):
     req = signoff.set_required(True)
     run = signoff.reset()
     try:
-        signoff._granted()["outer"] = [{"id": "t3s-outer"}]
+        signoff._grant("outer", {"id": "t3s-outer"})
         showcase.main(["config"])
         capsys.readouterr()
-        assert signoff.required() is True and signoff._granted() == {"outer": [{"id": "t3s-outer"}]}
+        assert signoff.required() is True and signoff._granted() == {"outer": ({"id": "t3s-outer"},)}
+    finally:
+        signoff.restore(run)
+        signoff.reset_required(req)
+
+
+# --- review round 4: explicit record file, record schema, timestamp expiry, copy-on-write state, change records ---
+
+def test_no_record_file_refuses_without_a_default(tmp_path):
+    """The canonical path in the estate bundle is still the maintainer's choice (issue 24), so the tool must not pick
+    one: a valid record sitting at the formerly hard-coded bundle path is NOT read unless the file is named."""
+    b = _bundle(tmp_path, [{"id": "t3s-d"}])
+    r = _run(tmp_path, None, "--require-t3-signoff", "--allow-t3", "describe", env={"SHOWCASE_ESTATE_ROOT": str(b)})
+    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r) and "--t3-signoff-file" in _out(r), _out(r)
+
+
+def test_record_file_may_have_any_name_and_come_from_env(tmp_path):
+    src = _file(_bundle(tmp_path, [{"id": "t3s-env"}]))
+    chosen = tmp_path / "elsewhere" / "my-approved-actions.yaml"
+    chosen.parent.mkdir()
+    chosen.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
+    r = _run(tmp_path, None, "--require-t3-signoff", "--allow-t3", "describe",
+             env={"SHOWCASE_ESTATE_ROOT": str(tmp_path / "nowhere"), "SHOWCASE_T3_SIGNOFF_FILE": str(chosen)})
+    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+
+
+@pytest.mark.parametrize("expires,why", [
+    ("2026-10-30T00:00:00+00:00", "expired"),   # same calendar day, but the instant has passed
+    ("2026-10-30T12:43:59Z", "expired"),
+    ("2026-10-30T12:45:00+00:00", None),
+    ("2026-10-30T14:00:00+02:00", "expired"),   # 12:00Z
+    ("2026-10-30", None),                       # a date is valid through that whole day (inclusive)
+    ("2026-10-29", "expired"),
+])
+def test_timestamp_expiry_is_compared_as_an_instant(expires, why):
+    import datetime as dt
+    from ctshowcase import signoff
+    now = dt.datetime(2026, 10, 30, 12, 44, tzinfo=dt.timezone.utc)
+    rec = {"id": "t", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "x", "approved_on": "2026-01-01",
+           "expires": expires}
+    assert signoff.evaluate([OWNER], None, records=[rec], now=now)[1] == why
+    aware = dt.datetime(2026, 10, 30, 0, 0, tzinfo=dt.timezone.utc)  # what YAML yields for an unquoted timestamp
+    assert signoff.evaluate([OWNER], None, records=[dict(rec, expires=aware)], now=now)[1] == "expired"
+
+
+def test_naive_timestamp_expiry_is_invalid():
+    import datetime as dt
+    from ctshowcase import signoff
+    rec = {"id": "t", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "x", "approved_on": "2026-01-01"}
+    for naive in ("2099-12-31T00:00:00", dt.datetime(2099, 12, 31)):
+        assert signoff.evaluate([OWNER], None, records=[dict(rec, expires=naive)])[1].startswith("invalid:")
+
+
+@pytest.mark.parametrize("drop", ["approver", "approved_on"])
+def test_audit_fields_are_required(tmp_path, drop):
+    body = (f"  - id: t3s-a\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n"
+            "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
+    body = "\n".join(line for line in body.split("\n") if not line.strip().startswith(drop + ":"))
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and drop in _out(r), _out(r)
+
+
+def test_approved_as_a_string_is_reported_invalid_not_missing(tmp_path):
+    body = (f"  - id: t3s-s\n    owner: {OWNER}\n    repos: ['*']\n    approved: 'true'\n"
+            "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "t3s-s" in _out(r), _out(r)
+
+
+def _iso(v):
+    import datetime as dt
+    if isinstance(v, (dt.date, dt.datetime)):
+        return v.isoformat()
+    if isinstance(v, dict):
+        return {k: _iso(x) for k, x in v.items()}
+    if isinstance(v, list):
+        return [_iso(x) for x in v]
+    return v
+
+
+def test_schema_and_problems_agree_on_the_fixtures():
+    """references/t3-signoff.schema.json is the contract; signoff.problems() must accept and reject the same records.
+    jsonschema is not a runtime dependency, so the schema half runs only where it is installed."""
+    import yaml
+    from ctshowcase import signoff
+    fix = ROOT / "tests" / "fixtures" / "t3-signoff"
+    valid = yaml.safe_load((fix / "valid.yaml").read_text(encoding="utf-8"))
+    invalid = yaml.safe_load((fix / "invalid.yaml").read_text(encoding="utf-8"))
+    assert all(signoff.problems(r) == [] for r in valid["signoffs"]), [signoff.problems(r) for r in valid["signoffs"]]
+    assert all(len(signoff.problems(r)) == 1 for r in invalid["signoffs"]), [signoff.problems(r) for r in invalid["signoffs"]]
+    jsonschema = pytest.importorskip("jsonschema")
+    schema = json.loads((ROOT / "references" / "t3-signoff.schema.json").read_text(encoding="utf-8"))
+    jsonschema.Draft202012Validator.check_schema(schema)
+    jsonschema.validate(_iso(valid), schema)
+    for rec in invalid["signoffs"]:
+        with pytest.raises(jsonschema.ValidationError):
+            jsonschema.validate({"signoffs": [_iso(rec)]}, schema)
+
+
+def test_topics_change_records_carry_the_signoff_id(tmp_path):
+    """#26: change records (records.record(), no `phase`) carry signoff_id, and no approval_id (not a writer job)."""
+    b = _bundle(tmp_path, [{"id": "t3s-cr"}])
+    out = tmp_path / "rec.jsonl"
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "topics", "--records", str(out))
+    assert "t3-signoff" not in _out(r) and out.is_file(), _out(r)
+    recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
+    assert recs and all(x["signoff_id"] == "t3s-cr" and "approval_id" not in x for x in recs), recs
+    plain = tmp_path / "plain.jsonl"
+    _run(tmp_path, b, "--allow-t3", "topics", "--records", str(plain))
+    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
+
+
+def test_adopt_json_output_stamps_change_records_and_jobs(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-ad"}])
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    obj = json.loads(r.stdout)
+    assert obj.get("records") and all(x.get("signoff_id") == "t3s-ad" for x in obj["records"]), obj.get("records")
+    assert all(x.get("signoff_id") == "t3s-ad" for x in obj.get("jobs") or []), obj.get("jobs")
+
+
+def test_child_context_grant_does_not_leak_into_parent(tmp_path, monkeypatch):
+    """An asyncio task inherits the parent's context. Before copy-on-write the inherited (granted, aliases) dicts were
+    shared, so a signed child's grant stayed in the unsigned parent and stamp() put the child's id on its jobs."""
+    import asyncio
+    from ctshowcase import signoff
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path, [{"id": "t3s-child"}]))))
+
+    async def child():
+        signoff.require(OWNER)
+        signoff.register_aliases([OWNER, "Old-Login"])
+        return signoff.record_for(OWNER)["id"]
+
+    async def parent():
+        signoff.set_required(True)
+        signoff.reset()  # the parent's state exists before the child starts, so the child inherits it
+        got = await asyncio.create_task(child())
+        job = {"id": "j", "phase": "p", "kind": "k", "repo": f"{OWNER}/x", "argv": []}
+        signoff.stamp([job])
+        return got, signoff._granted(), signoff._aliases(), job
+
+    got, grants, aliases, job = asyncio.run(parent())
+    assert got == "t3s-child"
+    assert grants == {} and aliases == {} and "signoff_id" not in job and "approval_id" not in job
+
+
+def test_star_list_jobs_for_a_t3_org_carry_its_signoff(tmp_path, monkeypatch, brand):
+    """`org pins` for a T3 org plans its star-List jobs on the personal account (org=CompleteDotTech); the grant is the
+    org's, so target-based stamping missed them. star_list_plan now passes the gated owner explicitly."""
+    from ctshowcase import org as O, signoff
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
+    from ctshowcase.resolver import Resolver
+    fix = ROOT / "tests" / "fixtures" / "org"
+    reg = {"orgs": {OWNER: {"star_list": {"name": "Pick Your AI: built on", "description": "x"}, "favorites": []}}}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "actions": [], "extra": []}))
+    lists = json.loads((fix / "star-lists.json").read_text(encoding="utf-8"))
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path, [{"id": "t3s-sl"}]))))
+    t3 = set_t3_signed_off(True)
+    req = signoff.set_required(True)
+    run = signoff.reset()
+    try:
+        signoff.require(OWNER)
+        res = O.star_list_plan(est, OWNER, lists_capture=lists, allow_t3=True)
+        assert res["jobs"] and all(j["org"] == O.USER_LOGIN for j in res["jobs"]), res
+        assert all(j["signoff_id"] == "t3s-sl" and j["approval_id"] == "t3s-sl" for j in res["jobs"]), res["jobs"]
     finally:
         signoff.restore(run)
         signoff.reset_required(req)
+        reset_t3_signed_off(t3)

From 337bd48cd64649f701d4d5c769431840943ce5b9 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 09:16:53 -0400
Subject: [PATCH 17/79] Match sign-off dates to the schema, stamp T3 favorites'
 star-List item jobs, refuse mixed-type keys (#23, #26)

- signoff._parse_when: a string must match the schema's date or awareTimestamp
  pattern before parsing, so compact (20991231), week (2099-W52-1) and +00
  offset forms are invalid at runtime as they are in the schema. A test applies
  the schema's patterns with re, so it runs without jsonschema.
- signoff.problems: sort unknown keys with a type-aware key, so a record with
  `unexpected: true` and `7: unexpected` refuses t3-signoff:invalid instead of
  raising TypeError.
- org star-List item jobs that add another owner's T3 repository now carry
  that repository's record as signoff_id/approval_id (signoff.stamp_source),
  with a T1-list/T3-favorite regression test.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     | 182 +++++++++++++++----------------
 references/t3-signoff.md         | 100 ++++++++---------
 scripts/ctshowcase/org.py        |  12 +-
 scripts/ctshowcase/signoff.py    |  67 +++++++++---
 tests/test_t3_signoff_require.py |  92 ++++++++++++++++
 5 files changed, 294 insertions(+), 159 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index eccd758..0e08634 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,91 +1,91 @@
-# Changelog
-
-All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
-
-## Unreleased
-
-### Added
-
-- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; change records carry `signoff_id`; `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
-- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
-
-### Fixed
-
-- T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
-- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
-- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
-- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
-
-- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
-- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
-- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
-- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
-- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
-
-- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
-- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
-- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
-- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
-- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
-- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
-- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
-
-## 1.0.0 — 2026-10-26
-
-First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
-
-### Added
-
-- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
-- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
-- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
-- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
-- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
-
-### Security
-
-- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
-- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
-- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
-- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
-- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
-- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
-- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
-- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
-- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
-- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
-- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
-- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
-- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
-
-### Fixed
-
-- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
-- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
-- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
-- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
-- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
-- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
-- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
-- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
-- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
-- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
-- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
-- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
-- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
-- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
-- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
-- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
-- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
-- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
-- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
-- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
-- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
-- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
-- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
-- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
-- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
-- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
-- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
-- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
+# Changelog
+
+All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
+
+## Unreleased
+
+### Added
+
+- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+
+### Fixed
+
+- T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
+- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
+- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
+- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
+
+- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
+- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
+- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
+- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
+- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
+
+- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
+- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
+- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
+- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
+- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
+- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
+- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
+
+## 1.0.0 — 2026-10-26
+
+First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
+
+### Added
+
+- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
+- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
+- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
+- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
+- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
+
+### Security
+
+- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
+- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
+- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
+- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
+- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
+- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
+- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
+- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
+- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
+- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
+- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
+- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
+- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
+
+### Fixed
+
+- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
+- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
+- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
+- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
+- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
+- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
+- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
+- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
+- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
+- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
+- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
+- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
+- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
+- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
+- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
+- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
+- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
+- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
+- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
+- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
+- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
+- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
+- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
+- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
+- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
+- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
+- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
+- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index a516ccd..75f8551 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,50 +1,50 @@
-# T3 sign-off records (`--require-t3-signoff`)
-
-`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
-
-## Where the file lives
-
-Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
-
-## Format
-
-The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`), and a test keeps the two in step.
-
-```yaml
-signoffs:
-  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
-    owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
-    repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
-    approved: true             # a boolean; only true grants
-    approver: example-co-owner # who signed off
-    approved_on: 2026-01-15    # the date they signed off
-    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
-    note: "optional free text"
-```
-
-| Field | Required | Rule |
-|---|---|---|
-| `id` | yes | non-empty string |
-| `owner` | yes | non-empty string |
-| `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
-| `approved` | yes | boolean (`"true"` as a string is invalid) |
-| `approver` | yes | non-empty string |
-| `approved_on` | yes | date `YYYY-MM-DD` |
-| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
-| `note` | no | string |
-
-No other fields are allowed.
-
-## Refusals
-
-Each refusal exits 2 with result `refused`.
-
-| Log | Meaning |
-|---|---|
-| `t3-signoff:no-file` | the flag is on but no record file was given |
-| `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file) |
-| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
-| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
-| `t3-signoff:expired` | every covering record is past `expires` |
-
-Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
+# T3 sign-off records (`--require-t3-signoff`)
+
+`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
+
+## Where the file lives
+
+Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
+
+## Format
+
+The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`): a string date or timestamp must match the schema's `date` or `awareTimestamp` pattern before it is parsed, so compact (`20991231`) and week (`2099-W52-1`) forms are invalid in both. The one deliberate difference is that a pattern-shaped but impossible date (`2099-02-30`) is also invalid in the tool. Tests keep the two in step, including one that applies the schema's patterns without needing `jsonschema`.
+
+```yaml
+signoffs:
+  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
+    owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
+    repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
+    approved: true             # a boolean; only true grants
+    approver: example-co-owner # who signed off
+    approved_on: 2026-01-15    # the date they signed off
+    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
+    note: "optional free text"
+```
+
+| Field | Required | Rule |
+|---|---|---|
+| `id` | yes | non-empty string |
+| `owner` | yes | non-empty string |
+| `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
+| `approved` | yes | boolean (`"true"` as a string is invalid) |
+| `approver` | yes | non-empty string |
+| `approved_on` | yes | date `YYYY-MM-DD` |
+| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
+| `note` | no | string |
+
+No other fields are allowed.
+
+## Refusals
+
+Each refusal exits 2 with result `refused`.
+
+| Log | Meaning |
+|---|---|
+| `t3-signoff:no-file` | the flag is on but no record file was given |
+| `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file) |
+| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
+| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
+| `t3-signoff:expired` | every covering record is past `expires` |
+
+Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 740a81f..feed5c5 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -1618,10 +1618,14 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
         union = sorted(have | {list_id} | targets.get(f.lower(), set()))
         q = (f"mutation {{ updateUserListsForItem(input: {{itemId: {_gql(rid)}, listIds: [{', '.join(_gql(x) for x in union)}]}}) "
              "{ lists { id name } } }")
-        out["jobs"].append(job(f"p{phase}-{login}-list-item-{f.replace('/', '__')}", phase, "star-list",
-                               ["gh", "api", "graphql", "-f", f"query={q}"], org=USER_LOGIN,
-                               note=f"Add {f} to '{name}', keeping its {len(have)} other list(s) and every estate star "
-                                    "List that also takes it (union; never unstar)."))
+        item = job(f"p{phase}-{login}-list-item-{f.replace('/', '__')}", phase, "star-list",
+                   ["gh", "api", "graphql", "-f", f"query={q}"], org=USER_LOGIN,
+                   note=f"Add {f} to '{name}', keeping its {len(have)} other list(s) and every estate star "
+                        "List that also takes it (union; never unstar).")
+        if r.owner_status(f.split("/")[0]) == "t3":  # a T3 favorite carries its own record (signoff.stamp_source)
+            from . import signoff
+            signoff.stamp_source(item, f, r.aliases(f.split("/")[0]))
+        out["jobs"].append(item)
     return dict(out, result="incomplete" if incomplete else "ok", list_id=list_id)
 
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 9da5650..8097d8b 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -28,6 +28,7 @@
 
 import datetime as _dt
 import os
+import re
 from contextvars import ContextVar, Token
 from pathlib import Path
 
@@ -149,22 +150,37 @@ def load_records(path: str | Path | None = None) -> list[dict]:
     return [r for r in items if isinstance(r, dict)]
 
 
+# The string forms references/t3-signoff.schema.json permits ($defs.date and $defs.awareTimestamp), checked before
+# parsing. Python 3.11+ fromisoformat also accepts compact (`20991231`), week (`2099-W52-1`) and hour-only offset
+# (`+00`) forms that the schema rejects, so without these the tool would grant a record an external validator of the
+# estate bundle refuses (tests/test_t3_signoff_require.py::test_problems_follow_the_schema_string_patterns, which runs
+# without jsonschema). ASCII digits only, like the schema's ECMA-262 `\d`. The one deliberate difference: a
+# calendar-impossible date that matches the pattern (`2099-02-30`) still fails to parse here, so the tool is stricter
+# than the schema there and fails closed.
+_DATE_RE = re.compile(r"[0-9]{4}-[0-9]{2}-[0-9]{2}", re.ASCII)
+_AWARE_TS_RE = re.compile(r"[0-9]{4}-[0-9]{2}-[0-9]{2}[T ][0-9]{2}:[0-9]{2}(:[0-9]{2}(\.[0-9]+)?)?(Z|[+-][0-9]{2}:?[0-9]{2})",
+                          re.ASCII)
+
+
 def _parse_when(v) -> _dt.date | _dt.datetime | None:
-    """A date, or a timezone-aware timestamp. A naive timestamp is ambiguous, so it never parses (fail closed)."""
+    """A date, or a timezone-aware timestamp. A naive timestamp is ambiguous, so it never parses (fail closed).
+    A string must match the schema's date or awareTimestamp pattern in full (no surrounding whitespace) first."""
     if isinstance(v, _dt.datetime):
         return v if v.tzinfo is not None else None
     if isinstance(v, _dt.date):
         return v
     if not isinstance(v, str):
         return None
-    s = v.strip()
-    # the whole value must parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
-    try:
-        return _dt.date.fromisoformat(s)
-    except ValueError:
-        pass
+    # the whole value must match and parse: `2099-12-31garbage` is not a date, so it never validates (fail closed)
+    if _DATE_RE.fullmatch(v):
+        try:
+            return _dt.date.fromisoformat(v)
+        except ValueError:
+            return None
+    if not _AWARE_TS_RE.fullmatch(v):
+        return None
     try:
-        ts = _dt.datetime.fromisoformat(s)
+        ts = _dt.datetime.fromisoformat(v.replace("Z", "+00:00"))  # `Z` for Python < 3.11
     except ValueError:
         return None
     return ts if ts.tzinfo is not None else None
@@ -194,7 +210,11 @@ def problems(rec: dict) -> list[str]:
         out.append("expires: needs a date (YYYY-MM-DD) or a timestamp with a UTC offset")
     if "note" in rec and rec["note"] is not None and not isinstance(rec["note"], str):
         out.append("note: needs a string")
-    extra = sorted(set(rec) - {"id", "owner", "repos", "approved", "approver", "approved_on", "expires", "note"})
+    # key=str: YAML keys need not be strings (`7: x` beside `unexpected: true`), and sorting mixed types raised
+    # TypeError out of showcase.main() instead of refusing t3-signoff:invalid
+    # (tests/test_t3_signoff_require.py::test_mixed_type_unknown_keys_refuse_invalid)
+    extra = sorted(set(rec) - {"id", "owner", "repos", "approved", "approver", "approved_on", "expires", "note"},
+                   key=lambda k: (type(k).__name__, str(k)))
     if extra:
         out.append("unknown field(s): " + ", ".join(map(str, extra)))
     return out
@@ -318,9 +338,28 @@ def stamp(items, owner: str | None = None):
             continue
         full = str(j.get("repo") or "")
         who = owner or j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
-        rec = record_for(str(who), full or None)
-        if rec is not None and rec.get("id"):
-            j["signoff_id"] = str(rec["id"])
-            if is_job:
-                j.setdefault("approval_id", str(rec["id"]))
+        _put(j, record_for(str(who), full or None))
     return items
+
+
+def _put(j: dict, rec: dict | None) -> None:
+    if rec is not None and rec.get("id"):
+        j["signoff_id"] = str(rec["id"])
+        if "phase" in j:
+            j.setdefault("approval_id", str(rec["id"]))
+
+
+def stamp_source(job: dict, full: str, aliases: list[str] | None = None) -> dict:
+    """Under the flag, stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
+    covering that repository. A star-List item job (org.star_list_plan) targets the personal account for some org's
+    List, so neither the target nor the org's grant names the record that let the favorite through
+    (org._t3_held checks it with granted(), which does not register a grant). It is evaluated here instead. The
+    repository's record wins over the List org's: the item job is what puts the T3 repository in public; the org's own
+    grant was enforced at the command gate and stays on its List create/describe jobs. No-op when off, when the job
+    already carries a signoff_id or when no valid record covers FULL (the favorite is then held and has no job)."""
+    if not required() or not isinstance(job, dict) or "signoff_id" in job or "/" not in (full or ""):
+        return job
+    owner, name = full.split("/", 1)
+    rec, _ = evaluate([owner, *(aliases or [])], name)
+    _put(job, rec)
+    return job
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 42d4df1..5a0884a 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -572,3 +572,95 @@ def test_star_list_jobs_for_a_t3_org_carry_its_signoff(tmp_path, monkeypatch, br
         signoff.restore(run)
         signoff.reset_required(req)
         reset_t3_signed_off(t3)
+
+
+# --- review round 3: evidence for each fixed finding (synthetic records only) ---
+
+def _schema_def(name):
+    return json.loads((ROOT / "references" / "t3-signoff.schema.json").read_text(encoding="utf-8"))["$defs"][name]
+
+
+def _schema_accepts(value, *defs):
+    """The schema's own string patterns (ECMA-262: `^...$` anchored, ASCII digits), applied with `re` so this runs
+    where jsonschema is not installed (test_schema_and_problems_agree_on_the_fixtures skips there)."""
+    import re
+    return any(re.search(_schema_def(d)["pattern"], value, re.ASCII) and not value.endswith("\n") for d in defs)
+
+
+_WHEN = ["2099-12-31", "20991231", "2099-W52-1", "2099-W52", "2099-365", " 2099-12-31", "2099-12-31 ",
+         "2099-12-31T00:00:00Z", "2099-12-31T00:00:00+00:00", "2099-12-31T00:00:00+0000", "2099-12-31 00:00Z",
+         "2099-12-31T00:00:00.5-05:00", "2099-12-31T00:00+00", "2099-12-31T00Z", "20991231T000000Z",
+         "2099-12-31T00:00:00", "2099-12-31garbage", "\u0662\u0660\u0669\u0669-12-31"]
+
+
+@pytest.mark.parametrize("value", _WHEN)
+def test_problems_follow_the_schema_string_patterns(value):
+    """Python 3.11+ fromisoformat accepts compact, week-date and `+00` forms the schema rejects; problems() used to
+    accept them, so --require-t3-signoff granted a record the published schema refuses. Both now agree."""
+    from ctshowcase import signoff
+    base = {"id": "t3s-p", "owner": OWNER, "repos": "*", "approved": True, "approver": "x",
+            "approved_on": "2026-01-15", "expires": "2099-12-31"}
+    exp_ok = not any(p.startswith("expires:") for p in signoff.problems(dict(base, expires=value)))
+    assert exp_ok == _schema_accepts(value, "date", "awareTimestamp"), value
+    on_ok = not any(p.startswith("approved_on:") for p in signoff.problems(dict(base, approved_on=value)))
+    assert on_ok == _schema_accepts(value, "date"), value
+
+
+def test_calendar_impossible_dates_fail_closed_although_the_pattern_matches():
+    """The one deliberate difference from the schema: a pattern-shaped but impossible date never validates."""
+    from ctshowcase import signoff
+    assert _schema_accepts("2099-02-30", "date")
+    rec = {"id": "t3s-c", "owner": OWNER, "repos": "*", "approved": True, "approver": "x",
+           "approved_on": "2026-01-15", "expires": "2099-02-30"}
+    assert signoff.problems(rec) == ["expires: needs a date (YYYY-MM-DD) or a timestamp with a UTC offset"]
+
+
+@pytest.mark.parametrize("field,value", [("expires", "20991231"), ("expires", "2099-W52-1"),
+                                         ("approved_on", "20260115")])
+def test_compact_and_week_dates_refuse_invalid(tmp_path, field, value):
+    vals = {"approved_on": "2026-01-15", "expires": "2099-12-31", field: value}
+    body = (f"  - id: t3s-cmp\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n    approver: x\n"
+            f"    approved_on: '{vals['approved_on']}'\n    expires: '{vals['expires']}'\n")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and field in _out(r), _out(r)
+
+
+def test_mixed_type_unknown_keys_refuse_invalid(tmp_path):
+    """`unexpected: true` beside `7: unexpected`: sorting str and int keys raised TypeError out of showcase.main()."""
+    body = (f"  - id: t3s-mix\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n    approver: x\n"
+            "    approved_on: 2026-01-15\n    expires: 2099-12-31\n    unexpected: true\n    7: unexpected\n")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "unknown field" in _out(r), _out(r)
+    assert "Traceback" not in _out(r), _out(r)
+
+
+def test_t1_star_list_item_for_a_t3_favorite_carries_the_favorites_signoff(tmp_path, monkeypatch, brand):
+    """A T1 org's List featuring a T3 org's repository: the favorite passed _t3_held via granted(), which registers no
+    grant, and star_list_plan stamped only the T1 org, so the updateUserListsForItem job had no signoff_id."""
+    from ctshowcase import org as O, signoff
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
+    from ctshowcase.resolver import Resolver
+    t1, fav = "Northwind-Trading-Co", f"{OWNER}/northwind-synthetic"
+    reg = {"orgs": {t1: {"star_list": {"name": "Misc", "description": ""}, "favorites": [{"full_name": fav}]}}}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "actions": [], "extra": []}),
+                   metas={"m": {"owner": OWNER, "repo": "northwind-synthetic", "visibility": "public"}})
+    lists = json.loads((ROOT / "tests" / "fixtures" / "org" / "star-lists.json").read_text(encoding="utf-8"))
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE",
+                       str(_file(_bundle(tmp_path, [{"id": "t3s-fav", "repos": ["northwind-synthetic"]}]))))
+    t3 = set_t3_signed_off(True)
+    req = signoff.set_required(True)
+    run = signoff.reset()
+    try:
+        assert est.resolver.owner_status(t1) != "t3"
+        res = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=True, repo_ids={fav: "R_synthetic"})
+        items = [j for j in res["jobs"] if "list-item" in j["id"]]
+        assert len(items) == 1 and items[0]["org"] == O.USER_LOGIN, res
+        assert items[0]["signoff_id"] == "t3s-fav" and items[0]["approval_id"] == "t3s-fav", items
+        signoff.reset_required(req)
+        req = signoff.set_required(False)  # without the flag nothing is stamped (behaviour unchanged)
+        plain = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=True, repo_ids={fav: "R_synthetic"})
+        assert all("signoff_id" not in j for j in plain["jobs"]), plain["jobs"]
+    finally:
+        signoff.restore(run)
+        signoff.reset_required(req)
+        reset_t3_signed_off(t3)

From b4ea236a3b447de874ced7c9e306212474161134 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 09:37:12 -0400
Subject: [PATCH 18/79] Gate T3 owners a pending transfer resolves to, keep
 association sign-offs, enforce the record-file envelope, restore LF (#23,
 #26)

- org labels: a member whose approved pending transfer resolves to a T3 org passes
  check_owner for that org (held otherwise); its label jobs carry the record.
- _t3_held checks the favorite's current slug as well as the named one.
- topics --also-in: the record that admitted a T3 membership topic is carried
  onto the change record (signoff_id; signoff_ids when several apply).
- signoff.load_records rejects files whose envelope breaks the schema
  (top-level list, extra top-level key, non-object entry): t3-signoff:missing.
- CHANGELOG.md and references/t3-signoff.md back to LF; .gitattributes pins them.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .gitattributes                   |   3 +
 CHANGELOG.md                     | 183 ++++++++++++++++---------------
 references/t3-signoff.md         | 102 ++++++++---------
 scripts/ctshowcase/org.py        |  30 ++++-
 scripts/ctshowcase/signoff.py    |  23 +++-
 scripts/ctshowcase/topics.py     |  24 +++-
 scripts/showcase.py              |  19 +++-
 tests/test_t3_signoff_require.py | 141 ++++++++++++++++++++++++
 8 files changed, 372 insertions(+), 153 deletions(-)

diff --git a/.gitattributes b/.gitattributes
index 182c875..583ef24 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -12,3 +12,6 @@
 *.webp binary
 # Generated SVGs are hashed into docs/images/.showcase.json; keep their bytes identical on every OS
 *.svg text eol=lf
+# Docs and the changelog stay LF: a CRLF commit rewrites every line and conflicts every branch (CHANGELOG Unreleased)
+CHANGELOG.md text eol=lf
+references/*.md text eol=lf
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0e08634..625cc59 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,91 +1,92 @@
-# Changelog
-
-All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
-
-## Unreleased
-
-### Added
-
-- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
-- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
-
-### Fixed
-
-- T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
-- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
-- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
-- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
-
-- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
-- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
-- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
-- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
-- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
-
-- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
-- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
-- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
-- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
-- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
-- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
-- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
-
-## 1.0.0 — 2026-10-26
-
-First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
-
-### Added
-
-- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
-- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
-- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
-- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
-- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
-
-### Security
-
-- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
-- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
-- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
-- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
-- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
-- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
-- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
-- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
-- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
-- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
-- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
-- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
-- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
-
-### Fixed
-
-- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
-- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
-- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
-- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
-- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
-- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
-- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
-- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
-- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
-- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
-- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
-- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
-- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
-- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
-- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
-- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
-- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
-- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
-- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
-- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
-- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
-- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
-- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
-- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
-- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
-- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
-- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
-- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
+# Changelog
+
+All notable changes to `github-showcase-skill` are recorded here. Versions follow [Semantic Versioning](https://semver.org/): a new major version changes a generated surface, a command's contract or the standard version (`ct-std-v1`); a minor version adds a command or option; a patch fixes output without changing the contract. The template's workflow pins a release tag by its commit SHA, so every entry below names one tag.
+
+## Unreleased
+
+### Added
+
+- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A topics change record that adds a signed-off T3 org's `--also-in` membership topic carries that org's record (`signoff_id`). A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+
+### Fixed
+
+- T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
+- A repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff`) unless `--allow-t3` (and, under `--require-t3-signoff`, the T3 org's record) covers it, and a favorite named under another org is held from profiles and star Lists the same way.
+- Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
+- Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
+- The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
+
+- `org health` and `org doctor` run available checkout/snapshot checks without the private estate registry, retaining missing-org errors when a registry is supplied or discovered. Doctor combines available file and visibility evidence without inventing completeness or dropping explicit absence, normalizes REST/GraphQL privacy fields, distinguishes absent fields from explicitly cleared identity fields, checks private links under known renamed repository/owner paths and supported verification reason codes, and reports incomplete registry-dependent coverage instead of aborting or claiming the org is done.
+- Older valid custom brand configs without the optional icon palette tokens retain icon normalization, checking and option B illustration prompts; missing palette inputs are reported without a traceback, and the bundled option A glyph prompt explains which tokens to add or how to supply an explicit palette.
+- `content icon` uses the bundled `references/art-direction.md` in every working directory. The option A glyph template uses dedicated, contrasting `icon_ink` and `icon_spark` brand tokens and the documented family seed (or the tool's default when absent) without requiring private estate files; explicit art-direction overrides remain supported and missing paths are named in the error.
+- CLI stdout and stderr are configured as UTF-8 before argument parsing, preserving their existing error handlers, so redirected Windows output preserves Unicode in label plans, raw footer markup, help and diagnostics without `UnicodeEncodeError`, and undecodable filenames still use the stream's original escape policy.
+- The Action summary and quality validator decode CLI results explicitly as UTF-8, preserving non-ASCII descriptions on Windows rather than corrupting them or failing with `UnicodeDecodeError`.
+
+- `doctor` reports disabled-Issues label checks, inapplicable social previews and archived community health as `n/a`, while preserving label coverage during approved archived polishing and unknown captured values on applicable surfaces. Social upload plans share the R10 applicability rule and include the personal-profile capstone.
+- `doctor` reports R11 as `n/a` for archived repositories and outside T1/T2 organizations (personal-account, utility and co-owned repositories), matching the definition of done.
+- R5 preserves upstream defaults on forks (forks in the watching and archive orgs still need Issues off, as `adopt` plans) and accepts a captured user keep decision for other default branches without relaxing the merge or Issues checks. `adopt` and the `doctor --estate` proposals honour the same keep decision: `adopt` logs `default-branch kept (user)` instead of asking for a `rename-default-branch` proposal, and neither asks for one on a fork.
+- One fork rule (GitHub's fork flag or a `-fork` slug, whatever type a repo config sets, plus a detected `fork` type) is shared by `doctor` (R5, R6, R10, R11), `adopt`, `labels --plan`, `org labels`, the `doctor --estate` proposals, the social preview, the card exemption (in `card`, `lint all`, `doctor` and the org and personal profile pages, under every owner code) and the watching-org exemptions, so a repository is never a fork to only some of them for what applies to it. Content (the README variant, the description template and the `fork` topic) still follows the detected type, which a repo config may set. R1 exempts GitHub forks only, as the estate proposals do: a non-network copy follows `UPSTREAM-fork` naming (§3.1).
+- `content social` renders the personal-profile capstone and backup repositories wherever R10 and the `adopt` upload job include them; it previously exempted them, so the planned upload had no image. Where R10 leaves them out (the archive org, an archived capture) they stay exempt.
+- Label job plans include a per-repository `labels:OWNER/REPO` group for writer reconciliation. Explicit orchestrator groups are preserved.
+- `adopt` withholds jobs and change records for an archived capture, with instructions to re-capture inside the approved unarchive/polish/re-archive cycle. Security jobs are emitted only for active eligible repositories.
+
+## 1.0.0 — 2026-10-26
+
+First public release, for the CompleteTech GitHub estate standard `ct-std-v1`.
+
+### Added
+
+- Repository surfaces: README hero banner (1280×360 and 2560×720), repo card SVG, social preview (1280×640), repo icon (1024×1024), the estate footer and README marker blocks for every README variant.
+- Checks: `describe`, `topics`, `labels --plan`, `readme` scaffold and upgrade, `lint` (SVG, banner, PNG, README, public leak) and `doctor` (R1 to R11 plus the art columns).
+- Command groups: `org` (profile README, About, pins, labels, health, doctor), `project` (capture, normalize, lint, copy plan, README, Estate board), `enterprise` (discover, snapshot, plans, doctor) and `content` (sidebar, links, images, art direction).
+- `meta --from-gh` records `last_substantive_commit` (CQ-16) and takes `--allow-t3` after co-owner sign-off.
+- The composite Action (`action.yml`) that the repository template runs to bootstrap and refresh its own README and images.
+
+### Security
+
+- Read-only toward GitHub: every write is printed as a `gh` argv or a writer job for the estate's writer to run.
+- `org profile` lists an estate-owned favorite (placeholder, merge-source and excluded owners included), or any favorite whose metadata was captured, only when it passes the public-slice test, and its leak check covers every captured repository whose metadata is not public, whoever the owner.
+- `labels --plan` and `adopt` hold a rename (`label-rewrite-first`) while an issue form's or `dependabot.yml`'s `labels:` entry still assigns the old label, so no rename leaves a form naming a missing label.
+- A label rename is never planned without its reference check: with no checkout (`labels --plan` without `--repo-dir`, `adopt`, `org labels`), it is planned only when the captured file tree, recorded whole (`files_complete: true`: `meta --from-gh` keeps GitHub's `truncated` answer), proves no issue form, `dependabot.yml`, workflow, `release.yml`, `labeler.yml` or `renovate.json` exists; otherwise it is held as `needs-input:label-references` with the files to check.
+- The label reference check also reads the owner's `.github` default issue forms for a repository without forms of its own (`org labels` from `--meta-dir`; `labels` and `adopt` take `--org-defaults` with a checkout or its metadata JSON), and parses forms, front matter and `dependabot.yml` as YAML, so multi-line values, quoted keys, aliases and a byte order mark are recognised and a file that does not parse holds the rename.
+- `org pins` adds to the public star List only the favorites the public slice may name: private, HOLD, excluded-owner and exposure favorites are dropped (`favorite-dropped:private-or-unknown`, unnamed) and unknown visibility leaves the plan `incomplete`.
+- `content icon` refuses a family on hold unless `--allow-hold` is passed, as `banner` and `card` do.
+- `org` exposure flags match their marker anywhere in the flag (`private-keep-private`, `...-must-stay-private`, `do-not-publish`, `possible-pii-in-output`, `lan-device-inventory`, ...) and follow a repository through its move or rename (`target_owner`, `new_name`), so a flagged repository re-captured under its new slug stays out of the public slice.
+- `lint public-leak` and the profile leak checks catch a private repository named under a former org login, and treat the registry's top-level `notes` and `judge_changes` and the personal profile's internal keys (`notes`, `romgenie`, pin `why`) as internal notes.
+- A T3 org's repository is left out of the personal pins and more projects, other orgs' cross-listings, favorites and star List items until co-owner sign-off (`--allow-t3`), logged `t3-signoff:OWNER/REPO`.
+- `project copy-plan` and the standalone `project readme` name no repository in the README of a board that is public (as captured, approved or not) or may go public (an approved visibility item), logged `readme-links:repositories-omitted (the board may go public)`; a board captured public without approval logs `visibility:public (no approval)`, not `visibility:private`.
+- `labels --plan` and `adopt` refuse an `--org-defaults` metadata JSON or checkout of another org's `.github` (usage, exit 2), with the owner read from `owner`, `owner.login`, `full_name` or the checkout's own `origin` and resolved through the run's org resolver (`--config` included). A JSON without an owner, or a checkout without a GitHub origin, can no longer prove that no default issue form names a label, so the rename stays held (`needs-input:label-references`). Before, another org's `.github` was accepted and the rename was planned while the owner's default forms still assigned the old label.
+- `readme --mode upgrade` (and the bootstrap `edited` path and the preserve list) replace an unmarked or drifted footer at the end of the README with the decision 18 footer instead of appending a second one. Only a block whose every line is a footer line (centring, complete.tech links, the footer's own logo image, the "Built by" credit line) is replaced; an image counts as the footer's logo only when its src or srcset is the brand footer logo URL (or the same file on another branch, with a query, or in its github.com blob/raw form) or its alt is exactly the company, never because its file name contains "logo". A centred block with an authored line (a sponsor or partner image, a thanks line) is kept, so no authored line is dropped. `lint readme` fails `D18 footer fail:duplicate`, and `footer --check` (and doctor's footer column) `fail:duplicate`, when a footer-like block outside code sits before the last block.
+
+### Fixed
+
+- `project copy-plan`: a view filter on a quoted Workstream value (`workstream:"Research"`) now follows the option rename, renames apply in one pass, and the template and the Estate never get the public-visibility job even with an approval row.
+- `topics`: the CVE-check vendor topic and the TouchedByAnAgent domain vocabulary match the owner through the shared resolver (CQ-03), so an approved org rename (`CompleTetech-Security` to `CompleteTech-Security`) no longer proposes removing a checker's vendor topic or logs `needs-input:domain-topic` and `topics-short`.
+- `meta`: normalizing a `--meta` file no longer drops keys later checks read. The social preview flag `uses_custom_og_image` (or the captured GraphQL `usesCustomOpenGraphImage`) now reaches the doctor's R10 cell, so a verified repository can be marked done; only a boolean counts, and two spellings that disagree leave R10 `unknown`. `has_pages`, `size` and the About sidebar counts (`releases`, `deployments`, `packages`, `environments`) are kept too, for `adopt`, the sidebar job and the `doctor --estate` empty-repository rule; `references/meta.schema.json` lists every preserved key.
+- `content links`: a link is proposed as "this repository under a former owner" (`moved`) only when an approved repository `rename` or `transfer` action in `decisions/estate-actions.json` records the move of exactly this repository, matched under the old owner and the old name. A same-named repository in another org is a different repository, so `CompleteTech-Skills/.github` no longer proposes rewriting the decision 18 footer's `CompleteTech-LLC/.github` logo URLs. Every URL `references/brand.yaml` holds (the footer's href and logos, the brand and hub sites) is fixed content: no org-rename, transfer or online `full_name` answer rewrites it.
+- `labels --plan`, `adopt` and `org labels`: rule 0 reads every Renovate config file Renovate itself reads (`renovate.json5`, `.github/renovate.json5`, `.gitlab/`, `.gitea/` and `.forgejo/` `renovate.json(5)`, `.renovaterc`, `.renovaterc.json`, `.renovaterc.json5`, and the `renovate` key of the root `package.json` on a checkout), not only `renovate.json` and `.github/renovate.json`, so a label named there blocks the rename (`label-referenced`), and without a checkout each of those files must be proven absent from the captured tree or the rename is held (`needs-input:label-references`).
+- `org pins`: each favorite's star List job carries every estate org's captured star List that takes it, so two orgs sharing a favorite never remove it from each other's List; no item job is planned from a capture whose List `items` page is cut short (`needs-input:star-lists-items-paged`); a pin behind an approved move that has not run is held (`pin-gated:<repo>:<action>`) and left out of the pin-order job; a HOLD org's pins only report (`pins:hold`).
+- `project copy-plan` stage 2 (and `estate-plan`) refuses a `--copied` capture that is not a board of the target (exit 2), gives each repository link a distinct job id (`order_ledger` and `order.ledger`) and refuses a plan that would reuse an id, and a Workstream option rename changes only `workstream:` and `-workstream:` filter values, never a label or other predicate with the same text.
+- `project copy-plan`: the short description and README job id ends in a hash of its argv, so the README-bearing re-plan after the view jobs ran never reuses an id with other content (the writer refuses such a batch whole). The first status update (`createProjectV2StatusUpdate`, not idempotent) is planned only when the capture shows no status update (`status-update:exists` otherwise) and the Shipped view's number is known; while the plan still creates the Shipped view it is left for the re-plan (`status-update:shipped-view-pending` and a pending entry), so it is planned once and never first with a placeholder body. Its dates are the current quarter's start and end, not today, and its id ends in a hash of the whole mutation, so a re-plan within the quarter is byte-identical (the writer skips it as already queued) and one id never carries two contents.
+- `adopt` and `org labels` hold a repository whose labels were not captured (`needs-input:labels`) instead of planning every standard label as a create, `labels --jobs`, `--records` and `--gh` (not only `--plan`) read the live labels first when the metadata has none, and fail with `needs-input:gh` (exit 4, nothing appended) when they cannot, and `adopt` keeps the AI-Ascension label exemption under any spelling of the owner (resolver identity, CQ-03).
+- `content icon prompt --option B` finds the family addition (trademark negatives such as the TCG one) under any login of the org or its display name, so it survives a brand.yaml row re-keyed after an approved org rename (`completetech-tcg` added). It refuses with `needs-input:family-additions` when the art direction lacks that org's addition. The ART_OWNER palette lookup follows the org's aliases too.
+- `content sidebar` reads a GraphQL `totalCount` (and the REST `total_count`) before any `nodes` list, so `{totalCount: 12, nodes: []}` no longer unchecks Releases.
+- `content images --out-dir` no longer writes a one-frame lossless candidate for an animated PNG. Its check reads `animated: N frames` and no candidate is offered.
+- README marker blocks, `<!-- showcase:license -->` and the template-body block shown inside fenced (``` or ~~~) or inline code are examples and are never regenerated by `readme --mode header`, `upgrade` or `--bootstrap`; on the bootstrap `edited` path only the real block's pristine marker is dropped, never one shown as an example. A line that starts with three backticks but has another backtick later (```` ```npm test``` runs ````) is inline code, as in CommonMark, not a fence opener, so it no longer hides every marker, H1 or link after it from `readme`, `lint readme` and `content links`.
+- `readme`, `lint readme` and the repository context (preserve list, own-banner check) drop a leading UTF-8 byte order mark, so the old H1 of a BOM README is folded into the header instead of being kept as a second H1.
+- shields.io badge segments are percent-encoded after the `-`/`_` doubling (`language-C%23-1E3A8A`), so `#`, `?`, `/` and `%` no longer cut the badge URL.
+- `lint readme` ignores `~~~` fences when counting H1s and placeholders, and resolves URL-encoded local image paths (`docs/images/My%20Shot.png`).
+- `readme --bootstrap` rewrites only the template owner's `.github` CONTRIBUTING/SECURITY links in CONTRIBUTING.md; links to another org's or an upstream's guides stay as written.
+- The social preview footer, the README nav line and the CI badge name the org's current login after an approved rename; `content social` renders the footer with the resolver its `--registry`/`--approved*` flags build. `content social --job` withholds the upload job (`needs-input:social-login`) when the rendered image names a different login than the slug it would be uploaded to.
+- The Action no longer deletes a repository's own `assets/icon.png` after a rename, a transfer or an org rename. `action_prepare.py foreign` treats art as another repository's only on proof: a template's sidecar (`inputs.type: template`, or the template slug), or an output record whose `repository_id` differs from `$GITHUB_REPOSITORY_ID`. Otherwise it keeps the art and the icon and logs a notice, and the art regenerates under the new name. `meta` keeps `id` and `node_id`, and every sidecar output record carries `repository_id`.
+- `fingerprint` reads the override `icon:` as the renderer does (YAML; a stdlib fallback strips quotes and a trailing comment), so changing an override icon whose line carries a comment regenerates the art.
+- `.github/showcase.yml` `for: OWNER/REPO`, the checkout check (`--meta` with `--repo-dir`) and the `adopt` slug check compare the owner through the shared resolver (any case, any `former_slugs` login, CQ-03) and the repository name case-insensitively. A genuinely different repository is still refused.
+- An owner spelled in another case (a lower-cased origin URL) takes the org's own spelling, so the README variant (`agent-skills` is A only in CompleteTech-Skills), the doctor R6 (AI-Ascension) and R9 rules, the nav line and the `describe` P1 rule (Pick-Your-AI) match. Former logins are not rewritten.
+- `labels --plan` applies the `org labels` gates: a family on hold is refused (exit 2) unless `--allow-hold`, AI-Ascension gets only the `dependencies` create or patch, and `has_issues: false` repositories other than `.github`, archived repositories (`archived`) and the romgenie family answer `n/a`. `adopt` refuses a family on hold, also when called directly.
+- Label writer job ids come from the operation (`…-label-<create|edit>-<name>[-to-<new>]-<hash8>` in `labels --plan` and `org labels`, the same parts in `adopt`), not its position, so a re-plan never queues one id with different content.
+- Metadata whose fork `parent` is an `OWNER/REPO` string (the estate snapshot form) is normalized, so `topics`, `doctor` and `adopt` no longer crash on it. `meta --from-gh` captures `.github/showcase.yaml` too, and an override read from metadata is validated like a checkout's.
+- Only watching-org forks are exempt from the icon, banner and footer (decisions 12, 13 and 18). The watching org's `.github` needs all three. Its other non-fork repositories are held (`hold:watching-non-fork`) until decided: `banner`, `card`, `content icon` and `readme` exit 2, and `--allow-hold` releases `banner`, `card` and `content icon`. `readme` has no `--allow-hold`: its hold message says the README stays unchanged while the repository is in the watching org instead of pointing to an option the command rejects. The Action treats a held or refused `readme` (exit 2 with a `hold` log or a `refused` result) like a held art family: a warning, the output skipped, the run green. Any other `readme` exit 2 (a `.github/showcase.yml` that fails its schema, a usage error) still fails the run. `footer --check README.md --org` with the watching org reads the README instead of answering `exempt`, since `--org` cannot tell its `.github` from a fork.
+- `readme --mode header` (the Action's README step) keeps a tagline written for the repository when the repository has no description yet (`needs-input:description`), instead of emptying it; only an inherited tagline is emptied: the block still holds exactly a tagline of the template the repository was generated from, as it was then or as it is now (`meta --from-gh` now records `template_repository` and `template_taglines`), or, only when those are unknown, the template body is still pristine.
+- `readme --bootstrap` (the template workflow's step before header mode, so every repository generated from the template runs it on each push) no longer erases a tagline written for the repository when it rebuilds the header with no description: the tagline block carries over and the header rule above decides it, in one place (`readme.tagline_body`), so only an inherited tagline is emptied. `readme --mode upgrade` (and `auto` when it picks upgrade) uses the same rule, so with no description it no longer fails with `readme-shrink` (exit 1, README unchanged): a tagline written for the repository is kept, and an inherited one is emptied without counting as a lost line. This holds in its additive preserve mode too (a README over 15000 bytes or on the org's `readme_preserve` list), where the tagline block now stays in place instead of being dropped. An unmarked bold tagline (a README adopted for the first time) is no longer erased silently (exit 0) with no description: when upgrade rebuilds the header (not in preserve mode), a single bare `**...**` line opening the README after its header lines (H1, badges, banner, `---`) moves into the tagline block by the same rule; a second bold line, one beside a tagline block that already holds a line, a bold line inside a centred `<div>`/`<p>` block, one in preserve mode, or one in an untouched template copy whose template taglines are unknown (where the rule would empty any line in the block on the next run) stays as authored text. `meta --from-gh` finds the template README's tagline block outside code, so a marker example in fenced or inline code is no longer read as the template's tagline (which also turned off the pristine-body fallback).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 75f8551..dccce60 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,50 +1,52 @@
-# T3 sign-off records (`--require-t3-signoff`)
-
-`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
-
-## Where the file lives
-
-Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
-
-## Format
-
-The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`): a string date or timestamp must match the schema's `date` or `awareTimestamp` pattern before it is parsed, so compact (`20991231`) and week (`2099-W52-1`) forms are invalid in both. The one deliberate difference is that a pattern-shaped but impossible date (`2099-02-30`) is also invalid in the tool. Tests keep the two in step, including one that applies the schema's patterns without needing `jsonschema`.
-
-```yaml
-signoffs:
-  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
-    owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
-    repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
-    approved: true             # a boolean; only true grants
-    approver: example-co-owner # who signed off
-    approved_on: 2026-01-15    # the date they signed off
-    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
-    note: "optional free text"
-```
-
-| Field | Required | Rule |
-|---|---|---|
-| `id` | yes | non-empty string |
-| `owner` | yes | non-empty string |
-| `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
-| `approved` | yes | boolean (`"true"` as a string is invalid) |
-| `approver` | yes | non-empty string |
-| `approved_on` | yes | date `YYYY-MM-DD` |
-| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
-| `note` | no | string |
-
-No other fields are allowed.
-
-## Refusals
-
-Each refusal exits 2 with result `refused`.
-
-| Log | Meaning |
-|---|---|
-| `t3-signoff:no-file` | the flag is on but no record file was given |
-| `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file) |
-| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
-| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
-| `t3-signoff:expired` | every covering record is past `expires` |
-
-Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
+# T3 sign-off records (`--require-t3-signoff`)
+
+`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
+
+## Where the file lives
+
+Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
+
+## Format
+
+The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`): a string date or timestamp must match the schema's `date` or `awareTimestamp` pattern before it is parsed, so compact (`20991231`) and week (`2099-W52-1`) forms are invalid in both. The one deliberate difference is that a pattern-shaped but impossible date (`2099-02-30`) is also invalid in the tool. Tests keep the two in step, including one that applies the schema's patterns without needing `jsonschema`.
+
+```yaml
+signoffs:
+  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
+    owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
+    repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
+    approved: true             # a boolean; only true grants
+    approver: example-co-owner # who signed off
+    approved_on: 2026-01-15    # the date they signed off
+    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
+    note: "optional free text"
+```
+
+| Field | Required | Rule |
+|---|---|---|
+| `id` | yes | non-empty string |
+| `owner` | yes | non-empty string |
+| `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
+| `approved` | yes | boolean (`"true"` as a string is invalid) |
+| `approver` | yes | non-empty string |
+| `approved_on` | yes | date `YYYY-MM-DD` |
+| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
+| `note` | no | string |
+
+No other fields are allowed. The file itself is an object with the one key `signoffs`, a list of record objects; a top-level list, any other top-level key or a non-object entry makes the whole file authorize nothing (`t3-signoff:missing`), as the schema refuses it.
+
+## Refusals
+
+Each refusal exits 2 with result `refused`.
+
+| Log | Meaning |
+|---|---|
+| `t3-signoff:no-file` | the flag is on but no record file was given |
+| `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
+| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
+| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
+| `t3-signoff:expired` | every covering record is past `expires` |
+
+Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
+
+The owner checked is the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, favorites and star-List items). A `topics --also-in` association with a signed-off T3 org carries that org's record id on the topics change record (`signoff_id`; `signoff_ids` lists every id when more than one record applies).
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index feed5c5..964bf67 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -366,9 +366,19 @@ def public_favorites(estate: Estate, reg: dict, *, allow_t3: bool = False) -> tu
 
 
 def _t3_held(estate: Estate, full: str, allow_t3: bool) -> bool:
-    """A repository of a T3 org (any of its logins) before co-owner sign-off: never named on a public profile."""
-    return "/" in (full or "") and estate.resolver.owner_status(full.split("/")[0]) == "t3" \
-        and not (allow_t3 and _t3_granted(full.split("/")[0], full.split("/")[1]))
+    """A repository of a T3 org (any of its logins) before co-owner sign-off: never named on a public profile.
+    Both the slug as named and the slug it has today (estate.current: an approved pending transfer) are checked, so a
+    favorite named under a T1 org but held by a T3 org today is still held, and under --require-t3-signoff it needs
+    a record for the T3 org that holds it (tests/test_t3_signoff_require.py
+    ::test_favorite_transferred_to_a_t3_org_is_held_without_its_record)."""
+    if "/" not in (full or ""):
+        return False
+    r = estate.resolver
+    for slug in dict.fromkeys([full, estate.current(r.slug(full))]):
+        owner, _, name = slug.partition("/")
+        if r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name)):
+            return True
+    return False
 
 
 def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
@@ -1799,6 +1809,18 @@ def labels_plan(estate: Estate, org: str, *, allow_t3: bool = False, checkouts:
         m = estate.meta(f"{login}/{n}")
         full = estate.current(f"{login}/{n}")  # labels are written where the repository is today
         current_owner, current_name = full.split("/", 1)
+        if not estate.resolver.same(current_owner, login) and estate.resolver.owner_status(current_owner) == "t3":
+            # An approved pending transfer: the label jobs target the T3 org that holds the repository today, so it
+            # passes that org's gate (--allow-t3 and, under --require-t3-signoff, its record; check_owner also
+            # registers the grant that stamps signoff_id on these jobs). The org gate above only saw LOGIN.
+            # (tests/test_t3_signoff_require.py::test_org_labels_gate_the_t3_owner_a_transfer_resolves_to)
+            from .errors import Refused
+            try:
+                estate.resolver.check_owner(current_owner, allow_t3=allow_t3, repo=current_name)
+            except Refused as exc:
+                repos.append({"repo": full, "result": "held", "log": exc.log})
+                logs.append(f"{exc.log}:{full}")
+                continue
         if m is None or m.get("error") and "labels" not in m:
             repos.append({"repo": full, "result": "unknown", "log": "needs-input:metadata"})
             continue
@@ -1885,7 +1907,7 @@ def labels_plan(estate: Estate, org: str, *, allow_t3: bool = False, checkouts:
     if unknown:
         logs.append(f"needs-input:metadata:{len(unknown)}")
     # a rename rule 0 could not check, or labels that were not captured, is never a pass
-    held = any(x.get("held") or x.get("log") == "needs-input:labels" for x in repos)
+    held = any(x.get("held") or x.get("result") == "held" or x.get("log") == "needs-input:labels" for x in repos)
     return {"command": "org", "action": "labels", "owner": login, "result": "incomplete" if held else "plan" if jobs else "pass",
             "repos": repos, "jobs": jobs, "logs": sorted(set(logs))}, OK
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 8097d8b..0fe8174 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -144,10 +144,25 @@ def load_records(path: str | Path | None = None) -> list[dict]:
         data = load_yaml_text(path.read_text(encoding="utf-8"))
     except Exception:  # invalid YAML or unreadable file: no usable records, so the gate refuses (t3-signoff:missing)
         return []
-    items = data.get("signoffs") if isinstance(data, dict) else data
-    if not isinstance(items, list):  # `signoffs: 7` and similar: fail closed instead of raising TypeError
-        return []
-    return [r for r in items if isinstance(r, dict)]
+    # the envelope is checked before any record is read (a top-level list or an extra key never authorizes)
+    return list(_envelope(data))
+
+
+def _envelope(data) -> tuple[dict, ...]:
+    """The records of a file whose envelope conforms to references/t3-signoff.schema.json, else none at all.
+
+    The schema's root is an object with exactly one property, `signoffs`, an array of record objects
+    (additionalProperties false). Anything else (a top-level list, an extra top-level key, `signoffs: 7`, a scalar
+    or a list entry in `signoffs`) is a file an external validator of the estate bundle refuses, so the whole file
+    authorizes nothing and the gate refuses t3-signoff:missing, as for unparsable YAML. Records that break the schema
+    one by one are still judged per record (problems(), t3-signoff:invalid).
+    (tests/test_t3_signoff_require.py::test_file_envelope_follows_the_schema)"""
+    if not isinstance(data, dict) or set(data) != {"signoffs"}:
+        return ()
+    items = data["signoffs"]
+    if not isinstance(items, list) or not all(isinstance(r, dict) for r in items):
+        return ()
+    return tuple(items)
 
 
 # The string forms references/t3-signoff.schema.json permits ($defs.date and $defs.awareTimestamp), checked before
diff --git a/scripts/ctshowcase/topics.py b/scripts/ctshowcase/topics.py
index 41ede7f..5636715 100644
--- a/scripts/ctshowcase/topics.py
+++ b/scripts/ctshowcase/topics.py
@@ -133,7 +133,7 @@ def alias(x):
         tech = [alias(x) for x in parent if alias(x) in set(t["featured"]) | set(t["allowed"])]
         # a fork listed in also_in also carries that org membership topic (§5.1), counted toward the maximum
         proposed = list(dict.fromkeys(["fork"] + m_topics + list(dict.fromkeys(tech))[:4]))[:limit]
-        return _result(current, proposed, logs)
+        return _with_signoffs(_result(current, proposed, logs), ctx, m_orgs, m_topics, proposed)
     if typ == "github-profile":
         proposed = [org.get("brand_topic") or "completetech", "github-profile"]
         return _result(current, proposed, logs)
@@ -188,7 +188,27 @@ def alias(x):
     minimum = t["min_private"] if private else t["min_public"]
     if len(proposed) < minimum:
         logs.append("topics-short")
-    return _result(current, proposed, logs)
+    return _with_signoffs(_result(current, proposed, logs), ctx, m_orgs, m_topics, proposed)
+
+
+def _with_signoffs(res: dict, ctx: RepoContext, orgs: list[str], topics_: list[str], proposed: list[str]) -> dict:
+    """Under --require-t3-signoff, name the records that let a T3 org's membership topic into `proposed` as
+    `signoff_ids`, so cmd_topics carries them onto the change record. membership_topics only asks granted(), which
+    registers no grant, and records.append stamps by the target owner (often T1), so without this the record that
+    authorized the T3 association was lost (tests/test_t3_signoff_require.py
+    ::test_t3_also_in_association_carries_its_signoff_id). No key at all when the flag is off or no T3 org applies."""
+    from . import signoff
+    if not signoff.required():
+        return res
+    resolver = ctx.brand.resolver()
+    ids: list[str] = []
+    for org, topic in zip(orgs, topics_):
+        if topic not in proposed or ctx.brand.owner_status(org) != "t3":
+            continue
+        rec, _ = signoff.evaluate([org, *resolver.aliases(org)])
+        if rec is not None and rec.get("id") and str(rec["id"]) not in ids:
+            ids.append(str(rec["id"]))
+    return dict(res, signoff_ids=ids) if ids else res
 
 
 def _result(current, proposed, logs):
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 2ba15c1..3211a17 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -476,6 +476,20 @@ def cmd_describe(args):
         CHECK_FAILED if failed else OK
 
 
+def _stamp_signoff_ids(rec: dict, association_ids, ctx) -> None:
+    """Under --require-t3-signoff: the topics change record names every record that authorized it, the target owner's
+    own grant first (a T3 target) and then each T3 `also_in` association's (topics.merge `signoff_ids`).
+    `signoff_id` is the first; `signoff_ids` lists all of them only when there is more than one."""
+    from ctshowcase import signoff
+    if not association_ids or not signoff.required():
+        return
+    own = signoff.record_for(ctx.owner, ctx.repo)
+    ids = list(dict.fromkeys(([str(own["id"])] if own and own.get("id") else []) + list(association_ids)))
+    rec["signoff_id"] = ids[0]
+    if len(ids) > 1:
+        rec["signoff_ids"] = ids
+
+
 def cmd_topics(args):
     from ctshowcase import records, topics
     ctx = context(args)
@@ -489,8 +503,9 @@ def cmd_topics(args):
         also_in = topics.registry_also_in(res, ctx.owner, ctx.repo)
     r = topics.merge(ctx, also_in)
     if args.records and not r["equal_as_set"]:
-        records.append(args.records, [records.record(ctx.owner, ctx.repo, "topics", "topics", r["current"], r["proposed"],
-                                                     "§5.6 merge")])
+        rec = records.record(ctx.owner, ctx.repo, "topics", "topics", r["current"], r["proposed"], "§5.6 merge")
+        _stamp_signoff_ids(rec, r.get("signoff_ids"), ctx)
+        records.append(args.records, [rec])
     out = base("topics", ctx, result="pass" if r["equal_as_set"] else "fail", **{k: v for k, v in r.items() if k != "logs"},
                logs=ctx.logs + r["logs"])
     if args.gh and not r["equal_as_set"]:
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 5a0884a..e65fc7a 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -664,3 +664,144 @@ def test_t1_star_list_item_for_a_t3_favorite_carries_the_favorites_signoff(tmp_p
         signoff.restore(run)
         signoff.reset_required(req)
         reset_t3_signed_off(t3)
+
+
+# --- review round 4: evidence for each fixed finding (synthetic records and slugs only) ---
+
+T1 = "CompleteTech-Skills"  # a brand.yaml T1 org; the transfer below is synthetic
+
+
+def _transfer_estate(brand, favorites=()):
+    """A synthetic approved pending transfer: the registry homes northwind-member in T1, but the repository is still
+    held by the T3 org (Pick-Your-AI) and its metadata was captured there, so estate.current() resolves to the T3 org."""
+    from ctshowcase import labels as L, org as O
+    from ctshowcase.resolver import Resolver
+    approvals = {"rows": set(), "ids": {"mv-synthetic"}, "answers": {}, "extra": [], "actions": [
+        {"id": "mv-synthetic", "action": "transfer", "owner": OWNER, "repo": "northwind-member", "target_owner": T1}]}
+    labels = [dict(lb) for lb in L.standard_labels()][:-2]  # two standard labels missing: create jobs are planned
+    reg = {"orgs": {T1: {"final_repos": ["northwind-member"], "favorites": [{"full_name": f} for f in favorites],
+                         "star_list": {"name": "Misc", "description": ""}}}}
+    est = O.Estate(brand, Resolver(brand, reg, approvals), {"m": {
+        "owner": OWNER, "repo": "northwind-member", "visibility": "public", "labels": labels, "has_issues": True,
+        "files": [], "files_complete": True}})
+    assert est.current(f"{T1}/northwind-member") == f"{OWNER}/northwind-member"
+    return est, reg
+
+
+class _Strict:
+    """`--allow-t3` (unless allow_t3=False) plus `--require-t3-signoff` in this context, reading the given file."""
+
+    def __init__(self, monkeypatch, path, allow_t3=True):
+        self.monkeypatch, self.path, self.allow_t3 = monkeypatch, path, allow_t3
+
+    def __enter__(self):
+        from ctshowcase import signoff
+        from ctshowcase.config import set_t3_signed_off
+        self.monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(self.path))
+        self.tokens = (set_t3_signed_off(self.allow_t3), signoff.set_required(True), signoff.reset())
+        return self
+
+    def __exit__(self, *exc):
+        from ctshowcase import signoff
+        from ctshowcase.config import reset_t3_signed_off
+        t3, req, run = self.tokens
+        signoff.restore(run)
+        signoff.reset_required(req)
+        reset_t3_signed_off(t3)
+
+
+def test_org_labels_gate_the_t3_owner_a_transfer_resolves_to(tmp_path, monkeypatch, brand):
+    """`org labels CompleteTech-Skills` with a member whose approved pending transfer resolves to Pick-Your-AI: the
+    label jobs target the T3 org, so they need its record. Before, the org gate only saw the T1 org, and an empty
+    record file still produced `gh label create ... -R Pick-Your-AI/northwind-member` jobs with no signoff_id."""
+    from ctshowcase import org as O, signoff
+    est, _ = _transfer_estate(brand)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
+        res, _ = O.labels_plan(est, T1, allow_t3=True)
+        assert not [j for j in res["jobs"] if f"{OWNER}/northwind-member" in j.get("argv", [])], res["jobs"]
+        assert res["repos"] == [{"repo": f"{OWNER}/northwind-member", "result": "held", "log": "t3-signoff:missing"}]
+        assert res["result"] == "incomplete", res
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", [{"id": "t3s-lbl", "repos": ["northwind-member"]}]))):
+        res, _ = O.labels_plan(est, T1, allow_t3=True)
+        jobs = [j for j in res["jobs"] if f"{OWNER}/northwind-member" in j.get("argv", [])]
+        assert jobs, res
+        signoff.stamp(jobs)  # showcase.main stamps every emitted job list the same way
+        assert all(j["signoff_id"] == "t3s-lbl" for j in jobs), jobs
+    # no --allow-t3: the T3 org that holds the repository today is held like any T3 org (decision 12)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "noflag", [{"id": "t3s-x"}])), allow_t3=False):
+        res, _ = O.labels_plan(est, T1, allow_t3=False)
+        assert res["repos"][0]["result"] == "held" and res["repos"][0]["log"] == "t3-signoff", res
+
+
+def test_favorite_transferred_to_a_t3_org_is_held_without_its_record(tmp_path, monkeypatch, brand):
+    """A favorite named CompleteTech-Skills/northwind-member resolves to Pick-Your-AI/northwind-member. _t3_held
+    checked only the named (T1) owner, so with an empty record file the favorite went public and `org pins` planned
+    updateUserListsForItem for it, unstamped."""
+    from ctshowcase import org as O
+    fav = f"{T1}/northwind-member"
+    est, reg = _transfer_estate(brand, favorites=[fav])
+    lists = json.loads((ROOT / "tests" / "fixtures" / "org" / "star-lists.json").read_text(encoding="utf-8"))
+    ids = {f"{OWNER}/northwind-member": "R_synthetic"}
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
+        favs, logs = O.public_favorites(est, reg["orgs"][T1], allow_t3=True)
+        assert favs == [] and logs == [f"t3-signoff:{fav}"], (favs, logs)
+        plan = O.star_list_plan(est, T1, lists_capture=lists, allow_t3=True, repo_ids=ids)
+        assert not [j for j in plan["jobs"] if "list-item" in j["id"]], plan["jobs"]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", [{"id": "t3s-fv", "repos": ["northwind-member"]}]))):
+        favs, _ = O.public_favorites(est, reg["orgs"][T1], allow_t3=True)
+        assert favs == [f"{OWNER}/northwind-member"], favs
+        plan = O.star_list_plan(est, T1, lists_capture=lists, allow_t3=True, repo_ids=ids)
+        items = [j for j in plan["jobs"] if "list-item" in j["id"]]
+        assert len(items) == 1 and items[0]["signoff_id"] == "t3s-fv", plan["jobs"]
+
+
+def test_t3_also_in_association_carries_its_signoff_id(tmp_path):
+    """`topics --also-in Pick-Your-AI --records` on a T1 repository: the record that let the T3 membership topic in
+    is named on the change record. Before, granted() verified it without keeping it and stamp() looked only at the T1
+    target owner, so the change record that adds the T3 topic had no signoff_id."""
+    from ctshowcase.config import load_brand
+    from ctshowcase.topics import org_topic
+    topic = org_topic(load_brand(), OWNER)[1]
+    assert topic
+    b = _bundle(tmp_path, [{"id": "t3s-assoc"}])
+    out = tmp_path / "rec.jsonl"
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "topics", "--also-in", OWNER, "--records", str(out),
+             owner=T1)
+    obj = json.loads(r.stdout)
+    assert topic in obj["proposed"] and obj.get("signoff_ids") == ["t3s-assoc"], _out(r)
+    recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
+    assert len(recs) == 1 and recs[0]["owner"] == T1 and topic in recs[0]["after"], recs
+    assert recs[0]["signoff_id"] == "t3s-assoc" and "approval_id" not in recs[0], recs
+    plain = tmp_path / "plain.jsonl"  # without the flag: no key, behaviour unchanged
+    r = _run(tmp_path, b, "--allow-t3", "topics", "--also-in", OWNER, "--records", str(plain), owner=T1)
+    assert "signoff_ids" not in json.loads(r.stdout), r.stdout
+    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
+
+
+_GOOD = {"id": "t3s-env", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "synthetic-co-owner",
+         "approved_on": "2026-01-15", "expires": "2099-12-31"}
+
+
+@pytest.mark.parametrize("doc,ok", [
+    ({"signoffs": [_GOOD]}, True),
+    ([_GOOD], False),                                # top-level list (schema: type object)
+    ({"signoffs": [_GOOD], "extra": True}, False),    # unsupported top-level key (additionalProperties false)
+    ({"signoffs": [_GOOD, "t3s-scalar"]}, False),     # a non-object entry (items: record)
+    ({"signoffs": _GOOD}, False),                     # signoffs not an array
+    ({}, False),                                      # signoffs missing (required)
+])
+def test_file_envelope_follows_the_schema(tmp_path, doc, ok):
+    """The record file's envelope is checked before any record is read: a structure the published schema refuses
+    authorizes nothing (t3-signoff:missing, like unparsable YAML). Before, a top-level list or an extra top-level key
+    still granted --allow-t3 (exit 0)."""
+    d = tmp_path / "bundle" / "decisions"
+    d.mkdir(parents=True)
+    (d / "t3-signoffs.yaml").write_text(json.dumps(doc), encoding="utf-8")  # JSON is YAML
+    r = _run(tmp_path, tmp_path / "bundle", "--require-t3-signoff", "--allow-t3", "describe")
+    if ok:
+        assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+    else:
+        assert r.returncode == 2 and "t3-signoff:missing" in _out(r) and "Traceback" not in _out(r), _out(r)
+    jsonschema = pytest.importorskip("jsonschema")
+    schema = json.loads((ROOT / "references" / "t3-signoff.schema.json").read_text(encoding="utf-8"))
+    assert jsonschema.Draft202012Validator(schema).is_valid(doc) is ok

From d2799fc9daef386fbac0faea7b44652619ef7606 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Fri, 30 Oct 2026 09:59:04 -0400
Subject: [PATCH 19/79] Keep transfer-target T3 checks opt-in, gate moved home
 repos, stamp adopt and estate-plan associations, restore CRLF (#23, #26)

- org: the transfer-target T3 checks (labels_plan gate, _t3_held current slug)
  now run only under --require-t3-signoff; the flag-off default matches base
  2be04ac (new flag-off test). The CHANGELOG "Fixed" entry moves into the
  opt-in flag's entry.
- org.public_slice: under the flag, a home repository a T3 org holds today
  (approved pending transfer) is omitted until that org's record covers it.
- signoff.stamp_associations: shared association stamping (cmd_topics,
  intake.adopt, project.estate_plan); keeps an existing approval_id.
- adopt: topics job and change record carry topics.merge signoff_ids.
- project.estate_plan: T3 orgs keep their record id; jobs naming them carry it.
- tests/test_allow_t3_global.py: base CRLF restored, diff vs base is +108/-0.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |   3 +-
 references/t3-signoff.md         |   2 +-
 scripts/ctshowcase/intake.py     |   5 +
 scripts/ctshowcase/org.py        |  54 +++--
 scripts/ctshowcase/project.py    |  42 +++-
 scripts/ctshowcase/signoff.py    |  30 +++
 scripts/showcase.py              |   8 +-
 tests/test_allow_t3_global.py    | 380 +++++++++++++++----------------
 tests/test_t3_signoff_require.py | 114 +++++++++-
 9 files changed, 411 insertions(+), 227 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 625cc59..a99c8da 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,14 +6,13 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A topics change record that adds a signed-off T3 org's `--also-in` membership topic carries that org's record (`signoff_id`). A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A T3 association carries that org's record (`signoff_id`): the topics change record of `topics --also-in`, `adopt`'s topics job and change record for an `also_in` T3 org (an existing `approval_id` is kept), and the `project estate-plan` jobs that add a T3 org to the Estate's Org field. Under the flag only, a repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff:<why>`), and `org profile` and star Lists omit it as a home repository or favorite until the T3 org's record covers it. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
 - T3 sign-off (`--allow-t3`) is now context-local (contextvars) so concurrent or embedded calls cannot leak sign-off to each other; CLI behaviour unchanged.
-- A repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff`) unless `--allow-t3` (and, under `--require-t3-signoff`, the T3 org's record) covers it, and a favorite named under another org is held from profiles and star Lists the same way.
 - Windows contributor tests now use explicit UTF-8, native path basenames, a platform-independent read-only metadata stub, and Git Bash with stdin-safe Action scripts. All 15 issue #9 failures are individually documented; the full suite now runs in Windows, Linux and macOS CI.
 - Lint accepts file operands after options on older Python 3.12 versions while continuing to reject unrecognized options.
 - The Action's optional render arguments support macOS Bash 3.2, including an empty argument array with `set -u`.
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index dccce60..a0e7764 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -49,4 +49,4 @@ Each refusal exits 2 with result `refused`.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
 
-The owner checked is the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, favorites and star-List items). A `topics --also-in` association with a signed-off T3 org carries that org's record id on the topics change record (`signoff_id`; `signoff_ids` lists every id when more than one record applies).
+Under `--require-t3-signoff` only, the owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). Without the flag those cases behave as before. A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.
diff --git a/scripts/ctshowcase/intake.py b/scripts/ctshowcase/intake.py
index 8bbb02d..afffedd 100644
--- a/scripts/ctshowcase/intake.py
+++ b/scripts/ctshowcase/intake.py
@@ -99,6 +99,11 @@ def adopt(ctx, resolver=None, *, approval_id: str | None = None, fresh: bool = F
         jobs.append(_job(_jid("p3", "topics", sid), argv, full, "§5.6 topics (full ordered list; PUT replaces the set).",
                          approval_id, kind="topics"))
         recs.append(records.record(owner, repo, "topics", "topics", tp["current"], tp["proposed"], "§5.6 merge"))
+        # a T3 `also_in` membership topic: carry the record(s) that let it in, as cmd_topics does (no-op unless
+        # --require-t3-signoff; a job's existing approval_id is kept)
+        from .signoff import stamp_associations
+        for item in (jobs[-1], recs[-1]):
+            stamp_associations(item, tp.get("signoff_ids"), owner, repo)
     # §6 labels --------------------------------------------------------------------------------------------------
     if fork or archived or ctx.tier in ("T2-R", "T3") or watching:
         logs.append("labels:n/a")
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 964bf67..1a0ea04 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -367,18 +367,34 @@ def public_favorites(estate: Estate, reg: dict, *, allow_t3: bool = False) -> tu
 
 def _t3_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     """A repository of a T3 org (any of its logins) before co-owner sign-off: never named on a public profile.
-    Both the slug as named and the slug it has today (estate.current: an approved pending transfer) are checked, so a
-    favorite named under a T1 org but held by a T3 org today is still held, and under --require-t3-signoff it needs
-    a record for the T3 org that holds it (tests/test_t3_signoff_require.py
-    ::test_favorite_transferred_to_a_t3_org_is_held_without_its_record)."""
+    The slug as named is checked as before. Under --require-t3-signoff only, the slug it has today (estate.current:
+    an approved pending transfer) is checked too (_t3_moved_held)."""
     if "/" not in (full or ""):
         return False
+    owner, _, name = full.partition("/")
+    if estate.resolver.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name)):
+        return True
+    return _t3_moved_held(estate, full, allow_t3)
+
+
+def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
+    """Under --require-t3-signoff: FULL is named under one org but a T3 org holds it today (an approved pending
+    transfer, estate.current), and that T3 org has no --allow-t3 plus valid record covering the repository.
+
+    Opt-in only: without the flag this is always False, so the default (base 2be04ac) behaviour of profiles, star
+    Lists and `org labels` is unchanged; no issue of epic #22 asks for a default-on tightening
+    (tests/test_t3_signoff_require.py::test_transfer_to_a_t3_org_is_unchanged_without_the_flag). With the flag:
+    ::test_favorite_transferred_to_a_t3_org_is_held_without_its_record and
+    ::test_home_repository_held_by_a_t3_org_is_omitted_without_its_record."""
+    from . import signoff
+    if not signoff.required() or "/" not in (full or ""):
+        return False
     r = estate.resolver
-    for slug in dict.fromkeys([full, estate.current(r.slug(full))]):
-        owner, _, name = slug.partition("/")
-        if r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name)):
-            return True
-    return False
+    cur = estate.current(r.slug(full))
+    owner, _, name = cur.partition("/")
+    if r.same(owner, full.split("/")[0]):
+        return False  # not moving to another org: the named check in _t3_held (or the org gate) covers it
+    return r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name))
 
 
 def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
@@ -398,6 +414,14 @@ def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
         logs.append("needs-input:org-description")
     names = estate.repos_of(org)
     public = [n for n in names if n != ".github" and estate.is_public(f"{login}/{n}")]
+    # Under --require-t3-signoff: a home repository that a T3 org holds today (approved pending transfer) needs that
+    # org's record before the profile names it; held ones are omitted from featured, sections, forks and archives.
+    # Only the moved slug is checked here: the home org itself already passed _gate, and the callers that pass no
+    # allow_t3 (leak scope, doctor) must keep seeing the org's own repositories. No-op without the flag.
+    moved_held = [n for n in public if _t3_moved_held(estate, f"{login}/{n}", allow_t3)]
+    for n in moved_held:
+        logs.append(f"t3-signoff:{estate.current(r.slug(f'{login}/{n}'))}")
+    public = [n for n in public if n not in moved_held]
     for n in names:
         if n != ".github" and estate.visibility(f"{login}/{n}") == "unknown":
             moving = estate.pending_move(f"{login}/{n}")
@@ -1809,11 +1833,15 @@ def labels_plan(estate: Estate, org: str, *, allow_t3: bool = False, checkouts:
         m = estate.meta(f"{login}/{n}")
         full = estate.current(f"{login}/{n}")  # labels are written where the repository is today
         current_owner, current_name = full.split("/", 1)
-        if not estate.resolver.same(current_owner, login) and estate.resolver.owner_status(current_owner) == "t3":
-            # An approved pending transfer: the label jobs target the T3 org that holds the repository today, so it
-            # passes that org's gate (--allow-t3 and, under --require-t3-signoff, its record; check_owner also
+        from . import signoff
+        if (signoff.required() and not estate.resolver.same(current_owner, login)
+                and estate.resolver.owner_status(current_owner) == "t3"):
+            # Under --require-t3-signoff only: an approved pending transfer whose label jobs target the T3 org that
+            # holds the repository today passes that org's gate (--allow-t3 and its record; check_owner also
             # registers the grant that stamps signoff_id on these jobs). The org gate above only saw LOGIN.
-            # (tests/test_t3_signoff_require.py::test_org_labels_gate_the_t3_owner_a_transfer_resolves_to)
+            # Without the flag the base behaviour is kept (no issue of epic #22 asks for a default-on change):
+            # tests/test_t3_signoff_require.py::test_org_labels_gate_the_t3_owner_a_transfer_resolves_to (flag on)
+            # and ::test_transfer_to_a_t3_org_is_unchanged_without_the_flag (flag off).
             from .errors import Refused
             try:
                 estate.resolver.check_owner(current_owner, allow_t3=allow_t3, repo=current_name)
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 5990640..889595a 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -174,12 +174,6 @@ def _slug(owner: str) -> str:
     return "me" if is_user(owner) else owner
 
 
-def _t3_granted(owner: str) -> bool:
-    """True unless `--require-t3-signoff` is on and no valid sign-off record covers the owner (signoff.py)."""
-    from . import signoff
-    return signoff.granted(owner)
-
-
 def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = False) -> str:
     """Targets of a write: never T3 without sign-off, never excluded or HOLD. Returns the resolved login."""
     if is_user(owner):
@@ -1088,7 +1082,10 @@ def lint(capture: dict, *, role: str = "org", owner: str | None = None, display_
 # estate-plan (§13.10): the cross-org personal Estate project on CompleteDotTech
 # =====================================================================================================
 def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
-    """In-scope orgs for the Estate's Org field: T1, T2, T2-R (T3 only after sign-off; never HOLD or excluded)."""
+    """In-scope orgs for the Estate's Org field: T1, T2, T2-R (T3 only after sign-off; never HOLD or excluded).
+    Under --require-t3-signoff a T3 org also needs a valid record, and its entry keeps that record's id as
+    `signoff_id` so estate_plan can carry it onto the jobs that bring the org into the personal board."""
+    from . import signoff
     out = []
     groups = (resolver.registry.get("profile") or {}).get("org_directory") or []
     keys = [o for g in groups for o in (g or {}).get("orgs") or []] or list(resolver.registry.get("orgs") or {})
@@ -1101,13 +1098,37 @@ def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
         except NeedsInput:
             continue
         tier = str(row.get("tier") or "").split()[0]
-        if tier == "T3" and not (allow_t3 and _t3_granted(key)):
-            continue
+        rec = None
+        if tier == "T3":
+            if not allow_t3:
+                continue
+            if signoff.required():
+                rec = signoff.record(key, None, resolver.aliases(key))
+                if rec is None:
+                    continue
         if tier in TIER_COLOR:
-            out.append({"login": resolver.canonical(key), "name": row.get("display_name") or key, "tier": tier})
+            entry = {"login": resolver.canonical(key), "name": row.get("display_name") or key, "tier": tier}
+            if rec is not None and rec.get("id"):
+                entry["signoff_id"] = str(rec["id"])
+            out.append(entry)
     return out
 
 
+def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
+    """Under --require-t3-signoff: each job that names a signed-off T3 org (its Org-field option, its login) carries
+    that org's record. The jobs target @me, so stamping by target owner never finds the T3 grant; several T3 orgs on
+    one job give `signoff_ids` (signoff.stamp_associations). No-op when no org carries a signoff_id.
+    (tests/test_t3_signoff_require.py::test_estate_plan_jobs_carry_the_t3_orgs_signoff)"""
+    from . import signoff
+    t3 = [o for o in orgs if o.get("signoff_id")]
+    if not t3:
+        return
+    for j in jobs:
+        blob = json.dumps(j, ensure_ascii=False)
+        ids = [o["signoff_id"] for o in t3 if o["name"] in blob or o["login"] in blob]
+        signoff.stamp_associations(j, ids)
+
+
 def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict | None = None, user_id: int | None = None,
                 approval_id: str | None = None, allow_t3: bool = False, reviewed: str | None = None) -> dict:
     orgs = estate_orgs(resolver, allow_t3=allow_t3)
@@ -1131,6 +1152,7 @@ def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict |
                                      [f"Open {url}/settings.", "Check that 'Visibility' reads Private; change nothing.",
                                       "Screenshot it into state/screens/projects/me/."], "project-check",
                                      "§13.2: the Estate stays private."))
+    _stamp_estate_orgs(plan["jobs"], orgs)
     return plan
 
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 0fe8174..54869d5 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -364,6 +364,36 @@ def _put(j: dict, rec: dict | None) -> None:
             j.setdefault("approval_id", str(rec["id"]))
 
 
+def stamp_associations(item: dict, association_ids, owner: str | None = None, repo: str | None = None) -> dict:
+    """Under the flag, name on ITEM (a writer job or a change record) every record that authorized it: OWNER's own
+    grant first (when OWNER/REPO is a signed-off T3 target), then each id in ASSOCIATION_IDS (a T3 org that ITEM
+    brings in without targeting it: topics.merge `signoff_ids` for an `also_in` membership topic, project.estate_plan
+    for a T3 org in the personal Estate's Org field). `signoff_id` is the first id and `signoff_ids` lists all of them
+    only when there is more than one. A writer job also gets `approval_id` = the first id unless it already has one
+    (an existing approval_id is never replaced). No-op when the flag is off or there are no association ids.
+    Shared by showcase.cmd_topics, intake.adopt and project.estate_plan
+    (tests/test_t3_signoff_require.py::test_adopt_topics_job_carries_the_also_in_signoff,
+    ::test_estate_plan_jobs_carry_the_t3_orgs_signoff)."""
+    if not association_ids or not required() or not isinstance(item, dict):
+        return item
+    own = record_for(owner, repo) if owner else None
+    ids = list(dict.fromkeys(([str(own["id"])] if own and own.get("id") else []) + [str(x) for x in association_ids]))
+    item["signoff_id"] = ids[0]
+    if len(ids) > 1:
+        item["signoff_ids"] = ids
+    if "phase" in item:
+        item.setdefault("approval_id", ids[0])
+    return item
+
+
+def record(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
+    """Under the flag, the valid record covering OWNER (and REPO), else None; registers no grant. None when off."""
+    if not required():
+        return None
+    rec, _ = evaluate([owner, *(aliases or [])], repo)
+    return rec
+
+
 def stamp_source(job: dict, full: str, aliases: list[str] | None = None) -> dict:
     """Under the flag, stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
     covering that repository. A star-List item job (org.star_list_plan) targets the personal account for some org's
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 3211a17..6fce659 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -481,13 +481,7 @@ def _stamp_signoff_ids(rec: dict, association_ids, ctx) -> None:
     own grant first (a T3 target) and then each T3 `also_in` association's (topics.merge `signoff_ids`).
     `signoff_id` is the first; `signoff_ids` lists all of them only when there is more than one."""
     from ctshowcase import signoff
-    if not association_ids or not signoff.required():
-        return
-    own = signoff.record_for(ctx.owner, ctx.repo)
-    ids = list(dict.fromkeys(([str(own["id"])] if own and own.get("id") else []) + list(association_ids)))
-    rec["signoff_id"] = ids[0]
-    if len(ids) > 1:
-        rec["signoff_ids"] = ids
+    signoff.stamp_associations(rec, association_ids, ctx.owner, ctx.repo)  # shared with intake.adopt
 
 
 def cmd_topics(args):
diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index 9012f84..4c5fbbe 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -1,190 +1,190 @@
-"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2)."""
-from __future__ import annotations
-
-import json
-import subprocess
-import sys
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
-META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
-
-
-def _run(tmp_path, *argv, owner="Pick-Your-AI"):
-    meta = tmp_path / "meta.json"
-    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
-    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT,
-                          capture_output=True, text=True, encoding="utf-8")
-
-
-def test_t3_owner_is_refused_without_the_flag(tmp_path):
-    for cmd in (["describe"], ["topics"], ["readme"],
-                ["banner", "--out", str(tmp_path / "b.png")]):
-        r = _run(tmp_path, *cmd)
-        assert r.returncode == 2, (cmd, r.stdout, r.stderr)
-        assert "co-owner sign-off" in r.stdout + r.stderr or "t3-signoff" in r.stdout + r.stderr
-
-
-def test_global_flag_lets_repository_commands_run(tmp_path):
-    for cmd in (["describe"], ["topics"]):
-        r = _run(tmp_path, "--allow-t3", *cmd)
-        assert r.returncode != 2, (cmd, r.stdout, r.stderr)
-        assert "t3-signoff" not in r.stdout + r.stderr
-
-
-def test_global_flag_renders_art_for_a_t3_owner(tmp_path):
-    out = tmp_path / "banner.png"
-    r = _run(tmp_path, "--allow-t3", "banner", "--out", str(out), "--allow-unmeasured", "--allow-few-chips")
-    assert r.returncode == 0, (r.stdout, r.stderr)
-    assert out.is_file() and out.stat().st_size > 10_000
-    assert "t3-signoff" not in r.stdout + r.stderr
-
-
-def test_flag_does_not_lift_excluded_owners(tmp_path):
-    r = _run(tmp_path, "--allow-t3", "describe", owner="BunsDev")
-    assert r.returncode == 2, (r.stdout, r.stderr)
-
-
-def test_doctor_reports_t3_cells_as_held_only_without_the_flag(tmp_path):
-    held = _run(tmp_path, "doctor", "--format", "json")
-    assert json.loads(held.stdout)["cells"]["R7"] == "hold", held.stdout
-    signed = _run(tmp_path, "--allow-t3", "doctor", "--format", "json")
-    assert json.loads(signed.stdout)["cells"]["R7"] != "hold", signed.stdout
-
-
-def test_signoff_does_not_outlive_the_invocation(tmp_path, capsys):
-    """`--allow-t3` holds for one main() call only: a later library call in the same process is refused again."""
-    import pytest
-    sys.path.insert(0, str(ROOT / "scripts"))
-    import showcase
-    from ctshowcase.config import load_brand, t3_signed_off
-    from ctshowcase.errors import Refused
-    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
-    capsys.readouterr()
-    assert t3_signed_off() is False
-    with pytest.raises(Refused):
-        load_brand().check_owner("Pick-Your-AI")
-
-
-def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
-    from ctshowcase.config import set_t3_signed_off
-    from ctshowcase.org import _star_held
-    from ctshowcase.resolver import Resolver
-    est = type("E", (), {"resolver": Resolver(brand, {"orgs": {}}, None)})()
-    assert _star_held(est, "Pick-Your-AI") == "t3"
-    assert _star_held(est, "Pick-Your-AI", allow_t3=True) is None
-    set_t3_signed_off(True)
-    try:
-        assert _star_held(est, "Pick-Your-AI") is None
-        assert _star_held(est, "BunsDev") == "excluded"  # sign-off never lifts an excluded owner
-    finally:
-        set_t3_signed_off(False)
-
-
-# Evidence note for reviewers: the seven tests above this line predate the ContextVar change
-# (they exist at 2be04ac, before be5cb14) and are regression guards for the CLI contract that
-# must keep passing. The five tests from here down are the discriminating ones: run against the
-# tree before be5cb14 they fail with ImportError on `reset_t3_signed_off`.
-
-
-def test_token_reset_restores_each_prior_value():
-    """set_t3_signed_off returns a token; reset_t3_signed_off restores exactly the value before that set."""
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    assert t3_signed_off() is False
-    outer = set_t3_signed_off(True)
-    inner = set_t3_signed_off(False)
-    assert t3_signed_off() is False
-    reset_t3_signed_off(inner)
-    assert t3_signed_off() is True
-    reset_t3_signed_off(outer)
-    assert t3_signed_off() is False
-
-
-def test_sign_off_is_invisible_to_a_separate_context():
-    """Sign-off is context-local: code run in a fresh copy of the context (as an embedding host would) stays unsigned."""
-    import contextvars
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    seen = []
-    token = set_t3_signed_off(True)
-    try:
-        assert t3_signed_off() is True
-        contextvars.Context().run(lambda: seen.append(t3_signed_off()))
-        assert seen == [False]
-        contextvars.copy_context().run(lambda: seen.append(t3_signed_off()))
-        assert seen == [False, True]
-    finally:
-        reset_t3_signed_off(token)
-    assert t3_signed_off() is False
-
-
-def test_sign_off_does_not_leak_to_a_thread_started_with_an_empty_context():
-    """A thread started while signed off must not see the sign-off on interpreters that do not inherit context."""
-    import sys
-    import threading
-    import pytest
-    if getattr(sys.flags, "thread_inherit_context", False):
-        pytest.skip("this interpreter's threads inherit the caller's context")
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    seen = []
-    token = set_t3_signed_off(True)
-    try:
-        worker = threading.Thread(target=lambda: seen.append(t3_signed_off()))
-        worker.start()
-        worker.join()
-    finally:
-        reset_t3_signed_off(token)
-    assert seen == [False]
-
-
-def test_main_restores_the_caller_sign_off_value(capsys):
-    """main() wraps one call in a token: whatever --allow-t3 set inside it is undone, and the caller's value is kept."""
-    import sys
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    sys.path.insert(0, str(ROOT / "scripts"))
-    import showcase
-    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
-    capsys.readouterr()
-    assert t3_signed_off() is False
-    token = set_t3_signed_off(True)
-    try:
-        assert showcase.main(["config"]) in (0, 1)
-        capsys.readouterr()
-        assert t3_signed_off() is True
-    finally:
-        reset_t3_signed_off(token)
-
-
-def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand):
-    """Acceptance: one thread signed off and one not behave independently; the unsigned one is refused for a T3 owner.
-
-    Each thread sets its own state explicitly, so this also runs where threads inherit the caller's context. The barrier
-    makes both threads hold their state at the same time before either calls the gate."""
-    import threading
-    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
-    from ctshowcase.errors import Refused
-    barrier = threading.Barrier(2, timeout=10)
-    out: dict[str, tuple] = {}
-
-    def worker(name, signed):
-        token = set_t3_signed_off(signed)
-        try:
-            barrier.wait()  # both states are live at once
-            try:
-                result = ("passed", brand.check_owner("Pick-Your-AI"))
-            except Refused as exc:
-                result = ("refused", exc.log)
-            barrier.wait()  # neither resets until both have checked
-            out[name] = (*result, t3_signed_off())
-        finally:
-            reset_t3_signed_off(token)
-
-    threads = [threading.Thread(target=worker, args=("signed", True)),
-               threading.Thread(target=worker, args=("unsigned", False))]
-    for t in threads:
-        t.start()
-    for t in threads:
-        t.join()
-    assert out["signed"] == ("passed", "t3", True), out
-    assert out["unsigned"] == ("refused", "t3-signoff", False), out
-    assert t3_signed_off() is False
+"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2)."""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+
+
+def _run(tmp_path, *argv, owner="Pick-Your-AI"):
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT,
+                          capture_output=True, text=True, encoding="utf-8")
+
+
+def test_t3_owner_is_refused_without_the_flag(tmp_path):
+    for cmd in (["describe"], ["topics"], ["readme"],
+                ["banner", "--out", str(tmp_path / "b.png")]):
+        r = _run(tmp_path, *cmd)
+        assert r.returncode == 2, (cmd, r.stdout, r.stderr)
+        assert "co-owner sign-off" in r.stdout + r.stderr or "t3-signoff" in r.stdout + r.stderr
+
+
+def test_global_flag_lets_repository_commands_run(tmp_path):
+    for cmd in (["describe"], ["topics"]):
+        r = _run(tmp_path, "--allow-t3", *cmd)
+        assert r.returncode != 2, (cmd, r.stdout, r.stderr)
+        assert "t3-signoff" not in r.stdout + r.stderr
+
+
+def test_global_flag_renders_art_for_a_t3_owner(tmp_path):
+    out = tmp_path / "banner.png"
+    r = _run(tmp_path, "--allow-t3", "banner", "--out", str(out), "--allow-unmeasured", "--allow-few-chips")
+    assert r.returncode == 0, (r.stdout, r.stderr)
+    assert out.is_file() and out.stat().st_size > 10_000
+    assert "t3-signoff" not in r.stdout + r.stderr
+
+
+def test_flag_does_not_lift_excluded_owners(tmp_path):
+    r = _run(tmp_path, "--allow-t3", "describe", owner="BunsDev")
+    assert r.returncode == 2, (r.stdout, r.stderr)
+
+
+def test_doctor_reports_t3_cells_as_held_only_without_the_flag(tmp_path):
+    held = _run(tmp_path, "doctor", "--format", "json")
+    assert json.loads(held.stdout)["cells"]["R7"] == "hold", held.stdout
+    signed = _run(tmp_path, "--allow-t3", "doctor", "--format", "json")
+    assert json.loads(signed.stdout)["cells"]["R7"] != "hold", signed.stdout
+
+
+def test_signoff_does_not_outlive_the_invocation(tmp_path, capsys):
+    """`--allow-t3` holds for one main() call only: a later library call in the same process is refused again."""
+    import pytest
+    sys.path.insert(0, str(ROOT / "scripts"))
+    import showcase
+    from ctshowcase.config import load_brand, t3_signed_off
+    from ctshowcase.errors import Refused
+    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
+    capsys.readouterr()
+    assert t3_signed_off() is False
+    with pytest.raises(Refused):
+        load_brand().check_owner("Pick-Your-AI")
+
+
+def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
+    from ctshowcase.config import set_t3_signed_off
+    from ctshowcase.org import _star_held
+    from ctshowcase.resolver import Resolver
+    est = type("E", (), {"resolver": Resolver(brand, {"orgs": {}}, None)})()
+    assert _star_held(est, "Pick-Your-AI") == "t3"
+    assert _star_held(est, "Pick-Your-AI", allow_t3=True) is None
+    set_t3_signed_off(True)
+    try:
+        assert _star_held(est, "Pick-Your-AI") is None
+        assert _star_held(est, "BunsDev") == "excluded"  # sign-off never lifts an excluded owner
+    finally:
+        set_t3_signed_off(False)
+
+
+# Evidence note for reviewers: the seven tests above this line predate the ContextVar change
+# (they exist at 2be04ac, before be5cb14) and are regression guards for the CLI contract that
+# must keep passing. The five tests from here down are the discriminating ones: run against the
+# tree before be5cb14 they fail with ImportError on `reset_t3_signed_off`.
+
+
+def test_token_reset_restores_each_prior_value():
+    """set_t3_signed_off returns a token; reset_t3_signed_off restores exactly the value before that set."""
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    assert t3_signed_off() is False
+    outer = set_t3_signed_off(True)
+    inner = set_t3_signed_off(False)
+    assert t3_signed_off() is False
+    reset_t3_signed_off(inner)
+    assert t3_signed_off() is True
+    reset_t3_signed_off(outer)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_is_invisible_to_a_separate_context():
+    """Sign-off is context-local: code run in a fresh copy of the context (as an embedding host would) stays unsigned."""
+    import contextvars
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        assert t3_signed_off() is True
+        contextvars.Context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False]
+        contextvars.copy_context().run(lambda: seen.append(t3_signed_off()))
+        assert seen == [False, True]
+    finally:
+        reset_t3_signed_off(token)
+    assert t3_signed_off() is False
+
+
+def test_sign_off_does_not_leak_to_a_thread_started_with_an_empty_context():
+    """A thread started while signed off must not see the sign-off on interpreters that do not inherit context."""
+    import sys
+    import threading
+    import pytest
+    if getattr(sys.flags, "thread_inherit_context", False):
+        pytest.skip("this interpreter's threads inherit the caller's context")
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    seen = []
+    token = set_t3_signed_off(True)
+    try:
+        worker = threading.Thread(target=lambda: seen.append(t3_signed_off()))
+        worker.start()
+        worker.join()
+    finally:
+        reset_t3_signed_off(token)
+    assert seen == [False]
+
+
+def test_main_restores_the_caller_sign_off_value(capsys):
+    """main() wraps one call in a token: whatever --allow-t3 set inside it is undone, and the caller's value is kept."""
+    import sys
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    sys.path.insert(0, str(ROOT / "scripts"))
+    import showcase
+    assert showcase.main(["--allow-t3", "config"]) in (0, 1)
+    capsys.readouterr()
+    assert t3_signed_off() is False
+    token = set_t3_signed_off(True)
+    try:
+        assert showcase.main(["config"]) in (0, 1)
+        capsys.readouterr()
+        assert t3_signed_off() is True
+    finally:
+        reset_t3_signed_off(token)
+
+
+def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand):
+    """Acceptance: one thread signed off and one not behave independently; the unsigned one is refused for a T3 owner.
+
+    Each thread sets its own state explicitly, so this also runs where threads inherit the caller's context. The barrier
+    makes both threads hold their state at the same time before either calls the gate."""
+    import threading
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
+    from ctshowcase.errors import Refused
+    barrier = threading.Barrier(2, timeout=10)
+    out: dict[str, tuple] = {}
+
+    def worker(name, signed):
+        token = set_t3_signed_off(signed)
+        try:
+            barrier.wait()  # both states are live at once
+            try:
+                result = ("passed", brand.check_owner("Pick-Your-AI"))
+            except Refused as exc:
+                result = ("refused", exc.log)
+            barrier.wait()  # neither resets until both have checked
+            out[name] = (*result, t3_signed_off())
+        finally:
+            reset_t3_signed_off(token)
+
+    threads = [threading.Thread(target=worker, args=("signed", True)),
+               threading.Thread(target=worker, args=("unsigned", False))]
+    for t in threads:
+        t.start()
+    for t in threads:
+        t.join()
+    assert out["signed"] == ("passed", "t3", True), out
+    assert out["unsigned"] == ("refused", "t3-signoff", False), out
+    assert t3_signed_off() is False
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index e65fc7a..9f474a5 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -37,9 +37,10 @@ def _bundle(tmp_path, records):
     return tmp_path / "bundle"
 
 
-def _run(tmp_path, bundle, *argv, owner=OWNER, env=None):
+def _run(tmp_path, bundle, *argv, owner=OWNER, env=None, meta_extra=None):
     meta = tmp_path / "meta.json"
-    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic", **(meta_extra or {}))),
+                    encoding="utf-8")
     e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
     e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
     e.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
@@ -201,7 +202,6 @@ def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
     from ctshowcase import signoff
     from ctshowcase.config import set_t3_signed_off, t3_signed_off
     from ctshowcase.org import _t3_granted as org_granted
-    from ctshowcase.project import _t3_granted as project_granted
     b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
     monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(b)))
     signoff.set_required(True)
@@ -209,7 +209,8 @@ def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
     try:
         assert not t3_signed_off("New-Login")  # nothing links the logins yet
         signoff.register_aliases(["New-Login", "Old-Login"])  # what Resolver.aliases does under the flag
-        assert t3_signed_off("New-Login") and org_granted("New-Login") and project_granted("New-Login")
+        assert t3_signed_off("New-Login") and org_granted("New-Login")
+        assert signoff.record("New-Login")["id"] == "t3s-10"  # what project.estate_orgs asks
     finally:
         set_t3_signed_off(False)
         signoff.set_required(False)
@@ -805,3 +806,108 @@ def test_file_envelope_follows_the_schema(tmp_path, doc, ok):
     jsonschema = pytest.importorskip("jsonschema")
     schema = json.loads((ROOT / "references" / "t3-signoff.schema.json").read_text(encoding="utf-8"))
     assert jsonschema.Draft202012Validator(schema).is_valid(doc) is ok
+
+
+# --- review round 4: evidence for each fixed finding (synthetic records only) ---
+
+def test_transfer_to_a_t3_org_is_unchanged_without_the_flag(monkeypatch, brand):
+    """Flag off (the default), no --allow-t3: a T1 member whose approved pending transfer resolves to the T3 org keeps
+    the base (2be04ac) behaviour. `org labels` plans its label jobs and the favorite and home entry stay public,
+    exactly as before this epic. The transfer-target T3 checks (org._t3_moved_held, the labels_plan gate) belong to
+    the opt-in --require-t3-signoff only: no issue of epic #22 (#31, #28, #23-#27) asks for a default-on tightening."""
+    from ctshowcase import org as O, signoff
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
+    monkeypatch.delenv("SHOWCASE_REQUIRE_T3_SIGNOFF", raising=False)
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    fav = f"{T1}/northwind-member"
+    est, reg = _transfer_estate(brand, favorites=[fav])
+    t3, req = set_t3_signed_off(False), signoff.set_required(False)
+    try:
+        res, _ = O.labels_plan(est, T1, allow_t3=False)
+        assert res["result"] == "plan" and not [x for x in res["repos"] if x.get("result") == "held"], res
+        assert [j for j in res["jobs"] if f"{OWNER}/northwind-member" in j.get("argv", [])], res["jobs"]
+        favs, logs = O.public_favorites(est, reg["orgs"][T1], allow_t3=False)
+        assert favs == [f"{OWNER}/northwind-member"] and not logs, (favs, logs)
+        data, logs = O.public_slice(est, T1, allow_t3=False)
+        assert f"{OWNER}/northwind-member" in json.dumps(data), data
+        assert not any(x.startswith("t3-signoff") for x in logs), logs
+    finally:
+        signoff.reset_required(req)
+        reset_t3_signed_off(t3)
+
+
+def test_home_repository_held_by_a_t3_org_is_omitted_without_its_record(tmp_path, monkeypatch, brand):
+    """`org profile CompleteTech-Skills` under --require-t3-signoff: northwind-member is homed in the T1 org but the
+    T3 org holds it today. public_slice built its home list through estate.is_public only, so with no record the
+    profile README and data still named Pick-Your-AI/northwind-member (featured and sections)."""
+    from ctshowcase import org as O
+    est, reg = _transfer_estate(brand)
+    reg["orgs"][T1].update(pins_public=["northwind-member"], sections=[{"title": "Tools", "repos": ["northwind-member"]}])
+    full = f"{OWNER}/northwind-member"
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
+        data, logs = O.public_slice(est, T1, allow_t3=True)
+        assert full not in json.dumps(data) and f"t3-signoff:{full}" in logs, (data, logs)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", [{"id": "t3s-home", "repos": ["northwind-member"]}]))):
+        data, logs = O.public_slice(est, T1, allow_t3=True)
+        assert [e["full_name"] for e in data["featured"]] == [full], data
+        assert f"t3-signoff:{full}" not in logs, logs
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "noflag", [{"id": "t3s-x"}])), allow_t3=False):
+        data, logs = O.public_slice(est, T1, allow_t3=False)  # a record alone is not --allow-t3
+        assert full not in json.dumps(data), data
+
+
+def test_adopt_topics_job_carries_the_also_in_signoff(tmp_path):
+    """`adopt` of a T1 repository whose metadata has also_in: [Pick-Your-AI]: the topics PUT job and change record
+    that add the T3 membership topic carry the T3 org's record. intake.adopt ignored topics.merge `signoff_ids`, and
+    target-owner stamping only sees the T1 owner."""
+    from ctshowcase.config import load_brand
+    from ctshowcase.topics import org_topic
+    topic = org_topic(load_brand(), OWNER)[1]
+    b = _bundle(tmp_path, [{"id": "t3s-adopt"}])
+    extra = {"also_in": [OWNER]}
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1,
+             meta_extra=extra)
+    obj = json.loads(r.stdout)
+    jobs = [j for j in obj["jobs"] if j["kind"] == "topics"]
+    recs = [x for x in obj["records"] if x.get("kind") == "topics"]
+    assert len(jobs) == 1 and any(topic in a for a in jobs[0]["argv"]), obj["jobs"]
+    assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "t3s-adopt", jobs
+    assert recs and all(x["signoff_id"] == "t3s-adopt" and "approval_id" not in x for x in recs), obj["records"]
+    # an existing approval_id on the job is kept
+    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic",
+             "--approval-id", "q-synthetic", owner=T1, meta_extra=extra)
+    jobs = [j for j in json.loads(r.stdout)["jobs"] if j["kind"] == "topics"]
+    assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "q-synthetic", jobs
+    # without the flag: nothing is stamped
+    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1, meta_extra=extra)
+    assert r.stdout and "signoff_id" not in r.stdout, _out(r)
+
+
+def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand):
+    """`project estate-plan --copied ...` with a signed-off T3 org in the registry: the Org-field job that brings
+    Pick Your AI into the personal board carries its record. _t3_granted only checked the record and stamping by
+    target owner looks at @me, so the job had neither signoff_id nor approval_id. Several T3 orgs on one job give
+    signoff_ids (signoff.stamp_associations)."""
+    from ctshowcase import project as PJ
+    from ctshowcase.config import load_yaml_text
+    from ctshowcase.resolver import Resolver
+    reg = load_yaml_text((ROOT / "tests" / "fixtures" / "org" / "registry.yaml").read_text(encoding="utf-8"))
+    reg["profile"]["org_directory"].append({"group": "T3", "orgs": [OWNER]})
+    reg["orgs"][OWNER] = {}
+    res = Resolver(brand, reg, {"rows": {("create-project", "@me", "*", "")}, "ids": set(), "answers": {},
+                                "actions": [], "extra": []})
+    cap = json.loads((ROOT / "tests" / "fixtures" / "project" / "estate-copy-capture.json").read_text(encoding="utf-8"))
+    name = brand.raw["orgs"][OWNER]["display_name"]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", [{"id": "t3s-board"}]))):
+        plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
+        t3 = [o for o in plan["orgs"] if o["login"] == OWNER]
+        assert t3 and t3[0]["signoff_id"] == "t3s-board", plan["orgs"]
+        named = [j for j in plan["jobs"] if OWNER in json.dumps(j) or name in json.dumps(j, ensure_ascii=False)]
+        assert any(j["id"].endswith("-field-org") for j in named), plan["jobs"]
+        assert all(j["signoff_id"] == "t3s-board" for j in named), named
+        assert all("signoff_id" not in j for j in plan["jobs"] if j not in named), plan["jobs"]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
+        plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
+        assert OWNER not in [o["login"] for o in plan["orgs"]] and OWNER not in json.dumps(plan["jobs"])
+    plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)  # flag off: included, nothing stamped
+    assert OWNER in [o["login"] for o in plan["orgs"]] and "signoff_id" not in json.dumps(plan)

From b71a0631dc68a331715c82a93d73a627146e37b6 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 12:53:21 -0400
Subject: [PATCH 20/79] Close sign-off review: gate renamed favorites, stamp T3
 destination Lists and aliases, match estate orgs by whole name, log ignored
 record file (#23, #25, #26)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 references/t3-signoff.md         |  5 ++
 scripts/ctshowcase/org.py        | 27 ++++++++--
 scripts/ctshowcase/project.py    | 36 ++++++++++++-
 scripts/ctshowcase/signoff.py    |  9 ++--
 scripts/showcase.py              |  5 ++
 tests/test_t3_signoff_require.py | 90 +++++++++++++++++++++++++++++++-
 6 files changed, 162 insertions(+), 10 deletions(-)

diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index a0e7764..30adaf1 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -6,6 +6,11 @@
 
 Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
 
+## Open maintainer decisions (not resolved by this change)
+
+- **Default off.** Enforcement is opt-in (`--require-t3-signoff`) because a behaviour-changing default stays off unless the issue says otherwise and no maintainer has asked for default-on. Flipping the default is a follow-up decision for #23 and #25; until it is recorded, a run without the flag is still trust-only.
+- **Canonical file path (#24, "Choose file path").** Not chosen: this is deferred to the maintainer, so the subtask stays open and the issue PR should not claim it. A record file given without `--require-t3-signoff` is never read; the run logs `t3-signoff:file-ignored` (and prints it on stderr in text mode) instead of looking enforced.
+
 ## Format
 
 The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are written bare (`2099-12-31`); convert them to ISO strings before validating with a generic JSON Schema validator. `scripts/ctshowcase/signoff.py` checks the same rules (`problems()`): a string date or timestamp must match the schema's `date` or `awareTimestamp` pattern before it is parsed, so compact (`20991231`) and week (`2099-W52-1`) forms are invalid in both. The one deliberate difference is that a pattern-shaped but impossible date (`2099-02-30`) is also invalid in the tool. Tests keep the two in step, including one that applies the schema's patterns without needing `jsonschema`.
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 1a0ea04..aad3a8a 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -393,7 +393,11 @@ def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     cur = estate.current(r.slug(full))
     owner, _, name = cur.partition("/")
     if r.same(owner, full.split("/")[0]):
-        return False  # not moving to another org: the named check in _t3_held (or the org gate) covers it
+        # same org: the named slug was checked by _t3_held, but a pending rename emits the slug it has today, so that
+        # name needs the record too (tests/test_t3_signoff_require.py::test_pending_rename_is_gated_on_the_emitted_name)
+        if name.lower() == full.partition("/")[2].lower():
+            return False
+        return r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name))
     return r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name))
 
 
@@ -1536,7 +1540,8 @@ def _list_complete(node: dict) -> bool:
     return isinstance(total, int) and total <= len([x for x in items["nodes"] if x])
 
 
-def _estate_list_targets(estate: Estate, nodes: list[dict], *, allow_t3: bool = False) -> dict[str, set[str]]:
+def _estate_list_targets(estate: Estate, nodes: list[dict], *, allow_t3: bool = False,
+                         signoffs: dict[str, str] | None = None) -> dict[str, set[str]]:
     """{favorite (lower): ids of every captured estate star List that some org's plan puts it on}. An
     updateUserListsForItem job replaces the item's whole set, so each org's job carries every estate List the item
     belongs on, and two orgs sharing a favorite never undo each other whichever job runs last."""
@@ -1552,6 +1557,11 @@ def _estate_list_targets(estate: Estate, nodes: list[dict], *, allow_t3: bool =
         node = by_name.get(ent["name"].lower())
         if node is None:
             continue  # created later: its own plan, after a re-capture, adds the item with the union then
+        if signoffs is not None and r.owner_status(key) == "t3":  # list id -> the record that admitted this T3 org
+            from . import signoff
+            rec = signoff.record(key, None, r.aliases(key))
+            if rec is not None and rec.get("id"):
+                signoffs[node["id"]] = str(rec["id"])
         for f in public_favorites(estate, reg or {}, allow_t3=allow_t3)[0]:
             out.setdefault(f.lower(), set()).add(node["id"])
     return out
@@ -1630,7 +1640,8 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
                                "needs": "a complete star_lists capture (every List's items.totalCount captured)"})
         return dict(out, result="needs-input", list_id=list_id,
                     logs=sorted(set(fav_logs) | {"needs-input:star-lists-items-paged"}))
-    targets = _estate_list_targets(estate, nodes, allow_t3=allow_t3)
+    list_signoffs: dict[str, str] = {}
+    targets = _estate_list_targets(estate, nodes, allow_t3=allow_t3, signoffs=list_signoffs)
     member_of: dict[str, set[str]] = {}
     ids: dict[str, str] = {k.lower(): v for k, v in (repo_ids or {}).items()}
     for n in nodes:
@@ -1656,9 +1667,17 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
                    ["gh", "api", "graphql", "-f", f"query={q}"], org=USER_LOGIN,
                    note=f"Add {f} to '{name}', keeping its {len(have)} other list(s) and every estate star "
                         "List that also takes it (union; never unstar).")
+        from . import signoff
         if r.owner_status(f.split("/")[0]) == "t3":  # a T3 favorite carries its own record (signoff.stamp_source)
-            from . import signoff
             signoff.stamp_source(item, f, r.aliases(f.split("/")[0]))
+        added = sorted(i for i in targets.get(f.lower(), set()) - have - {list_id} if i in list_signoffs)
+        if added and signoff.required():  # a newly added T3 destination List carries the record that admitted it
+            ids = [item["signoff_id"]] if "signoff_id" in item else []
+            if not ids and r.owner_status(login) == "t3":
+                own = signoff.record(login, None, r.aliases(login))
+                ids = [str(own["id"])] if own and own.get("id") else []
+            item.pop("signoff_id", None)
+            signoff.stamp_associations(item, ids + [list_signoffs[i] for i in added])
         out["jobs"].append(item)
     return dict(out, result="incomplete" if incomplete else "ok", list_id=list_id)
 
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 889595a..d3ac384 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1114,6 +1114,37 @@ def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
     return out
 
 
+TIER_PREFIX_T3 = "T3: "  # the Org-field option description is "{tier}: {login}" (estate_plan)
+_QUOTED = re.compile(r'"((?:[^"\\]|\\.)*)"')
+
+
+def _job_tokens(job: dict) -> set[str]:
+    """Whole values a job names, lowercased: every string in it, the value of a `key=value` argv element and every
+    double-quoted literal inside a GraphQL string. An org matches only a whole token, never a substring, so a job
+    for `Acme-Tools` or `Acme Tools` is not credited to a T3 org named `Acme`
+    (tests/test_t3_signoff_require.py::test_estate_plan_stamping_matches_whole_names_not_substrings)."""
+    out: set[str] = set()
+
+    def walk(v):
+        if isinstance(v, str):
+            out.add(v.lower())
+            out.add(v.partition("=")[2].lower())
+            for m in _QUOTED.finditer(v):
+                try:
+                    out.add(json.loads(m.group(0)).lower())
+                except ValueError:
+                    out.add(m.group(1).lower())
+        elif isinstance(v, dict):
+            for x in v.values():
+                walk(x)
+        elif isinstance(v, (list, tuple)):
+            for x in v:
+                walk(x)
+    walk(job)
+    out.discard("")
+    return out
+
+
 def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
     """Under --require-t3-signoff: each job that names a signed-off T3 org (its Org-field option, its login) carries
     that org's record. The jobs target @me, so stamping by target owner never finds the T3 grant; several T3 orgs on
@@ -1124,8 +1155,9 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
     if not t3:
         return
     for j in jobs:
-        blob = json.dumps(j, ensure_ascii=False)
-        ids = [o["signoff_id"] for o in t3 if o["name"] in blob or o["login"] in blob]
+        tokens = _job_tokens(j)
+        ids = [o["signoff_id"] for o in t3 if o["name"].lower() in tokens or o["login"].lower() in tokens
+               or f"{TIER_PREFIX_T3}{o['login']}".lower() in tokens]
         signoff.stamp_associations(j, ids)
 
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 54869d5..b781740 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -327,9 +327,12 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
 
 
 def record_for(owner: str, repo: str | None = None) -> dict | None:
-    for rec in _granted().get((owner or "").lower(), ()):
-        if _covers(rec, repo, _expand([owner or ""])):
-            return rec
+    logins = _expand([owner or ""])  # a grant cached under a former login still applies once the alias is registered
+    granted = _granted()
+    for login in dict.fromkeys([(owner or "").lower(), *logins]):
+        for rec in granted.get(login, ()):
+            if _covers(rec, repo, logins):
+                return rec
     return None
 
 
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 6fce659..ddf0451 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -1269,6 +1269,11 @@ def _main(argv=None) -> int:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
     if obj is not None:
+        if not signoff.required() and signoff.record_file() is not None:  # a file nobody enforces is not silently ignored
+            obj["logs"] = [*(obj.get("logs") or []), "t3-signoff:file-ignored"]
+            if args.format == "text" and not args.quiet:
+                print("t3-signoff:file-ignored: a sign-off record file was given without --require-t3-signoff, "
+                      "so no record is read or enforced", file=sys.stderr)
         for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
             if signoff.required() and isinstance(obj.get(key), list):
                 signoff.stamp(obj[key])
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 9f474a5..673e1f0 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -104,7 +104,7 @@ def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
 def test_default_is_unchanged_without_the_new_flag(tmp_path):
     """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
     r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+    assert r.returncode != 2 and "t3-signoff" not in _out(r).replace("t3-signoff:file-ignored", ""), _out(r)
 
 
 def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
@@ -911,3 +911,91 @@ def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand
         assert OWNER not in [o["login"] for o in plan["orgs"]] and OWNER not in json.dumps(plan["jobs"])
     plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)  # flag off: included, nothing stamped
     assert OWNER in [o["login"] for o in plan["orgs"]] and "signoff_id" not in json.dumps(plan)
+
+
+# --- review round 5: evidence for each fixed finding (synthetic records and slugs only) ---
+
+def test_signoff_file_without_the_flag_is_logged_not_silently_ignored(tmp_path):
+    """A record file given without --require-t3-signoff is never read; the run says so instead of looking enforced."""
+    b = _bundle(tmp_path, [{"id": "t3s-ign", "expires": "2020-01-01"}])
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff:file-ignored" in _out(r), _out(r)
+    r = _run(tmp_path, b, "--allow-t3", "--require-t3-signoff", "describe")  # enforced: expired record refuses
+    assert r.returncode == 2 and "file-ignored" not in _out(r), _out(r)
+    r = _run(tmp_path, None, "--allow-t3", "describe")  # no file at all: nothing to report
+    assert "file-ignored" not in _out(r), _out(r)
+
+
+def test_estate_plan_stamping_matches_whole_names_not_substrings(tmp_path, monkeypatch):
+    """A job that names `Acme Tools` / `Acme-Tools` must not be credited to a T3 org named `Acme`."""
+    from ctshowcase import project as PJ
+    orgs = [{"login": "Acme", "name": "Acme", "tier": "T3", "signoff_id": "t3s-acme"},
+            {"login": "Acme-Tools", "name": "Acme Tools", "tier": "T1"}]
+    jobs = [{"id": "other", "phase": 1, "argv": ["gh", "x", "name=Acme Tools"], "note": "Acme-Tools and Acme Tools"},
+            {"id": "own", "phase": 1, "argv": ["gh", "api", "graphql", "-f", 'query=m { o: [{name: "Acme", description: "T3: Acme"}] }']},
+            {"id": "plain", "phase": 1, "argv": ["gh", "x", "name=Acme"]}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, [{"id": "t3s-acme", "owner": "Acme"}]))):
+        PJ._stamp_estate_orgs(jobs, orgs)
+    got = {j["id"]: j.get("signoff_id") for j in jobs}
+    assert got == {"other": None, "own": "t3s-acme", "plain": "t3s-acme"}, got
+    assert "approval_id" not in jobs[0], jobs[0]
+
+
+def test_pending_rename_is_gated_on_the_emitted_name(tmp_path, monkeypatch, brand):
+    """A favorite named under its new name, while metadata and the emitted slug are the old name: a record scoped to
+    the new name alone must not let the old name into public (same owner, so the transfer check skipped it)."""
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    fav = f"{OWNER}/new-name"
+    approvals = {"rows": set(), "ids": {"rn-synthetic"}, "answers": {}, "extra": [], "actions": [
+        {"id": "rn-synthetic", "action": "rename", "owner": OWNER, "repo": "old-name", "new_name": "new-name"}]}
+    reg = {"orgs": {"Northwind-Trading-Co": {"favorites": [{"full_name": fav}],
+                                             "star_list": {"name": "Misc", "description": ""}}}}
+    est = O.Estate(brand, Resolver(brand, reg, approvals),
+                   {"m": {"owner": OWNER, "repo": "old-name", "visibility": "public"}})
+    assert est.current(fav) == f"{OWNER}/old-name"
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "new", [{"id": "t3s-new", "repos": ["new-name"]}]))):
+        favs, logs = O.public_favorites(est, reg["orgs"]["Northwind-Trading-Co"], allow_t3=True)
+        assert favs == [] and logs == [f"t3-signoff:{fav}"], (favs, logs)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "both", [{"id": "t3s-both", "repos": ["new-name", "old-name"]}]))):
+        favs, _ = O.public_favorites(est, reg["orgs"]["Northwind-Trading-Co"], allow_t3=True)
+        assert favs == [f"{OWNER}/old-name"], favs
+    favs, _ = O.public_favorites(est, reg["orgs"]["Northwind-Trading-Co"], allow_t3=True)  # flag off: unchanged
+    assert favs == [f"{OWNER}/old-name"], favs
+
+
+def test_record_for_follows_an_alias_registered_after_the_grant(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, [{"id": "t3s-al"}]))):
+        signoff.require(OWNER)
+        assert signoff.record_for("Renamed-Org") is None
+        signoff.register_aliases([OWNER, "Renamed-Org"])
+        assert signoff.record_for("Renamed-Org")["id"] == "t3s-al"
+        job = {"phase": 1, "org": "Renamed-Org"}
+        assert signoff.stamp([job])[0]["signoff_id"] == "t3s-al"
+
+
+def test_list_union_job_carries_the_signoff_of_a_t3_destination_list(tmp_path, monkeypatch, brand):
+    """Two orgs share a public T1 favorite; `org pins` for the T1 org adds it to the T3 org's existing List as well.
+    That membership needs the T3 org's record on the job."""
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    t1, fav = "Northwind-Trading-Co", "Northwind-Trading-Co/shared-synthetic"
+    reg = {"orgs": {t1: {"favorites": [{"full_name": fav}], "star_list": {"name": "Misc", "description": ""}},
+                    OWNER: {"favorites": [{"full_name": fav}], "star_list": {"name": "Built on", "description": ""}}}}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "actions": [], "extra": []}),
+                   {"m": {"owner": t1, "repo": "shared-synthetic", "visibility": "public"}})
+    def lst(i, n):
+        return {"id": i, "name": n, "slug": n.lower(), "description": "", "isPrivate": False,
+                "items": {"totalCount": 0, "nodes": []}}
+    lists = {"data": {"viewer": {"login": "x", "lists": {"totalCount": 2, "nodes": [lst("UL_t1", "Misc"), lst("UL_t3", "Built on")]}}}}
+    ids = {fav: "R_shared"}
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", [{"id": "t3s-dest"}]))):
+        plan = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=True, repo_ids=ids)
+        items = [j for j in plan["jobs"] if "list-item" in j["id"]]
+        assert len(items) == 1 and "UL_t3" in items[0]["argv"][-1], plan["jobs"]
+        assert items[0]["signoff_id"] == "t3s-dest", items
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", [])), allow_t3=False):
+        plan = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=False, repo_ids=ids)
+        items = [j for j in plan["jobs"] if "list-item" in j["id"]]
+        assert items and "UL_t3" not in items[0]["argv"][-1] and "signoff_id" not in items[0], items

From bdcca23c28e9133c6a95f09a87031aa29b4c3690 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 13:00:22 -0400
Subject: [PATCH 21/79] docs: make T3 sign-off enforcement default-on and
 document canonical path

Rewrite references/t3-signoff.md to the agreed interface: --require-t3-signoff
is on by default, the canonical record file is <estate_root>/decisions/
t3-signoffs.yaml (resolver.estate_root(); SHOWCASE_ESTATE_ROOT or the skill's
parent bundle), and --t3-signoff-file / SHOWCASE_T3_SIGNOFF_FILE override it.
Removes the resolved open-decision section. Format, YAML example and
synthetic-fixture note are unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 references/t3-signoff.md | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 30adaf1..00dd4f7 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,15 +1,10 @@
 # T3 sign-off records (`--require-t3-signoff`)
 
-`--allow-t3` alone is trust-only: the operator asserts that a co-owner signed off. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) makes the tool verify that claim against a record file. Without the flag nothing here applies and `--allow-t3` behaves as before.
+`--allow-t3` is enforced by default. The tool requires `--require-t3-signoff` to be on (it is on by default) and verifies the operator's claim that a co-owner signed off against a record file. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
-Pass the file explicitly: the global `--t3-signoff-file PATH`, or `SHOWCASE_T3_SIGNOFF_FILE=PATH`. **There is no default location.** The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories), but the canonical path inside the bundle is still the maintainer's choice. Until it is chosen, the tool never picks a file on its own, and `--require-t3-signoff` without a file refuses with `t3-signoff:no-file`. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
-
-## Open maintainer decisions (not resolved by this change)
-
-- **Default off.** Enforcement is opt-in (`--require-t3-signoff`) because a behaviour-changing default stays off unless the issue says otherwise and no maintainer has asked for default-on. Flipping the default is a follow-up decision for #23 and #25; until it is recorded, a run without the flag is still trust-only.
-- **Canonical file path (#24, "Choose file path").** Not chosen: this is deferred to the maintainer, so the subtask stays open and the issue PR should not claim it. A record file given without `--require-t3-signoff` is never read; the run logs `t3-signoff:file-ignored` (and prints it on stderr in text mode) instead of looking enforced.
+The canonical private path is `<estate_root>/decisions/t3-signoffs.yaml`, where the estate root is `resolver.estate_root()`: `SHOWCASE_ESTATE_ROOT` when set, otherwise the skill's parent bundle. An explicit `--t3-signoff-file PATH` or `SHOWCASE_T3_SIGNOFF_FILE=PATH` overrides the canonical path. The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories). Never copy a record into a repository. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
 
 ## Format
 
@@ -46,7 +41,7 @@ Each refusal exits 2 with result `refused`.
 
 | Log | Meaning |
 |---|---|
-| `t3-signoff:no-file` | the flag is on but no record file was given |
+| `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
 | `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
 | `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
@@ -54,4 +49,4 @@ Each refusal exits 2 with result `refused`.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
 
-Under `--require-t3-signoff` only, the owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). Without the flag those cases behave as before. A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.
+The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.

From e0d5f845889e99ef4f2625e7c8f451687b1fa7cf Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 13:23:17 -0400
Subject: [PATCH 22/79] Make T3 sign-off enforcement default-on with a
 canonical private record path (#23, #24, #25, #26, #27)

--allow-t3 now needs a valid, unexpired record by default. The record file resolves
as --t3-signoff-file, then SHOWCASE_T3_SIGNOFF_FILE, then
<estate root>/decisions/t3-signoffs.yaml; a missing file or unavailable estate root
refuses t3-signoff:no-file naming the path and the tool never creates the file.
--no-require-t3-signoff (or SHOWCASE_REQUIRE_T3_SIGNOFF=0) is the explicit, logged
opt-out. OWNER/NAME repositories are covered only by the record's own org, and
estate-plan stamping ignores display names shared with another org. Existing
trust-only tests use a synthetic record fixture; docs and CHANGELOG updated.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |   3 +-
 ONBOARDING.md                          |   2 +-
 SKILL.md                               |   6 +-
 references/constraints.md              |   2 +-
 references/labels.md                   |   2 +-
 references/org.md                      |   2 +-
 references/t3-signoff.md               |   6 +-
 scripts/ctshowcase/project.py          |   8 +-
 scripts/ctshowcase/signoff.py          |  73 +++++++----
 scripts/showcase.py                    |  25 ++--
 tests/conftest.py                      |  32 +++++
 tests/test_allow_t3_docs.py            |  22 +++-
 tests/test_allow_t3_global.py          |  16 ++-
 tests/test_meta_recency.py             |   2 +-
 tests/test_org.py                      |   2 +-
 tests/test_project.py                  |   2 +-
 tests/test_resolver.py                 |   2 +-
 tests/test_review_sweep_org_project.py |   2 +-
 tests/test_t3_signoff_default.py       | 173 +++++++++++++++++++++++++
 tests/test_t3_signoff_require.py       |  61 +++++----
 20 files changed, 362 insertions(+), 81 deletions(-)
 create mode 100644 tests/test_t3_signoff_default.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a99c8da..cf2f528 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,8 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Opt-in `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`): `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A T3 association carries that org's record (`signoff_id`): the topics change record of `topics --also-in`, `adopt`'s topics job and change record for an `also_in` T3 org (an existing `approval_id` is kept), and the `project estate-plan` jobs that add a T3 org to the Estate's Org field. Under the flag only, a repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff:<why>`), and `org profile` and star Lists omit it as a home repository or favorite until the T3 org's record covers it. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. The one escape is the explicit opt-out `--no-require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), logged `t3-signoff:opt-out`; `--require-t3-signoff` is still accepted. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. `t3-signoff:file-ignored` now appears only when an explicit file is given while opted out. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name.
+- Earlier, opt-in form of the above (superseded by the default-on entry): `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`) with the file named by `--t3-signoff-file PATH`. `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A T3 association carries that org's record (`signoff_id`): the topics change record of `topics --also-in`, `adopt`'s topics job and change record for an `also_in` T3 org (an existing `approval_id` is kept), and the `project estate-plan` jobs that add a T3 org to the Estate's Org field. Under the flag only, a repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff:<why>`), and `org profile` and star Lists omit it as a home repository or favorite until the T3 org's record covers it. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/ONBOARDING.md b/ONBOARDING.md
index 89465dd..aa9e3f1 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -68,7 +68,7 @@ For a multi-skill handoff, preserve the source facts, artifact paths, `logs[]` c
 
 ## Safety and permissions
 
-The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the opt-in `--require-t3-signoff --t3-signoff-file PATH` also checks that claim against a sign-off record file ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
+The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the claim is checked by default against a sign-off record in the private estate bundle (`decisions/t3-signoffs.yaml`, or `--t3-signoff-file PATH`; `--no-require-t3-signoff` is the explicit opt-out) ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
 
 ## Troubleshooting and verification
 
diff --git a/SKILL.md b/SKILL.md
index e4c992a..64bc627 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -73,7 +73,7 @@ Run every command **from inside the target repository's checkout**, with the ski
 
 | Step | Command | Gate |
 |---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. With the opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`), `--allow-t3` also needs a valid, unexpired record in the file named by the global `--t3-signoff-file PATH` (or `SHOWCASE_T3_SIGNOFF_FILE`; no default location until the maintainer chooses one), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope`. Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. `--allow-t3` also needs, by default, a valid, unexpired record in the private estate file `<estate root>/decisions/t3-signoffs.yaml` (or the file named by the global `--t3-signoff-file PATH` / `SHOWCASE_T3_SIGNOFF_FILE`, which overrides it), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope` (`no-file` names the resolved path; the tool never creates the file). Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
 | 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
 | 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
 | 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; it is never read from a config file or environment. The opt-in global `--require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=1`; default off) tightens it: `--allow-t3` is then honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when no `--t3-signoff-file` is given, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)); writer jobs then carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` stays read-only and shows the record as `signoff_id`. The record file is read, never copied; its canonical place in the estate bundle is still the maintainer's choice, so it is always named explicitly.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` and the opt-out `SHOWCASE_REQUIRE_T3_SIGNOFF=0` are). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores trust-only `--allow-t3` for that run and is logged `t3-signoff:opt-out`; writer jobs then carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` stays read-only and shows the record as `signoff_id`. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
@@ -165,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff | --no-require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/constraints.md b/references/constraints.md
index 49d526a..ab299dc 100644
--- a/references/constraints.md
+++ b/references/constraints.md
@@ -26,7 +26,7 @@ Condensed from `ct-std-v1` §10 and §12. The skill proposes; a single serialize
 1. **One serialized writer queue** for every REST call, git push and UI write. Planners and this skill emit change records.
 2. **Change record:** `{std, owner, repo, kind: api|file|ui, target, before_sha256, after, rule}`. The writer rejects a record whose `before` no longer matches the live state. Commands that propose writes take `--records FILE`.
 3. **Diff first.** GET, compute the delta, write only the delta, GET again to verify. Never write a value that is already equal.
-4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (with the opt-in `--require-t3-signoff`: `t3-signoff:no-file|missing|invalid|expired|scope`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
+4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (enforced by default; `--no-require-t3-signoff` opts out: `t3-signoff:no-file|missing|invalid|expired|scope`, plus `t3-signoff:opt-out` when opted out, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
 5. **Never commit logs** or the moves list to a public repository: they name private repositories.
 
 ## Content commits
diff --git a/references/labels.md b/references/labels.md
index 3d593e8..fa8276e 100644
--- a/references/labels.md
+++ b/references/labels.md
@@ -15,7 +15,7 @@ GitHub limits: hex colours without `#`; descriptions at most 100 characters; ren
 - **`.github` repos** always get the standard set, whatever their `has_issues`.
 - **AI-Ascension:** keeps its `labels.yml` and color tokens. R6 there means only that `dependencies` exists (`0366d6`, the standard set description); its Dependabot configs use `labels: ["dependencies"]`.
 - **Don't apply** to T2-R, T3, HOLD, forks or archived repos.
-- `labels --plan` (one repository) applies the same gates as `org labels`: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off, as `org labels` refuses it without `--allow-t3`; AI-Ascension gets only the `dependencies` create or patch; a repository with `has_issues: false` other than `.github`, forks, archived repositories (`archived`), T2-R and romgenie repositories answer `n/a`. Metadata without labels (a missing key, or `[]`, which is also what a failed capture records) is never planned against: whenever argv, writer jobs (`--jobs`), records (`--records`) or `gh` lines leave, `labels` reads the live labels first (read-only GET) and exits 4 (`needs-input:gh`) when it cannot. Writer job ids come from the operation (`p3.2-OWNER__REPO-label-<create|edit>-<name>[-to-<new>]-<hash8>` for `labels --plan` and `org labels`, `p3:label:OWNER__REPO:<create|edit>:<name>[-to-<new>]:<hash8>` for `adopt`), so a re-plan never reuses an id for other content.
+- `labels --plan` (one repository) applies the same gates as `org labels`: a family on hold is refused (exit 2) unless `--allow-hold`; a T3 owner is refused (exit 2, `t3-signoff`) until co-owner sign-off, as `org labels` refuses it without `--allow-t3` (and, with it, without a valid record in the estate sign-off file, `t3-signoff:<why>`; [t3-signoff.md](t3-signoff.md)); AI-Ascension gets only the `dependencies` create or patch; a repository with `has_issues: false` other than `.github`, forks, archived repositories (`archived`), T2-R and romgenie repositories answer `n/a`. Metadata without labels (a missing key, or `[]`, which is also what a failed capture records) is never planned against: whenever argv, writer jobs (`--jobs`), records (`--records`) or `gh` lines leave, `labels` reads the live labels first (read-only GET) and exits 4 (`needs-input:gh`) when it cannot. Writer job ids come from the operation (`p3.2-OWNER__REPO-label-<create|edit>-<name>[-to-<new>]-<hash8>` for `labels --plan` and `org labels`, `p3:label:OWNER__REPO:<create|edit>:<name>[-to-<new>]:<hash8>` for `adopt`), so a re-plan never reuses an id for other content.
 - **Org default labels** [UI]: all T1 orgs and the T2 product orgs except AI-Ascension, which uses its own `labels.yml`. None for the romgenie orgs or CompleteDotTech. Removing GitHub's default entries from org defaults is exempt from the approval list.
 
 ## The standard set: 23 labels
diff --git a/references/org.md b/references/org.md
index 78e2371..a92dccb 100644
--- a/references/org.md
+++ b/references/org.md
@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent.
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope` otherwise, see [t3-signoff.md](t3-signoff.md)); `--no-require-t3-signoff` is the explicit opt-out.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 00dd4f7..3b7d087 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,10 +1,10 @@
 # T3 sign-off records (`--require-t3-signoff`)
 
-`--allow-t3` is enforced by default. The tool requires `--require-t3-signoff` to be on (it is on by default) and verifies the operator's claim that a co-owner signed off against a record file. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores the trust-only meaning of `--allow-t3` for that run and is logged `t3-signoff:opt-out`; the two flags together are a usage error. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
-The canonical private path is `<estate_root>/decisions/t3-signoffs.yaml`, where the estate root is `resolver.estate_root()`: `SHOWCASE_ESTATE_ROOT` when set, otherwise the skill's parent bundle. An explicit `--t3-signoff-file PATH` or `SHOWCASE_T3_SIGNOFF_FILE=PATH` overrides the canonical path. The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories). Never copy a record into a repository. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
+The canonical private path is `<estate_root>/decisions/t3-signoffs.yaml`, where the estate root is `resolver.estate_root()`: `SHOWCASE_ESTATE_ROOT` when set, otherwise the skill's parent bundle. The order is the explicit `--t3-signoff-file PATH`, then `SHOWCASE_T3_SIGNOFF_FILE=PATH`, then the canonical path. When no estate root resolves there is no default path and the refusal is `t3-signoff:no-file` saying so; the flag is never trusted instead. The tool reads the file and never creates it. The records belong in the private estate bundle (issue 24: tracked there, never copied into target repositories). Never copy a record into a repository. Real records come only from the estate bundle; the files under `tests/fixtures/t3-signoff/` are synthetic.
 
 ## Format
 
@@ -44,7 +44,7 @@ Each refusal exits 2 with result `refused`.
 | `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
 | `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
-| `t3-signoff:scope` | the owner has valid approved records but none covers the repository |
+| `t3-signoff:scope` | the owner has valid approved records but none covers the repository; an `OWNER/NAME` repository is covered only when that owner is the record's org (only `*` covers another account's repository) |
 | `t3-signoff:expired` | every covering record is past `expires` |
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index d3ac384..5cd0e0b 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1156,8 +1156,12 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
         return
     for j in jobs:
         tokens = _job_tokens(j)
-        ids = [o["signoff_id"] for o in t3 if o["name"].lower() in tokens or o["login"].lower() in tokens
-               or f"{TIER_PREFIX_T3}{o['login']}".lower() in tokens]
+        # a name that is also another org's login or display name is ambiguous: only that org's login or its
+        # `T3: login` description credits the job (exact identity, never a shared label)
+        others = {x.lower() for o in orgs if not o.get("signoff_id") for x in (o["login"], o["name"])}
+        ids = [o["signoff_id"] for o in t3
+               if o["login"].lower() in tokens or f"{TIER_PREFIX_T3}{o['login']}".lower() in tokens
+               or (o["name"].lower() in tokens and o["name"].lower() not in others)]
         signoff.stamp_associations(j, ids)
 
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index b781740..f73a646 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -1,12 +1,13 @@
-"""Opt-in T3 sign-off verification (`--require-t3-signoff`, env SHOWCASE_REQUIRE_T3_SIGNOFF=1; issue 23).
+"""Default-on T3 sign-off verification (`--allow-t3` needs a record; issue 23, tasks 24-27).
 
-Off by default: nothing here runs and `--allow-t3` keeps its original meaning (tests/test_allow_t3_global.py).
-When on, `--allow-t3` is honoured only while the sign-off record file holds a valid, unexpired record for the owner
-(and the repository when the record is scoped). The file is passed explicitly with the global `--t3-signoff-file PATH`
-(env SHOWCASE_T3_SIGNOFF_FILE). There is deliberately no default location: issue 24 leaves the canonical path inside
-the estate bundle to the maintainer, so the tool never picks one (tests/test_t3_signoff_require.py
-::test_no_record_file_refuses_without_a_default). The file is read, never copied. Format (the contract is
-references/t3-signoff.schema.json, described in references/t3-signoff.md)::
+On by default: `--allow-t3` is honoured only while the sign-off record file holds a valid, unexpired record for the
+owner (and the repository when the record is scoped). The record file is the private estate file
+`<estate_root>/decisions/t3-signoffs.yaml` (default_record_path(); estate_root is resolver.estate_root()). An explicit
+`--t3-signoff-file PATH` (env SHOWCASE_T3_SIGNOFF_FILE) overrides it. The order is: the explicit flag, then the env,
+then the default. The tool never creates the file and never falls back to trusting the flag when it is absent.
+The one opt-out is explicit: `--no-require-t3-signoff` or env SHOWCASE_REQUIRE_T3_SIGNOFF=0, which restores the
+trust-only meaning of `--allow-t3` for that run (tests/test_t3_signoff_default.py). The file is read, never copied.
+Format (the contract is references/t3-signoff.schema.json, described in references/t3-signoff.md)::
 
     signoffs:
       - id: t3s-001                 # carried onto writer jobs and change records as `signoff_id`
@@ -18,7 +19,7 @@
         expires: 2099-12-31         # a date (valid through that day) or a timestamp with a UTC offset
         note: "optional free text"
 
-Refusals are exit 2 with log `t3-signoff:no-file` (no record file was given), `t3-signoff:missing` (no approved record
+Refusals are exit 2 with log `t3-signoff:no-file` (no record file at the resolved path, or no estate root to resolve one; the log names the path), `t3-signoff:missing` (no approved record
 for the owner), `t3-signoff:invalid` (the owner's records all break the schema; the error names the first problem),
 `t3-signoff:expired` (every matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none
 covers the repository; an owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are
@@ -35,15 +36,18 @@
 from .errors import Refused
 
 FILE_ENV = "SHOWCASE_T3_SIGNOFF_FILE"
+REQUIRE_ENV = "SHOWCASE_REQUIRE_T3_SIGNOFF"
+DEFAULT_RELATIVE = Path("decisions") / "t3-signoffs.yaml"
+_OFF = ("0", "false", "no", "off")
 
 # All sign-off state is context-local, like `--allow-t3` itself (config._T3_SIGNED_OFF, issue 28): one thread's or
 # asyncio task's --require-t3-signoff, record file, grants and aliases never leak into another's owner gate
 # (tests/test_t3_signoff_require.py::test_signoff_state_is_context_local). showcase.main() opens a fresh run state
 # and restores the enclosing one on every exit.
-_REQUIRE: ContextVar[bool] = ContextVar("ctshowcase_t3_signoff_required", default=False)
+_REQUIRE: ContextVar[bool] = ContextVar("ctshowcase_t3_signoff_required", default=True)
 _FILE: ContextVar[str | None] = ContextVar("ctshowcase_t3_signoff_file", default=None)
 # (granted, aliases): lowercase login -> the records that granted it, for stamping this run's writer jobs; and
-# lowercase login -> every login of its org, filled by Resolver.aliases under the flag. None until first use.
+# lowercase login -> every login of its org, filled by Resolver.aliases by default. None until first use.
 # Copy-on-write: every update builds new dicts and sets them, so a context that inherited this value (an asyncio task,
 # contextvars.copy_context().run) never mutates its parent's grants
 # (tests/test_t3_signoff_require.py::test_child_context_grant_does_not_leak_into_parent).
@@ -52,7 +56,8 @@
 
 
 def env_required() -> bool:
-    return os.environ.get("SHOWCASE_REQUIRE_T3_SIGNOFF", "").strip().lower() in ("1", "true", "yes", "on")
+    """On unless the environment opts out explicitly (SHOWCASE_REQUIRE_T3_SIGNOFF=0|false|no|off)."""
+    return os.environ.get(REQUIRE_ENV, "").strip().lower() not in _OFF
 
 
 def set_required(value: bool) -> Token:
@@ -77,11 +82,25 @@ def reset_file(token: Token) -> None:
     _FILE.reset(token)
 
 
-def record_file() -> Path | None:
+def explicit_file() -> Path | None:
+    """The file named by `--t3-signoff-file` or env SHOWCASE_T3_SIGNOFF_FILE, else None (in that order)."""
     v = _FILE.get() or os.environ.get(FILE_ENV, "").strip()
     return Path(v) if v else None
 
 
+def default_record_path() -> Path | None:
+    """`<estate_root>/decisions/t3-signoffs.yaml` in the private estate bundle, or None when no estate root resolves.
+    Only a path: the file is never created."""
+    from . import resolver
+    root = resolver.estate_root()
+    return root / DEFAULT_RELATIVE if root else None
+
+
+def record_file() -> Path | None:
+    """The record file this context reads: the explicit flag, then the env, then default_record_path()."""
+    return explicit_file() or default_record_path()
+
+
 def _run_state() -> tuple[dict[str, tuple[dict, ...]], dict[str, frozenset[str]]]:
     state = _RUN.get()
     return state if state is not None else ({}, {})
@@ -135,7 +154,7 @@ def _expand(owners: list[str]) -> list[str]:
 
 
 def load_records(path: str | Path | None = None) -> list[dict]:
-    """Records from PATH, else from this run's `--t3-signoff-file` / SHOWCASE_T3_SIGNOFF_FILE. No file: []."""
+    """Records from PATH, else from this run's record_file() (flag, env, then the estate default). No file: []."""
     from .config import load_yaml_text
     path = Path(path) if path else record_file()
     if not path or not path.is_file():
@@ -256,8 +275,11 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
         if today is not None:  # start of that local day, so date expiries compare exactly as before
             now = _dt.datetime.combine(today, _dt.time.min).astimezone()
     if records is None:
-        if record_file() is None:
-            return None, "no-file"
+        path = record_file()
+        if path is None:
+            return None, "no-file:no estate root resolves, so there is no default record path"
+        if not path.is_file():
+            return None, f"no-file:{path}"
         records = load_records()
     logins = set(_expand([o for o in owners if o]))
     ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
@@ -279,7 +301,8 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
 
 def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
     """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
-    (the requested owner and its org aliases) as well as the name. A malformed `repos` (not a string or a list of
+    (the requested owner and its org aliases) as well as the name. A repository given as OWNER/NAME is covered only
+    when that owner is one of `logins` too (only `*` covers another account's repository). A malformed `repos` (not a string or a list of
     strings) covers nothing, so it surfaces as t3-signoff:scope instead of an uncaught exception."""
     repos = rec.get("repos")
     if isinstance(repos, str):
@@ -292,6 +315,9 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
     if not name:
         return False
     mine = {x.lower() for x in logins or []}
+    holder = (repo or "").rpartition("/")[0].lower()
+    if holder and logins is not None and holder not in mine:
+        return False  # OWNER/NAME names another account's repository: a bare name or this owner's pair never covers it
     for r in repos:
         head, _, tail = r.rpartition("/")
         if tail.lower() != name:
@@ -317,8 +343,9 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
     rec, why = evaluate(logins, repo)
     if rec is None:
         code, _, detail = (why or "missing").partition(":")
-        hint = " (pass --t3-signoff-file PATH or set SHOWCASE_T3_SIGNOFF_FILE)" if code == "no-file" else ""
-        raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and --require-t3-signoff is set: "
+        hint = (" (create the record in the private estate bundle, or pass --t3-signoff-file PATH / set "
+                "SHOWCASE_T3_SIGNOFF_FILE; --no-require-t3-signoff opts out)") if code == "no-file" else ""
+        raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and a sign-off record is required: "
                       f"no valid sign-off record ({code}{': ' + detail.strip() if detail else ''}){hint}",
                       log=f"t3-signoff:{code}")
     for login in _expand(logins):
@@ -337,7 +364,7 @@ def record_for(owner: str, repo: str | None = None) -> dict | None:
 
 
 def stamp(items, owner: str | None = None):
-    """Under the flag, carry the granting sign-off onto this run's output:
+    """By default, carry the granting sign-off onto this run's output:
 
     - writer jobs (dicts with `phase`) for a signed-off T3 owner get `signoff_id`, and `approval_id` when none is set;
     - change records (records.record(): dicts with `std`, `owner` and `repo`, no `phase`) get `signoff_id` only, since
@@ -368,7 +395,7 @@ def _put(j: dict, rec: dict | None) -> None:
 
 
 def stamp_associations(item: dict, association_ids, owner: str | None = None, repo: str | None = None) -> dict:
-    """Under the flag, name on ITEM (a writer job or a change record) every record that authorized it: OWNER's own
+    """By default, name on ITEM (a writer job or a change record) every record that authorized it: OWNER's own
     grant first (when OWNER/REPO is a signed-off T3 target), then each id in ASSOCIATION_IDS (a T3 org that ITEM
     brings in without targeting it: topics.merge `signoff_ids` for an `also_in` membership topic, project.estate_plan
     for a T3 org in the personal Estate's Org field). `signoff_id` is the first id and `signoff_ids` lists all of them
@@ -390,7 +417,7 @@ def stamp_associations(item: dict, association_ids, owner: str | None = None, re
 
 
 def record(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
-    """Under the flag, the valid record covering OWNER (and REPO), else None; registers no grant. None when off."""
+    """By default, the valid record covering OWNER (and REPO), else None; registers no grant. None when off."""
     if not required():
         return None
     rec, _ = evaluate([owner, *(aliases or [])], repo)
@@ -398,7 +425,7 @@ def record(owner: str, repo: str | None = None, aliases: list[str] | None = None
 
 
 def stamp_source(job: dict, full: str, aliases: list[str] | None = None) -> dict:
-    """Under the flag, stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
+    """By default, stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
     covering that repository. A star-List item job (org.star_list_plan) targets the personal account for some org's
     List, so neither the target nor the org's grant names the record that let the favorite through
     (org._t3_held checks it with granted(), which does not register a grant). It is evaluated here instead. The
diff --git a/scripts/showcase.py b/scripts/showcase.py
index ddf0451..dfb7269 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -960,13 +960,15 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--allow-t3", action="store_true",
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2)")
     p.add_argument("--require-t3-signoff", action="store_true",
-                   help="opt-in (env SHOWCASE_REQUIRE_T3_SIGNOFF=1): honour --allow-t3 only when a valid, unexpired sign-off record "
-                        "in --t3-signoff-file covers the owner and repository; otherwise exit 2 "
-                        "(t3-signoff:no-file|missing|invalid|expired|scope). Default off: --allow-t3 behaves as before")
+                   help="the default, accepted for explicitness: --allow-t3 is honoured only when a valid, unexpired sign-off record "
+                        "covers the owner and repository; otherwise exit 2 (t3-signoff:no-file|missing|invalid|expired|scope)")
+    p.add_argument("--no-require-t3-signoff", action="store_true",
+                   help="explicit opt-out (env SHOWCASE_REQUIRE_T3_SIGNOFF=0): --allow-t3 is trusted without a record, as before issue 23; "
+                        "logged as t3-signoff:opt-out")
     p.add_argument("--t3-signoff-file", metavar="PATH",
-                   help="the sign-off record file --require-t3-signoff reads (env SHOWCASE_T3_SIGNOFF_FILE; format: "
-                        "references/t3-signoff.md). There is no default location: the canonical path in the estate bundle "
-                        "is still the maintainer's choice, so the file must be named explicitly")
+                   help="the sign-off record file to read instead of the default <estate root>/decisions/t3-signoffs.yaml "
+                        "(env SHOWCASE_T3_SIGNOFF_FILE; format: references/t3-signoff.md). Order: this flag, the env, the default. "
+                        "The file is read, never created")
     p.add_argument("--version", action="version", version=f"%(prog)s {__version__} ({STANDARD})")
     sub = p.add_subparsers(dest="command", required=True, metavar="<command>")
 
@@ -1248,7 +1250,10 @@ def _main(argv=None) -> int:
     from ctshowcase.config import set_t3_signed_off
     set_t3_signed_off(getattr(args, "allow_t3", False))
     from ctshowcase import signoff
-    signoff.set_required(getattr(args, "require_t3_signoff", False) or signoff.env_required())
+    if getattr(args, "no_require_t3_signoff", False) and getattr(args, "require_t3_signoff", False):
+        cli.error("--require-t3-signoff and --no-require-t3-signoff are mutually exclusive")
+    signoff.set_required(False if getattr(args, "no_require_t3_signoff", False)
+                         else bool(getattr(args, "require_t3_signoff", False)) or signoff.env_required())
     signoff.set_file(getattr(args, "t3_signoff_file", None))
     if args.format is None:
         args.format = "text" if args.command in GENERATORS else "json"
@@ -1269,11 +1274,13 @@ def _main(argv=None) -> int:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
     if obj is not None:
-        if not signoff.required() and signoff.record_file() is not None:  # a file nobody enforces is not silently ignored
+        if not signoff.required() and signoff.explicit_file() is not None:  # a file nobody enforces is not silently ignored
             obj["logs"] = [*(obj.get("logs") or []), "t3-signoff:file-ignored"]
             if args.format == "text" and not args.quiet:
-                print("t3-signoff:file-ignored: a sign-off record file was given without --require-t3-signoff, "
+                print("t3-signoff:file-ignored: a sign-off record file was given with sign-off enforcement opted out, "
                       "so no record is read or enforced", file=sys.stderr)
+        if not signoff.required() and getattr(args, "allow_t3", False):  # trust-only --allow-t3 is visible in the output
+            obj["logs"] = [*(obj.get("logs") or []), "t3-signoff:opt-out"]
         for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
             if signoff.required() and isinstance(obj.get(key), list):
                 signoff.stamp(obj[key])
diff --git a/tests/conftest.py b/tests/conftest.py
index 2d50371..884b527 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -124,3 +124,35 @@ def _make(**readme_opts):
         raw.setdefault("readme", {}).update(readme_opts)
         return Brand(raw, base.path)
     return _make
+
+
+T3_RECORD_OWNERS = ("Pick-Your-AI", "Pick-Your-Stack", "Northwind-Trading-Co", "Jevelopers-neatHack-2026")
+
+
+@pytest.fixture
+def t3_record(tmp_path, monkeypatch):
+    """A synthetic sign-off record file (every owner `*`, id t3s-synthetic-N) behind SHOWCASE_T3_SIGNOFF_FILE: `--allow-t3`
+    needs a record by default (issue 23), and the in-process tests that exercise a T3 gate bring their own. No estate
+    bundle is read and nothing here is a real approval."""
+    lines = ["signoffs:"]
+    for n, owner in enumerate(T3_RECORD_OWNERS, 1):
+        lines += [f"  - id: t3s-synthetic-{n}", f"    owner: {owner}", '    repos: ["*"]', "    approved: true",
+                  "    approver: synthetic-co-owner", "    approved_on: 2026-01-15", "    expires: 2099-12-31"]
+    path = tmp_path / "t3-signoffs.yaml"
+    path.write_text(os.linesep.join(lines) + os.linesep, encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(path))
+    return path
+
+
+@pytest.fixture(autouse=True)
+def _isolated_signoff_state():
+    """Sign-off enforcement is on by default (issue 23), so library calls outside showcase.main() now register grants in the
+    module's context. Give every test fresh grants and the default `required` and record file, and restore them after."""
+    from ctshowcase import signoff
+    run, req, file = signoff.reset(), signoff.set_required(True), signoff.set_file(None)
+    try:
+        yield
+    finally:
+        signoff.reset_file(file)
+        signoff.reset_required(req)
+        signoff.restore(run)
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index b66a8b2..7a2c850 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -65,13 +65,14 @@ def test_help_text_matches_docs():
     )
     assert result.returncode == 0, result.stderr
     assert "--allow-t3" in result.stdout
-    # issue 23 adds the opt-in --require-t3-signoff right after --allow-t3; the synopsis must keep up with --help
-    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
+    # issue 23 adds --require-t3-signoff (default) and its opt-out right after --allow-t3; the synopsis must keep up with --help
+    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff | --no-require-t3-signoff] [--t3-signoff-file PATH] [--version]"
+    usage_fragment = "[--allow-t3] [--require-t3-signoff] [--no-require-t3-signoff] [--t3-signoff-file PATH] [--version]"
     help_usage = " ".join(result.stdout.split())
     skill = _read("SKILL.md")
     ref = skill[skill.index("## Command Reference"):]
     synopsis = next(line for line in ref.splitlines() if line.startswith("python3 <skill-dir>/scripts/showcase.py"))
-    assert fragment in help_usage, help_usage
+    assert usage_fragment in help_usage, help_usage  # argparse prints the pair as separate options
     assert fragment in " ".join(synopsis.split()), synopsis
 
 
@@ -82,3 +83,18 @@ def test_skill_documents_require_t3_signoff_beside_allow_t3():
     assert "--require-t3-signoff" in para, para
     for code in ("t3-signoff:missing", "t3-signoff:expired", "t3-signoff:scope"):
         assert code in para, code
+
+
+def test_skill_documents_default_on_enforcement_path_and_opt_out():
+    """Issue 23: SKILL.md, ONBOARDING.md, CHANGELOG.md and references/t3-signoff.md describe the default-on record check."""
+    skill = _read("SKILL.md")
+    para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
+    assert "on by default" in para and "decisions/t3-signoffs.yaml" in skill, para
+    assert "--no-require-t3-signoff" in para and "SHOWCASE_REQUIRE_T3_SIGNOFF=0" in para, para
+    assert "default off" not in para and "is always named explicitly" not in para, para
+    assert "it is never read from a config file or environment." not in para, para
+    assert "decisions/t3-signoffs.yaml" in _read("ONBOARDING.md")
+    changelog = _read("CHANGELOG.md")
+    assert "Default-on T3 sign-off enforcement" in changelog and "decisions/t3-signoffs.yaml" in changelog
+    ref = _read("references/t3-signoff.md")
+    assert "DEFAULT OFF" not in ref and "decisions/t3-signoffs.yaml" in ref
diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index 4c5fbbe..4b5c2fb 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -1,20 +1,27 @@
-"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2)."""
+"""A global `--allow-t3` lifts the T3 refusal for every repository command; the default still refuses (exit 2).
+
+Issue 23: `--allow-t3` also needs a sign-off record by default, so the runs that expect it to lift the refusal read the
+synthetic record fixture (tests/fixtures/t3-signoff/valid.yaml, owner Pick-Your-AI) through SHOWCASE_T3_SIGNOFF_FILE."""
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 from pathlib import Path
 
 ROOT = Path(__file__).resolve().parents[1]
 SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+RECORDS = ROOT / "tests" / "fixtures" / "t3-signoff" / "valid.yaml"
 META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
 
 
 def _run(tmp_path, *argv, owner="Pick-Your-AI"):
     meta = tmp_path / "meta.json"
     meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
-    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT,
+    env = dict(os.environ, SHOWCASE_T3_SIGNOFF_FILE=str(RECORDS))
+    env.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=env,
                           capture_output=True, text=True, encoding="utf-8")
 
 
@@ -67,7 +74,7 @@ def test_signoff_does_not_outlive_the_invocation(tmp_path, capsys):
         load_brand().check_owner("Pick-Your-AI")
 
 
-def test_signed_off_t3_org_joins_also_in_and_star_lists(brand):
+def test_signed_off_t3_org_joins_also_in_and_star_lists(brand, t3_record):
     from ctshowcase.config import set_t3_signed_off
     from ctshowcase.org import _star_held
     from ctshowcase.resolver import Resolver
@@ -155,7 +162,7 @@ def test_main_restores_the_caller_sign_off_value(capsys):
         reset_t3_signed_off(token)
 
 
-def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand):
+def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(brand, monkeypatch):
     """Acceptance: one thread signed off and one not behave independently; the unsigned one is refused for a T3 owner.
 
     Each thread sets its own state explicitly, so this also runs where threads inherit the caller's context. The barrier
@@ -163,6 +170,7 @@ def test_two_concurrent_threads_have_independent_sign_off_at_the_owner_gate(bran
     import threading
     from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
     from ctshowcase.errors import Refused
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(RECORDS))  # the signed thread's record (synthetic)
     barrier = threading.Barrier(2, timeout=10)
     out: dict[str, tuple] = {}
 
diff --git a/tests/test_meta_recency.py b/tests/test_meta_recency.py
index ff77df9..9337eba 100644
--- a/tests/test_meta_recency.py
+++ b/tests/test_meta_recency.py
@@ -47,7 +47,7 @@ def run(argv, **kwargs):
     return requests
 
 
-def test_meta_from_gh_t3_needs_allow_t3_and_records_recency(tmp_path, monkeypatch, capsys):
+def test_meta_from_gh_t3_needs_allow_t3_and_records_recency(tmp_path, monkeypatch, capsys, t3_record):
     requests = _stub_gh(monkeypatch, "Pick-Your-AI", "core")
     cmd = ["meta", "--from-gh", "Pick-Your-AI/core"]
     assert showcase.main(cmd) == 2
diff --git a/tests/test_org.py b/tests/test_org.py
index e123cf5..89e743a 100644
--- a/tests/test_org.py
+++ b/tests/test_org.py
@@ -128,7 +128,7 @@ def test_profile_writes_and_renders(make_estate, tmp_path):
 
 @pytest.mark.parametrize("owners", [None, "t3", "watching"])
 @pytest.mark.parametrize("cfg", [None, "type: cli\n"])
-def test_profile_lists_a_pinned_slug_fork_without_a_card(labs_brand, cfg, owners):
+def test_profile_lists_a_pinned_slug_fork_without_a_card(labs_brand, cfg, owners, t3_record):
     """A `-fork` copy (type rule 1) has no card in `card`, `lint all` or doctor, so the profile shows it as a line,
     also in a co-owned org after sign-off (`--allow-t3`) and in the watching org."""
     brand = labs_brand
diff --git a/tests/test_project.py b/tests/test_project.py
index 2d5cf9b..d9879aa 100644
--- a/tests/test_project.py
+++ b/tests/test_project.py
@@ -335,7 +335,7 @@ def estate_resolver(brand):
     return resolver(b, rows=[("create-project", "@me", "*", "")], registry=reg)
 
 
-def test_estate_plan_stage_one(estate_resolver):
+def test_estate_plan_stage_one(estate_resolver, t3_record):
     plan = PJ.estate_plan(estate_resolver, source="CompleteTech-LLC/4")
     assert plan["action"] == "estate-plan" and plan["owner"] == "@me"
     assert plan["jobs"][0]["argv"] == ["gh", "project", "copy", "4", "--source-owner", "CompleteTech-LLC", "--target-owner",
diff --git a/tests/test_resolver.py b/tests/test_resolver.py
index 8206be8..77a37d3 100644
--- a/tests/test_resolver.py
+++ b/tests/test_resolver.py
@@ -78,7 +78,7 @@ def test_unknown_org_is_needs_input_not_defaults(brand):
         r.registry_org("Nobody-Knows-This-Org")
 
 
-def test_check_owner_refuses_under_every_alias(brand):
+def test_check_owner_refuses_under_every_alias(brand, t3_record):
     r = R.Resolver(brand, {}, approvals(rows=[("org-rename", "Pick-Your-AI", "*", "Pick-Your-Stack")], actions=[]))
     with pytest.raises(Refused) as e:
         r.check_owner("Pick-Your-Stack")
diff --git a/tests/test_review_sweep_org_project.py b/tests/test_review_sweep_org_project.py
index 11df5f9..6ef552d 100644
--- a/tests/test_review_sweep_org_project.py
+++ b/tests/test_review_sweep_org_project.py
@@ -300,7 +300,7 @@ def _t3_estate(labs_brand):
     return est
 
 
-def test_t3_repositories_wait_for_sign_off_on_public_profiles(labs_brand):
+def test_t3_repositories_wait_for_sign_off_on_public_profiles(labs_brand, t3_record):
     est = _t3_estate(labs_brand)
     data, logs = O.user_slice(est, "CompleteDotTech")
     assert "Pick-Your-AI/demo-board" not in json.dumps(data["pins"] + data["more_projects"])
diff --git a/tests/test_t3_signoff_default.py b/tests/test_t3_signoff_default.py
new file mode 100644
index 0000000..9abe87e
--- /dev/null
+++ b/tests/test_t3_signoff_default.py
@@ -0,0 +1,173 @@
+"""Default-on T3 sign-off (issue 23, tasks 24-27): a bare `--allow-t3` needs a record at the private estate path.
+
+Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; ids and dates are made up). Each test fails on
+b71a063, where enforcement was opt-in and there was no default location.
+"""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+OWNER = "Pick-Your-AI"
+RECORD = """signoffs:
+  - id: {id}
+    owner: {owner}
+    repos: {repos}
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: 2099-12-31
+"""
+
+
+def _bundle(tmp_path, *, id="t3s-default", owner=OWNER, repos='["*"]', write=True):
+    root = tmp_path / "bundle"
+    (root / "decisions").mkdir(parents=True)
+    if write:
+        (root / "decisions" / "t3-signoffs.yaml").write_text(RECORD.format(id=id, owner=owner, repos=repos),
+                                                             encoding="utf-8")
+    return root
+
+
+def _run(tmp_path, root, *argv, env=None, owner=OWNER):
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
+    e = dict(os.environ)
+    for k in ("SHOWCASE_REQUIRE_T3_SIGNOFF", "SHOWCASE_T3_SIGNOFF_FILE", "SHOWCASE_ESTATE_ROOT"):
+        e.pop(k, None)
+    if root is not None:
+        e["SHOWCASE_ESTATE_ROOT"] = str(root)
+    e.update(env or {})
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=e,
+                          capture_output=True, text=True, encoding="utf-8")
+
+
+def _out(r):
+    return r.stdout + r.stderr
+
+
+def test_bare_allow_t3_without_a_record_is_refused_and_names_the_path(tmp_path):
+    root = _bundle(tmp_path, write=False)
+    r = _run(tmp_path, root, "--allow-t3", "describe")
+    want = root / "decisions" / "t3-signoffs.yaml"
+    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), _out(r)
+    assert str(want) in json.loads(r.stdout)["error"], r.stdout
+    assert not want.exists(), "the tool must never create the record file"
+
+
+def test_bare_allow_t3_reads_the_default_estate_record(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path), "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
+
+
+def test_default_record_for_another_owner_does_not_authorize(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, owner="Some-Other-Org"), "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+
+
+def test_unavailable_estate_root_fails_closed(monkeypatch):
+    """No estate root resolves: there is no default path, and the gate reports no-file instead of trusting the flag."""
+    from ctshowcase import resolver, signoff
+    monkeypatch.delenv("SHOWCASE_ESTATE_ROOT", raising=False)
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    monkeypatch.setattr(resolver, "estate_root", lambda: None)
+    assert signoff.default_record_path() is None and signoff.record_file() is None
+    rec, why = signoff.evaluate([OWNER], "northwind-synthetic")
+    assert rec is None and why.startswith("no-file:"), why
+
+
+def test_record_file_resolution_order_flag_then_env_then_default(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    root = _bundle(tmp_path)
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(root))
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    default = root / "decisions" / "t3-signoffs.yaml"
+    assert signoff.default_record_path() == default and signoff.record_file() == default
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(tmp_path / "env.yaml"))
+    assert signoff.record_file() == tmp_path / "env.yaml"
+    token = signoff.set_file(tmp_path / "flag.yaml")
+    try:
+        assert signoff.record_file() == tmp_path / "flag.yaml"
+    finally:
+        signoff.reset_file(token)
+
+
+def test_explicit_opt_out_restores_trust_only_and_is_logged(tmp_path):
+    root = _bundle(tmp_path, write=False)
+    r = _run(tmp_path, root, "--no-require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
+    r = _run(tmp_path, root, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "0"})
+    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
+    r = _run(tmp_path, root, "--require-t3-signoff", "--no-require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode == 2 and "mutually exclusive" in _out(r), _out(r)
+
+
+def test_opt_out_does_not_lift_excluded_owners(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, write=False), "--no-require-t3-signoff", "--allow-t3", "describe",
+             owner="BunsDev")
+    assert r.returncode == 2, _out(r)
+
+
+def test_writer_jobs_carry_the_default_records_id(tmp_path):
+    r = _run(tmp_path, _bundle(tmp_path, id="t3s-def-job"), "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    jobs = json.loads(r.stdout)["jobs"]
+    topics = [j for j in jobs if j["kind"] == "topics"]
+    assert topics and all(j.get("signoff_id") == "t3s-def-job" for j in topics), r.stdout[:400]
+
+
+# --- exact owner/repo identity for project job provenance ---
+
+def test_record_for_another_owners_repo_does_not_cover_a_same_named_repo_elsewhere(tmp_path, monkeypatch):
+    """A record for Pick-Your-AI/website must not stamp (or authorize) Other-Org/website: the repository's owner has
+    to be the record's org, the name alone is not an identity."""
+    from ctshowcase import signoff
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path, repos='["Pick-Your-AI/website", "plain-name"]')))
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    token = signoff.reset()
+    try:
+        assert signoff.evaluate([OWNER], "Pick-Your-AI/website")[0] is not None
+        assert signoff.evaluate([OWNER], "Other-Org/website")[1] == "scope"
+        assert signoff.evaluate([OWNER], "Other-Org/plain-name")[1] == "scope"
+        assert signoff.evaluate([OWNER], "Pick-Your-AI/plain-name")[0] is not None
+        signoff.require(OWNER, "Pick-Your-AI/website")
+        job = {"phase": 1, "repo": "Other-Org/website", "org": OWNER}
+        assert "signoff_id" not in signoff.stamp([job])[0]
+    finally:
+        signoff.restore(token)
+
+
+def test_stamp_source_matches_the_exact_owner_and_name(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path, repos='["Pick-Your-AI/website"]')))
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    token = signoff.reset()
+    try:
+        ok = signoff.stamp_source({"phase": 1}, "Pick-Your-AI/website")
+        other = signoff.stamp_source({"phase": 1}, "Other-Org/website")
+        assert ok.get("signoff_id") == "t3s-default" and "signoff_id" not in other
+    finally:
+        signoff.restore(token)
+
+
+def test_estate_plan_stamping_ignores_a_display_name_shared_with_another_org(tmp_path, monkeypatch):
+    """A T3 org whose display name equals a T1 org's login or name is ambiguous: only its login (or `T3: login`) credits a job."""
+    from ctshowcase import project as PJ, signoff
+    monkeypatch.setenv("SHOWCASE_ESTATE_ROOT", str(_bundle(tmp_path, owner="Acme-T3")))
+    monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
+    orgs = [{"login": "Acme-T3", "name": "Acme", "tier": "T3", "signoff_id": "t3s-acme"},
+            {"login": "Acme", "name": "Acme", "tier": "T1"}]
+    jobs = [{"id": "t1", "phase": 1, "argv": ["gh", "x", "name=Acme"]},
+            {"id": "t3", "phase": 1, "argv": ["gh", "x", "name=Acme-T3"]}]
+    token = signoff.reset()
+    try:
+        PJ._stamp_estate_orgs(jobs, orgs)
+    finally:
+        signoff.restore(token)
+    assert {j["id"]: j.get("signoff_id") for j in jobs} == {"t1": None, "t3": "t3s-acme"}
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 673e1f0..747482d 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,5 +1,7 @@
 """`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
-`--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE). There is no default location (the maintainer has not chosen one).
+`--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE) or, by default, in the private estate bundle
+(`<estate root>/decisions/t3-signoffs.yaml`; tests/test_t3_signoff_default.py). The enforcement is default-on; the tests
+that pin the trust-only behaviour pass the explicit opt-out `--no-require-t3-signoff`.
 
 Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
 tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
@@ -100,11 +102,11 @@ def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
     assert r.returncode == 2 and "t3-signoff" in _out(r)
 
 
-# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
-def test_default_is_unchanged_without_the_new_flag(tmp_path):
-    """No flag and no records at all: `--allow-t3` alone still lifts the refusal (byte-for-byte old behaviour)."""
-    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff" not in _out(r).replace("t3-signoff:file-ignored", ""), _out(r)
+def test_opt_out_keeps_the_trust_only_behaviour(tmp_path):
+    """The explicit opt-out and no records at all: `--allow-t3` alone lifts the refusal (the pre-issue-23 behaviour)."""
+    r = _run(tmp_path, _bundle(tmp_path, []), "--no-require-t3-signoff", "--allow-t3", "describe")
+    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
+    assert "t3-signoff:no-file" not in _out(r) and "t3-signoff:missing" not in _out(r), _out(r)
 
 
 def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
@@ -119,7 +121,7 @@ def test_doctor_shows_the_signoff_id(tmp_path):
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
     row = json.loads(r.stdout)
     assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
-    plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", "json")
+    plain = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
     assert "signoff_id" not in json.loads(plain.stdout)  # off by default: the row is unchanged
 
 
@@ -144,10 +146,11 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
         signoff.reset()
 
 
-def test_jobs_are_untouched_without_the_flag(tmp_path):
+def test_jobs_are_untouched_when_enforcement_is_opted_out(tmp_path):
     from ctshowcase import signoff
     from ctshowcase.records import append
     signoff._grant(OWNER.lower(), {"id": "t3s-8", "repos": ["*"]})
+    signoff.set_required(False)
     try:
         out = tmp_path / "jobs.jsonl"
         append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
@@ -159,9 +162,10 @@ def test_jobs_are_untouched_without_the_flag(tmp_path):
 def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
     from ctshowcase import signoff
     import showcase
-    showcase.main(["--require-t3-signoff", "config"])
+    assert signoff.required() is True  # the default
+    showcase.main(["--no-require-t3-signoff", "config"])
     capsys.readouterr()
-    assert signoff.required() is False and not signoff._granted()
+    assert signoff.required() is True and not signoff._granted()  # the opt-out held for that call only
 
 
 @pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
@@ -245,7 +249,7 @@ def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
     for fmt in ("tsv", "md"):
         r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
         assert "t3s-13" in r.stdout, _out(r)
-        plain = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
+        plain = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
         assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged
 
 
@@ -413,12 +417,16 @@ def test_main_restores_an_enclosing_runs_signoff_state(tmp_path, capsys):
 
 # --- review round 4: explicit record file, record schema, timestamp expiry, copy-on-write state, change records ---
 
-def test_no_record_file_refuses_without_a_default(tmp_path):
-    """The canonical path in the estate bundle is still the maintainer's choice (issue 24), so the tool must not pick
-    one: a valid record sitting at the formerly hard-coded bundle path is NOT read unless the file is named."""
-    b = _bundle(tmp_path, [{"id": "t3s-d"}])
-    r = _run(tmp_path, None, "--require-t3-signoff", "--allow-t3", "describe", env={"SHOWCASE_ESTATE_ROOT": str(b)})
-    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r) and "--t3-signoff-file" in _out(r), _out(r)
+def test_no_record_file_refuses_and_names_the_resolved_path(tmp_path):
+    """Nothing at the default path and no explicit file: the gate refuses t3-signoff:no-file and names the path it
+    resolved (the estate default). It never creates the file and never falls back to trusting --allow-t3."""
+    root = tmp_path / "bundle"
+    (root / "decisions").mkdir(parents=True)
+    r = _run(tmp_path, None, "--allow-t3", "describe", env={"SHOWCASE_ESTATE_ROOT": str(root)})
+    want = root / "decisions" / "t3-signoffs.yaml"
+    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), _out(r)
+    assert str(want) in json.loads(r.stdout)["error"], r.stdout
+    assert not want.exists()
 
 
 def test_record_file_may_have_any_name_and_come_from_env(tmp_path):
@@ -513,7 +521,7 @@ def test_topics_change_records_carry_the_signoff_id(tmp_path):
     recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
     assert recs and all(x["signoff_id"] == "t3s-cr" and "approval_id" not in x for x in recs), recs
     plain = tmp_path / "plain.jsonl"
-    _run(tmp_path, b, "--allow-t3", "topics", "--records", str(plain))
+    _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--records", str(plain))
     assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
 
 
@@ -774,7 +782,7 @@ def test_t3_also_in_association_carries_its_signoff_id(tmp_path):
     assert len(recs) == 1 and recs[0]["owner"] == T1 and topic in recs[0]["after"], recs
     assert recs[0]["signoff_id"] == "t3s-assoc" and "approval_id" not in recs[0], recs
     plain = tmp_path / "plain.jsonl"  # without the flag: no key, behaviour unchanged
-    r = _run(tmp_path, b, "--allow-t3", "topics", "--also-in", OWNER, "--records", str(plain), owner=T1)
+    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--also-in", OWNER, "--records", str(plain), owner=T1)
     assert "signoff_ids" not in json.loads(r.stdout), r.stdout
     assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
 
@@ -879,7 +887,7 @@ def test_adopt_topics_job_carries_the_also_in_signoff(tmp_path):
     jobs = [j for j in json.loads(r.stdout)["jobs"] if j["kind"] == "topics"]
     assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "q-synthetic", jobs
     # without the flag: nothing is stamped
-    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1, meta_extra=extra)
+    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1, meta_extra=extra)
     assert r.stdout and "signoff_id" not in r.stdout, _out(r)
 
 
@@ -909,20 +917,25 @@ def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
         plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
         assert OWNER not in [o["login"] for o in plan["orgs"]] and OWNER not in json.dumps(plan["jobs"])
-    plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)  # flag off: included, nothing stamped
+    from ctshowcase import signoff
+    off = signoff.set_required(False)  # opted out: included, nothing stamped
+    try:
+        plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
+    finally:
+        signoff.reset_required(off)
     assert OWNER in [o["login"] for o in plan["orgs"]] and "signoff_id" not in json.dumps(plan)
 
 
 # --- review round 5: evidence for each fixed finding (synthetic records and slugs only) ---
 
 def test_signoff_file_without_the_flag_is_logged_not_silently_ignored(tmp_path):
-    """A record file given without --require-t3-signoff is never read; the run says so instead of looking enforced."""
+    """A record file given while enforcement is opted out is never read; the run says so instead of looking enforced."""
     b = _bundle(tmp_path, [{"id": "t3s-ign", "expires": "2020-01-01"}])
-    r = _run(tmp_path, b, "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "describe")
     assert r.returncode != 2 and "t3-signoff:file-ignored" in _out(r), _out(r)
     r = _run(tmp_path, b, "--allow-t3", "--require-t3-signoff", "describe")  # enforced: expired record refuses
     assert r.returncode == 2 and "file-ignored" not in _out(r), _out(r)
-    r = _run(tmp_path, None, "--allow-t3", "describe")  # no file at all: nothing to report
+    r = _run(tmp_path, None, "--no-require-t3-signoff", "--allow-t3", "describe")  # no explicit file: nothing to report
     assert "file-ignored" not in _out(r), _out(r)
 
 

From c98704090f8138df7701c27b089ad8bab81aa2fd Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 14:15:29 -0400
Subject: [PATCH 23/79] Keep T3 transfer holds opt-in, mark opt-out output,
 enforce unique record ids (#23)

- Transfer-target T3 holds (org._t3_moved_held, labels_plan gate) apply only when
  --allow-t3 is passed, so T1/T2 org output is unchanged by default enforcement.
- Under --no-require-t3-signoff --allow-t3, T3 jobs and change records carry
  signoff_id "opt-out"; direct-print commands log the opt-out audit on stderr.
- Duplicate record ids refuse t3-signoff:invalid.
- Fix org pins signoff id accumulation clobbering the repository-id dict.
- doctor adds the signoff_id column only with --allow-t3.
- Reword SKILL.md, fix stale comments, CHANGELOG, reference doc, tests.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |  2 +-
 SKILL.md                         |  2 +-
 references/t3-signoff.md         |  2 +-
 scripts/ctshowcase/config.py     |  2 +-
 scripts/ctshowcase/content.py    |  2 +-
 scripts/ctshowcase/doctor.py     |  3 +-
 scripts/ctshowcase/intake.py     |  4 +-
 scripts/ctshowcase/org.py        | 20 +++++-----
 scripts/ctshowcase/project.py    |  2 +-
 scripts/ctshowcase/records.py    |  2 +-
 scripts/ctshowcase/resolver.py   |  2 +-
 scripts/ctshowcase/signoff.py    | 43 ++++++++++++++++++++-
 scripts/showcase.py              | 30 +++++++++++----
 tests/test_t3_signoff_require.py | 65 +++++++++++++++++++++++++++-----
 14 files changed, 143 insertions(+), 38 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cf2f528..654b81b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. The one escape is the explicit opt-out `--no-require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), logged `t3-signoff:opt-out`; `--require-t3-signoff` is still accepted. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. `t3-signoff:file-ignored` now appears only when an explicit file is given while opted out. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. The one escape is the explicit opt-out `--no-require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), logged `t3-signoff:opt-out`; `--require-t3-signoff` is still accepted. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. `t3-signoff:file-ignored` now appears only when an explicit file is given while opted out. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Under the opt-out with `--allow-t3`, T3 writer jobs and change records carry `signoff_id: "opt-out"` and direct-print commands (`doctor`, `lint`, `meta`) log `t3-signoff:opt-out` and `t3-signoff:file-ignored` on stderr. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default.
 - Earlier, opt-in form of the above (superseded by the default-on entry): `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`) with the file named by `--t3-signoff-file PATH`. `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A T3 association carries that org's record (`signoff_id`): the topics change record of `topics --also-in`, `adopt`'s topics job and change record for an `also_in` T3 org (an existing `approval_id` is kept), and the `project estate-plan` jobs that add a T3 org to the Estate's Org field. Under the flag only, a repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff:<why>`), and `org profile` and star Lists omit it as a home repository or favorite until the T3 org's record covers it. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
diff --git a/SKILL.md b/SKILL.md
index 64bc627..454e251 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` and the opt-out `SHOWCASE_REQUIRE_T3_SIGNOFF=0` are). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores trust-only `--allow-t3` for that run and is logged `t3-signoff:opt-out`; writer jobs then carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` stays read-only and shows the record as `signoff_id`. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` and the opt-out `SHOWCASE_REQUIRE_T3_SIGNOFF=0` are). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores trust-only `--allow-t3` for that run and is logged `t3-signoff:opt-out` (on stderr for direct-print commands such as `doctor`, `lint` and `meta` without `--out`); T3 writer jobs and change records made under it carry `signoff_id: "opt-out"` so no record is mistaken for authorization. With enforcement on, writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 3b7d087..706431b 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,6 +1,6 @@
 # T3 sign-off records (`--require-t3-signoff`)
 
-`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores the trust-only meaning of `--allow-t3` for that run and is logged `t3-signoff:opt-out`; the two flags together are a usage error. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores the trust-only meaning of `--allow-t3` for that run and is logged `t3-signoff:opt-out`; T3 writer jobs and change records made under it carry `signoff_id: "opt-out"`; the two flags together are a usage error. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index 872f1e5..5694c21 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -127,7 +127,7 @@ def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None =
             raise Refused(f"{owner} is T3; needs co-owner sign-off", log="t3-signoff")
         if status == "t3" and verify_signoff:
             from . import signoff
-            signoff.require(owner, repo, self.aliases(owner))  # no-op unless --require-t3-signoff
+            signoff.require(owner, repo, self.aliases(owner))  # no-op when opted out (--no-require-t3-signoff)
         return status
 
     def org(self, owner: str) -> dict:
diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index 9fe6016..5602e7f 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -2349,7 +2349,7 @@ def _ctx(args, cli, resolver):
 def _finish(args, obj: dict, code: int):
     jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
     from .signoff import stamp
-    stamp(jobs)  # before any serialization (--jobs, --report): a no-op unless --require-t3-signoff
+    stamp(jobs)  # before any serialization (--jobs, --report): a no-op when opted out (--no-require-t3-signoff)
     if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
         from .records import append
         append(args.jobs, jobs)
diff --git a/scripts/ctshowcase/doctor.py b/scripts/ctshowcase/doctor.py
index b5a4b47..7926b62 100644
--- a/scripts/ctshowcase/doctor.py
+++ b/scripts/ctshowcase/doctor.py
@@ -177,7 +177,8 @@ def row(ctx: RepoContext) -> dict:
 
 def _signoff_cols() -> list[str]:
     from . import signoff
-    return ["signoff_id"] if signoff.required() else []  # extra column only under --require-t3-signoff
+    # extra column only when --allow-t3 is passed with enforcement on; the documented row shape is unchanged otherwise
+    return ["signoff_id"] if signoff.required() and t3_signed_off() else []
 
 
 def _signoff_vals(r: dict) -> list[str]:
diff --git a/scripts/ctshowcase/intake.py b/scripts/ctshowcase/intake.py
index afffedd..112a3b0 100644
--- a/scripts/ctshowcase/intake.py
+++ b/scripts/ctshowcase/intake.py
@@ -99,8 +99,8 @@ def adopt(ctx, resolver=None, *, approval_id: str | None = None, fresh: bool = F
         jobs.append(_job(_jid("p3", "topics", sid), argv, full, "§5.6 topics (full ordered list; PUT replaces the set).",
                          approval_id, kind="topics"))
         recs.append(records.record(owner, repo, "topics", "topics", tp["current"], tp["proposed"], "§5.6 merge"))
-        # a T3 `also_in` membership topic: carry the record(s) that let it in, as cmd_topics does (no-op unless
-        # --require-t3-signoff; a job's existing approval_id is kept)
+        # a T3 `also_in` membership topic: carry the record(s) that let it in, as cmd_topics does (no-op when opted out;
+        # a job's existing approval_id is kept)
         from .signoff import stamp_associations
         for item in (jobs[-1], recs[-1]):
             stamp_associations(item, tp.get("signoff_ids"), owner, repo)
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index aad3a8a..e808abb 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -367,7 +367,7 @@ def public_favorites(estate: Estate, reg: dict, *, allow_t3: bool = False) -> tu
 
 def _t3_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     """A repository of a T3 org (any of its logins) before co-owner sign-off: never named on a public profile.
-    The slug as named is checked as before. Under --require-t3-signoff only, the slug it has today (estate.current:
+    The slug as named is checked as before. Only when --allow-t3 is passed (with enforcement on), the slug it has today (estate.current:
     an approved pending transfer) is checked too (_t3_moved_held)."""
     if "/" not in (full or ""):
         return False
@@ -378,16 +378,17 @@ def _t3_held(estate: Estate, full: str, allow_t3: bool) -> bool:
 
 
 def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
-    """Under --require-t3-signoff: FULL is named under one org but a T3 org holds it today (an approved pending
+    """When the T3 flag (--allow-t3) is passed with enforcement on: FULL is named under one org but a T3 org holds it today (an approved pending
     transfer, estate.current), and that T3 org has no --allow-t3 plus valid record covering the repository.
 
-    Opt-in only: without the flag this is always False, so the default (base 2be04ac) behaviour of profiles, star
+    Opt-in only: without --allow-t3 this is always False (enforcement being default-on does not change that), so the default (base 2be04ac) behaviour of profiles, star
     Lists and `org labels` is unchanged; no issue of epic #22 asks for a default-on tightening
     (tests/test_t3_signoff_require.py::test_transfer_to_a_t3_org_is_unchanged_without_the_flag). With the flag:
     ::test_favorite_transferred_to_a_t3_org_is_held_without_its_record and
     ::test_home_repository_held_by_a_t3_org_is_omitted_without_its_record."""
     from . import signoff
-    if not signoff.required() or "/" not in (full or ""):
+    from .config import t3_signed_off
+    if not (allow_t3 or t3_signed_off()) or not signoff.required() or "/" not in (full or ""):
         return False
     r = estate.resolver
     cur = estate.current(r.slug(full))
@@ -1672,12 +1673,12 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
             signoff.stamp_source(item, f, r.aliases(f.split("/")[0]))
         added = sorted(i for i in targets.get(f.lower(), set()) - have - {list_id} if i in list_signoffs)
         if added and signoff.required():  # a newly added T3 destination List carries the record that admitted it
-            ids = [item["signoff_id"]] if "signoff_id" in item else []
-            if not ids and r.owner_status(login) == "t3":
+            sids = [item["signoff_id"]] if "signoff_id" in item else []
+            if not sids and r.owner_status(login) == "t3":
                 own = signoff.record(login, None, r.aliases(login))
-                ids = [str(own["id"])] if own and own.get("id") else []
+                sids = [str(own["id"])] if own and own.get("id") else []
             item.pop("signoff_id", None)
-            signoff.stamp_associations(item, ids + [list_signoffs[i] for i in added])
+            signoff.stamp_associations(item, sids + [list_signoffs[i] for i in added])
         out["jobs"].append(item)
     return dict(out, result="incomplete" if incomplete else "ok", list_id=list_id)
 
@@ -1853,7 +1854,8 @@ def labels_plan(estate: Estate, org: str, *, allow_t3: bool = False, checkouts:
         full = estate.current(f"{login}/{n}")  # labels are written where the repository is today
         current_owner, current_name = full.split("/", 1)
         from . import signoff
-        if (signoff.required() and not estate.resolver.same(current_owner, login)
+        from .config import t3_signed_off
+        if (signoff.required() and (allow_t3 or t3_signed_off()) and not estate.resolver.same(current_owner, login)
                 and estate.resolver.owner_status(current_owner) == "t3"):
             # Under --require-t3-signoff only: an approved pending transfer whose label jobs target the T3 org that
             # holds the repository today passes that org's gate (--allow-t3 and its record; check_owner also
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 5cd0e0b..4c45178 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -188,7 +188,7 @@ def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = Fals
     if st == "t3" and not allow_t3:
         raise Refused(f"{owner} is T3: reading its project is fine, changing anything needs co-owner sign-off",
                       log="t3-signoff")
-    if st == "t3":  # registers the grant so writer jobs carry signoff_id; refuses t3-signoff:<why>; no-op unless the flag is on
+    if st == "t3":  # registers the grant so writer jobs carry signoff_id; refuses t3-signoff:<why>; no-op when opted out (--no-require-t3-signoff)
         from . import signoff
         signoff.require(owner, None, resolver.aliases(owner))
     return resolver.canonical(owner)
diff --git a/scripts/ctshowcase/records.py b/scripts/ctshowcase/records.py
index 5540ea0..c4e8182 100644
--- a/scripts/ctshowcase/records.py
+++ b/scripts/ctshowcase/records.py
@@ -21,7 +21,7 @@ def append(path: str | Path | None, recs: list[dict]) -> None:
     if not path or not recs:
         return
     from .signoff import stamp
-    stamp(recs)  # only under --require-t3-signoff: jobs and change records of a signed-off T3 owner carry signoff_id
+    stamp(recs)  # jobs and change records of a signed-off T3 owner carry signoff_id (or "opt-out" under the opt-out)
     p = Path(path)
     p.parent.mkdir(parents=True, exist_ok=True)
     with p.open("a", encoding="utf-8") as fh:
diff --git a/scripts/ctshowcase/resolver.py b/scripts/ctshowcase/resolver.py
index 88f47c1..00195de 100644
--- a/scripts/ctshowcase/resolver.py
+++ b/scripts/ctshowcase/resolver.py
@@ -301,7 +301,7 @@ def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool =
             raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
         if st == "t3" and verify_signoff:  # doctor passes False: it reports the hold instead of refusing
             from . import signoff
-            signoff.require(login, repo, self.aliases(login))  # no-op unless --require-t3-signoff
+            signoff.require(login, repo, self.aliases(login))  # no-op when opted out (--no-require-t3-signoff)
         return st
 
     def family_hold(self, login: str) -> bool:
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index f73a646..4f6acc0 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -45,6 +45,8 @@
 # (tests/test_t3_signoff_require.py::test_signoff_state_is_context_local). showcase.main() opens a fresh run state
 # and restores the enclosing one on every exit.
 _REQUIRE: ContextVar[bool] = ContextVar("ctshowcase_t3_signoff_required", default=True)
+# Under the opt-out with --allow-t3: owner -> is it a T3 org (set by showcase.main), so stamp() can mark T3 output "opt-out".
+_OPT_OUT_T3: ContextVar = ContextVar("ctshowcase_t3_signoff_opt_out_t3", default=None)
 _FILE: ContextVar[str | None] = ContextVar("ctshowcase_t3_signoff_file", default=None)
 # (granted, aliases): lowercase login -> the records that granted it, for stamping this run's writer jobs; and
 # lowercase login -> every login of its org, filled by Resolver.aliases by default. None until first use.
@@ -282,6 +284,12 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
             return None, f"no-file:{path}"
         records = load_records()
     logins = set(_expand([o for o in owners if o]))
+    seen: set[str] = set()
+    for r in records:  # signoff_id is the audit key carried onto jobs, so an id must name exactly one record
+        rid = str(r.get("id") or "")
+        if rid and rid in seen:
+            return None, f"invalid:{rid}: duplicate id (record ids must be unique within the file)"
+        seen.add(rid)
     ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
     valid = [r for r in ours if not problems(r)]
     mine = [r for r in valid if r.get("approved") is True]
@@ -373,7 +381,12 @@ def stamp(items, owner: str | None = None):
     `owner` names the gated owner explicitly when a job's target is another account (the star-List jobs of a T3 org's
     `org pins` run as the personal account, org.star_list_plan); without it the owner is read from the item. An item
     that already carries a `signoff_id` is left as it is."""
-    if not required() or not _granted():
+    if not required():
+        pred = _OPT_OUT_T3.get()
+        if pred is not None:
+            stamp_opt_out(items, pred)
+        return items
+    if not _granted():
         return items
     for j in items or []:
         if not isinstance(j, dict) or "signoff_id" in j:
@@ -387,6 +400,34 @@ def stamp(items, owner: str | None = None):
     return items
 
 
+OPT_OUT = "opt-out"
+
+
+def set_opt_out_t3(predicate) -> Token:
+    """Register IS_T3(owner) for this context so stamp() marks T3 jobs and change records `signoff_id: "opt-out"` while
+    enforcement is opted out; None clears it. Returns a token for reset_opt_out_t3."""
+    return _OPT_OUT_T3.set(predicate)
+
+
+def reset_opt_out_t3(token: Token) -> None:
+    _OPT_OUT_T3.reset(token)
+
+
+def stamp_opt_out(items, is_t3) -> None:
+    """Under the explicit opt-out with --allow-t3, mark every T3 writer job and change record `signoff_id: "opt-out"`
+    so the serialized artifacts show that no record authorized them. IS_T3(owner) says whether OWNER is a T3 org.
+    Items that already carry a signoff_id are left alone."""
+    for j in items or []:
+        if not isinstance(j, dict) or "signoff_id" in j:
+            continue
+        if "phase" not in j and not ("std" in j and "owner" in j and "repo" in j):
+            continue
+        full = str(j.get("repo") or "")
+        who = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
+        if who and is_t3(str(who)):
+            j["signoff_id"] = OPT_OUT
+
+
 def _put(j: dict, rec: dict | None) -> None:
     if rec is not None and rec.get("id"):
         j["signoff_id"] = str(rec["id"])
diff --git a/scripts/showcase.py b/scripts/showcase.py
index dfb7269..a8139d9 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -1255,6 +1255,7 @@ def _main(argv=None) -> int:
     signoff.set_required(False if getattr(args, "no_require_t3_signoff", False)
                          else bool(getattr(args, "require_t3_signoff", False)) or signoff.env_required())
     signoff.set_file(getattr(args, "t3_signoff_file", None))
+    signoff.set_opt_out_t3(_is_t3_owner(args) if (not signoff.required() and getattr(args, "allow_t3", False)) else None)
     if args.format is None:
         args.format = "text" if args.command in GENERATORS else "json"
     try:
@@ -1273,20 +1274,35 @@ def _main(argv=None) -> int:
         if args.format == "text" and not args.quiet:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
+    audit = []  # opt-out diagnostics, independent of whether the command returned an object
+    if not signoff.required() and signoff.explicit_file() is not None:  # a file nobody enforces is not silently ignored
+        audit.append("t3-signoff:file-ignored")
+    if not signoff.required() and getattr(args, "allow_t3", False):  # trust-only --allow-t3 is visible in the output
+        audit.append("t3-signoff:opt-out")
     if obj is not None:
-        if not signoff.required() and signoff.explicit_file() is not None:  # a file nobody enforces is not silently ignored
-            obj["logs"] = [*(obj.get("logs") or []), "t3-signoff:file-ignored"]
-            if args.format == "text" and not args.quiet:
+        if audit:
+            obj["logs"] = [*(obj.get("logs") or []), *audit]
+            if "t3-signoff:file-ignored" in audit and args.format == "text" and not args.quiet:
                 print("t3-signoff:file-ignored: a sign-off record file was given with sign-off enforcement opted out, "
                       "so no record is read or enforced", file=sys.stderr)
-        if not signoff.required() and getattr(args, "allow_t3", False):  # trust-only --allow-t3 is visible in the output
-            obj["logs"] = [*(obj.get("logs") or []), "t3-signoff:opt-out"]
         for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
-            if signoff.required() and isinstance(obj.get(key), list):
-                signoff.stamp(obj[key])
+            if isinstance(obj.get(key), list):
+                signoff.stamp(obj[key])  # the granting record, or "opt-out" for T3 items under the opt-out
         emit(args, obj)
+    elif audit:  # direct-print commands (doctor, lint, meta without --out): stderr keeps their stdout formats intact
+        for a in audit:
+            print(f"{a}: sign-off enforcement is opted out for this run", file=sys.stderr)
     return code
 
 
+def _is_t3_owner(args):
+    """A predicate for signoff.stamp_opt_out: is OWNER a T3 org in the brand data (False when it cannot be read)."""
+    try:
+        b = brand(args, prefer_lock=True)
+    except Exception:
+        return lambda owner: False
+    return lambda owner: b.owner_status(owner) == "t3"
+
+
 if __name__ == "__main__":
     raise SystemExit(main())
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 747482d..73b6404 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -522,7 +522,7 @@ def test_topics_change_records_carry_the_signoff_id(tmp_path):
     assert recs and all(x["signoff_id"] == "t3s-cr" and "approval_id" not in x for x in recs), recs
     plain = tmp_path / "plain.jsonl"
     _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--records", str(plain))
-    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
+    assert all(json.loads(x)["signoff_id"] == "opt-out" for x in plain.read_text(encoding="utf-8").splitlines())  # no record authorized them
 
 
 def test_adopt_json_output_stamps_change_records_and_jobs(tmp_path):
@@ -736,10 +736,11 @@ def test_org_labels_gate_the_t3_owner_a_transfer_resolves_to(tmp_path, monkeypat
         assert jobs, res
         signoff.stamp(jobs)  # showcase.main stamps every emitted job list the same way
         assert all(j["signoff_id"] == "t3s-lbl" for j in jobs), jobs
-    # no --allow-t3: the T3 org that holds the repository today is held like any T3 org (decision 12)
+    # no --allow-t3: the base behaviour is kept (the transfer-target hold is opt-in via the T3 flag, not via the
+    # default-on enforcement), so T1/T2 org output does not change
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "noflag", [{"id": "t3s-x"}])), allow_t3=False):
         res, _ = O.labels_plan(est, T1, allow_t3=False)
-        assert res["repos"][0]["result"] == "held" and res["repos"][0]["log"] == "t3-signoff", res
+        assert res["result"] == "plan" and not [x for x in res["repos"] if x.get("result") == "held"], res
 
 
 def test_favorite_transferred_to_a_t3_org_is_held_without_its_record(tmp_path, monkeypatch, brand):
@@ -784,7 +785,7 @@ def test_t3_also_in_association_carries_its_signoff_id(tmp_path):
     plain = tmp_path / "plain.jsonl"  # without the flag: no key, behaviour unchanged
     r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--also-in", OWNER, "--records", str(plain), owner=T1)
     assert "signoff_ids" not in json.loads(r.stdout), r.stdout
-    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())
+    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())  # T1-owner record: not a T3 item
 
 
 _GOOD = {"id": "t3s-env", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "synthetic-co-owner",
@@ -819,17 +820,18 @@ def test_file_envelope_follows_the_schema(tmp_path, doc, ok):
 # --- review round 4: evidence for each fixed finding (synthetic records only) ---
 
 def test_transfer_to_a_t3_org_is_unchanged_without_the_flag(monkeypatch, brand):
-    """Flag off (the default), no --allow-t3: a T1 member whose approved pending transfer resolves to the T3 org keeps
+    """Enforcement left at its real default (on), no --allow-t3: a T1 member whose approved pending transfer resolves to the T3 org keeps
     the base (2be04ac) behaviour. `org labels` plans its label jobs and the favorite and home entry stay public,
     exactly as before this epic. The transfer-target T3 checks (org._t3_moved_held, the labels_plan gate) belong to
-    the opt-in --require-t3-signoff only: no issue of epic #22 (#31, #28, #23-#27) asks for a default-on tightening."""
+    --allow-t3 only (enforcement defaulting on changes nothing here): no issue of epic #22 (#31, #28, #23-#27) asks for a default-on tightening."""
     from ctshowcase import org as O, signoff
     from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
     monkeypatch.delenv("SHOWCASE_REQUIRE_T3_SIGNOFF", raising=False)
     monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
     fav = f"{T1}/northwind-member"
     est, reg = _transfer_estate(brand, favorites=[fav])
-    t3, req = set_t3_signed_off(False), signoff.set_required(False)
+    t3 = set_t3_signed_off(False)
+    assert signoff.required() is True  # the shipped default, not forced off
     try:
         res, _ = O.labels_plan(est, T1, allow_t3=False)
         assert res["result"] == "plan" and not [x for x in res["repos"] if x.get("result") == "held"], res
@@ -840,7 +842,6 @@ def test_transfer_to_a_t3_org_is_unchanged_without_the_flag(monkeypatch, brand):
         assert f"{OWNER}/northwind-member" in json.dumps(data), data
         assert not any(x.startswith("t3-signoff") for x in logs), logs
     finally:
-        signoff.reset_required(req)
         reset_t3_signed_off(t3)
 
 
@@ -860,8 +861,8 @@ def test_home_repository_held_by_a_t3_org_is_omitted_without_its_record(tmp_path
         assert [e["full_name"] for e in data["featured"]] == [full], data
         assert f"t3-signoff:{full}" not in logs, logs
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "noflag", [{"id": "t3s-x"}])), allow_t3=False):
-        data, logs = O.public_slice(est, T1, allow_t3=False)  # a record alone is not --allow-t3
-        assert full not in json.dumps(data), data
+        data, logs = O.public_slice(est, T1, allow_t3=False)  # no --allow-t3: base behaviour, no transfer-target hold
+        assert full in json.dumps(data) and f"t3-signoff:{full}" not in logs, (data, logs)
 
 
 def test_adopt_topics_job_carries_the_also_in_signoff(tmp_path):
@@ -1012,3 +1013,47 @@ def lst(i, n):
         plan = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=False, repo_ids=ids)
         items = [j for j in plan["jobs"] if "list-item" in j["id"]]
         assert items and "UL_t3" not in items[0]["argv"][-1] and "signoff_id" not in items[0], items
+
+
+# --- review round 5: opt-out audit, duplicate ids, doctor shape, direct-print diagnostics ---
+
+def test_duplicate_record_ids_refuse_invalid(tmp_path):
+    """signoff_id is the audit key on jobs, so two records sharing an id make a file that authorizes nothing."""
+    from ctshowcase import signoff
+    base = {"id": "t3s-001", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "a",
+            "approved_on": "2026-01-15", "expires": "2099-12-31"}
+    other = dict(base, owner="Jevelopers-neatHack-2026", repos=["x"], approver="b")
+    rec, why = signoff.evaluate([OWNER], None, records=[base, other])
+    assert rec is None and why.startswith("invalid:t3s-001") and "duplicate id" in why, (rec, why)
+    rec, why = signoff.evaluate([OWNER], None, records=[base, dict(other, id="t3s-002")])
+    assert why is None and rec["id"] == "t3s-001"
+
+
+def test_opt_out_marks_t3_jobs_and_records(tmp_path):
+    """--allow-t3 --no-require-t3-signoff: the serialized jobs say no record authorized them."""
+    jobs, recs = tmp_path / "jobs.jsonl", tmp_path / "recs.jsonl"
+    r = _run(tmp_path, _bundle(tmp_path, []), "--no-require-t3-signoff", "--allow-t3", "adopt",
+             f"{OWNER}/northwind-synthetic", "--jobs", str(jobs), "--records", str(recs))
+    assert r.returncode != 2, _out(r)
+    rows = [json.loads(x) for f in (jobs, recs) if f.exists() for x in f.read_text(encoding="utf-8").splitlines() if x.strip()]
+    assert rows, _out(r)
+    assert all(j.get("signoff_id") == "opt-out" for j in rows), rows
+
+
+def test_direct_print_commands_emit_the_opt_out_audit_on_stderr(tmp_path):
+    bundle = _bundle(tmp_path, [])
+    r = _run(tmp_path, bundle, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
+    assert r.returncode != 2, _out(r)
+    assert "t3-signoff:opt-out" in r.stderr, r.stderr
+    json.loads(r.stdout.splitlines()[0])  # stdout format intact
+    r = _run(tmp_path, bundle, "--no-require-t3-signoff", "--allow-t3", "--t3-signoff-file", str(tmp_path / "x.yaml"),
+             "doctor", "--format", "json")
+    assert "t3-signoff:file-ignored" in r.stderr, r.stderr
+
+
+def test_doctor_row_shape_is_unchanged_without_allow_t3(tmp_path):
+    """The documented row (R1-R11, banner, icon, card, footer, done) gains signoff_id only when --allow-t3 is passed."""
+    bundle = _bundle(tmp_path, [])
+    r = _run(tmp_path, bundle, "doctor", "--header", owner="CompleteTech-Skills")
+    head = r.stdout.splitlines()[0].split("\t")
+    assert head[-1] == "done" and "signoff_id" not in head, r.stdout

From f3415a53b743fc523aef691a53ba1fd91f6484fd Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 14:47:57 -0400
Subject: [PATCH 24/79] Remove the T3 sign-off opt-out, reject future and
 inverted record dates, keep both grants on star-List items, report malformed
 covering records as invalid (#23)

Applies the t3-no-bypass adjudication: --no-require-t3-signoff and SHOWCASE_REQUIRE_T3_SIGNOFF are gone,
enforcement is unconditional and --require-t3-signoff stays a no-op. Also fixes the review findings: approved_on in
the future and expires before approved_on are t3-signoff:invalid, a malformed record that would cover the repository
is invalid rather than scope, a T3 favorite no longer suppresses the T3 List org's record, help/docstring/CHANGELOG
text matches default-on, and jsonschema is installed where CI runs pytest.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/quality.yml          |   2 +-
 .github/workflows/test-portability.yml |   2 +-
 CHANGELOG.md                           |   3 +-
 CONTRIBUTING.md                        |   2 +-
 ONBOARDING.md                          |   2 +-
 SKILL.md                               |   4 +-
 references/constraints.md              |   2 +-
 references/org.md                      |   2 +-
 references/t3-signoff.md               |  18 +-
 references/t3-signoff.schema.json      |   2 +-
 scripts/ctshowcase/config.py           |   6 +-
 scripts/ctshowcase/content.py          |   2 +-
 scripts/ctshowcase/doctor.py           |   9 +-
 scripts/ctshowcase/intake.py           |   4 +-
 scripts/ctshowcase/org.py              |  42 ++---
 scripts/ctshowcase/project.py          |  13 +-
 scripts/ctshowcase/records.py          |   2 +-
 scripts/ctshowcase/resolver.py         |   5 +-
 scripts/ctshowcase/signoff.py          | 124 +++++---------
 scripts/ctshowcase/topics.py           |   6 +-
 scripts/showcase.py                    |  45 +----
 tests/conftest.py                      |   5 +-
 tests/test_allow_t3_docs.py            |  19 ++-
 tests/test_allow_t3_global.py          |   1 -
 tests/test_t3_signoff_default.py       |  22 +--
 tests/test_t3_signoff_require.py       | 228 +++++++++++--------------
 26 files changed, 236 insertions(+), 336 deletions(-)

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index f161f59..d264db7 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -24,7 +24,7 @@ jobs:
       - name: Install Python quality dependencies
         run: |
           python -m pip install --upgrade pip
-          python -m pip install -r requirements.txt ruff==0.17.2 pyyaml==6.0.3 pytest==9.1.1
+          python -m pip install -r requirements.txt ruff==0.17.2 pyyaml==6.0.3 pytest==9.1.1 jsonschema==4.25.1
       - name: Install diagram and type-check tools
         run: npm install -g @mermaid-js/mermaid-cli pyright
       - name: Verify the bundled OFL fonts
diff --git a/.github/workflows/test-portability.yml b/.github/workflows/test-portability.yml
index d7d9482..b79a04c 100644
--- a/.github/workflows/test-portability.yml
+++ b/.github/workflows/test-portability.yml
@@ -21,6 +21,6 @@ jobs:
         with:
           python-version: '3.12'
       - name: Install test dependencies
-        run: python -m pip install -r requirements.txt pytest==9.1.1
+        run: python -m pip install -r requirements.txt pytest==9.1.1 jsonschema==4.25.1
       - name: Run the full test suite
         run: python -m pytest -q
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 654b81b..e0e9451 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,8 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. The one escape is the explicit opt-out `--no-require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), logged `t3-signoff:opt-out`; `--require-t3-signoff` is still accepted. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. `t3-signoff:file-ignored` now appears only when an explicit file is given while opted out. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Under the opt-out with `--allow-t3`, T3 writer jobs and change records carry `signoff_id: "opt-out"` and direct-print commands (`doctor`, `lint`, `meta`) log `t3-signoff:opt-out` and `t3-signoff:file-ignored` on stderr. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default.
-- Earlier, opt-in form of the above (superseded by the default-on entry): `--require-t3-signoff` (env `SHOWCASE_REQUIRE_T3_SIGNOFF=1`) with the file named by `--t3-signoff-file PATH`. `--allow-t3` is then honoured only while the record file named by the new global `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`; there is no default location until the maintainer chooses the canonical path in the estate bundle) holds an approved, unexpired record for the owner (and the repository when the record is scoped; `repos: ["*"]` covers all). The record format (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`) is `references/t3-signoff.schema.json`, described in `references/t3-signoff.md`; a date expiry is valid through that day and a timestamp expiry (UTC offset required) only before that instant. Otherwise the command exits 2 with `t3-signoff:no-file`, `t3-signoff:missing`, `t3-signoff:invalid`, `t3-signoff:expired` or `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account (an item job that adds another owner's T3 repository carries that repository's record); change records carry `signoff_id`; `doctor` shows `signoff_id`. A T3 association carries that org's record (`signoff_id`): the topics change record of `topics --also-in`, `adopt`'s topics job and change record for an `also_in` T3 org (an existing `approval_id` is kept), and the `project estate-plan` jobs that add a T3 org to the Estate's Org field. Under the flag only, a repository whose approved pending transfer resolves to a T3 org is gated as that org's: `org labels` holds its label jobs (`held`, `t3-signoff:<why>`), and `org profile` and star Lists omit it as a home repository or favorite until the T3 org's record covers it. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused; without the flag behaviour is unchanged.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is only an accepted no-op. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed record that would have covered the requested repository is reported as `t3-signoff:invalid`, not `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index dc88ffc..00f6402 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -28,7 +28,7 @@ Use synthetic fixtures and new output paths instead of overwriting committed pre
 The full gate for this repository adds the test suite and the showcase quality gates to the package baseline:
 
 ```bash
-python -m pip install -r requirements.txt ruff==0.17.2 pytest==9.1.1
+python -m pip install -r requirements.txt ruff==0.17.2 pytest==9.1.1 jsonschema==4.25.1
 python -m pytest -q
 python scripts/validate_quality.py
 ```
diff --git a/ONBOARDING.md b/ONBOARDING.md
index aa9e3f1..3e94964 100644
--- a/ONBOARDING.md
+++ b/ONBOARDING.md
@@ -68,7 +68,7 @@ For a multi-skill handoff, preserve the source facts, artifact paths, `logs[]` c
 
 ## Safety and permissions
 
-The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the claim is checked by default against a sign-off record in the private estate bundle (`decisions/t3-signoffs.yaml`, or `--t3-signoff-file PATH`; `--no-require-t3-signoff` is the explicit opt-out) ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
+The documented generation workflow is local. Installation may contact GitHub and package indexes. `meta --from-gh` and the opt-in `org labels ORG --repos-from-gh` mode make read-only `gh api` GETs. `fonts --fetch` downloads the pinned fonts. Org-wide label planning emits proposed jobs for review; it never applies them. Generation does not push commits, change descriptions, topics, labels or settings, publish documents, grant approval or install background services. T3 (co-owned) owners are refused unless `--allow-t3` is passed for one approved invocation; the claim is checked by default against a sign-off record in the private estate bundle (`decisions/t3-signoffs.yaml`, or `--t3-signoff-file PATH`; there is no opt-out) ([references/t3-signoff.md](references/t3-signoff.md)). Keep real sign-off records in the private estate bundle; never copy them into a repository. Review the boundaries in [SKILL.md](SKILL.md) before using real repositories.
 
 ## Troubleshooting and verification
 
diff --git a/SKILL.md b/SKILL.md
index 454e251..156daae 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` and the opt-out `SHOWCASE_REQUIRE_T3_SIGNOFF=0` are). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores trust-only `--allow-t3` for that run and is logged `t3-signoff:opt-out` (on stderr for direct-print commands such as `doctor`, `lint` and `meta` without `--out`); T3 writer jobs and change records made under it carry `signoff_id: "opt-out"` so no record is mistaken for authorization. With enforcement on, writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
@@ -165,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff | --no-require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/constraints.md b/references/constraints.md
index ab299dc..c31f87c 100644
--- a/references/constraints.md
+++ b/references/constraints.md
@@ -26,7 +26,7 @@ Condensed from `ct-std-v1` §10 and §12. The skill proposes; a single serialize
 1. **One serialized writer queue** for every REST call, git push and UI write. Planners and this skill emit change records.
 2. **Change record:** `{std, owner, repo, kind: api|file|ui, target, before_sha256, after, rule}`. The writer rejects a record whose `before` no longer matches the live state. Commands that propose writes take `--records FILE`.
 3. **Diff first.** GET, compute the delta, write only the delta, GET again to verify. Never write a value that is already equal.
-4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (enforced by default; `--no-require-t3-signoff` opts out: `t3-signoff:no-file|missing|invalid|expired|scope`, plus `t3-signoff:opt-out` when opted out, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
+4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (always enforced: `t3-signoff:no-file|missing|invalid|expired|scope`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
 5. **Never commit logs** or the moves list to a public repository: they name private repositories.
 
 ## Content commits
diff --git a/references/org.md b/references/org.md
index a92dccb..2b5ce03 100644
--- a/references/org.md
+++ b/references/org.md
@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope` otherwise, see [t3-signoff.md](t3-signoff.md)); `--no-require-t3-signoff` is the explicit opt-out.
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope` otherwise, see [t3-signoff.md](t3-signoff.md)); there is no opt-out.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 706431b..fbbc0fb 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,6 +1,6 @@
-# T3 sign-off records (`--require-t3-signoff`)
+# T3 sign-off records (`--allow-t3` needs one)
 
-`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. The one escape is the explicit opt-out `--no-require-t3-signoff` (or `SHOWCASE_REQUIRE_T3_SIGNOFF=0`), which restores the trust-only meaning of `--allow-t3` for that run and is logged `t3-signoff:opt-out`; T3 writer jobs and change records made under it carry `signoff_id: "opt-out"`; the two flags together are a usage error. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
@@ -17,8 +17,8 @@ signoffs:
     repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
     approved: true             # a boolean; only true grants
     approver: example-co-owner # who signed off
-    approved_on: 2026-01-15    # the date they signed off
-    expires: 2099-12-31        # a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
+    approved_on: 2026-01-15    # the date they signed off (not in the future)
+    expires: 2099-12-31        # not before approved_on; a date (valid through that day) or a timestamp with a UTC offset (valid before that instant)
     note: "optional free text"
 ```
 
@@ -29,8 +29,8 @@ signoffs:
 | `repos` | yes | `"*"`, a name, or a non-empty list of names / `OWNER/NAME` |
 | `approved` | yes | boolean (`"true"` as a string is invalid) |
 | `approver` | yes | non-empty string |
-| `approved_on` | yes | date `YYYY-MM-DD` |
-| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid |
+| `approved_on` | yes | date `YYYY-MM-DD`, not later than today (a sign-off that has not happened yet grants nothing) |
+| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid; not earlier than `approved_on` |
 | `note` | no | string |
 
 No other fields are allowed. The file itself is an object with the one key `signoffs`, a list of record objects; a top-level list, any other top-level key or a non-object entry makes the whole file authorize nothing (`t3-signoff:missing`), as the schema refuses it.
@@ -43,10 +43,10 @@ Each refusal exits 2 with result `refused`.
 |---|---|
 | `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
-| `t3-signoff:invalid` | the owner has records but every one breaks the schema; the error names the record id and the first problem |
+| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`), or a malformed record would have covered the repository; the error names the record id and the first problem. Two records with one id are also invalid |
 | `t3-signoff:scope` | the owner has valid approved records but none covers the repository; an `OWNER/NAME` repository is covered only when that owner is the record's org (only `*` covers another account's repository) |
 | `t3-signoff:expired` | every covering record is past `expires` |
 
-Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and under the flag shows the granting record as `signoff_id`.
+Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
-The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.
+The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.
diff --git a/references/t3-signoff.schema.json b/references/t3-signoff.schema.json
index 17ea440..fecd30e 100644
--- a/references/t3-signoff.schema.json
+++ b/references/t3-signoff.schema.json
@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/CompleteTech-Skills/github-showcase-skill/references/t3-signoff.schema.json",
   "title": "T3 co-owner sign-off records",
-  "description": "The file that --require-t3-signoff reads (passed with --t3-signoff-file or SHOWCASE_T3_SIGNOFF_FILE). Dates are written as YAML dates or ISO 8601 strings; validate after converting YAML dates to ISO strings. See references/t3-signoff.md.",
+  "description": "The file that --allow-t3 is checked against: --t3-signoff-file PATH, else SHOWCASE_T3_SIGNOFF_FILE, else <estate root>/decisions/t3-signoffs.yaml. The tool also rejects an approved_on later than today and an expires earlier than approved_on, which a schema cannot state. Dates are written as YAML dates or ISO 8601 strings; validate after converting YAML dates to ISO strings. See references/t3-signoff.md.",
   "type": "object",
   "required": ["signoffs"],
   "additionalProperties": false,
diff --git a/scripts/ctshowcase/config.py b/scripts/ctshowcase/config.py
index 5694c21..905f417 100644
--- a/scripts/ctshowcase/config.py
+++ b/scripts/ctshowcase/config.py
@@ -57,8 +57,8 @@ def reset_t3_signed_off(token: Token) -> None:
 
 
 def t3_signed_off(owner: str | None = None, repo: str | None = None) -> bool:
-    """The run's `--allow-t3` (context-local). With an owner and `--require-t3-signoff`, also needs a valid sign-off
-    record (ctshowcase/signoff.py); without the opt-in flag the answer is the bare flag, as before."""
+    """The run's `--allow-t3` (context-local). With an owner, also needs a valid sign-off
+    record (ctshowcase/signoff.py): enforcement is always on, and no flag or environment variable opts out of it."""
     signed = _T3_SIGNED_OFF.get()
     if owner is not None and signed:
         from . import signoff
@@ -127,7 +127,7 @@ def check_owner(self, owner: str, *, allow_t3: bool = False, repo: str | None =
             raise Refused(f"{owner} is T3; needs co-owner sign-off", log="t3-signoff")
         if status == "t3" and verify_signoff:
             from . import signoff
-            signoff.require(owner, repo, self.aliases(owner))  # no-op when opted out (--no-require-t3-signoff)
+            signoff.require(owner, repo, self.aliases(owner))
         return status
 
     def org(self, owner: str) -> dict:
diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index 5602e7f..952ff61 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -2349,7 +2349,7 @@ def _ctx(args, cli, resolver):
 def _finish(args, obj: dict, code: int):
     jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
     from .signoff import stamp
-    stamp(jobs)  # before any serialization (--jobs, --report): a no-op when opted out (--no-require-t3-signoff)
+    stamp(jobs)  # before any serialization (--jobs, --report)
     if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
         from .records import append
         append(args.jobs, jobs)
diff --git a/scripts/ctshowcase/doctor.py b/scripts/ctshowcase/doctor.py
index 7926b62..55cca46 100644
--- a/scripts/ctshowcase/doctor.py
+++ b/scripts/ctshowcase/doctor.py
@@ -166,19 +166,18 @@ def row(ctx: RepoContext) -> dict:
            "done": "yes" if done else "no", "logs": sorted(set(logs + ctx.logs))}
     from . import signoff
     rec = None
-    if signoff.required() and ctx.brand.owner_status(ctx.owner) == "t3" and t3_signed_off(ctx.owner, ctx.repo):
+    if ctx.brand.owner_status(ctx.owner) == "t3" and t3_signed_off(ctx.owner, ctx.repo):
         # evaluated directly (not via the gate's cache) so `doctor --estate` rows, which never run check_owner, show it too
         rec, _ = signoff.evaluate(ctx.brand.aliases(ctx.owner), ctx.repo)
-    if rec is not None:  # only under --require-t3-signoff with a valid record: show which sign-off lifted the hold
+    if rec is not None:  # only with a valid record: show which sign-off lifted the hold
         row["signoff_id"] = str(rec.get("id") or "")
         row["signoff_expires"] = str(rec.get("expires") or "")
     return row
 
 
 def _signoff_cols() -> list[str]:
-    from . import signoff
-    # extra column only when --allow-t3 is passed with enforcement on; the documented row shape is unchanged otherwise
-    return ["signoff_id"] if signoff.required() and t3_signed_off() else []
+    # extra column only when --allow-t3 is passed; the documented row shape is unchanged otherwise
+    return ["signoff_id"] if t3_signed_off() else []
 
 
 def _signoff_vals(r: dict) -> list[str]:
diff --git a/scripts/ctshowcase/intake.py b/scripts/ctshowcase/intake.py
index 112a3b0..58fcaf2 100644
--- a/scripts/ctshowcase/intake.py
+++ b/scripts/ctshowcase/intake.py
@@ -99,8 +99,8 @@ def adopt(ctx, resolver=None, *, approval_id: str | None = None, fresh: bool = F
         jobs.append(_job(_jid("p3", "topics", sid), argv, full, "§5.6 topics (full ordered list; PUT replaces the set).",
                          approval_id, kind="topics"))
         recs.append(records.record(owner, repo, "topics", "topics", tp["current"], tp["proposed"], "§5.6 merge"))
-        # a T3 `also_in` membership topic: carry the record(s) that let it in, as cmd_topics does (no-op when opted out;
-        # a job's existing approval_id is kept)
+        # a T3 `also_in` membership topic: carry the record(s) that let it in, as cmd_topics does (a job's existing
+        # approval_id is kept)
         from .signoff import stamp_associations
         for item in (jobs[-1], recs[-1]):
             stamp_associations(item, tp.get("signoff_ids"), owner, repo)
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index e808abb..9fac188 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -293,7 +293,7 @@ def _gate(estate: Estate, org: str, *, allow_t3=False, allow_hold=False,
 
 
 def _t3_granted(owner: str, repo: str | None = None) -> bool:
-    """True unless `--require-t3-signoff` is on and no valid sign-off record covers the owner (signoff.py)."""
+    """True when a valid sign-off record covers the owner (signoff.py)."""
     from . import signoff
     return signoff.granted(owner, repo)
 
@@ -386,9 +386,8 @@ def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     (tests/test_t3_signoff_require.py::test_transfer_to_a_t3_org_is_unchanged_without_the_flag). With the flag:
     ::test_favorite_transferred_to_a_t3_org_is_held_without_its_record and
     ::test_home_repository_held_by_a_t3_org_is_omitted_without_its_record."""
-    from . import signoff
     from .config import t3_signed_off
-    if not (allow_t3 or t3_signed_off()) or not signoff.required() or "/" not in (full or ""):
+    if not (allow_t3 or t3_signed_off()) or "/" not in (full or ""):
         return False
     r = estate.resolver
     cur = estate.current(r.slug(full))
@@ -419,10 +418,10 @@ def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
         logs.append("needs-input:org-description")
     names = estate.repos_of(org)
     public = [n for n in names if n != ".github" and estate.is_public(f"{login}/{n}")]
-    # Under --require-t3-signoff: a home repository that a T3 org holds today (approved pending transfer) needs that
+    # A home repository that a T3 org holds today (approved pending transfer) needs that
     # org's record before the profile names it; held ones are omitted from featured, sections, forks and archives.
     # Only the moved slug is checked here: the home org itself already passed _gate, and the callers that pass no
-    # allow_t3 (leak scope, doctor) must keep seeing the org's own repositories. No-op without the flag.
+    # allow_t3 (leak scope, doctor) must keep seeing the org's own repositories. No-op without --allow-t3.
     moved_held = [n for n in public if _t3_moved_held(estate, f"{login}/{n}", allow_t3)]
     for n in moved_held:
         logs.append(f"t3-signoff:{estate.current(r.slug(f'{login}/{n}'))}")
@@ -1570,8 +1569,8 @@ def _estate_list_targets(estate: Estate, nodes: list[dict], *, allow_t3: bool =
 
 def star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = None, repo_ids: dict | None = None,
                    planned_new: int | None = None, allow_t3: bool = False) -> dict:
-    """See _star_list_plan. Its jobs target the personal account (USER_LOGIN), not the org, so under
-    --require-t3-signoff the org's grant is carried onto them explicitly (target-based stamping would miss it)."""
+    """See _star_list_plan. Its jobs target the personal account (USER_LOGIN), not the org, so the org's
+    grant is carried onto them explicitly (target-based stamping would miss it)."""
     from . import signoff
     out = _star_list_plan(estate, org, lists_capture=lists_capture, repo_ids=repo_ids, planned_new=planned_new,
                           allow_t3=allow_t3)
@@ -1672,13 +1671,19 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
         if r.owner_status(f.split("/")[0]) == "t3":  # a T3 favorite carries its own record (signoff.stamp_source)
             signoff.stamp_source(item, f, r.aliases(f.split("/")[0]))
         added = sorted(i for i in targets.get(f.lower(), set()) - have - {list_id} if i in list_signoffs)
-        if added and signoff.required():  # a newly added T3 destination List carries the record that admitted it
-            sids = [item["signoff_id"]] if "signoff_id" in item else []
-            if not sids and r.owner_status(login) == "t3":
-                own = signoff.record(login, None, r.aliases(login))
-                sids = [str(own["id"])] if own and own.get("id") else []
+        # Every grant the job needs is kept: the T3 favorite's own record (stamped above), the List org's record when
+        # that org is T3 (the destination of this item job), and the record of each newly added T3 destination List.
+        # One grant never suppresses another; an existing approval_id is kept (signoff.stamp_associations).
+        sids = [item["signoff_id"]] if "signoff_id" in item else []
+        if r.owner_status(login) == "t3":
+            own = signoff.record(login, None, r.aliases(login))
+            if own and own.get("id"):
+                sids.append(str(own["id"]))
+        sids += [list_signoffs[i] for i in added]
+        sids = list(dict.fromkeys(sids))
+        if len(sids) > 1 or (sids and "signoff_id" not in item):
             item.pop("signoff_id", None)
-            signoff.stamp_associations(item, sids + [list_signoffs[i] for i in added])
+            signoff.stamp_associations(item, sids)
         out["jobs"].append(item)
     return dict(out, result="incomplete" if incomplete else "ok", list_id=list_id)
 
@@ -1853,16 +1858,15 @@ def labels_plan(estate: Estate, org: str, *, allow_t3: bool = False, checkouts:
         m = estate.meta(f"{login}/{n}")
         full = estate.current(f"{login}/{n}")  # labels are written where the repository is today
         current_owner, current_name = full.split("/", 1)
-        from . import signoff
         from .config import t3_signed_off
-        if (signoff.required() and (allow_t3 or t3_signed_off()) and not estate.resolver.same(current_owner, login)
+        if ((allow_t3 or t3_signed_off()) and not estate.resolver.same(current_owner, login)
                 and estate.resolver.owner_status(current_owner) == "t3"):
-            # Under --require-t3-signoff only: an approved pending transfer whose label jobs target the T3 org that
+            # An approved pending transfer whose label jobs target the T3 org that
             # holds the repository today passes that org's gate (--allow-t3 and its record; check_owner also
             # registers the grant that stamps signoff_id on these jobs). The org gate above only saw LOGIN.
-            # Without the flag the base behaviour is kept (no issue of epic #22 asks for a default-on change):
-            # tests/test_t3_signoff_require.py::test_org_labels_gate_the_t3_owner_a_transfer_resolves_to (flag on)
-            # and ::test_transfer_to_a_t3_org_is_unchanged_without_the_flag (flag off).
+            # Without --allow-t3 the base behaviour is kept (no issue of epic #22 asks for a default-on change):
+            # tests/test_t3_signoff_require.py::test_org_labels_gate_the_t3_owner_a_transfer_resolves_to (with the flag)
+            # and ::test_transfer_to_a_t3_org_is_unchanged_without_the_flag (without it).
             from .errors import Refused
             try:
                 estate.resolver.check_owner(current_owner, allow_t3=allow_t3, repo=current_name)
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 4c45178..01ab73b 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -188,7 +188,7 @@ def _gate_target(resolver: Resolver | None, owner: str, *, allow_t3: bool = Fals
     if st == "t3" and not allow_t3:
         raise Refused(f"{owner} is T3: reading its project is fine, changing anything needs co-owner sign-off",
                       log="t3-signoff")
-    if st == "t3":  # registers the grant so writer jobs carry signoff_id; refuses t3-signoff:<why>; no-op when opted out (--no-require-t3-signoff)
+    if st == "t3":  # registers the grant so writer jobs carry signoff_id; refuses t3-signoff:<why>
         from . import signoff
         signoff.require(owner, None, resolver.aliases(owner))
     return resolver.canonical(owner)
@@ -1083,7 +1083,7 @@ def lint(capture: dict, *, role: str = "org", owner: str | None = None, display_
 # =====================================================================================================
 def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
     """In-scope orgs for the Estate's Org field: T1, T2, T2-R (T3 only after sign-off; never HOLD or excluded).
-    Under --require-t3-signoff a T3 org also needs a valid record, and its entry keeps that record's id as
+    A T3 org also needs a valid record, and its entry keeps that record's id as
     `signoff_id` so estate_plan can carry it onto the jobs that bring the org into the personal board."""
     from . import signoff
     out = []
@@ -1102,10 +1102,9 @@ def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
         if tier == "T3":
             if not allow_t3:
                 continue
-            if signoff.required():
-                rec = signoff.record(key, None, resolver.aliases(key))
-                if rec is None:
-                    continue
+            rec = signoff.record(key, None, resolver.aliases(key))
+            if rec is None:
+                continue
         if tier in TIER_COLOR:
             entry = {"login": resolver.canonical(key), "name": row.get("display_name") or key, "tier": tier}
             if rec is not None and rec.get("id"):
@@ -1146,7 +1145,7 @@ def walk(v):
 
 
 def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
-    """Under --require-t3-signoff: each job that names a signed-off T3 org (its Org-field option, its login) carries
+    """Each job that names a signed-off T3 org (its Org-field option, its login) carries
     that org's record. The jobs target @me, so stamping by target owner never finds the T3 grant; several T3 orgs on
     one job give `signoff_ids` (signoff.stamp_associations). No-op when no org carries a signoff_id.
     (tests/test_t3_signoff_require.py::test_estate_plan_jobs_carry_the_t3_orgs_signoff)"""
diff --git a/scripts/ctshowcase/records.py b/scripts/ctshowcase/records.py
index c4e8182..7aeea62 100644
--- a/scripts/ctshowcase/records.py
+++ b/scripts/ctshowcase/records.py
@@ -21,7 +21,7 @@ def append(path: str | Path | None, recs: list[dict]) -> None:
     if not path or not recs:
         return
     from .signoff import stamp
-    stamp(recs)  # jobs and change records of a signed-off T3 owner carry signoff_id (or "opt-out" under the opt-out)
+    stamp(recs)  # jobs and change records of a signed-off T3 owner carry signoff_id
     p = Path(path)
     p.parent.mkdir(parents=True, exist_ok=True)
     with p.open("a", encoding="utf-8") as fh:
diff --git a/scripts/ctshowcase/resolver.py b/scripts/ctshowcase/resolver.py
index 00195de..0670cd9 100644
--- a/scripts/ctshowcase/resolver.py
+++ b/scripts/ctshowcase/resolver.py
@@ -222,8 +222,7 @@ def aliases(self, login: str) -> list[str]:
                 seen.add(x.lower())
                 uniq.append(x)
         from . import signoff
-        if signoff.required():  # --require-t3-signoff: a record under any login of the org matches wherever it is re-checked
-            signoff.register_aliases(uniq)
+        signoff.register_aliases(uniq)  # a record under any login of the org matches wherever it is re-checked
         return uniq
 
     def same(self, a: str, b: str) -> bool:
@@ -301,7 +300,7 @@ def check_owner(self, login: str, *, allow_t3: bool = False, allow_hold: bool =
             raise Refused(f"{login} is T3; needs co-owner sign-off", log="t3-signoff")
         if st == "t3" and verify_signoff:  # doctor passes False: it reports the hold instead of refusing
             from . import signoff
-            signoff.require(login, repo, self.aliases(login))  # no-op when opted out (--no-require-t3-signoff)
+            signoff.require(login, repo, self.aliases(login))
         return st
 
     def family_hold(self, login: str) -> bool:
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 4f6acc0..8afc4a7 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -5,8 +5,8 @@
 `<estate_root>/decisions/t3-signoffs.yaml` (default_record_path(); estate_root is resolver.estate_root()). An explicit
 `--t3-signoff-file PATH` (env SHOWCASE_T3_SIGNOFF_FILE) overrides it. The order is: the explicit flag, then the env,
 then the default. The tool never creates the file and never falls back to trusting the flag when it is absent.
-The one opt-out is explicit: `--no-require-t3-signoff` or env SHOWCASE_REQUIRE_T3_SIGNOFF=0, which restores the
-trust-only meaning of `--allow-t3` for that run (tests/test_t3_signoff_default.py). The file is read, never copied.
+There is no opt-out: no flag or environment variable turns enforcement off, and `--require-t3-signoff` is only an
+accepted no-op. The file is read, never copied.
 Format (the contract is references/t3-signoff.schema.json, described in references/t3-signoff.md)::
 
     signoffs:
@@ -15,12 +15,13 @@
         repos: ["*"]                # "*" or repository names / OWNER/NAME; absent or empty matches nothing
         approved: true
         approver: example-co-owner  # who signed off (audit)
-        approved_on: 2026-01-15     # when they signed off (audit)
-        expires: 2099-12-31         # a date (valid through that day) or a timestamp with a UTC offset
+        approved_on: 2026-01-15     # when they signed off (audit); a future date grants nothing yet
+        expires: 2099-12-31         # a date (valid through that day) or a timestamp with a UTC offset; not before approved_on
         note: "optional free text"
 
 Refusals are exit 2 with log `t3-signoff:no-file` (no record file at the resolved path, or no estate root to resolve one; the log names the path), `t3-signoff:missing` (no approved record
-for the owner), `t3-signoff:invalid` (the owner's records all break the schema; the error names the first problem),
+for the owner), `t3-signoff:invalid` (the owner's records all break the schema, or a malformed record would have covered the
+repository; the error names the first problem),
 `t3-signoff:expired` (every matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none
 covers the repository; an owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are
 refused before this runs.
@@ -36,17 +37,12 @@
 from .errors import Refused
 
 FILE_ENV = "SHOWCASE_T3_SIGNOFF_FILE"
-REQUIRE_ENV = "SHOWCASE_REQUIRE_T3_SIGNOFF"
 DEFAULT_RELATIVE = Path("decisions") / "t3-signoffs.yaml"
-_OFF = ("0", "false", "no", "off")
 
 # All sign-off state is context-local, like `--allow-t3` itself (config._T3_SIGNED_OFF, issue 28): one thread's or
-# asyncio task's --require-t3-signoff, record file, grants and aliases never leak into another's owner gate
+# asyncio task's record file, grants and aliases never leak into another's owner gate
 # (tests/test_t3_signoff_require.py::test_signoff_state_is_context_local). showcase.main() opens a fresh run state
 # and restores the enclosing one on every exit.
-_REQUIRE: ContextVar[bool] = ContextVar("ctshowcase_t3_signoff_required", default=True)
-# Under the opt-out with --allow-t3: owner -> is it a T3 org (set by showcase.main), so stamp() can mark T3 output "opt-out".
-_OPT_OUT_T3: ContextVar = ContextVar("ctshowcase_t3_signoff_opt_out_t3", default=None)
 _FILE: ContextVar[str | None] = ContextVar("ctshowcase_t3_signoff_file", default=None)
 # (granted, aliases): lowercase login -> the records that granted it, for stamping this run's writer jobs; and
 # lowercase login -> every login of its org, filled by Resolver.aliases by default. None until first use.
@@ -57,24 +53,6 @@
     "ctshowcase_t3_signoff_run", default=None)
 
 
-def env_required() -> bool:
-    """On unless the environment opts out explicitly (SHOWCASE_REQUIRE_T3_SIGNOFF=0|false|no|off)."""
-    return os.environ.get(REQUIRE_ENV, "").strip().lower() not in _OFF
-
-
-def set_required(value: bool) -> Token:
-    """Set this context's `--require-t3-signoff`; the token restores the prior value (reset_required)."""
-    return _REQUIRE.set(bool(value))
-
-
-def reset_required(token: Token) -> None:
-    _REQUIRE.reset(token)
-
-
-def required() -> bool:
-    return _REQUIRE.get()
-
-
 def set_file(path: str | Path | None) -> Token:
     """Set this context's `--t3-signoff-file` (None: fall back to env SHOWCASE_T3_SIGNOFF_FILE, else no file)."""
     return _FILE.set(str(path) if path else None)
@@ -226,9 +204,11 @@ def _expiry(rec: dict) -> _dt.date | _dt.datetime | None:
     return _parse_when(rec.get("expires"))
 
 
-def problems(rec: dict) -> list[str]:
-    """What breaks references/t3-signoff.schema.json in one record ([] when it conforms). Kept in step with the schema
-    by tests/test_t3_signoff_require.py::test_schema_and_problems_agree_on_the_fixtures."""
+def problems(rec: dict, today: _dt.date | None = None) -> list[str]:
+    """What makes one record unusable ([] when it is sound): the breaks of references/t3-signoff.schema.json, plus two
+    rules a schema cannot state, an `approved_on` later than TODAY (default: today, local calendar; the sign-off has
+    not happened yet) and an `expires` earlier than `approved_on` (a grant that ended before it began). Kept in step
+    with the schema by tests/test_t3_signoff_require.py::test_schema_and_problems_agree_on_the_fixtures."""
     out = []
     for key in ("id", "owner", "approver"):
         if not isinstance(rec.get(key), str) or not rec[key].strip():
@@ -246,6 +226,14 @@ def problems(rec: dict) -> list[str]:
         out.append("expires: needs a date (YYYY-MM-DD) or a timestamp with a UTC offset")
     if "note" in rec and rec["note"] is not None and not isinstance(rec["note"], str):
         out.append("note: needs a string")
+    if isinstance(approved_on, _dt.date) and not isinstance(approved_on, _dt.datetime):
+        if approved_on > (today or _dt.datetime.now().astimezone().date()):
+            out.append(f"approved_on: {approved_on.isoformat()} is in the future (the sign-off has not happened yet)")
+        exp = _expiry(rec)
+        if exp is not None:
+            exp_day = exp.astimezone(_dt.timezone.utc).date() if isinstance(exp, _dt.datetime) else exp
+            if exp_day < approved_on:
+                out.append(f"expires: is earlier than approved_on {approved_on.isoformat()}")
     # key=str: YAML keys need not be strings (`7: x` beside `unexpected: true`), and sorting mixed types raised
     # TypeError out of showcase.main() instead of refusing t3-signoff:invalid
     # (tests/test_t3_signoff_require.py::test_mixed_type_unknown_keys_refuse_invalid)
@@ -291,15 +279,20 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
             return None, f"invalid:{rid}: duplicate id (record ids must be unique within the file)"
         seen.add(rid)
     ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
-    valid = [r for r in ours if not problems(r)]
+    today = now.astimezone().date()
+    valid = [r for r in ours if not problems(r, today)]
     mine = [r for r in valid if r.get("approved") is True]
     if not mine:
-        bad = [r for r in ours if problems(r)]
+        bad = [r for r in ours if problems(r, today)]
         if bad:  # a malformed record never authorizes, and the refusal says why instead of a silent 'missing'
-            return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0])[0]}"
+            return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0], today)[0]}"
         return None, "missing"
     scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
     if not scoped:
+        # a malformed record that would have covered the repository is the cause, not a missing scope
+        bad = [r for r in ours if problems(r, today) and _covers(r, repo, sorted(logins))]
+        if bad:
+            return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0], today)[0]}"
         return None, "scope"
     live = [r for r in scoped if _live(r, now)]
     if not live:
@@ -336,23 +329,19 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
 
 
 def granted(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> bool:
-    """True when sign-off is not required, or a valid record covers the owner (and repository). Never raises."""
-    if not required():
-        return True
+    """True when a valid record covers the owner (and repository). Never raises."""
     rec, _ = evaluate([owner, *(aliases or [])], repo)  # evaluate also expands the aliases Resolver.aliases registered
     return rec is not None
 
 
 def require(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
-    """Gate for a requested `--allow-t3`: the record, or Refused (exit 2) logged t3-signoff:<why>. No-op when off."""
-    if not required():
-        return None
+    """Gate for a requested `--allow-t3`: the record, or Refused (exit 2) logged t3-signoff:<why>."""
     logins = [owner, *(aliases or [])]
     rec, why = evaluate(logins, repo)
     if rec is None:
         code, _, detail = (why or "missing").partition(":")
         hint = (" (create the record in the private estate bundle, or pass --t3-signoff-file PATH / set "
-                "SHOWCASE_T3_SIGNOFF_FILE; --no-require-t3-signoff opts out)") if code == "no-file" else ""
+                "SHOWCASE_T3_SIGNOFF_FILE)") if code == "no-file" else ""
         raise Refused(f"{owner}{'/' + repo if repo else ''} is T3 and a sign-off record is required: "
                       f"no valid sign-off record ({code}{': ' + detail.strip() if detail else ''}){hint}",
                       log=f"t3-signoff:{code}")
@@ -372,7 +361,7 @@ def record_for(owner: str, repo: str | None = None) -> dict | None:
 
 
 def stamp(items, owner: str | None = None):
-    """By default, carry the granting sign-off onto this run's output:
+    """Carry the granting sign-off onto this run's output:
 
     - writer jobs (dicts with `phase`) for a signed-off T3 owner get `signoff_id`, and `approval_id` when none is set;
     - change records (records.record(): dicts with `std`, `owner` and `repo`, no `phase`) get `signoff_id` only, since
@@ -381,11 +370,6 @@ def stamp(items, owner: str | None = None):
     `owner` names the gated owner explicitly when a job's target is another account (the star-List jobs of a T3 org's
     `org pins` run as the personal account, org.star_list_plan); without it the owner is read from the item. An item
     that already carries a `signoff_id` is left as it is."""
-    if not required():
-        pred = _OPT_OUT_T3.get()
-        if pred is not None:
-            stamp_opt_out(items, pred)
-        return items
     if not _granted():
         return items
     for j in items or []:
@@ -400,34 +384,6 @@ def stamp(items, owner: str | None = None):
     return items
 
 
-OPT_OUT = "opt-out"
-
-
-def set_opt_out_t3(predicate) -> Token:
-    """Register IS_T3(owner) for this context so stamp() marks T3 jobs and change records `signoff_id: "opt-out"` while
-    enforcement is opted out; None clears it. Returns a token for reset_opt_out_t3."""
-    return _OPT_OUT_T3.set(predicate)
-
-
-def reset_opt_out_t3(token: Token) -> None:
-    _OPT_OUT_T3.reset(token)
-
-
-def stamp_opt_out(items, is_t3) -> None:
-    """Under the explicit opt-out with --allow-t3, mark every T3 writer job and change record `signoff_id: "opt-out"`
-    so the serialized artifacts show that no record authorized them. IS_T3(owner) says whether OWNER is a T3 org.
-    Items that already carry a signoff_id are left alone."""
-    for j in items or []:
-        if not isinstance(j, dict) or "signoff_id" in j:
-            continue
-        if "phase" not in j and not ("std" in j and "owner" in j and "repo" in j):
-            continue
-        full = str(j.get("repo") or "")
-        who = j.get("org") or j.get("owner") or (full.split("/")[0] if "/" in full else "")
-        if who and is_t3(str(who)):
-            j["signoff_id"] = OPT_OUT
-
-
 def _put(j: dict, rec: dict | None) -> None:
     if rec is not None and rec.get("id"):
         j["signoff_id"] = str(rec["id"])
@@ -436,16 +392,16 @@ def _put(j: dict, rec: dict | None) -> None:
 
 
 def stamp_associations(item: dict, association_ids, owner: str | None = None, repo: str | None = None) -> dict:
-    """By default, name on ITEM (a writer job or a change record) every record that authorized it: OWNER's own
+    """Name on ITEM (a writer job or a change record) every record that authorized it: OWNER's own
     grant first (when OWNER/REPO is a signed-off T3 target), then each id in ASSOCIATION_IDS (a T3 org that ITEM
     brings in without targeting it: topics.merge `signoff_ids` for an `also_in` membership topic, project.estate_plan
     for a T3 org in the personal Estate's Org field). `signoff_id` is the first id and `signoff_ids` lists all of them
     only when there is more than one. A writer job also gets `approval_id` = the first id unless it already has one
-    (an existing approval_id is never replaced). No-op when the flag is off or there are no association ids.
+    (an existing approval_id is never replaced). No-op when there are no association ids.
     Shared by showcase.cmd_topics, intake.adopt and project.estate_plan
     (tests/test_t3_signoff_require.py::test_adopt_topics_job_carries_the_also_in_signoff,
     ::test_estate_plan_jobs_carry_the_t3_orgs_signoff)."""
-    if not association_ids or not required() or not isinstance(item, dict):
+    if not association_ids or not isinstance(item, dict):
         return item
     own = record_for(owner, repo) if owner else None
     ids = list(dict.fromkeys(([str(own["id"])] if own and own.get("id") else []) + [str(x) for x in association_ids]))
@@ -458,22 +414,20 @@ def stamp_associations(item: dict, association_ids, owner: str | None = None, re
 
 
 def record(owner: str, repo: str | None = None, aliases: list[str] | None = None) -> dict | None:
-    """By default, the valid record covering OWNER (and REPO), else None; registers no grant. None when off."""
-    if not required():
-        return None
+    """The valid record covering OWNER (and REPO), else None; registers no grant."""
     rec, _ = evaluate([owner, *(aliases or [])], repo)
     return rec
 
 
 def stamp_source(job: dict, full: str, aliases: list[str] | None = None) -> dict:
-    """By default, stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
+    """Stamp a writer job that names another owner's T3 repository FULL (OWNER/NAME) with the record
     covering that repository. A star-List item job (org.star_list_plan) targets the personal account for some org's
     List, so neither the target nor the org's grant names the record that let the favorite through
     (org._t3_held checks it with granted(), which does not register a grant). It is evaluated here instead. The
     repository's record wins over the List org's: the item job is what puts the T3 repository in public; the org's own
-    grant was enforced at the command gate and stays on its List create/describe jobs. No-op when off, when the job
+    grant was enforced at the command gate and stays on its List create/describe jobs. No-op when the job
     already carries a signoff_id or when no valid record covers FULL (the favorite is then held and has no job)."""
-    if not required() or not isinstance(job, dict) or "signoff_id" in job or "/" not in (full or ""):
+    if not isinstance(job, dict) or "signoff_id" in job or "/" not in (full or ""):
         return job
     owner, name = full.split("/", 1)
     rec, _ = evaluate([owner, *(aliases or [])], name)
diff --git a/scripts/ctshowcase/topics.py b/scripts/ctshowcase/topics.py
index 5636715..cbd22a0 100644
--- a/scripts/ctshowcase/topics.py
+++ b/scripts/ctshowcase/topics.py
@@ -192,14 +192,12 @@ def alias(x):
 
 
 def _with_signoffs(res: dict, ctx: RepoContext, orgs: list[str], topics_: list[str], proposed: list[str]) -> dict:
-    """Under --require-t3-signoff, name the records that let a T3 org's membership topic into `proposed` as
+    """Name the records that let a T3 org's membership topic into `proposed` as
     `signoff_ids`, so cmd_topics carries them onto the change record. membership_topics only asks granted(), which
     registers no grant, and records.append stamps by the target owner (often T1), so without this the record that
     authorized the T3 association was lost (tests/test_t3_signoff_require.py
-    ::test_t3_also_in_association_carries_its_signoff_id). No key at all when the flag is off or no T3 org applies."""
+    ::test_t3_also_in_association_carries_its_signoff_id). No key at all when no T3 org applies."""
     from . import signoff
-    if not signoff.required():
-        return res
     resolver = ctx.brand.resolver()
     ids: list[str] = []
     for org, topic in zip(orgs, topics_):
diff --git a/scripts/showcase.py b/scripts/showcase.py
index a8139d9..bfbbd88 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -477,7 +477,7 @@ def cmd_describe(args):
 
 
 def _stamp_signoff_ids(rec: dict, association_ids, ctx) -> None:
-    """Under --require-t3-signoff: the topics change record names every record that authorized it, the target owner's
+    """The topics change record names every record that authorized it, the target owner's
     own grant first (a T3 target) and then each T3 `also_in` association's (topics.merge `signoff_ids`).
     `signoff_id` is the first; `signoff_ids` lists all of them only when there is more than one."""
     from ctshowcase import signoff
@@ -958,13 +958,11 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--format", choices=("json", "text"), default=None, help="output style")
     p.add_argument("--quiet", action="store_true")
     p.add_argument("--allow-t3", action="store_true",
-                   help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2)")
+                   help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2). It also needs a valid sign-off record, by default in <estate root>/decisions/t3-signoffs.yaml (see --t3-signoff-file and references/t3-signoff.md); there is no opt-out")
     p.add_argument("--require-t3-signoff", action="store_true",
-                   help="the default, accepted for explicitness: --allow-t3 is honoured only when a valid, unexpired sign-off record "
-                        "covers the owner and repository; otherwise exit 2 (t3-signoff:no-file|missing|invalid|expired|scope)")
-    p.add_argument("--no-require-t3-signoff", action="store_true",
-                   help="explicit opt-out (env SHOWCASE_REQUIRE_T3_SIGNOFF=0): --allow-t3 is trusted without a record, as before issue 23; "
-                        "logged as t3-signoff:opt-out")
+                   help="accepted for explicitness and a no-op, since enforcement is always on: --allow-t3 is honoured only when a valid, "
+                        "unexpired sign-off record covers the owner and repository; otherwise exit 2 "
+                        "(t3-signoff:no-file|missing|invalid|expired|scope)")
     p.add_argument("--t3-signoff-file", metavar="PATH",
                    help="the sign-off record file to read instead of the default <estate root>/decisions/t3-signoffs.yaml "
                         "(env SHOWCASE_T3_SIGNOFF_FILE; format: references/t3-signoff.md). Order: this flag, the env, the default. "
@@ -1210,12 +1208,11 @@ def parser() -> argparse.ArgumentParser:
 
 
 def main(argv=None) -> int:
-    """Run one invocation. `--allow-t3` and `--require-t3-signoff` hold only for this call (and this context): the prior
+    """Run one invocation. `--allow-t3` and the sign-off record file hold only for this call (and this context): the prior
     values, and the sign-off grants of any enclosing run, are restored on every exit."""
     from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off, t3_signed_off
     from ctshowcase import signoff
     token = set_t3_signed_off(t3_signed_off())
-    required_token = signoff.set_required(signoff.required())
     file_token = signoff.set_file(signoff._FILE.get())
     run_token = signoff.reset()
     try:
@@ -1223,7 +1220,6 @@ def main(argv=None) -> int:
     finally:
         signoff.restore(run_token)
         signoff.reset_file(file_token)
-        signoff.reset_required(required_token)
         reset_t3_signed_off(token)
 
 
@@ -1250,12 +1246,7 @@ def _main(argv=None) -> int:
     from ctshowcase.config import set_t3_signed_off
     set_t3_signed_off(getattr(args, "allow_t3", False))
     from ctshowcase import signoff
-    if getattr(args, "no_require_t3_signoff", False) and getattr(args, "require_t3_signoff", False):
-        cli.error("--require-t3-signoff and --no-require-t3-signoff are mutually exclusive")
-    signoff.set_required(False if getattr(args, "no_require_t3_signoff", False)
-                         else bool(getattr(args, "require_t3_signoff", False)) or signoff.env_required())
     signoff.set_file(getattr(args, "t3_signoff_file", None))
-    signoff.set_opt_out_t3(_is_t3_owner(args) if (not signoff.required() and getattr(args, "allow_t3", False)) else None)
     if args.format is None:
         args.format = "text" if args.command in GENERATORS else "json"
     try:
@@ -1274,35 +1265,13 @@ def _main(argv=None) -> int:
         if args.format == "text" and not args.quiet:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
-    audit = []  # opt-out diagnostics, independent of whether the command returned an object
-    if not signoff.required() and signoff.explicit_file() is not None:  # a file nobody enforces is not silently ignored
-        audit.append("t3-signoff:file-ignored")
-    if not signoff.required() and getattr(args, "allow_t3", False):  # trust-only --allow-t3 is visible in the output
-        audit.append("t3-signoff:opt-out")
     if obj is not None:
-        if audit:
-            obj["logs"] = [*(obj.get("logs") or []), *audit]
-            if "t3-signoff:file-ignored" in audit and args.format == "text" and not args.quiet:
-                print("t3-signoff:file-ignored: a sign-off record file was given with sign-off enforcement opted out, "
-                      "so no record is read or enforced", file=sys.stderr)
         for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
             if isinstance(obj.get(key), list):
-                signoff.stamp(obj[key])  # the granting record, or "opt-out" for T3 items under the opt-out
+                signoff.stamp(obj[key])  # the granting record
         emit(args, obj)
-    elif audit:  # direct-print commands (doctor, lint, meta without --out): stderr keeps their stdout formats intact
-        for a in audit:
-            print(f"{a}: sign-off enforcement is opted out for this run", file=sys.stderr)
     return code
 
 
-def _is_t3_owner(args):
-    """A predicate for signoff.stamp_opt_out: is OWNER a T3 org in the brand data (False when it cannot be read)."""
-    try:
-        b = brand(args, prefer_lock=True)
-    except Exception:
-        return lambda owner: False
-    return lambda owner: b.owner_status(owner) == "t3"
-
-
 if __name__ == "__main__":
     raise SystemExit(main())
diff --git a/tests/conftest.py b/tests/conftest.py
index 884b527..0b3599d 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -147,12 +147,11 @@ def t3_record(tmp_path, monkeypatch):
 @pytest.fixture(autouse=True)
 def _isolated_signoff_state():
     """Sign-off enforcement is on by default (issue 23), so library calls outside showcase.main() now register grants in the
-    module's context. Give every test fresh grants and the default `required` and record file, and restore them after."""
+    module's context. Give every test fresh grants and the default record file, and restore them after."""
     from ctshowcase import signoff
-    run, req, file = signoff.reset(), signoff.set_required(True), signoff.set_file(None)
+    run, file = signoff.reset(), signoff.set_file(None)
     try:
         yield
     finally:
         signoff.reset_file(file)
-        signoff.reset_required(req)
         signoff.restore(run)
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index 7a2c850..27687f6 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -65,9 +65,9 @@ def test_help_text_matches_docs():
     )
     assert result.returncode == 0, result.stderr
     assert "--allow-t3" in result.stdout
-    # issue 23 adds --require-t3-signoff (default) and its opt-out right after --allow-t3; the synopsis must keep up with --help
-    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff | --no-require-t3-signoff] [--t3-signoff-file PATH] [--version]"
-    usage_fragment = "[--allow-t3] [--require-t3-signoff] [--no-require-t3-signoff] [--t3-signoff-file PATH] [--version]"
+    # issue 23 adds --require-t3-signoff (default) and right after --allow-t3 (there is no opt-out flag); the synopsis must keep up with --help
+    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
+    usage_fragment = "[--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
     help_usage = " ".join(result.stdout.split())
     skill = _read("SKILL.md")
     ref = skill[skill.index("## Command Reference"):]
@@ -85,12 +85,21 @@ def test_skill_documents_require_t3_signoff_beside_allow_t3():
         assert code in para, code
 
 
-def test_skill_documents_default_on_enforcement_path_and_opt_out():
+def test_skill_documents_default_on_enforcement_path_and_no_opt_out():
     """Issue 23: SKILL.md, ONBOARDING.md, CHANGELOG.md and references/t3-signoff.md describe the default-on record check."""
     skill = _read("SKILL.md")
     para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
     assert "on by default" in para and "decisions/t3-signoffs.yaml" in skill, para
-    assert "--no-require-t3-signoff" in para and "SHOWCASE_REQUIRE_T3_SIGNOFF=0" in para, para
+    assert "no opt-out" in para and "--no-require-t3-signoff" not in para and "SHOWCASE_REQUIRE_T3_SIGNOFF" not in para, para
+    for name in ("SKILL.md", "ONBOARDING.md", "CHANGELOG.md", "references/t3-signoff.md", "references/org.md",
+                 "references/constraints.md"):
+        text = _read(name)
+        assert "--no-require-t3-signoff" not in text and "SHOWCASE_REQUIRE_T3_SIGNOFF" not in text, name
+    assert "Earlier, opt-in form" not in _read("CHANGELOG.md")
+    helptext = " ".join(subprocess.run([sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+                                       capture_output=True, encoding="utf-8",
+                                       env=dict(os.environ, COLUMNS="5000")).stdout.split())
+    assert "valid sign-off record" in helptext and "decisions/t3-signoffs.yaml" in helptext  # --allow-t3 help names the record
     assert "default off" not in para and "is always named explicitly" not in para, para
     assert "it is never read from a config file or environment." not in para, para
     assert "decisions/t3-signoffs.yaml" in _read("ONBOARDING.md")
diff --git a/tests/test_allow_t3_global.py b/tests/test_allow_t3_global.py
index 4b5c2fb..da0008e 100644
--- a/tests/test_allow_t3_global.py
+++ b/tests/test_allow_t3_global.py
@@ -20,7 +20,6 @@ def _run(tmp_path, *argv, owner="Pick-Your-AI"):
     meta = tmp_path / "meta.json"
     meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
     env = dict(os.environ, SHOWCASE_T3_SIGNOFF_FILE=str(RECORDS))
-    env.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
     return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", *argv], cwd=ROOT, env=env,
                           capture_output=True, text=True, encoding="utf-8")
 
diff --git a/tests/test_t3_signoff_default.py b/tests/test_t3_signoff_default.py
index 9abe87e..79a0033 100644
--- a/tests/test_t3_signoff_default.py
+++ b/tests/test_t3_signoff_default.py
@@ -40,7 +40,7 @@ def _run(tmp_path, root, *argv, env=None, owner=OWNER):
     meta = tmp_path / "meta.json"
     meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic")), encoding="utf-8")
     e = dict(os.environ)
-    for k in ("SHOWCASE_REQUIRE_T3_SIGNOFF", "SHOWCASE_T3_SIGNOFF_FILE", "SHOWCASE_ESTATE_ROOT"):
+    for k in ("SHOWCASE_T3_SIGNOFF_FILE", "SHOWCASE_ESTATE_ROOT"):
         e.pop(k, None)
     if root is not None:
         e["SHOWCASE_ESTATE_ROOT"] = str(root)
@@ -99,20 +99,16 @@ def test_record_file_resolution_order_flag_then_env_then_default(tmp_path, monke
         signoff.reset_file(token)
 
 
-def test_explicit_opt_out_restores_trust_only_and_is_logged(tmp_path):
+def test_there_is_no_opt_out(tmp_path):
+    """Adjudication t3-no-bypass: neither a flag nor an environment variable turns enforcement off."""
     root = _bundle(tmp_path, write=False)
     r = _run(tmp_path, root, "--no-require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
-    r = _run(tmp_path, root, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "0"})
-    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
-    r = _run(tmp_path, root, "--require-t3-signoff", "--no-require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode == 2 and "mutually exclusive" in _out(r), _out(r)
-
-
-def test_opt_out_does_not_lift_excluded_owners(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, write=False), "--no-require-t3-signoff", "--allow-t3", "describe",
-             owner="BunsDev")
-    assert r.returncode == 2, _out(r)
+    assert r.returncode == 2 and "unrecognized arguments" in _out(r), _out(r)
+    for value in ("0", "false", "no", "off"):
+        r = _run(tmp_path, root, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": value})
+        assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), (value, _out(r))
+    r = _run(tmp_path, root, "--require-t3-signoff", "--allow-t3", "describe")  # the compatible no-op flag
+    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), _out(r)
 
 
 def test_writer_jobs_carry_the_default_records_id(tmp_path):
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 73b6404..6cdf45d 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,10 +1,11 @@
 """`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
 `--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE) or, by default, in the private estate bundle
 (`<estate root>/decisions/t3-signoffs.yaml`; tests/test_t3_signoff_default.py). The enforcement is default-on; the tests
-that pin the trust-only behaviour pass the explicit opt-out `--no-require-t3-signoff`.
+there is no opt-out (tests/test_t3_signoff_default.py::test_there_is_no_opt_out).
 
 Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
-tests/test_allow_t3_global.py is the proof that behaviour without the new flag is unchanged and stays untouched.
+tests/test_allow_t3_global.py pins the refusals without `--allow-t3`; it only gained the record-file environment that
+`--allow-t3` now needs.
 """
 from __future__ import annotations
 
@@ -33,7 +34,7 @@ def _bundle(tmp_path, records):
         lines.append(f"    repos: {json.dumps(r.get('repos', ['*']))}")
         lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
         lines.append(f"    approver: {r.get('approver', 'synthetic-co-owner')}")
-        lines.append(f"    approved_on: {r.get('approved_on', '2026-01-15')}")
+        lines.append(f"    approved_on: {r.get('approved_on', '1990-01-01')}")
         lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
     (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
     return tmp_path / "bundle"
@@ -44,7 +45,6 @@ def _run(tmp_path, bundle, *argv, owner=OWNER, env=None, meta_extra=None):
     meta.write_text(json.dumps(dict(META, owner=owner, repo="northwind-synthetic", **(meta_extra or {}))),
                     encoding="utf-8")
     e = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(bundle))
-    e.pop("SHOWCASE_REQUIRE_T3_SIGNOFF", None)
     e.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
     e.update(env or {})
     rec = ["--t3-signoff-file", str(_file(bundle))] if bundle is not None else []
@@ -102,13 +102,6 @@ def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
     assert r.returncode == 2 and "t3-signoff" in _out(r)
 
 
-def test_opt_out_keeps_the_trust_only_behaviour(tmp_path):
-    """The explicit opt-out and no records at all: `--allow-t3` alone lifts the refusal (the pre-issue-23 behaviour)."""
-    r = _run(tmp_path, _bundle(tmp_path, []), "--no-require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff:opt-out" in _out(r), _out(r)
-    assert "t3-signoff:no-file" not in _out(r) and "t3-signoff:missing" not in _out(r), _out(r)
-
-
 def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-5", "owner": "BunsDev"}])
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe", owner="BunsDev")
@@ -121,15 +114,14 @@ def test_doctor_shows_the_signoff_id(tmp_path):
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
     row = json.loads(r.stdout)
     assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
-    plain = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
-    assert "signoff_id" not in json.loads(plain.stdout)  # off by default: the row is unchanged
+    plain = _run(tmp_path, b, "doctor", "--format", "json")
+    assert "signoff_id" not in json.loads(plain.stdout)  # without --allow-t3 the row is unchanged
 
 
 def test_writer_jobs_carry_the_signoff_id(tmp_path):
     from ctshowcase import signoff
     from ctshowcase.records import append
     rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
-    signoff.set_required(True)
     try:
         signoff._grant(OWNER.lower(), rec)
         out = tmp_path / "jobs.jsonl"
@@ -141,20 +133,6 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
         assert a["signoff_id"] == "t3s-8" and a["approval_id"] == "t3s-8"
         assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # an existing approval is kept
         assert "signoff_id" not in c
-    finally:
-        signoff.set_required(False)
-        signoff.reset()
-
-
-def test_jobs_are_untouched_when_enforcement_is_opted_out(tmp_path):
-    from ctshowcase import signoff
-    from ctshowcase.records import append
-    signoff._grant(OWNER.lower(), {"id": "t3s-8", "repos": ["*"]})
-    signoff.set_required(False)
-    try:
-        out = tmp_path / "jobs.jsonl"
-        append(out, [{"id": "a", "phase": "p", "kind": "k", "repo": f"{OWNER}/x"}])
-        assert "signoff_id" not in json.loads(out.read_text(encoding="utf-8"))
     finally:
         signoff.reset()
 
@@ -162,10 +140,10 @@ def test_jobs_are_untouched_when_enforcement_is_opted_out(tmp_path):
 def test_state_does_not_outlive_the_invocation(tmp_path, capsys):
     from ctshowcase import signoff
     import showcase
-    assert signoff.required() is True  # the default
-    showcase.main(["--no-require-t3-signoff", "config"])
+    before = signoff.record_file()
+    showcase.main(["--t3-signoff-file", "elsewhere.yaml", "config"])
     capsys.readouterr()
-    assert signoff.required() is True and not signoff._granted()  # the opt-out held for that call only
+    assert signoff.record_file() == before and not signoff._granted()  # the file held for that call only
 
 
 @pytest.mark.parametrize("repo,expect", [(None, "scope"), ("a", None), ("B", None), ("c", "scope")])
@@ -208,7 +186,6 @@ def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
     from ctshowcase.org import _t3_granted as org_granted
     b = _bundle(tmp_path, [{"id": "t3s-10", "owner": "Old-Login"}])
     monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(b)))
-    signoff.set_required(True)
     set_t3_signed_off(True)
     try:
         assert not t3_signed_off("New-Login")  # nothing links the logins yet
@@ -217,7 +194,6 @@ def test_alias_record_matches_every_later_check(tmp_path, monkeypatch):
         assert signoff.record("New-Login")["id"] == "t3s-10"  # what project.estate_orgs asks
     finally:
         set_t3_signed_off(False)
-        signoff.set_required(False)
         signoff.reset()
 
 
@@ -229,7 +205,6 @@ def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monke
     from ctshowcase.config import Brand
     brand = Brand({"owners": {"t3": [OWNER]}}, ROOT / "references" / "brand.yaml")
     resolver = Resolver(brand, {}, None)
-    signoff.set_required(True)
     try:
         monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path / "ok", [{"id": "t3s-11"}]))))
         assert _gate_target(resolver, OWNER, allow_t3=True) == OWNER
@@ -240,7 +215,6 @@ def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monke
             _gate_target(resolver, OWNER, allow_t3=True)
         assert exc.value.log == "t3-signoff:expired"
     finally:
-        signoff.set_required(False)
         signoff.reset()
 
 
@@ -249,8 +223,8 @@ def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
     for fmt in ("tsv", "md"):
         r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
         assert "t3s-13" in r.stdout, _out(r)
-        plain = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
-        assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # off: output unchanged
+        plain = _run(tmp_path, b, "doctor", "--format", fmt)
+        assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # no --allow-t3: output unchanged
 
 
 # --- review round 2: evidence for each fixed finding (synthetic records only) ---
@@ -297,7 +271,6 @@ def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
 def test_report_jobs_carry_signoff_id(tmp_path):
     from ctshowcase import signoff
     signoff.reset()
-    signoff.set_required(True)
     try:
         rec = {"id": "t3s-8", "owner": OWNER, "repos": ["*"], "approved": True, "expires": "2099-12-31"}
         signoff._grant(OWNER.lower(), rec)
@@ -309,7 +282,6 @@ def test_report_jobs_carry_signoff_id(tmp_path):
         saved = json.loads(rp.read_text(encoding="utf-8"))["job"]
         assert saved["signoff_id"] == "t3s-8" and saved["approval_id"] == "t3s-8"
     finally:
-        signoff.set_required(False)
         signoff.reset()
 
 
@@ -325,14 +297,12 @@ def test_hold_owner_is_refused_even_with_a_record(tmp_path, monkeypatch):
     resolver = Resolver(brand, {}, None)
     b = _bundle(tmp_path, [{"id": "t3s-h", "owner": "Held-Co", "repos": ["*"]}])
     monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(b)))
-    signoff.set_required(True)
     try:
         for check in (brand.check_owner, resolver.check_owner):
             with pytest.raises(Refused) as exc:
                 check("Held-Co", allow_t3=True)
             assert exc.value.log == "hold"
     finally:
-        signoff.set_required(False)
         signoff.reset()
 
 
@@ -357,10 +327,9 @@ def test_keyed_sidebar_batch_does_not_swallow_signoff_refusals(tmp_path, records
 # --- epic 22 integration: sign-off state is context-local, like --allow-t3 (issue 28) ---
 
 def test_signoff_state_is_context_local(tmp_path, monkeypatch):
-    """Issue 28 made `--allow-t3` a ContextVar; issue 23's --require-t3-signoff, grants and aliases must follow, or one
-    thread's opt-in refuses (or one thread's grant stamps) another thread's run. Both threads hold `--allow-t3`; only
-    `strict` requires a record, and the bundle has none. With module globals (the issue 23 branch before integration)
-    `lax` sees `strict`'s set_required(True) and is refused t3-signoff:missing, so this test fails there."""
+    """Issue 28 made `--allow-t3` a ContextVar; issue 23's grants and aliases must follow, or one thread's grant
+    stamps (or authorizes) another thread's run. Both threads hold `--allow-t3` and the bundle has no record; only
+    `holder` registers a grant. With module globals `plain` would see `holder`'s grant."""
     import threading
     from ctshowcase import signoff
     from ctshowcase.config import Brand, reset_t3_signed_off, set_t3_signed_off
@@ -370,12 +339,11 @@ def test_signoff_state_is_context_local(tmp_path, monkeypatch):
     barrier = threading.Barrier(2, timeout=10)
     out: dict[str, tuple] = {}
 
-    def worker(name, strict):
+    def worker(name, holder):
         t3 = set_t3_signed_off(True)
-        req = signoff.set_required(strict)
         run = signoff.reset()
         try:
-            if not strict:
+            if holder:
                 signoff._grant("someone-else", {"id": "t3s-lax"})
             barrier.wait()  # both states are live at once
             try:
@@ -383,36 +351,36 @@ def worker(name, strict):
             except Refused as exc:
                 result = ("refused", exc.log)
             barrier.wait()  # neither resets until both have checked
-            out[name] = (*result, signoff.required(), sorted(signoff._granted()))
+            out[name] = (*result, sorted(signoff._granted()))
         finally:
             signoff.restore(run)
-            signoff.reset_required(req)
             reset_t3_signed_off(t3)
 
-    threads = [threading.Thread(target=worker, args=("strict", True)),
-               threading.Thread(target=worker, args=("lax", False))]
+    threads = [threading.Thread(target=worker, args=("plain", False)),
+               threading.Thread(target=worker, args=("holder", True))]
     for t in threads:
         t.start()
     for t in threads:
         t.join(timeout=20)
-    assert out["strict"] == ("refused", "t3-signoff:missing", True, []), out
-    assert out["lax"] == ("passed", "t3", False, ["someone-else"]), out
+    assert out["plain"] == ("refused", "t3-signoff:missing", []), out
+    assert out["holder"] == ("refused", "t3-signoff:missing", ["someone-else"]), out
 
 
 def test_main_restores_an_enclosing_runs_signoff_state(tmp_path, capsys):
-    """A nested showcase.main() (an in-process caller) must not clear the caller's grants or flip its opt-in."""
+    """A nested showcase.main() (an in-process caller) must not clear the caller's grants or record file."""
     from ctshowcase import signoff
     import showcase
-    req = signoff.set_required(True)
     run = signoff.reset()
+    file = signoff.set_file("outer-file.yaml")
     try:
         signoff._grant("outer", {"id": "t3s-outer"})
         showcase.main(["config"])
         capsys.readouterr()
-        assert signoff.required() is True and signoff._granted() == {"outer": ({"id": "t3s-outer"},)}
+        assert signoff.explicit_file() == Path("outer-file.yaml")
+        assert signoff._granted() == {"outer": ({"id": "t3s-outer"},)}
     finally:
+        signoff.reset_file(file)
         signoff.restore(run)
-        signoff.reset_required(req)
 
 
 # --- review round 4: explicit record file, record schema, timestamp expiry, copy-on-write state, change records ---
@@ -520,9 +488,6 @@ def test_topics_change_records_carry_the_signoff_id(tmp_path):
     assert "t3-signoff" not in _out(r) and out.is_file(), _out(r)
     recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
     assert recs and all(x["signoff_id"] == "t3s-cr" and "approval_id" not in x for x in recs), recs
-    plain = tmp_path / "plain.jsonl"
-    _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--records", str(plain))
-    assert all(json.loads(x)["signoff_id"] == "opt-out" for x in plain.read_text(encoding="utf-8").splitlines())  # no record authorized them
 
 
 def test_adopt_json_output_stamps_change_records_and_jobs(tmp_path):
@@ -546,7 +511,6 @@ async def child():
         return signoff.record_for(OWNER)["id"]
 
     async def parent():
-        signoff.set_required(True)
         signoff.reset()  # the parent's state exists before the child starts, so the child inherits it
         got = await asyncio.create_task(child())
         job = {"id": "j", "phase": "p", "kind": "k", "repo": f"{OWNER}/x", "argv": []}
@@ -570,7 +534,6 @@ def test_star_list_jobs_for_a_t3_org_carry_its_signoff(tmp_path, monkeypatch, br
     lists = json.loads((fix / "star-lists.json").read_text(encoding="utf-8"))
     monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(_file(_bundle(tmp_path, [{"id": "t3s-sl"}]))))
     t3 = set_t3_signed_off(True)
-    req = signoff.set_required(True)
     run = signoff.reset()
     try:
         signoff.require(OWNER)
@@ -579,7 +542,6 @@ def test_star_list_jobs_for_a_t3_org_carry_its_signoff(tmp_path, monkeypatch, br
         assert all(j["signoff_id"] == "t3s-sl" and j["approval_id"] == "t3s-sl" for j in res["jobs"]), res["jobs"]
     finally:
         signoff.restore(run)
-        signoff.reset_required(req)
         reset_t3_signed_off(t3)
 
 
@@ -611,7 +573,8 @@ def test_problems_follow_the_schema_string_patterns(value):
             "approved_on": "2026-01-15", "expires": "2099-12-31"}
     exp_ok = not any(p.startswith("expires:") for p in signoff.problems(dict(base, expires=value)))
     assert exp_ok == _schema_accepts(value, "date", "awareTimestamp"), value
-    on_ok = not any(p.startswith("approved_on:") for p in signoff.problems(dict(base, approved_on=value)))
+    on_ok = not any(p.startswith("approved_on:") and "in the future" not in p  # the future rule is not a schema rule
+                    for p in signoff.problems(dict(base, approved_on=value)))
     assert on_ok == _schema_accepts(value, "date"), value
 
 
@@ -657,7 +620,6 @@ def test_t1_star_list_item_for_a_t3_favorite_carries_the_favorites_signoff(tmp_p
     monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE",
                        str(_file(_bundle(tmp_path, [{"id": "t3s-fav", "repos": ["northwind-synthetic"]}]))))
     t3 = set_t3_signed_off(True)
-    req = signoff.set_required(True)
     run = signoff.reset()
     try:
         assert est.resolver.owner_status(t1) != "t3"
@@ -665,13 +627,8 @@ def test_t1_star_list_item_for_a_t3_favorite_carries_the_favorites_signoff(tmp_p
         items = [j for j in res["jobs"] if "list-item" in j["id"]]
         assert len(items) == 1 and items[0]["org"] == O.USER_LOGIN, res
         assert items[0]["signoff_id"] == "t3s-fav" and items[0]["approval_id"] == "t3s-fav", items
-        signoff.reset_required(req)
-        req = signoff.set_required(False)  # without the flag nothing is stamped (behaviour unchanged)
-        plain = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=True, repo_ids={fav: "R_synthetic"})
-        assert all("signoff_id" not in j for j in plain["jobs"]), plain["jobs"]
     finally:
         signoff.restore(run)
-        signoff.reset_required(req)
         reset_t3_signed_off(t3)
 
 
@@ -707,15 +664,14 @@ def __enter__(self):
         from ctshowcase import signoff
         from ctshowcase.config import set_t3_signed_off
         self.monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(self.path))
-        self.tokens = (set_t3_signed_off(self.allow_t3), signoff.set_required(True), signoff.reset())
+        self.tokens = (set_t3_signed_off(self.allow_t3), signoff.reset())
         return self
 
     def __exit__(self, *exc):
         from ctshowcase import signoff
         from ctshowcase.config import reset_t3_signed_off
-        t3, req, run = self.tokens
+        t3, run = self.tokens
         signoff.restore(run)
-        signoff.reset_required(req)
         reset_t3_signed_off(t3)
 
 
@@ -782,10 +738,6 @@ def test_t3_also_in_association_carries_its_signoff_id(tmp_path):
     recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
     assert len(recs) == 1 and recs[0]["owner"] == T1 and topic in recs[0]["after"], recs
     assert recs[0]["signoff_id"] == "t3s-assoc" and "approval_id" not in recs[0], recs
-    plain = tmp_path / "plain.jsonl"  # without the flag: no key, behaviour unchanged
-    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "topics", "--also-in", OWNER, "--records", str(plain), owner=T1)
-    assert "signoff_ids" not in json.loads(r.stdout), r.stdout
-    assert all("signoff_id" not in json.loads(x) for x in plain.read_text(encoding="utf-8").splitlines())  # T1-owner record: not a T3 item
 
 
 _GOOD = {"id": "t3s-env", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "synthetic-co-owner",
@@ -820,18 +772,16 @@ def test_file_envelope_follows_the_schema(tmp_path, doc, ok):
 # --- review round 4: evidence for each fixed finding (synthetic records only) ---
 
 def test_transfer_to_a_t3_org_is_unchanged_without_the_flag(monkeypatch, brand):
-    """Enforcement left at its real default (on), no --allow-t3: a T1 member whose approved pending transfer resolves to the T3 org keeps
+    """Enforcement is always on; with no --allow-t3: a T1 member whose approved pending transfer resolves to the T3 org keeps
     the base (2be04ac) behaviour. `org labels` plans its label jobs and the favorite and home entry stay public,
     exactly as before this epic. The transfer-target T3 checks (org._t3_moved_held, the labels_plan gate) belong to
     --allow-t3 only (enforcement defaulting on changes nothing here): no issue of epic #22 (#31, #28, #23-#27) asks for a default-on tightening."""
-    from ctshowcase import org as O, signoff
+    from ctshowcase import org as O
     from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
-    monkeypatch.delenv("SHOWCASE_REQUIRE_T3_SIGNOFF", raising=False)
     monkeypatch.delenv("SHOWCASE_T3_SIGNOFF_FILE", raising=False)
     fav = f"{T1}/northwind-member"
     est, reg = _transfer_estate(brand, favorites=[fav])
     t3 = set_t3_signed_off(False)
-    assert signoff.required() is True  # the shipped default, not forced off
     try:
         res, _ = O.labels_plan(est, T1, allow_t3=False)
         assert res["result"] == "plan" and not [x for x in res["repos"] if x.get("result") == "held"], res
@@ -887,9 +837,6 @@ def test_adopt_topics_job_carries_the_also_in_signoff(tmp_path):
              "--approval-id", "q-synthetic", owner=T1, meta_extra=extra)
     jobs = [j for j in json.loads(r.stdout)["jobs"] if j["kind"] == "topics"]
     assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "q-synthetic", jobs
-    # without the flag: nothing is stamped
-    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1, meta_extra=extra)
-    assert r.stdout and "signoff_id" not in r.stdout, _out(r)
 
 
 def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand):
@@ -918,28 +865,10 @@ def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
         plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
         assert OWNER not in [o["login"] for o in plan["orgs"]] and OWNER not in json.dumps(plan["jobs"])
-    from ctshowcase import signoff
-    off = signoff.set_required(False)  # opted out: included, nothing stamped
-    try:
-        plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
-    finally:
-        signoff.reset_required(off)
-    assert OWNER in [o["login"] for o in plan["orgs"]] and "signoff_id" not in json.dumps(plan)
 
 
 # --- review round 5: evidence for each fixed finding (synthetic records and slugs only) ---
 
-def test_signoff_file_without_the_flag_is_logged_not_silently_ignored(tmp_path):
-    """A record file given while enforcement is opted out is never read; the run says so instead of looking enforced."""
-    b = _bundle(tmp_path, [{"id": "t3s-ign", "expires": "2020-01-01"}])
-    r = _run(tmp_path, b, "--no-require-t3-signoff", "--allow-t3", "describe")
-    assert r.returncode != 2 and "t3-signoff:file-ignored" in _out(r), _out(r)
-    r = _run(tmp_path, b, "--allow-t3", "--require-t3-signoff", "describe")  # enforced: expired record refuses
-    assert r.returncode == 2 and "file-ignored" not in _out(r), _out(r)
-    r = _run(tmp_path, None, "--no-require-t3-signoff", "--allow-t3", "describe")  # no explicit file: nothing to report
-    assert "file-ignored" not in _out(r), _out(r)
-
-
 def test_estate_plan_stamping_matches_whole_names_not_substrings(tmp_path, monkeypatch):
     """A job that names `Acme Tools` / `Acme-Tools` must not be credited to a T3 org named `Acme`."""
     from ctshowcase import project as PJ
@@ -1015,7 +944,76 @@ def lst(i, n):
         assert items and "UL_t3" not in items[0]["argv"][-1] and "signoff_id" not in items[0], items
 
 
-# --- review round 5: opt-out audit, duplicate ids, doctor shape, direct-print diagnostics ---
+def test_t3_favorite_and_t3_list_org_keep_both_grants(tmp_path, monkeypatch, brand):
+    """A T3 org's unchanged List gains a public repository of the other T3 org: the item job needs the favorite's record
+    and the List org's record. The favorite's record used to suppress the destination's (stamp skipped a stamped job)."""
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    other = "Jevelopers-neatHack-2026"
+    fav = f"{other}/northwind-synthetic"
+    reg = {"orgs": {OWNER: {"favorites": [{"full_name": fav}], "star_list": {"name": "Built on", "description": ""}}}}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "actions": [], "extra": []}),
+                   {"m": {"owner": other, "repo": "northwind-synthetic", "visibility": "public"}})
+    lists = {"data": {"viewer": {"login": "x", "lists": {"totalCount": 1, "nodes": [
+        {"id": "UL_t3", "name": "Built on", "slug": "built-on", "description": "", "isPrivate": False,
+         "items": {"totalCount": 0, "nodes": []}}]}}}}
+    recs = [{"id": "t3s-fav", "owner": other}, {"id": "t3s-dest", "owner": OWNER}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "both", recs))):
+        plan = O.star_list_plan(est, OWNER, lists_capture=lists, allow_t3=True, repo_ids={fav: "R_x"})
+        items = [j for j in plan["jobs"] if "list-item" in j["id"]]
+        assert len(items) == 1, plan["jobs"]
+        assert items[0]["signoff_id"] == "t3s-fav" and items[0]["signoff_ids"] == ["t3s-fav", "t3s-dest"], items
+        assert items[0]["approval_id"] == "t3s-fav", items  # the first id; an existing approval_id is never replaced
+
+
+# --- review round 6: dates that make a record unusable, malformed-vs-scope, no opt-out ---
+
+@pytest.mark.parametrize("approved_on,expires,needle", [
+    ("2099-06-01", "2099-12-31", "in the future"),
+    ("2099-06-01", "2099-01-01", "in the future"),            # also expires before it was approved
+    ("2026-01-15", "2026-01-14", "earlier than approved_on"),
+    ("2026-01-15", "2026-01-14T23:59:59+00:00", "earlier than approved_on"),
+])
+def test_future_or_inverted_dates_never_authorize(approved_on, expires, needle):
+    from ctshowcase import signoff
+    rec = {"id": "t3s-dates", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "x",
+           "approved_on": approved_on, "expires": expires}
+    assert any(needle in x for x in signoff.problems(rec)), signoff.problems(rec)
+    got, why = signoff.evaluate([OWNER], None, records=[rec])
+    assert got is None and why.startswith("invalid:t3s-dates") and needle in why, (got, why)
+
+
+def test_equal_approved_on_and_expires_and_today_are_valid():
+    import datetime as dt
+    from ctshowcase import signoff
+    today = dt.datetime.now().astimezone().date()
+    rec = {"id": "t3s-today", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "x",
+           "approved_on": today, "expires": today}
+    assert signoff.problems(rec) == []
+    assert signoff.evaluate([OWNER], None, records=[rec])[0] is rec
+
+
+def test_future_dated_record_refuses_on_the_cli(tmp_path):
+    """Native probe from the review: a record dated 2099 that expires before it was given lifted the T3 gate."""
+    b = _bundle(tmp_path, [{"id": "a1", "approved_on": "2099-06-01", "expires": "2099-01-01"}])
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "in the future" in _out(r), _out(r)
+
+
+def test_malformed_record_for_the_repository_is_invalid_not_scope():
+    from ctshowcase import signoff
+    good = {"id": "t3s-1", "owner": OWNER, "repos": ["other-repo"], "approved": True, "approver": "x",
+            "approved_on": "2026-01-15", "expires": "2099-12-31"}
+    bad = dict(good, id="t3s-2", repos=["northwind-synthetic"], approved="true")
+    got, why = signoff.evaluate([OWNER], "northwind-synthetic", records=[good, bad])
+    assert got is None and why.startswith("invalid:t3s-2") and "approved" in why, (got, why)
+    # a malformed record for some other repository is not the cause: the refusal stays 'scope'
+    unrelated = dict(bad, repos=["unrelated"])
+    assert signoff.evaluate([OWNER], "northwind-synthetic", records=[good, unrelated]) == (None, "scope")
+    assert signoff.evaluate([OWNER], "other-repo", records=[good, bad])[0] is good
+
+
+# --- review round 5: duplicate ids, doctor shape ---
 
 def test_duplicate_record_ids_refuse_invalid(tmp_path):
     """signoff_id is the audit key on jobs, so two records sharing an id make a file that authorizes nothing."""
@@ -1029,28 +1027,6 @@ def test_duplicate_record_ids_refuse_invalid(tmp_path):
     assert why is None and rec["id"] == "t3s-001"
 
 
-def test_opt_out_marks_t3_jobs_and_records(tmp_path):
-    """--allow-t3 --no-require-t3-signoff: the serialized jobs say no record authorized them."""
-    jobs, recs = tmp_path / "jobs.jsonl", tmp_path / "recs.jsonl"
-    r = _run(tmp_path, _bundle(tmp_path, []), "--no-require-t3-signoff", "--allow-t3", "adopt",
-             f"{OWNER}/northwind-synthetic", "--jobs", str(jobs), "--records", str(recs))
-    assert r.returncode != 2, _out(r)
-    rows = [json.loads(x) for f in (jobs, recs) if f.exists() for x in f.read_text(encoding="utf-8").splitlines() if x.strip()]
-    assert rows, _out(r)
-    assert all(j.get("signoff_id") == "opt-out" for j in rows), rows
-
-
-def test_direct_print_commands_emit_the_opt_out_audit_on_stderr(tmp_path):
-    bundle = _bundle(tmp_path, [])
-    r = _run(tmp_path, bundle, "--no-require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
-    assert r.returncode != 2, _out(r)
-    assert "t3-signoff:opt-out" in r.stderr, r.stderr
-    json.loads(r.stdout.splitlines()[0])  # stdout format intact
-    r = _run(tmp_path, bundle, "--no-require-t3-signoff", "--allow-t3", "--t3-signoff-file", str(tmp_path / "x.yaml"),
-             "doctor", "--format", "json")
-    assert "t3-signoff:file-ignored" in r.stderr, r.stderr
-
-
 def test_doctor_row_shape_is_unchanged_without_allow_t3(tmp_path):
     """The documented row (R1-R11, banner, icon, card, footer, done) gains signoff_id only when --allow-t3 is passed."""
     bundle = _bundle(tmp_path, [])

From 8f3831f159360e5e503b2a27affea883fa4ebc49 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:16:15 -0400
Subject: [PATCH 25/79] Make T3 sign-off expiry optional, add approved:false
 withdrawal (revoked), fix repos docstrings (#23)

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 58 ++++++++++++++++++++++++++++++-----
 1 file changed, 51 insertions(+), 7 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 8afc4a7..f05afb0 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -12,18 +12,19 @@
     signoffs:
       - id: t3s-001                 # carried onto writer jobs and change records as `signoff_id`
         owner: Example-Co-Owned     # any login of the org (renames resolve through the aliases the gate passes in)
-        repos: ["*"]                # "*" or repository names / OWNER/NAME; absent or empty matches nothing
+        repos: ["*"]                # "*" or repository names / OWNER/NAME; an absent or empty value makes the record invalid (t3-signoff:invalid)
         approved: true
         approver: example-co-owner  # who signed off (audit)
         approved_on: 2026-01-15     # when they signed off (audit); a future date grants nothing yet
-        expires: 2099-12-31         # a date (valid through that day) or a timestamp with a UTC offset; not before approved_on
+        expires: 2099-12-31         # optional; absent means no expiry. A date (valid through that day) or a timestamp with a UTC offset; not before approved_on
         note: "optional free text"
 
 Refusals are exit 2 with log `t3-signoff:no-file` (no record file at the resolved path, or no estate root to resolve one; the log names the path), `t3-signoff:missing` (no approved record
 for the owner), `t3-signoff:invalid` (the owner's records all break the schema, or a malformed record would have covered the
 repository; the error names the first problem),
 `t3-signoff:expired` (every matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none
-covers the repository; an owner-wide command with no repository needs a `*` record). Excluded and HOLD owners are
+covers the repository; an owner-wide command with no repository needs a `*` record), or `t3-signoff:revoked` (a
+later or same-day `approved: false` record withdraws every covering grant). Excluded and HOLD owners are
 refused before this runs.
 """
 from __future__ import annotations
@@ -222,7 +223,7 @@ def problems(rec: dict, today: _dt.date | None = None) -> list[str]:
     approved_on = _parse_when(rec.get("approved_on"))
     if approved_on is None or isinstance(approved_on, _dt.datetime):
         out.append("approved_on: needs a date (YYYY-MM-DD)")
-    if _expiry(rec) is None:
+    if "expires" in rec and _parse_when(rec["expires"]) is None:
         out.append("expires: needs a date (YYYY-MM-DD) or a timestamp with a UTC offset")
     if "note" in rec and rec["note"] is not None and not isinstance(rec["note"], str):
         out.append("note: needs a string")
@@ -247,7 +248,9 @@ def problems(rec: dict, today: _dt.date | None = None) -> list[str]:
 def _live(rec: dict, now: _dt.datetime) -> bool:
     """A date expiry is valid through the end of that day (inclusive, local calendar day, as before); a timestamp
     expiry is valid only strictly before that instant, compared timezone-aware (a record expiring at
-    2026-10-30T00:00:00+00:00 is dead at 2026-10-30T12:44Z)."""
+    2026-10-30T00:00:00+00:00 is dead at 2026-10-30T12:44Z). An absent `expires` means no expiry, so it is always live."""
+    if "expires" not in rec:
+        return True
     exp = _expiry(rec)
     if isinstance(exp, _dt.datetime):
         return exp > now
@@ -256,9 +259,44 @@ def _live(rec: dict, now: _dt.datetime) -> bool:
     return False
 
 
+def _repo_list(repos) -> list[str] | None:
+    """`repos` as a list of strings (a bare string is one entry), or None when it is malformed."""
+    if isinstance(repos, str):
+        return [repos]
+    if isinstance(repos, list) and all(isinstance(x, str) for x in repos):
+        return repos
+    return None
+
+
+def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None = None) -> bool:
+    """True when an approved:false record (a withdrawal) vetoes GRANT: its approved_on is on or after the grant's
+    approved_on (same day counts), its owner is one of LOGINS (when given), and its repos cover everything the grant
+    covers (`*`, or every entry of the grant's repos, case-insensitively, appears in its own repos). A malformed
+    `repos` never withdraws."""
+    g_on = _parse_when(grant.get("approved_on"))
+    g_repos = _repo_list(grant.get("repos"))
+    if g_on is None or g_repos is None or isinstance(g_on, _dt.datetime):
+        return False
+    owners = {x.lower() for x in logins} if logins is not None else None
+    for f in withdrawals:
+        if owners is not None and str(f.get("owner") or "").lower() not in owners:
+            continue
+        f_on = _parse_when(f.get("approved_on"))
+        f_repos = _repo_list(f.get("repos"))
+        if f_on is None or f_repos is None or isinstance(f_on, _dt.datetime) or f_on < g_on:
+            continue
+        if "*" in f_repos:
+            return True
+        have = {x.lower() for x in f_repos}
+        if all(x.lower() in have for x in g_repos):
+            return True
+    return False
+
+
 def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
              records: list[dict] | None = None, now: _dt.datetime | None = None) -> tuple[dict | None, str | None]:
-    """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<problem>' | 'expired' | 'scope').
+    """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<problem>' | 'expired' | 'scope' |
+    'revoked'). 'revoked' means every otherwise-grantable record was vetoed by a withdrawal (see _withdrawn).
     `today` (a date) is kept for callers that only care about date expiries; `now` is an aware instant."""
     if now is None:
         now = _dt.datetime.now(_dt.timezone.utc)
@@ -281,7 +319,12 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
     today = now.astimezone().date()
     valid = [r for r in ours if not problems(r, today)]
+    withdrawals = [r for r in valid if r.get("approved") is False]
     mine = [r for r in valid if r.get("approved") is True]
+    had_grants = bool(mine)
+    mine = [g for g in mine if not _withdrawn(g, withdrawals, sorted(logins))]
+    if had_grants and not mine:
+        return None, "revoked"
     if not mine:
         bad = [r for r in ours if problems(r, today)]
         if bad:  # a malformed record never authorizes, and the refusal says why instead of a silent 'missing'
@@ -304,7 +347,8 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
     """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
     (the requested owner and its org aliases) as well as the name. A repository given as OWNER/NAME is covered only
     when that owner is one of `logins` too (only `*` covers another account's repository). A malformed `repos` (not a string or a list of
-    strings) covers nothing, so it surfaces as t3-signoff:scope instead of an uncaught exception."""
+    strings) covers nothing; evaluate() reports such a record as t3-signoff:invalid through problems(), not as
+    t3-signoff:scope."""
     repos = rec.get("repos")
     if isinstance(repos, str):
         repos = [repos]

From 45ebf8a781660a2547bf9ed95647f802feba5a73 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:16:20 -0400
Subject: [PATCH 26/79] Carry the T3 sign-off id into estate README jobs (#23)

_stamp_estate_orgs matched only whole argv tokens, so the project-edit job whose
--readme Markdown table names a signed-off T3 org (Pick Your AI / Pick-Your-AI)
received no signoff_id. Add _readme_signoff_ids, which finds orgs whose login or
display name appears in README text on word boundaries, and use it for each
argv value that directly follows --readme. Display names that are also a non-T3
org's name stay ambiguous; logins always count. Ids are de-duplicated in order.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 34 +++++++++++++++++++++++++++++-----
 1 file changed, 29 insertions(+), 5 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 01ab73b..df18974 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1144,24 +1144,48 @@ def walk(v):
     return out
 
 
+def _readme_signoff_ids(orgs: list[dict], text: str) -> list[str]:
+    """The signoff_id of every org in ORGS that carries one and whose login or display name appears in TEXT
+    (a README Markdown table, say). Case-insensitive, on word boundaries: a name inside a longer word or a
+    hyphenated name (`Acme` in `Acme-Tools`) does not match. An empty name matches nothing."""
+    out: list[str] = []
+    for o in orgs:
+        if not o.get("signoff_id"):
+            continue
+        for name in (o.get("login"), o.get("name")):
+            if not name:
+                continue
+            if re.search(r"(?<![\w-])" + re.escape(str(name)) + r"(?![\w-])", text, re.IGNORECASE):
+                out.append(str(o["signoff_id"]))
+                break
+    return out
+
+
 def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
     """Each job that names a signed-off T3 org (its Org-field option, its login) carries
     that org's record. The jobs target @me, so stamping by target owner never finds the T3 grant; several T3 orgs on
-    one job give `signoff_ids` (signoff.stamp_associations). No-op when no org carries a signoff_id.
+    one job give `signoff_ids` (signoff.stamp_associations). A `--readme` Markdown value names orgs inside its text,
+    so it is also searched by name. No-op when no org carries a signoff_id.
     (tests/test_t3_signoff_require.py::test_estate_plan_jobs_carry_the_t3_orgs_signoff)"""
     from . import signoff
     t3 = [o for o in orgs if o.get("signoff_id")]
     if not t3:
         return
+    # a name that is also another org's login or display name is ambiguous: only that org's login or its
+    # `T3: login` description credits the job (exact identity, never a shared label)
+    others = {x.lower() for o in orgs if not o.get("signoff_id") for x in (o["login"], o["name"])}
+    # for README text the display name counts only when it is not ambiguous; the login always may
+    readme_orgs = [o if o["name"].lower() not in others else {**o, "name": ""} for o in t3]
     for j in jobs:
         tokens = _job_tokens(j)
-        # a name that is also another org's login or display name is ambiguous: only that org's login or its
-        # `T3: login` description credits the job (exact identity, never a shared label)
-        others = {x.lower() for o in orgs if not o.get("signoff_id") for x in (o["login"], o["name"])}
         ids = [o["signoff_id"] for o in t3
                if o["login"].lower() in tokens or f"{TIER_PREFIX_T3}{o['login']}".lower() in tokens
                or (o["name"].lower() in tokens and o["name"].lower() not in others)]
-        signoff.stamp_associations(j, ids)
+        argv = j.get("argv") if isinstance(j.get("argv"), list) else []
+        for i, arg in enumerate(argv[:-1]):
+            if arg == "--readme" and isinstance(argv[i + 1], str):
+                ids += _readme_signoff_ids(readme_orgs, argv[i + 1])
+        signoff.stamp_associations(j, list(dict.fromkeys(ids)))
 
 
 def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict | None = None, user_id: int | None = None,

From 6c22d22d9b6ea38240e61a3b3cd2d3b9a99c7374 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:20:52 -0400
Subject: [PATCH 27/79] Report a withdrawn in-scope grant as revoked, keep Acme
 from matching inside Acme Tools in estate READMEs (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 9 ++++++---
 scripts/ctshowcase/signoff.py | 5 ++++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index df18974..5a7a874 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1144,11 +1144,14 @@ def walk(v):
     return out
 
 
-def _readme_signoff_ids(orgs: list[dict], text: str) -> list[str]:
+def _readme_signoff_ids(orgs: list[dict], text: str, others: tuple[str, ...] = ()) -> list[str]:
     """The signoff_id of every org in ORGS that carries one and whose login or display name appears in TEXT
     (a README Markdown table, say). Case-insensitive, on word boundaries: a name inside a longer word or a
-    hyphenated name (`Acme` in `Acme-Tools`) does not match. An empty name matches nothing."""
+    hyphenated name (`Acme` in `Acme-Tools`) does not match. OTHERS are the names of non-T3 orgs: they are blanked out of
+    TEXT first, so `Acme` does not match inside the longer `Acme Tools`. An empty name matches nothing."""
     out: list[str] = []
+    for x in sorted((x for x in others if x), key=len, reverse=True):
+        text = re.sub(r"(?<![\w-])" + re.escape(str(x)) + r"(?![\w-])", " ", text, flags=re.IGNORECASE)
     for o in orgs:
         if not o.get("signoff_id"):
             continue
@@ -1184,7 +1187,7 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
         argv = j.get("argv") if isinstance(j.get("argv"), list) else []
         for i, arg in enumerate(argv[:-1]):
             if arg == "--readme" and isinstance(argv[i + 1], str):
-                ids += _readme_signoff_ids(readme_orgs, argv[i + 1])
+                ids += _readme_signoff_ids(readme_orgs, argv[i + 1], tuple(others))
         signoff.stamp_associations(j, list(dict.fromkeys(ids)))
 
 
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index f05afb0..f7f4ae4 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -322,7 +322,8 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     withdrawals = [r for r in valid if r.get("approved") is False]
     mine = [r for r in valid if r.get("approved") is True]
     had_grants = bool(mine)
-    mine = [g for g in mine if not _withdrawn(g, withdrawals, sorted(logins))]
+    revoked = [g for g in mine if _withdrawn(g, withdrawals, sorted(logins))]
+    mine = [g for g in mine if g not in revoked]
     if had_grants and not mine:
         return None, "revoked"
     if not mine:
@@ -336,6 +337,8 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
         bad = [r for r in ours if problems(r, today) and _covers(r, repo, sorted(logins))]
         if bad:
             return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0], today)[0]}"
+        if any(_covers(g, repo, sorted(logins)) for g in revoked):  # the grant that covered it was withdrawn
+            return None, "revoked"
         return None, "scope"
     live = [r for r in scoped if _live(r, now)]
     if not live:

From e829f971d95eb8536d2fa71a19a70b509e70cdcd Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:20:53 -0400
Subject: [PATCH 28/79] Document optional expires, withdrawal and
 t3-signoff:revoked; schema drops expires from required (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                      |  2 +-
 SKILL.md                          |  4 ++--
 references/constraints.md         |  2 +-
 references/org.md                 |  2 +-
 references/t3-signoff.md          | 11 ++++++++---
 references/t3-signoff.schema.json |  6 +++---
 scripts/showcase.py               |  4 ++--
 7 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e0e9451..f97f8b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is only an accepted no-op. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed record that would have covered the requested repository is reported as `t3-signoff:invalid`, not `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is only an accepted no-op kept for compatibility. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant, for the same owner and covering the grant's scope, withdraws it (`t3-signoff:revoked`); a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed record that would have covered the requested repository is reported as `t3-signoff:invalid`, not `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/SKILL.md b/SKILL.md
index 156daae..b0555ea 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -73,7 +73,7 @@ Run every command **from inside the target repository's checkout**, with the ski
 
 | Step | Command | Gate |
 |---|---|---|
-| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. `--allow-t3` also needs, by default, a valid, unexpired record in the private estate file `<estate root>/decisions/t3-signoffs.yaml` (or the file named by the global `--t3-signoff-file PATH` / `SHOWCASE_T3_SIGNOFF_FILE`, which overrides it), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope` (`no-file` names the resolved path; the tool never creates the file). Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
+| 1 | `meta --from-gh OWNER/REPO --out meta.json`, or pass an existing `--meta` file. It also records `pushed_at` and `last_substantive_commit` (CQ-16: the newest default-branch commit whose message does not match `ct-std-v1\|showcase banner and card\|\[skip ci\]`) | Refused owners stop here (exit 2); T3 owners pass only with `--allow-t3`, after an approved `t3-metadata` or `t3-signoff` row. `--allow-t3` also needs, by default, a valid, unexpired record in the private estate file `<estate root>/decisions/t3-signoffs.yaml` (or the file named by the global `--t3-signoff-file PATH` / `SHOWCASE_T3_SIGNOFF_FILE`, which overrides it), in the format of [references/t3-signoff.md](references/t3-signoff.md) (`id`, `owner`, `repos`, `approved`, `approver`, `approved_on`, `expires`, optional `note`), else exit 2 with `t3-signoff:no-file|missing|invalid|expired|scope|revoked` (`no-file` names the resolved path; the tool never creates the file). Watching-org forks get metadata only. Archived repositories are in scope (decision 6): the orchestrator unarchives, polishes and re-archives them. |
 | 2 | `describe` | `keep`, `edit` (smallest passing edit, in `proposed`) or `needs-writer`. On `needs-writer`, write the sentence yourself from the template in [references/descriptions.md](references/descriptions.md) and the repository's facts, then re-run `describe --text "..."` until it answers `keep`. The tool never composes it. |
 | 3 | `topics`, `labels --plan` | Proposals only. Add `--records FILE` to emit change records, `--gh` to print the exact `gh` commands. |
 | 4 | Apply the approved description and topics on GitHub (the writer), or write them into `meta.json` | Before any art: the banner subtitle, the card and the README tagline come from the description, so rendering first breaks R2 (tagline equals description) the moment the writer applies the new one. |
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted for explicitness): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired` or `t3-signoff:scope` (also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is an accepted no-op kept for compatibility): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later `approved: false` record withdraws a grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/constraints.md b/references/constraints.md
index c31f87c..d86c5ef 100644
--- a/references/constraints.md
+++ b/references/constraints.md
@@ -26,7 +26,7 @@ Condensed from `ct-std-v1` §10 and §12. The skill proposes; a single serialize
 1. **One serialized writer queue** for every REST call, git push and UI write. Planners and this skill emit change records.
 2. **Change record:** `{std, owner, repo, kind: api|file|ui, target, before_sha256, after, rule}`. The writer rejects a record whose `before` no longer matches the live state. Commands that propose writes take `--records FILE`.
 3. **Diff first.** GET, compute the delta, write only the delta, GET again to verify. Never write a value that is already equal.
-4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (always enforced: `t3-signoff:no-file|missing|invalid|expired|scope`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
+4. **Log every write with its rule** and every skip with a code: `needs-input[:DETAIL]`, `license-review`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references`, `hold`, `t3-signoff` (always enforced: `t3-signoff:no-file|missing|invalid|expired|scope|revoked`, see [t3-signoff.md](t3-signoff.md)), `archived`, `topics-short`, `dead-link`, `fork-parent-missing`, `pages-mismatch`, `pages-readme-index`, `homepage-review`, `readme-shrink`, `apache-notice-review`, `art-fail`, `exempt`, `deploy-relink`, `dns-update`, `ui-danger-dialog`.
 5. **Never commit logs** or the moves list to a public repository: they name private repositories.
 
 ## Content commits
diff --git a/references/org.md b/references/org.md
index 2b5ce03..ac13dce 100644
--- a/references/org.md
+++ b/references/org.md
@@ -14,7 +14,7 @@ python3 $S org health  ORG [--dot-github CHECKOUT]                  # O4: §8.1
 python3 $S org doctor  ORG --snapshot org-snapshot.json [--dot-github CHECKOUT] [--avatar avatar.png] [--doctor-format tsv|json|md] [--header]
 ```
 
-Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope` otherwise, see [t3-signoff.md](t3-signoff.md)); there is no opt-out.
+Every action takes `ORG` (any former login resolves, see below), `--registry`, `--meta-dir`, `--decisions`, `--approved`, `--approved-yaml`, `--actions`, `--allow-t3` and `--jobs FILE` (append the writer jobs as JSON lines). The global `--allow-t3` (before the command) is equivalent. Either needs a valid sign-off record by default (`<estate root>/decisions/t3-signoffs.yaml` or `--t3-signoff-file`; `t3-signoff:no-file|missing|invalid|expired|scope|revoked` otherwise, see [t3-signoff.md](t3-signoff.md)); there is no opt-out.
 
 | Action | Reads | Emits | Writes |
 |---|---|---|---|
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index fbbc0fb..d4b4b5b 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,6 +1,6 @@
 # T3 sign-off records (`--allow-t3` needs one)
 
-`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted for explicitness and changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is an accepted no-op, kept for compatibility, and changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
@@ -30,7 +30,7 @@ signoffs:
 | `approved` | yes | boolean (`"true"` as a string is invalid) |
 | `approver` | yes | non-empty string |
 | `approved_on` | yes | date `YYYY-MM-DD`, not later than today (a sign-off that has not happened yet grants nothing) |
-| `expires` | yes | date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid; not earlier than `approved_on` |
+| `expires` | no | optional; absent means no expiry. When present: date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid; not earlier than `approved_on` |
 | `note` | no | string |
 
 No other fields are allowed. The file itself is an object with the one key `signoffs`, a list of record objects; a top-level list, any other top-level key or a non-object entry makes the whole file authorize nothing (`t3-signoff:missing`), as the schema refuses it.
@@ -43,9 +43,14 @@ Each refusal exits 2 with result `refused`.
 |---|---|
 | `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
-| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`), or a malformed record would have covered the repository; the error names the record id and the first problem. Two records with one id are also invalid |
+| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`, or `expires` is null or unparseable), or a malformed record would have covered the repository (a `repos` that is not `"*"`, a name or a non-empty list of names is invalid, never `scope`); the error names the record id and the first problem. Two records with one id are also invalid |
 | `t3-signoff:scope` | the owner has valid approved records but none covers the repository; an `OWNER/NAME` repository is covered only when that owner is the record's org (only `*` covers another account's repository) |
 | `t3-signoff:expired` | every covering record is past `expires` |
+| `t3-signoff:revoked` | every otherwise-grantable record was withdrawn by a later or same-day `approved: false` record (see Withdrawal) |
+
+## Withdrawal
+
+The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on`, whose `repos` cover the grant's scope (`*`, or every repository the grant names), withdraws that grant, and the refusal is `t3-signoff:revoked`. A false record dated before the grant, or scoped to fewer repositories than the grant covers, does not revoke it. A new `approved: true` record dated after the withdrawal grants again. Grants on distinct scopes are independent, so each keeps its own record id.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
diff --git a/references/t3-signoff.schema.json b/references/t3-signoff.schema.json
index fecd30e..ac7082e 100644
--- a/references/t3-signoff.schema.json
+++ b/references/t3-signoff.schema.json
@@ -21,7 +21,7 @@
     },
     "record": {
       "type": "object",
-      "required": ["id", "owner", "repos", "approved", "approver", "approved_on", "expires"],
+      "required": ["id", "owner", "repos", "approved", "approver", "approved_on"],
       "additionalProperties": false,
       "properties": {
         "id": { "$ref": "#/$defs/nonEmpty", "description": "Carried onto writer jobs and change records as signoff_id." },
@@ -33,11 +33,11 @@
             { "type": "array", "minItems": 1, "items": { "$ref": "#/$defs/nonEmpty" } }
           ]
         },
-        "approved": { "type": "boolean", "description": "Only true grants; false is kept for the audit trail." },
+        "approved": { "type": "boolean", "description": "Only true grants. A false record (kept for the audit trail) with approved_on on or after a grant's date, for the same owner and covering the grant's scope, withdraws that grant (t3-signoff:revoked)." },
         "approver": { "$ref": "#/$defs/nonEmpty", "description": "Who signed off." },
         "approved_on": { "$ref": "#/$defs/date", "description": "The date of the sign-off." },
         "expires": {
-          "description": "A date (valid through that day) or a timestamp with a UTC offset (valid before that instant).",
+          "description": "Optional. An absent value means no expiry. Otherwise a date (valid through that day) or a timestamp with a UTC offset (valid before that instant); null is invalid.",
           "oneOf": [ { "$ref": "#/$defs/date" }, { "$ref": "#/$defs/awareTimestamp" } ]
         },
         "note": { "type": ["string", "null"] }
diff --git a/scripts/showcase.py b/scripts/showcase.py
index bfbbd88..15b134a 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -960,9 +960,9 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--allow-t3", action="store_true",
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2). It also needs a valid sign-off record, by default in <estate root>/decisions/t3-signoffs.yaml (see --t3-signoff-file and references/t3-signoff.md); there is no opt-out")
     p.add_argument("--require-t3-signoff", action="store_true",
-                   help="accepted for explicitness and a no-op, since enforcement is always on: --allow-t3 is honoured only when a valid, "
+                   help="accepted and ignored (a no-op kept for compatibility), since enforcement is always on: --allow-t3 is honoured only when a valid, "
                         "unexpired sign-off record covers the owner and repository; otherwise exit 2 "
-                        "(t3-signoff:no-file|missing|invalid|expired|scope)")
+                        "(t3-signoff:no-file|missing|invalid|expired|scope|revoked)")
     p.add_argument("--t3-signoff-file", metavar="PATH",
                    help="the sign-off record file to read instead of the default <estate root>/decisions/t3-signoffs.yaml "
                         "(env SHOWCASE_T3_SIGNOFF_FILE; format: references/t3-signoff.md). Order: this flag, the env, the default. "

From b564abc8c8908eeeea8029446f88950793ddb318 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:20:55 -0400
Subject: [PATCH 29/79] Test optional expiry, withdrawal, repos invalid, no-op
 flag pin and estate README stamping (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/fixtures/t3-signoff/invalid.yaml |   7 ++
 tests/fixtures/t3-signoff/valid.yaml   |   6 +
 tests/test_t3_signoff_default.py       |  22 ++++
 tests/test_t3_signoff_require.py       | 157 ++++++++++++++++++++++++-
 4 files changed, 190 insertions(+), 2 deletions(-)

diff --git a/tests/fixtures/t3-signoff/invalid.yaml b/tests/fixtures/t3-signoff/invalid.yaml
index dbbd7d9..ec151c0 100644
--- a/tests/fixtures/t3-signoff/invalid.yaml
+++ b/tests/fixtures/t3-signoff/invalid.yaml
@@ -41,3 +41,10 @@ signoffs:
     approved_on: 2026-01-15
     expires: 2099-12-31
     approvd_by: typo
+  - id: t3s-bad-null-expiry
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
+    expires: null
diff --git a/tests/fixtures/t3-signoff/valid.yaml b/tests/fixtures/t3-signoff/valid.yaml
index 5210caf..da14c23 100644
--- a/tests/fixtures/t3-signoff/valid.yaml
+++ b/tests/fixtures/t3-signoff/valid.yaml
@@ -15,3 +15,9 @@ signoffs:
     approver: synthetic-co-owner
     approved_on: 2026-01-15
     expires: "2099-12-31T23:59:59+00:00"
+  - id: t3s-fixture-open
+    owner: Pick-Your-AI
+    repos: ["*"]
+    approved: true
+    approver: synthetic-co-owner
+    approved_on: 2026-01-15
diff --git a/tests/test_t3_signoff_default.py b/tests/test_t3_signoff_default.py
index 79a0033..7af2615 100644
--- a/tests/test_t3_signoff_default.py
+++ b/tests/test_t3_signoff_default.py
@@ -167,3 +167,25 @@ def test_estate_plan_stamping_ignores_a_display_name_shared_with_another_org(tmp
     finally:
         signoff.restore(token)
     assert {j["id"]: j.get("signoff_id") for j in jobs} == {"t1": None, "t3": "t3s-acme"}
+
+
+def test_flag_is_an_accepted_no_op_and_the_no_file_default_still_refuses(tmp_path):
+    """Default-on enforcement is not a regression: with no record file `--allow-t3` refuses exactly as it does with
+    the compatibility flag, and the flag changes neither the exit code nor the output."""
+    root = _bundle(tmp_path, write=False)
+    bare = _run(tmp_path, root, "--allow-t3", "describe")
+    flagged = _run(tmp_path, root, "--require-t3-signoff", "--allow-t3", "describe")
+    assert bare.returncode == flagged.returncode == 2
+    assert "t3-signoff:no-file" in _out(bare) and "t3-signoff:no-file" in _out(flagged), _out(bare)
+    assert (bare.stdout, bare.stderr) == (flagged.stdout, flagged.stderr)
+    root = _bundle(tmp_path / "ok", id="t3s-flag")
+    ok = _run(tmp_path / "ok", root, "--allow-t3", "describe")
+    ok_flag = _run(tmp_path / "ok", root, "--require-t3-signoff", "--allow-t3", "describe")
+    assert ok.returncode == ok_flag.returncode == 0 and ok.stdout == ok_flag.stdout
+
+
+def test_no_opt_out_option_exists_in_help_or_source():
+    helptext = subprocess.run([*SHOWCASE, "--help"], capture_output=True, encoding="utf-8").stdout
+    assert "--require-t3-signoff" in helptext and "--no-require-t3-signoff" not in helptext
+    src = "".join(p.read_text(encoding="utf-8") for p in (ROOT / "scripts").rglob("*.py"))
+    assert "SHOWCASE_REQUIRE_T3_SIGNOFF" not in src and "no-require-t3-signoff" not in src
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 6cdf45d..33e16ca 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -35,7 +35,8 @@ def _bundle(tmp_path, records):
         lines.append(f"    approved: {str(r.get('approved', True)).lower()}")
         lines.append(f"    approver: {r.get('approver', 'synthetic-co-owner')}")
         lines.append(f"    approved_on: {r.get('approved_on', '1990-01-01')}")
-        lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
+        if r.get("expires", "2099-12-31") is not None:  # expires=None omits the key: the record has no expiry
+            lines.append(f"    expires: {r.get('expires', '2099-12-31')}")
     (d / "t3-signoffs.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
     return tmp_path / "bundle"
 
@@ -259,7 +260,16 @@ def test_malformed_repos_refuses_instead_of_raising(tmp_path):
                               "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
     r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "repos" in _out(r), _out(r)
-    assert "Traceback" not in _out(r), _out(r)
+    assert "t3-signoff:scope" not in _out(r) and "Traceback" not in _out(r), _out(r)
+
+
+@pytest.mark.parametrize("repos", ["7", "[]"])
+def test_malformed_or_empty_repos_is_invalid_with_a_needs_star_message(tmp_path, repos):
+    b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: {repos}\n    approved: true\n"
+                              "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "repos: needs '*'" in _out(r), _out(r)
+    assert "t3-signoff:scope" not in _out(r) and "Traceback" not in _out(r), _out(r)
 
 
 def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
@@ -1033,3 +1043,146 @@ def test_doctor_row_shape_is_unchanged_without_allow_t3(tmp_path):
     r = _run(tmp_path, bundle, "doctor", "--header", owner="CompleteTech-Skills")
     head = r.stdout.splitlines()[0].split("\t")
     assert head[-1] == "done" and "signoff_id" not in head, r.stdout
+
+
+# --- review fix round 1: optional expiry, withdrawal, estate README stamping ---
+
+def _rec(**kw):
+    base = {"id": "a", "owner": OWNER, "repos": ["*"], "approved": True, "approver": "synthetic-co-owner",
+            "approved_on": "2026-01-15"}
+    base.update(kw)
+    return base
+
+
+def test_record_without_expires_grants_and_has_no_expiry(tmp_path):
+    from ctshowcase import signoff
+    rec = _rec()
+    assert "expires" not in rec and signoff.problems(rec) == []
+    got, why = signoff.evaluate([OWNER], "r", records=[rec])
+    assert why is None and got is rec
+    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-open", "expires": None}]), "--allow-t3", "describe")
+    assert r.returncode == 0 and "t3-signoff" not in _out(r), _out(r)
+    (tmp_path / "j").mkdir()
+    j = _run(tmp_path / "j", _bundle(tmp_path / "j", [{"id": "t3s-open", "expires": None}]), "--allow-t3", "adopt",
+             f"{OWNER}/northwind-synthetic")
+    topics = [x for x in json.loads(j.stdout)["jobs"] if x["kind"] == "topics"]
+    assert topics and all(x.get("signoff_id") == "t3s-open" for x in topics), j.stdout[:400]
+
+
+@pytest.mark.parametrize("body", ["    expires: null\n", "    expires: not-a-date\n", "    expires: 2099-12-31garbage\n"])
+def test_null_or_unparseable_expires_is_still_invalid(tmp_path, body):
+    from ctshowcase import signoff
+    b = _raw_bundle(tmp_path, f"  - id: t3s-x\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n"
+                              f"    approver: x\n    approved_on: 2026-01-01\n{body}")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "expires" in _out(r), _out(r)
+    assert signoff.evaluate([OWNER], "r", records=[_rec(expires=None)])[1].startswith("invalid")
+
+
+A_TRUE = _rec(id="a", approved_on="2026-01-15")
+B_FALSE = _rec(id="b", approved=False, approved_on="2026-10-01")
+
+
+def test_later_false_record_withdraws_the_grant(tmp_path):
+    from ctshowcase import signoff
+    assert signoff.evaluate([OWNER], "foo", records=[A_TRUE, B_FALSE]) == (None, "revoked")
+    assert signoff.evaluate([OWNER], None, records=[B_FALSE, A_TRUE]) == (None, "revoked")
+    b = _bundle(tmp_path, [{"id": "a", "approved_on": "2026-01-15"},
+                           {"id": "b", "approved": False, "approved_on": "2026-10-01"}])
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:revoked" in _out(r), _out(r)
+
+
+def test_same_day_false_record_withdraws_too():
+    from ctshowcase import signoff
+    same = _rec(id="b", approved=False, approved_on="2026-01-15")
+    assert signoff.evaluate([OWNER], "foo", records=[A_TRUE, same]) == (None, "revoked")
+
+
+def test_false_record_dated_before_the_grant_does_not_revoke():
+    from ctshowcase import signoff
+    early = _rec(id="b", approved=False, approved_on="2026-01-01")
+    got, why = signoff.evaluate([OWNER], "foo", records=[A_TRUE, early])
+    assert why is None and got["id"] == "a"
+
+
+def test_false_record_scoped_to_one_repo_does_not_revoke_a_star_grant():
+    from ctshowcase import signoff
+    narrow = _rec(id="b", approved=False, approved_on="2026-10-01", repos=["X"])
+    for repo in ("foo", "X"):
+        got, why = signoff.evaluate([OWNER], repo, records=[A_TRUE, narrow])
+        assert why is None and got["id"] == "a", repo
+
+
+def test_false_record_for_another_owner_does_not_revoke():
+    from ctshowcase import signoff
+    other = _rec(id="b", owner="Other-Org", approved=False, approved_on="2026-10-01")
+    got, why = signoff.evaluate([OWNER], "foo", records=[A_TRUE, other])
+    assert why is None and got["id"] == "a"
+
+
+def test_regrant_after_the_withdrawal_grants_again():
+    from ctshowcase import signoff
+    regrant = _rec(id="c", approved_on="2026-10-02")
+    got, why = signoff.evaluate([OWNER], "foo", records=[A_TRUE, B_FALSE, regrant])
+    assert why is None and got["id"] == "c"
+
+
+def test_withdrawal_of_one_scope_leaves_the_other_scope_granted():
+    from ctshowcase import signoff
+    x = _rec(id="x", repos=["X"], approved_on="2026-01-15")
+    y = _rec(id="y", repos=["Y"], approved_on="2026-01-15")
+    drop_x = _rec(id="dx", repos=["X"], approved=False, approved_on="2026-10-01")
+    assert signoff.evaluate([OWNER], "X", records=[x, y, drop_x]) == (None, "revoked")
+    got, why = signoff.evaluate([OWNER], "Y", records=[x, y, drop_x])
+    assert why is None and got["id"] == "y"
+
+
+def _complete_estate_capture():
+    """estate-copy-capture.json plus every Estate view and an Org field whose existing option is the T3 org."""
+    from ctshowcase import project as PJ
+    cap = json.loads((ROOT / "tests" / "fixtures" / "project" / "estate-copy-capture.json").read_text(encoding="utf-8"))
+    board = cap["data"]["user"]["projectV2"]
+    for i, v in enumerate(PJ.ESTATE_VIEWS):
+        board["views"]["nodes"].append(dict(board["views"]["nodes"][-1], id=f"PVTV_e{i}", number=20 + i, name=v["name"],
+                                            filter=v["filter"]))
+    board["fields"]["nodes"].append({"__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099,
+                                     "name": "Org", "dataType": "SINGLE_SELECT", "isIssueField": False,
+                                     "options": [{"id": "optorg1", "name": "Pick Your AI", "color": "YELLOW",
+                                                  "description": f"T3: {OWNER}"}]})
+    return cap
+
+
+def _readme_jobs(plan):
+    return [j for j in plan["jobs"] if "--readme" in j.get("argv", [])]
+
+
+def test_estate_readme_job_carries_the_t3_orgs_signoff(tmp_path, monkeypatch, brand):
+    from ctshowcase import project as PJ
+    from ctshowcase.config import load_yaml_text
+    from ctshowcase.resolver import Resolver
+    reg = load_yaml_text((ROOT / "tests" / "fixtures" / "org" / "registry.yaml").read_text(encoding="utf-8"))
+    reg["profile"]["org_directory"].append({"group": "T3", "orgs": [OWNER]})
+    reg["orgs"][OWNER] = {}
+    res = Resolver(brand, reg, {"rows": {("create-project", "@me", "*", "")}, "ids": set(), "answers": {},
+                                "actions": [], "extra": []})
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, [{"id": "t3s-board"}]))):
+        plan = PJ.estate_plan(res, copied=_complete_estate_capture(), user_id=100, allow_t3=True)
+    readme = _readme_jobs(plan)
+    assert readme, [j["id"] for j in plan["jobs"]]
+    text = readme[0]["argv"][readme[0]["argv"].index("--readme") + 1]
+    assert "Pick Your AI" in text, text
+    assert all(j.get("signoff_id") == "t3s-board" for j in readme), readme
+
+
+def test_readme_naming_only_a_non_t3_org_gets_no_signoff_id():
+    from ctshowcase import project as PJ
+    orgs = [{"login": "Acme", "name": "Acme", "tier": "T3", "signoff_id": "t3s-acme"},
+            {"login": "Acme-Tools", "name": "Acme Tools", "tier": "T1"}]
+    for table in ("| Acme-Tools | tools |", "| Acme Tools | tools |", "AcmeCorp and Acme-Tools"):
+        jobs = [{"id": "r", "phase": 1, "argv": ["gh", "project", "edit", "7", "--readme", table]}]
+        PJ._stamp_estate_orgs(jobs, orgs)
+        assert "signoff_id" not in jobs[0] and "signoff_ids" not in jobs[0], (table, jobs[0])
+    jobs = [{"id": "r", "phase": 1, "argv": ["gh", "project", "edit", "7", "--readme", "| Acme | own |"]}]
+    PJ._stamp_estate_orgs(jobs, orgs)
+    assert jobs[0].get("signoff_id") == "t3s-acme"

From 96b8d42f954268aef4884b2bbba381dfac2b2c3e Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:41:41 -0400
Subject: [PATCH 30/79] Compare T3 withdrawal scopes alias-aware and report
 malformed repos as invalid (#23)

- Add _scope_key: bare name equals OWNER/NAME for the owner's own logins;
  another account's OWNER/NAME stays distinct.
- _withdrawn compares canonical scope sets, so bare and qualified forms and
  owner aliases revoke each other.
- evaluate reports a malformed repos record as t3-signoff:invalid regardless
  of whether it would have covered the repository.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 47 +++++++++++++++++++++++++++++------
 1 file changed, 40 insertions(+), 7 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index f7f4ae4..c5407b5 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -268,16 +268,44 @@ def _repo_list(repos) -> list[str] | None:
     return None
 
 
+def _repos_malformed(rec: dict) -> bool:
+    """True when problems() reports the `repos:` break: `repos` is neither a non-empty string nor a non-empty list of
+    non-empty strings."""
+    repos = rec.get("repos")
+    if isinstance(repos, str) and repos.strip():
+        return False
+    if isinstance(repos, list) and repos and all(isinstance(x, str) and x.strip() for x in repos):
+        return False
+    return True
+
+
+def _scope_key(entry: str, logins: list[str] | None) -> str:
+    """A canonical key for one `repos` entry, so equivalent scopes compare equal. `*` stays `*`. A bare NAME is its
+    lowercased name. OWNER/NAME for one of LOGINS (the owner's own logins, aliases included) is the bare name, the same
+    repository. OWNER/NAME for another account keeps its full lowercased form. With logins None, the lowercased entry."""
+    e = entry.strip().lower()
+    if e == "*":
+        return "*"
+    head, sep, tail = e.rpartition("/")
+    if not sep:
+        return e
+    if logins is not None and head in {x.lower() for x in logins}:
+        return tail
+    return e
+
+
 def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None = None) -> bool:
     """True when an approved:false record (a withdrawal) vetoes GRANT: its approved_on is on or after the grant's
     approved_on (same day counts), its owner is one of LOGINS (when given), and its repos cover everything the grant
-    covers (`*`, or every entry of the grant's repos, case-insensitively, appears in its own repos). A malformed
-    `repos` never withdraws."""
+    covers (`*`, or every scope of the grant appears among its own). Scopes are compared owner- and alias-aware: a bare
+    name equals OWNER/NAME when OWNER is one of the owner's own LOGINS, so the two forms revoke each other, and another
+    account's OWNER/NAME stays distinct. A malformed `repos` never withdraws."""
     g_on = _parse_when(grant.get("approved_on"))
     g_repos = _repo_list(grant.get("repos"))
     if g_on is None or g_repos is None or isinstance(g_on, _dt.datetime):
         return False
     owners = {x.lower() for x in logins} if logins is not None else None
+    g_keys = {_scope_key(x, logins) for x in g_repos}
     for f in withdrawals:
         if owners is not None and str(f.get("owner") or "").lower() not in owners:
             continue
@@ -285,10 +313,10 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
         f_repos = _repo_list(f.get("repos"))
         if f_on is None or f_repos is None or isinstance(f_on, _dt.datetime) or f_on < g_on:
             continue
-        if "*" in f_repos:
+        f_keys = {_scope_key(x, logins) for x in f_repos}
+        if "*" in f_keys:
             return True
-        have = {x.lower() for x in f_repos}
-        if all(x.lower() in have for x in g_repos):
+        if g_keys <= f_keys:
             return True
     return False
 
@@ -334,9 +362,14 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     scoped = [r for r in mine if _covers(r, repo, sorted(logins))]
     if not scoped:
         # a malformed record that would have covered the repository is the cause, not a missing scope
-        bad = [r for r in ours if problems(r, today) and _covers(r, repo, sorted(logins))]
+        # a malformed `repos` is reported whether or not it would have covered the repository
+        bad = [r for r in ours if problems(r, today) and (_repos_malformed(r) or _covers(r, repo, sorted(logins)))]
         if bad:
-            return None, f"invalid:{str(bad[0].get('id') or '?')}: {problems(bad[0], today)[0]}"
+            malformed = [r for r in bad if _repos_malformed(r)]
+            pick = (malformed or bad)[0]
+            probs = problems(pick, today)
+            line = next((p for p in probs if p.startswith("repos:")), probs[0]) if malformed else probs[0]
+            return None, f"invalid:{str(pick.get('id') or '?')}: {line}"
         if any(_covers(g, repo, sorted(logins)) for g in revoked):  # the grant that covered it was withdrawn
             return None, "revoked"
         return None, "scope"

From c8a36cb76f04a56127a9bd45824ce2ddcd34e9dc Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:41:41 -0400
Subject: [PATCH 31/79] Report refused T3 orgs in estate-plan logs (#23)

estate_orgs drops a T3 org whose sign-off record is missing, expired,
revoked, out of scope or invalid without a log. Collect each refusal as
t3-signoff:<code>:<login> through a new optional refusals keyword and
have estate_plan add the deduplicated entries to plan logs. Return value
and call compatibility are unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 5a7a874..a734d6d 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1081,10 +1081,12 @@ def lint(capture: dict, *, role: str = "org", owner: str | None = None, display_
 # =====================================================================================================
 # estate-plan (§13.10): the cross-org personal Estate project on CompleteDotTech
 # =====================================================================================================
-def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
+def estate_orgs(resolver: Resolver, *, allow_t3: bool = False, refusals: list[str] | None = None) -> list[dict]:
     """In-scope orgs for the Estate's Org field: T1, T2, T2-R (T3 only after sign-off; never HOLD or excluded).
     A T3 org also needs a valid record, and its entry keeps that record's id as
-    `signoff_id` so estate_plan can carry it onto the jobs that bring the org into the personal board."""
+    `signoff_id` so estate_plan can carry it onto the jobs that bring the org into the personal board.
+    A T3 org without a valid record is omitted; when `refusals` is a list, each such org is reported there as
+    `t3-signoff:<code>:<login>`."""
     from . import signoff
     out = []
     groups = (resolver.registry.get("profile") or {}).get("org_directory") or []
@@ -1102,8 +1104,11 @@ def estate_orgs(resolver: Resolver, *, allow_t3: bool = False) -> list[dict]:
         if tier == "T3":
             if not allow_t3:
                 continue
-            rec = signoff.record(key, None, resolver.aliases(key))
+            rec, why = signoff.evaluate([key, *resolver.aliases(key)])
             if rec is None:
+                code = (why or "missing").partition(":")[0]
+                if refusals is not None:
+                    refusals.append(f"t3-signoff:{code}:{resolver.canonical(key)}")
                 continue
         if tier in TIER_COLOR:
             entry = {"login": resolver.canonical(key), "name": row.get("display_name") or key, "tier": tier}
@@ -1193,7 +1198,8 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
 
 def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict | None = None, user_id: int | None = None,
                 approval_id: str | None = None, allow_t3: bool = False, reviewed: str | None = None) -> dict:
-    orgs = estate_orgs(resolver, allow_t3=allow_t3)
+    t3_refusals: list[str] = []
+    orgs = estate_orgs(resolver, allow_t3=allow_t3, refusals=t3_refusals)
     if len(orgs) > 50:
         raise ShowcaseError("more than 50 orgs for the Org single-select", log="usage")
     org_field = dict(ESTATE_FIELDS[0], options=[(o["name"], TIER_COLOR[o["tier"]], f"{o['tier']}: {o['login']}") for o in orgs])
@@ -1203,7 +1209,8 @@ def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict |
                      display_name="CompleteTech Estate", status_update=False, allow_t3=allow_t3)
     plan["action"] = "estate-plan"
     plan["orgs"] = orgs
-    plan["reads"] += [{"name": f"estate-items:{o['login']}",
+    plan["logs"] = [*plan.get("logs", []), *dict.fromkeys(t3_refusals)]
+    plan["reads"] +=[{"name": f"estate-items:{o['login']}",
                        "argv": ["gh", "search", "issues", "--owner", o["login"], "--label", "estate", "--state", "open",
                                 "--json", "url", "--limit", "200"]} for o in orgs]
     plan["pending"].append({"why": "add each labelled Initiative or Feature with `gh project item-add N --owner @me --url URL` "

From ac58267ed8fc109e2e1e599c6b46db6227a75679 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:43:32 -0400
Subject: [PATCH 32/79] Test T3 withdrawal scope equivalence, malformed scope
 beside a grant, estate-plan refusal logs and env non-opt-out (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_allow_t3_docs.py      | 10 ++++
 tests/test_t3_signoff_require.py | 84 +++++++++++++++++++++++++++++---
 2 files changed, 86 insertions(+), 8 deletions(-)

diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index 27687f6..9940539 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -107,3 +107,13 @@ def test_skill_documents_default_on_enforcement_path_and_no_opt_out():
     assert "Default-on T3 sign-off enforcement" in changelog and "decisions/t3-signoffs.yaml" in changelog
     ref = _read("references/t3-signoff.md")
     assert "DEFAULT OFF" not in ref and "decisions/t3-signoffs.yaml" in ref
+
+
+def test_require_t3_signoff_is_documented_as_accepted_and_ignored():
+    """The flag is a no-op, never a released compatibility surface: no doc says it is kept for compatibility."""
+    for name in ("SKILL.md", "CHANGELOG.md", "references/t3-signoff.md"):
+        text = _read(name)
+        for line in text.splitlines():
+            if "--require-t3-signoff" in line:
+                assert "kept for compatibility" not in line, (name, line[:200])
+        assert "accepted and ignored" in text, name
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 33e16ca..5767bdc 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,7 +1,8 @@
-"""`--require-t3-signoff` (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
+"""`--allow-t3` sign-off enforcement (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
 `--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE) or, by default, in the private estate bundle
-(`<estate root>/decisions/t3-signoffs.yaml`; tests/test_t3_signoff_default.py). The enforcement is default-on; the tests
-there is no opt-out (tests/test_t3_signoff_default.py::test_there_is_no_opt_out).
+(`<estate root>/decisions/t3-signoffs.yaml`; tests/test_t3_signoff_default.py). The enforcement is default-on and
+there is no opt-out (tests/test_t3_signoff_default.py::test_there_is_no_opt_out); `--require-t3-signoff` is an accepted
+no-op flag.
 
 Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
 tests/test_allow_t3_global.py pins the refusals without `--allow-t3`; it only gained the record-file environment that
@@ -91,13 +92,14 @@ def test_valid_wildcard_and_repo_scoped_records_are_honoured(tmp_path):
         assert r.returncode != 2 and "t3-signoff" not in _out(r), (repos, _out(r))
 
 
-def test_env_var_is_equivalent_to_the_flag(tmp_path):
-    b = _bundle(tmp_path, [])
-    r = _run(tmp_path, b, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": "1"})
-    assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
+@pytest.mark.parametrize("value", ["0", "false"])
+def test_unrelated_env_cannot_disable_enforcement(tmp_path, value):
+    """No environment variable turns the check off: SHOWCASE_REQUIRE_T3_SIGNOFF is not a knob."""
+    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": value})
+    assert r.returncode == 2 and ("t3-signoff:missing" in _out(r) or "t3-signoff:no-file" in _out(r)), _out(r)
 
 
-# Guard test: passes on base 2be04ac by design (verified: 28 of 30 tests in this file fail on base, only the two guards pass). It pins the unchanged default.
+# Guard test: pins the unchanged refusal when --allow-t3 is absent, even with the (no-op) flag.
 def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
     r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
     assert r.returncode == 2 and "t3-signoff" in _out(r)
@@ -875,6 +877,17 @@ def test_estate_plan_jobs_carry_the_t3_orgs_signoff(tmp_path, monkeypatch, brand
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "none", []))):
         plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
         assert OWNER not in [o["login"] for o in plan["orgs"]] and OWNER not in json.dumps(plan["jobs"])
+        assert f"t3-signoff:missing:{OWNER}" in plan["logs"], plan["logs"]
+    for tag, recs, code in (("exp", [{"id": "t3s-x", "expires": "2020-01-01"}], "expired"),
+                            ("rev", [{"id": "t3s-g", "approved_on": "2026-01-15"},
+                                     {"id": "t3s-w", "approved": False, "approved_on": "2026-10-01"}], "revoked")):
+        with _Strict(monkeypatch, _file(_bundle(tmp_path / tag, recs))):
+            plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
+            assert OWNER not in [o["login"] for o in plan["orgs"]], plan["orgs"]
+            assert f"t3-signoff:{code}:{OWNER}" in plan["logs"], (code, plan["logs"])
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok2", [{"id": "t3s-board"}]))):
+        plan = PJ.estate_plan(res, copied=cap, user_id=100, allow_t3=True)
+        assert not [x for x in plan["logs"] if str(x).startswith("t3-signoff:")], plan["logs"]
 
 
 # --- review round 5: evidence for each fixed finding (synthetic records and slugs only) ---
@@ -1186,3 +1199,58 @@ def test_readme_naming_only_a_non_t3_org_gets_no_signoff_id():
     jobs = [{"id": "r", "phase": 1, "argv": ["gh", "project", "edit", "7", "--readme", "| Acme | own |"]}]
     PJ._stamp_estate_orgs(jobs, orgs)
     assert jobs[0].get("signoff_id") == "t3s-acme"
+
+
+# --- review fix round 2: withdrawal scope equivalence, malformed scope beside a valid grant ---
+
+def _withdraw_case(grant_repos, withdraw_repos, repo="site", owner="Ex-Co", w_owner=None, logins=None):
+    from ctshowcase import signoff
+    g = _rec(id="g1", owner=owner, repos=grant_repos, approved_on="2026-01-01")
+    w = _rec(id="w1", owner=w_owner or owner, repos=withdraw_repos, approved=False, approved_on="2026-02-01")
+    return signoff.evaluate(logins or [owner], repo, records=[g, w])
+
+
+@pytest.mark.parametrize("grant,withdrawal", [
+    (["Ex-Co/site"], ["site"]),
+    (["site"], ["Ex-Co/site"]),
+    (["site"], ["ex-co/SITE"]),
+    (["Ex-Co/site"], ["*"]),
+])
+def test_withdrawal_covers_the_grant_in_either_scope_form(grant, withdrawal):
+    assert _withdraw_case(grant, withdrawal) == (None, "revoked")
+
+
+def test_withdrawal_under_an_alias_login_revokes():
+    from ctshowcase import signoff
+    g = _rec(id="g1", owner="Old-Login", repos=["Old-Login/site"], approved_on="2026-01-01")
+    w = _rec(id="w1", owner="New-Login", repos=["New-Login/site"], approved=False, approved_on="2026-02-01")
+    assert signoff.evaluate(["New-Login", "Old-Login"], "site", records=[g, w]) == (None, "revoked")
+
+
+def test_withdrawal_for_another_account_or_repo_does_not_revoke():
+    got, why = _withdraw_case(["Ex-Co/site"], ["Other/site"])
+    assert why is None and got["id"] == "g1", (got, why)
+    got, why = _withdraw_case(["site"], ["Other/site"])
+    assert why is None and got["id"] == "g1", (got, why)
+    got, why = _withdraw_case(["Ex-Co/site"], ["other-repo"])
+    assert why is None and got["id"] == "g1", (got, why)
+    got, why = _withdraw_case(["Ex-Co/site"], ["Ex-Co/other-repo"])
+    assert why is None and got["id"] == "g1", (got, why)
+
+
+def test_cli_withdrawal_in_the_other_scope_form_refuses_revoked(tmp_path):
+    b = _bundle(tmp_path, [{"id": "t3s-g", "repos": [f"{OWNER}/northwind-synthetic"], "approved_on": "2026-01-15"},
+                           {"id": "t3s-w", "repos": ["northwind-synthetic"], "approved": False,
+                            "approved_on": "2026-10-01"}])
+    r = _run(tmp_path, b, "--allow-t3", "describe")
+    assert r.returncode == 2 and "t3-signoff:revoked" in _out(r), _out(r)
+
+
+@pytest.mark.parametrize("bad_repos", [7, []])
+def test_malformed_repos_beside_a_valid_unrelated_grant_is_invalid_not_scope(bad_repos):
+    from ctshowcase import signoff
+    good = _rec(id="t3s-1", repos=["other-repo"])
+    bad = _rec(id="t3s-2", repos=bad_repos)
+    got, why = signoff.evaluate([OWNER], "northwind-synthetic", records=[good, bad])
+    assert got is None and why.startswith("invalid:t3s-2: repos"), (got, why)
+    assert signoff.evaluate([OWNER], "northwind-synthetic", records=[good]) == (None, "scope")

From a09ff738f0d137e9d774d05c0cdb01d5e6bf31b8 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 15:45:01 -0400
Subject: [PATCH 33/79] Document accepted-and-ignored flag, withdrawal scope
 equivalence, estate-plan refusal logs and invalid repos (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 2 +-
 SKILL.md                 | 2 +-
 references/t3-signoff.md | 8 +++++---
 scripts/showcase.py      | 2 +-
 4 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f97f8b0..4801feb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is only an accepted no-op kept for compatibility. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant, for the same owner and covering the grant's scope, withdraws it (`t3-signoff:revoked`); a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed record that would have covered the requested repository is reported as `t3-signoff:invalid`, not `t3-signoff:scope`. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is accepted and ignored: enforcement is always on. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant, for the same owner and covering the grant's scope, withdraws it (`t3-signoff:revoked`); a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal covers its grant when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/SKILL.md b/SKILL.md
index b0555ea..115f8bb 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is an accepted no-op kept for compatibility): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later `approved: false` record withdraws a grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted and ignored: enforcement is always on): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later `approved: false` record withdraws a grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index d4b4b5b..7402e92 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,6 +1,6 @@
 # T3 sign-off records (`--allow-t3` needs one)
 
-`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is an accepted no-op, kept for compatibility, and changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted and ignored: enforcement is always on, and the flag changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
@@ -43,14 +43,16 @@ Each refusal exits 2 with result `refused`.
 |---|---|
 | `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
-| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`, or `expires` is null or unparseable), or a malformed record would have covered the repository (a `repos` that is not `"*"`, a name or a non-empty list of names is invalid, never `scope`); the error names the record id and the first problem. Two records with one id are also invalid |
+| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`, or `expires` is null or unparseable), or a malformed `repos` (not `"*"`, a name or a non-empty list of names) is on the owner's record, which is always reported as invalid and never as `scope`, even beside a valid grant for an unrelated repository; the error names the record id and the first problem. Two records with one id are also invalid |
 | `t3-signoff:scope` | the owner has valid approved records but none covers the repository; an `OWNER/NAME` repository is covered only when that owner is the record's org (only `*` covers another account's repository) |
 | `t3-signoff:expired` | every covering record is past `expires` |
 | `t3-signoff:revoked` | every otherwise-grantable record was withdrawn by a later or same-day `approved: false` record (see Withdrawal) |
 
 ## Withdrawal
 
-The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on`, whose `repos` cover the grant's scope (`*`, or every repository the grant names), withdraws that grant, and the refusal is `t3-signoff:revoked`. A false record dated before the grant, or scoped to fewer repositories than the grant covers, does not revoke it. A new `approved: true` record dated after the withdrawal grants again. Grants on distinct scopes are independent, so each keeps its own record id.
+The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on`, whose `repos` cover the grant's scope (`*`, or every repository the grant names), withdraws that grant. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. The refusal is `t3-signoff:revoked`. A false record dated before the grant, or scoped to fewer repositories than the grant covers, does not revoke it. A new `approved: true` record dated after the withdrawal grants again. Grants on distinct scopes are independent, so each keeps its own record id.
+
+`project estate-plan --allow-t3` omits every T3 org that has no valid record and records `t3-signoff:<code>:<login>` (code `missing`, `expired`, `scope`, `revoked` or `invalid`) in the plan's `logs` for each one, so the operator sees why the org is absent.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 15b134a..fe46532 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -960,7 +960,7 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--allow-t3", action="store_true",
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2). It also needs a valid sign-off record, by default in <estate root>/decisions/t3-signoffs.yaml (see --t3-signoff-file and references/t3-signoff.md); there is no opt-out")
     p.add_argument("--require-t3-signoff", action="store_true",
-                   help="accepted and ignored (a no-op kept for compatibility), since enforcement is always on: --allow-t3 is honoured only when a valid, "
+                   help="accepted and ignored: enforcement is always on. --allow-t3 is honoured only when a valid, "
                         "unexpired sign-off record covers the owner and repository; otherwise exit 2 "
                         "(t3-signoff:no-file|missing|invalid|expired|scope|revoked)")
     p.add_argument("--t3-signoff-file", metavar="PATH",

From 475569e4f360365a8cd4855b1d75169bdedaebd8 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:07:37 -0400
Subject: [PATCH 34/79] cli: remove accepted-and-ignored --require-t3-signoff
 flag (#23)

Enforcement of T3 sign-off is unconditional, so the no-op flag only added
misleading command-contract surface. Remove its argparse definition and
help text. --allow-t3 and --t3-signoff-file are unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/showcase.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/scripts/showcase.py b/scripts/showcase.py
index fe46532..efc6266 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -959,10 +959,6 @@ def parser() -> argparse.ArgumentParser:
     p.add_argument("--quiet", action="store_true")
     p.add_argument("--allow-t3", action="store_true",
                    help="treat a T3 (co-owned) owner as signed off for this run: every repository command and generator, not just `meta`; pass only when a t3-metadata or t3-signoff row is approved (default: T3 owners are refused, exit 2). It also needs a valid sign-off record, by default in <estate root>/decisions/t3-signoffs.yaml (see --t3-signoff-file and references/t3-signoff.md); there is no opt-out")
-    p.add_argument("--require-t3-signoff", action="store_true",
-                   help="accepted and ignored: enforcement is always on. --allow-t3 is honoured only when a valid, "
-                        "unexpired sign-off record covers the owner and repository; otherwise exit 2 "
-                        "(t3-signoff:no-file|missing|invalid|expired|scope|revoked)")
     p.add_argument("--t3-signoff-file", metavar="PATH",
                    help="the sign-off record file to read instead of the default <estate root>/decisions/t3-signoffs.yaml "
                         "(env SHOWCASE_T3_SIGNOFF_FILE; format: references/t3-signoff.md). Order: this flag, the env, the default. "

From 5c5276c98a3bfb06cba58a1882ffcd3c4e565c8d Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:09:38 -0400
Subject: [PATCH 35/79] fix(t3-signoff): per-repository withdrawal veto, fail
 closed, signoff_id only (#23)

- _withdrawn takes an optional repo: with a repo, a withdrawal vetoes a
  grant that covers that repo when it covers the repo too, regardless of
  its whole scope. Without a repo the whole-grant rule is unchanged.
- evaluate() passes the requested repo and refuses with
  invalid:<id>: <problem> when a malformed withdrawal could cover it.
- record_for() applies the same per-repo veto to cached grants.
- _put() and stamp_associations() no longer set approval_id; jobs
  carry signoff_id (and signoff_ids) only.
- Module docstring: no opt-out; --require-t3-signoff is no longer a flag.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 76 +++++++++++++++++++++++++----------
 1 file changed, 55 insertions(+), 21 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index c5407b5..a3f0785 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -5,8 +5,9 @@
 `<estate_root>/decisions/t3-signoffs.yaml` (default_record_path(); estate_root is resolver.estate_root()). An explicit
 `--t3-signoff-file PATH` (env SHOWCASE_T3_SIGNOFF_FILE) overrides it. The order is: the explicit flag, then the env,
 then the default. The tool never creates the file and never falls back to trusting the flag when it is absent.
-There is no opt-out: no flag or environment variable turns enforcement off, and `--require-t3-signoff` is only an
-accepted no-op. The file is read, never copied.
+There is no opt-out: no flag or environment variable turns enforcement off. The file is read, never copied.
+A writer job carries the granting record as `signoff_id` (and `signoff_ids` when several records authorized it).
+`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row.
 Format (the contract is references/t3-signoff.schema.json, described in references/t3-signoff.md)::
 
     signoffs:
@@ -20,11 +21,11 @@
         note: "optional free text"
 
 Refusals are exit 2 with log `t3-signoff:no-file` (no record file at the resolved path, or no estate root to resolve one; the log names the path), `t3-signoff:missing` (no approved record
-for the owner), `t3-signoff:invalid` (the owner's records all break the schema, or a malformed record would have covered the
+for the owner), `t3-signoff:invalid` (the owner's records all break the schema, or a malformed record or withdrawal could cover the
 repository; the error names the first problem),
 `t3-signoff:expired` (every matching record is past `expires`) or `t3-signoff:scope` (the owner has records but none
 covers the repository; an owner-wide command with no repository needs a `*` record), or `t3-signoff:revoked` (a
-later or same-day `approved: false` record withdraws every covering grant). Excluded and HOLD owners are
+later or same-day `approved: false` record withdraws every grant covering the repository). Excluded and HOLD owners are
 refused before this runs.
 """
 from __future__ import annotations
@@ -294,12 +295,16 @@ def _scope_key(entry: str, logins: list[str] | None) -> str:
     return e
 
 
-def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None = None) -> bool:
+def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None = None,
+               repo: str | None = None) -> bool:
     """True when an approved:false record (a withdrawal) vetoes GRANT: its approved_on is on or after the grant's
-    approved_on (same day counts), its owner is one of LOGINS (when given), and its repos cover everything the grant
-    covers (`*`, or every scope of the grant appears among its own). Scopes are compared owner- and alias-aware: a bare
+    approved_on (same day counts), and its owner is one of LOGINS (when given). A malformed `repos` never withdraws.
+    With REPO (non-empty) the veto is per repository: a withdrawal vetoes the grant when the grant covers REPO and the
+    withdrawal covers REPO (_covers), whether or not it covers the grant's whole scope. So a grant of [a, b] or `*`
+    withdrawn for [a] is refused for a and still grants b. Without REPO the whole-grant rule applies: the withdrawal
+    has `*`, or every scope of the grant appears among its own. Scopes are compared owner- and alias-aware: a bare
     name equals OWNER/NAME when OWNER is one of the owner's own LOGINS, so the two forms revoke each other, and another
-    account's OWNER/NAME stays distinct. A malformed `repos` never withdraws."""
+    account's OWNER/NAME stays distinct."""
     g_on = _parse_when(grant.get("approved_on"))
     g_repos = _repo_list(grant.get("repos"))
     if g_on is None or g_repos is None or isinstance(g_on, _dt.datetime):
@@ -313,6 +318,10 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
         f_repos = _repo_list(f.get("repos"))
         if f_on is None or f_repos is None or isinstance(f_on, _dt.datetime) or f_on < g_on:
             continue
+        if repo:
+            if _covers(grant, repo, logins) and _covers(f, repo, logins):
+                return True
+            continue
         f_keys = {_scope_key(x, logins) for x in f_repos}
         if "*" in f_keys:
             return True
@@ -321,10 +330,29 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
     return False
 
 
+def _malformed_withdrawal(ours: list[dict], repo: str | None, logins: list[str], today: _dt.date) -> str | None:
+    """The refusal for a malformed withdrawal (approved: false, failing problems()) that could withdraw a grant for REPO,
+    else None. Possibly relevant: its `repos` is malformed, its approved_on is not a date (none, or a timestamp), REPO
+    is empty, or it covers REPO. A malformed withdrawal clearly for another named repository does not block."""
+    for r in ours:
+        if r.get("approved") is not False:
+            continue
+        probs = problems(r, today)
+        if not probs:
+            continue
+        on = _parse_when(r.get("approved_on"))
+        if _repos_malformed(r) or on is None or isinstance(on, _dt.datetime) or not repo or _covers(r, repo, logins):
+            return f"invalid:{str(r.get('id') or '?')}: {probs[0]}"
+    return None
+
+
 def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None = None,
              records: list[dict] | None = None, now: _dt.datetime | None = None) -> tuple[dict | None, str | None]:
-    """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<problem>' | 'expired' | 'scope' |
-    'revoked'). 'revoked' means every otherwise-grantable record was vetoed by a withdrawal (see _withdrawn).
+    """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<id>: <problem>' | 'expired' | 'scope' |
+    'revoked'). The veto is per requested REPO: 'revoked' means every otherwise-grantable record was vetoed for that
+    repository by a withdrawal (see _withdrawn). Fail closed: when a malformed withdrawal (approved: false, failing
+    problems()) could cover REPO, no record is returned and the result is 'invalid:<id>: <problem>'. A malformed
+    withdrawal clearly for another repository does not block. Only owners in the logins are considered.
     `today` (a date) is kept for callers that only care about date expiries; `now` is an aware instant."""
     if now is None:
         now = _dt.datetime.now(_dt.timezone.utc)
@@ -350,7 +378,7 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     withdrawals = [r for r in valid if r.get("approved") is False]
     mine = [r for r in valid if r.get("approved") is True]
     had_grants = bool(mine)
-    revoked = [g for g in mine if _withdrawn(g, withdrawals, sorted(logins))]
+    revoked = [g for g in mine if _withdrawn(g, withdrawals, sorted(logins), repo)]
     mine = [g for g in mine if g not in revoked]
     if had_grants and not mine:
         return None, "revoked"
@@ -376,6 +404,9 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     live = [r for r in scoped if _live(r, now)]
     if not live:
         return None, "expired"
+    unsafe = _malformed_withdrawal(ours, repo, sorted(logins), today)
+    if unsafe:  # a malformed withdrawal that could cover the repository never lets the grant through
+        return None, unsafe
     return live[0], None
 
 
@@ -431,11 +462,15 @@ def require(owner: str, repo: str | None = None, aliases: list[str] | None = Non
 
 
 def record_for(owner: str, repo: str | None = None) -> dict | None:
+    """The granted record covering OWNER (and REPO) that no withdrawal in the record file vetoes for REPO, else None.
+    The same per-repository veto as evaluate() applies (a withdrawal that names REPO after the grant still refuses the
+    stamp), so the file's withdrawals are read here, only when this run holds a grant."""
     logins = _expand([owner or ""])  # a grant cached under a former login still applies once the alias is registered
     granted = _granted()
+    withdrawals = [r for r in load_records() if r.get("approved") is False] if granted else []
     for login in dict.fromkeys([(owner or "").lower(), *logins]):
         for rec in granted.get(login, ()):
-            if _covers(rec, repo, logins):
+            if _covers(rec, repo, logins) and not _withdrawn(rec, withdrawals, logins, repo):
                 return rec
     return None
 
@@ -443,9 +478,11 @@ def record_for(owner: str, repo: str | None = None) -> dict | None:
 def stamp(items, owner: str | None = None):
     """Carry the granting sign-off onto this run's output:
 
-    - writer jobs (dicts with `phase`) for a signed-off T3 owner get `signoff_id`, and `approval_id` when none is set;
-    - change records (records.record(): dicts with `std`, `owner` and `repo`, no `phase`) get `signoff_id` only, since
-      they are not writer jobs and carry no approval_id.
+    - writer jobs (dicts with `phase`) for a signed-off T3 owner get `signoff_id`;
+    - change records (records.record(): dicts with `std`, `owner` and `repo`, no `phase`) get `signoff_id` too.
+
+    Jobs carry `signoff_id` (and `signoff_ids` via stamp_associations). `approval_id` is left untouched on every item,
+    because it names the decisions/APPROVED_ACTIONS.yaml row, not a sign-off.
 
     `owner` names the gated owner explicitly when a job's target is another account (the star-List jobs of a T3 org's
     `org pins` run as the personal account, org.star_list_plan); without it the owner is read from the item. An item
@@ -465,10 +502,9 @@ def stamp(items, owner: str | None = None):
 
 
 def _put(j: dict, rec: dict | None) -> None:
+    """Set `signoff_id` (only) on J from REC. approval_id is never set here (it names an APPROVED_ACTIONS.yaml row)."""
     if rec is not None and rec.get("id"):
         j["signoff_id"] = str(rec["id"])
-        if "phase" in j:
-            j.setdefault("approval_id", str(rec["id"]))
 
 
 def stamp_associations(item: dict, association_ids, owner: str | None = None, repo: str | None = None) -> dict:
@@ -476,8 +512,8 @@ def stamp_associations(item: dict, association_ids, owner: str | None = None, re
     grant first (when OWNER/REPO is a signed-off T3 target), then each id in ASSOCIATION_IDS (a T3 org that ITEM
     brings in without targeting it: topics.merge `signoff_ids` for an `also_in` membership topic, project.estate_plan
     for a T3 org in the personal Estate's Org field). `signoff_id` is the first id and `signoff_ids` lists all of them
-    only when there is more than one. A writer job also gets `approval_id` = the first id unless it already has one
-    (an existing approval_id is never replaced). No-op when there are no association ids.
+    only when there is more than one. Jobs carry only these sign-off ids: approval_id is never read or set here, since
+    it names the decisions/APPROVED_ACTIONS.yaml row. No-op when there are no association ids.
     Shared by showcase.cmd_topics, intake.adopt and project.estate_plan
     (tests/test_t3_signoff_require.py::test_adopt_topics_job_carries_the_also_in_signoff,
     ::test_estate_plan_jobs_carry_the_t3_orgs_signoff)."""
@@ -488,8 +524,6 @@ def stamp_associations(item: dict, association_ids, owner: str | None = None, re
     item["signoff_id"] = ids[0]
     if len(ids) > 1:
         item["signoff_ids"] = ids
-    if "phase" in item:
-        item.setdefault("approval_id", ids[0])
     return item
 
 

From 848f9684abdec8b4d0df5090be5d0b1187991bc1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:29:11 -0400
Subject: [PATCH 36/79] Per-repository withdrawal tests, signoff_id-only docs
 and tests, drop --require-t3-signoff (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                         |   3 +-
 SKILL.md                             |   4 +-
 references/t3-signoff.md             |  12 +--
 scripts/ctshowcase/org.py            |   2 +-
 tests/fixtures/t3-signoff/valid.yaml |   2 +-
 tests/test_allow_t3_docs.py          |  32 +++---
 tests/test_t3_signoff_default.py     |  20 ++--
 tests/test_t3_signoff_require.py     |  92 ++++++++---------
 tests/test_t3_signoff_withdrawal.py  | 143 +++++++++++++++++++++++++++
 9 files changed, 227 insertions(+), 83 deletions(-)
 create mode 100644 tests/test_t3_signoff_withdrawal.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4801feb..8a8006e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,8 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off, and `--require-t3-signoff` is accepted and ignored: enforcement is always on. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant, for the same owner and covering the grant's scope, withdraws it (`t3-signoff:revoked`); a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal covers its grant when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` (and `approval_id` when none is set), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
+- Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
diff --git a/SKILL.md b/SKILL.md
index 115f8bb..4ad7cc2 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default (`--require-t3-signoff` is accepted and ignored: enforcement is always on): `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later `approved: false` record withdraws a grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` (and `approval_id` when none is set), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
@@ -165,7 +165,7 @@ python3 $S --meta meta.json content links --base-ref origin/main --diff     # in
 ## Command Reference
 
 ```text
-python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version] <command> [options]
+python3 <skill-dir>/scripts/showcase.py [--config PATH] [--repo-dir DIR | --no-repo-dir] [--meta FILE] [--type TYPE] [--format json|text] [--quiet] [--allow-t3] [--t3-signoff-file PATH] [--version] <command> [options]
 
 meta --from-gh OWNER/REPO [--out FILE] [--allow-t3]
 fingerprint [--out-dir docs/images] [--github-output]
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 7402e92..f96c887 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -1,6 +1,6 @@
 # T3 sign-off records (`--allow-t3` needs one)
 
-`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. `--require-t3-signoff` is accepted and ignored: enforcement is always on, and the flag changes nothing. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
+`--allow-t3` is enforced by default: the tool verifies the operator's claim that a co-owner signed off against a record file. There is no opt-out: no flag or environment variable turns the check off. A T3 run therefore needs a valid, unexpired record that covers the owner and, when the record is scoped, the repository.
 
 ## Where the file lives
 
@@ -12,7 +12,7 @@ The contract is [t3-signoff.schema.json](t3-signoff.schema.json). YAML dates are
 
 ```yaml
 signoffs:
-  - id: t3s-001                # carried onto writer jobs (signoff_id, and approval_id when none is set) and change records (signoff_id)
+  - id: t3s-001                # carried onto writer jobs and change records as signoff_id (approval_id is never set from it)
     owner: Example-Co-Owned    # any login of the org; renamed logins resolve through its aliases
     repos: ["*"]               # "*" (also needed for owner-wide actions), repository names, or OWNER/NAME
     approved: true             # a boolean; only true grants
@@ -43,17 +43,17 @@ Each refusal exits 2 with result `refused`.
 |---|---|
 | `t3-signoff:no-file` | no record file was found; the log names the resolved path |
 | `t3-signoff:missing` | no approved record for the owner (also an unreadable or non-YAML file, or a file whose envelope breaks the schema) |
-| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`, or `expires` is null or unparseable), or a malformed `repos` (not `"*"`, a name or a non-empty list of names) is on the owner's record, which is always reported as invalid and never as `scope`, even beside a valid grant for an unrelated repository; the error names the record id and the first problem. Two records with one id are also invalid |
+| `t3-signoff:invalid` | the owner has no usable approved record and a malformed one is the cause (it breaks the schema, has `approved_on` in the future or `expires` before `approved_on`, or `expires` is null or unparseable), or a malformed `repos` (not `"*"`, a name or a non-empty list of names) is on the owner's record, which is always reported as invalid and never as `scope`, even beside a valid grant for an unrelated repository; the error names the record id and the first problem. Two records with one id are also invalid. A malformed `approved: false` record (an extra key, an `approved_on` with a time part, a non-string `note`, a malformed `repos`) that could cover the request is also `t3-signoff:invalid` and never leaves a grant standing; one clearly for a different named repository does not block |
 | `t3-signoff:scope` | the owner has valid approved records but none covers the repository; an `OWNER/NAME` repository is covered only when that owner is the record's org (only `*` covers another account's repository) |
 | `t3-signoff:expired` | every covering record is past `expires` |
-| `t3-signoff:revoked` | every otherwise-grantable record was withdrawn by a later or same-day `approved: false` record (see Withdrawal) |
+| `t3-signoff:revoked` | every otherwise-grantable record was withdrawn, for the requested repository, by a later or same-day `approved: false` record (see Withdrawal) |
 
 ## Withdrawal
 
-The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on`, whose `repos` cover the grant's scope (`*`, or every repository the grant names), withdraws that grant. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. The refusal is `t3-signoff:revoked`. A false record dated before the grant, or scoped to fewer repositories than the grant covers, does not revoke it. A new `approved: true` record dated after the withdrawal grants again. Grants on distinct scopes are independent, so each keeps its own record id.
+The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing.
 
 `project estate-plan --allow-t3` omits every T3 org that has no valid record and records `t3-signoff:<code>:<login>` (code `missing`, `expired`, `scope`, `revoked` or `invalid`) in the plan's `logs` for each one, so the operator sees why the org is absent.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
-The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). A job's existing `approval_id` is kept.
+The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it.
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 9fac188..383c07c 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -1673,7 +1673,7 @@ def _star_list_plan(estate: Estate, org: str, *, lists_capture: dict | None = No
         added = sorted(i for i in targets.get(f.lower(), set()) - have - {list_id} if i in list_signoffs)
         # Every grant the job needs is kept: the T3 favorite's own record (stamped above), the List org's record when
         # that org is T3 (the destination of this item job), and the record of each newly added T3 destination List.
-        # One grant never suppresses another; an existing approval_id is kept (signoff.stamp_associations).
+        # One grant never suppresses another; the ids are kept in signoff_id/signoff_ids (signoff.stamp_associations), and approval_id is left as the job had it.
         sids = [item["signoff_id"]] if "signoff_id" in item else []
         if r.owner_status(login) == "t3":
             own = signoff.record(login, None, r.aliases(login))
diff --git a/tests/fixtures/t3-signoff/valid.yaml b/tests/fixtures/t3-signoff/valid.yaml
index da14c23..20c6ac7 100644
--- a/tests/fixtures/t3-signoff/valid.yaml
+++ b/tests/fixtures/t3-signoff/valid.yaml
@@ -10,7 +10,7 @@ signoffs:
     note: "synthetic fixture"
   - id: t3s-fixture-one
     owner: Pick-Your-AI
-    repos: northwind-synthetic
+    repos: northwind-withdrawn
     approved: false
     approver: synthetic-co-owner
     approved_on: 2026-01-15
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index 9940539..6219ecf 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -65,9 +65,9 @@ def test_help_text_matches_docs():
     )
     assert result.returncode == 0, result.stderr
     assert "--allow-t3" in result.stdout
-    # issue 23 adds --require-t3-signoff (default) and right after --allow-t3 (there is no opt-out flag); the synopsis must keep up with --help
-    fragment = "[--quiet] [--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
-    usage_fragment = "[--allow-t3] [--require-t3-signoff] [--t3-signoff-file PATH] [--version]"
+    # issue 23 adds --t3-signoff-file right after --allow-t3 (enforcement is unconditional: no toggle flag); the synopsis must keep up with --help
+    fragment = "[--quiet] [--allow-t3] [--t3-signoff-file PATH] [--version]"
+    usage_fragment = "[--allow-t3] [--t3-signoff-file PATH] [--version]"
     help_usage = " ".join(result.stdout.split())
     skill = _read("SKILL.md")
     ref = skill[skill.index("## Command Reference"):]
@@ -76,12 +76,11 @@ def test_help_text_matches_docs():
     assert fragment in " ".join(synopsis.split()), synopsis
 
 
-def test_skill_documents_require_t3_signoff_beside_allow_t3():
-    """Epic 22 integration: the sign-off paragraph (issue 31) names the opt-in record check (issue 23) and its codes."""
+def test_skill_names_the_signoff_refusal_codes_beside_allow_t3():
+    """Epic 22 integration: the sign-off paragraph (issue 31) names the record check (issue 23) and its codes."""
     skill = _read("SKILL.md")
     para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
-    assert "--require-t3-signoff" in para, para
-    for code in ("t3-signoff:missing", "t3-signoff:expired", "t3-signoff:scope"):
+    for code in ("t3-signoff:missing", "t3-signoff:expired", "t3-signoff:scope", "t3-signoff:revoked", "t3-signoff:invalid"):
         assert code in para, code
 
 
@@ -109,11 +108,14 @@ def test_skill_documents_default_on_enforcement_path_and_no_opt_out():
     assert "DEFAULT OFF" not in ref and "decisions/t3-signoffs.yaml" in ref
 
 
-def test_require_t3_signoff_is_documented_as_accepted_and_ignored():
-    """The flag is a no-op, never a released compatibility surface: no doc says it is kept for compatibility."""
-    for name in ("SKILL.md", "CHANGELOG.md", "references/t3-signoff.md"):
-        text = _read(name)
-        for line in text.splitlines():
-            if "--require-t3-signoff" in line:
-                assert "kept for compatibility" not in line, (name, line[:200])
-        assert "accepted and ignored" in text, name
+def test_require_t3_signoff_flag_does_not_exist():
+    """The flag never shipped and enforcement is unconditional: it is not a live option in --help, SKILL.md,
+    references/t3-signoff.md or CHANGELOG.md, and argparse rejects it (exit 2)."""
+    helptext = subprocess.run([sys.executable, str(ROOT / "scripts" / "showcase.py"), "--help"],
+                              capture_output=True, encoding="utf-8").stdout
+    assert "require-t3-signoff" not in helptext
+    for name in ("SKILL.md", "references/t3-signoff.md", "CHANGELOG.md"):
+        assert "--require-t3-signoff" not in _read(name), name
+    r = subprocess.run([sys.executable, str(ROOT / "scripts" / "showcase.py"), "--require-t3-signoff", "--allow-t3", "describe"],
+                       capture_output=True, encoding="utf-8")
+    assert r.returncode == 2 and "unrecognized arguments: --require-t3-signoff" in r.stderr, r.stderr
diff --git a/tests/test_t3_signoff_default.py b/tests/test_t3_signoff_default.py
index 7af2615..f072089 100644
--- a/tests/test_t3_signoff_default.py
+++ b/tests/test_t3_signoff_default.py
@@ -107,8 +107,8 @@ def test_there_is_no_opt_out(tmp_path):
     for value in ("0", "false", "no", "off"):
         r = _run(tmp_path, root, "--allow-t3", "describe", env={"SHOWCASE_REQUIRE_T3_SIGNOFF": value})
         assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), (value, _out(r))
-    r = _run(tmp_path, root, "--require-t3-signoff", "--allow-t3", "describe")  # the compatible no-op flag
-    assert r.returncode == 2 and "t3-signoff:no-file" in _out(r), _out(r)
+    r = _run(tmp_path, root, "--require-t3-signoff", "--allow-t3", "describe")  # the flag no longer exists
+    assert r.returncode == 2 and "unrecognized arguments: --require-t3-signoff" in _out(r), _out(r)
 
 
 def test_writer_jobs_carry_the_default_records_id(tmp_path):
@@ -169,23 +169,21 @@ def test_estate_plan_stamping_ignores_a_display_name_shared_with_another_org(tmp
     assert {j["id"]: j.get("signoff_id") for j in jobs} == {"t1": None, "t3": "t3s-acme"}
 
 
-def test_flag_is_an_accepted_no_op_and_the_no_file_default_still_refuses(tmp_path):
-    """Default-on enforcement is not a regression: with no record file `--allow-t3` refuses exactly as it does with
-    the compatibility flag, and the flag changes neither the exit code nor the output."""
+def test_no_file_default_refuses_with_or_without_the_removed_flag(tmp_path):
+    """Default-on enforcement: with no record file `--allow-t3` refuses (exit 2, t3-signoff:no-file); the removed
+    `--require-t3-signoff` is rejected by argparse instead of being accepted as a no-op."""
     root = _bundle(tmp_path, write=False)
     bare = _run(tmp_path, root, "--allow-t3", "describe")
+    assert bare.returncode == 2 and "t3-signoff:no-file" in _out(bare), _out(bare)
     flagged = _run(tmp_path, root, "--require-t3-signoff", "--allow-t3", "describe")
-    assert bare.returncode == flagged.returncode == 2
-    assert "t3-signoff:no-file" in _out(bare) and "t3-signoff:no-file" in _out(flagged), _out(bare)
-    assert (bare.stdout, bare.stderr) == (flagged.stdout, flagged.stderr)
+    assert flagged.returncode == 2 and "unrecognized arguments" in _out(flagged), _out(flagged)
     root = _bundle(tmp_path / "ok", id="t3s-flag")
     ok = _run(tmp_path / "ok", root, "--allow-t3", "describe")
-    ok_flag = _run(tmp_path / "ok", root, "--require-t3-signoff", "--allow-t3", "describe")
-    assert ok.returncode == ok_flag.returncode == 0 and ok.stdout == ok_flag.stdout
+    assert ok.returncode == 0
 
 
 def test_no_opt_out_option_exists_in_help_or_source():
     helptext = subprocess.run([*SHOWCASE, "--help"], capture_output=True, encoding="utf-8").stdout
-    assert "--require-t3-signoff" in helptext and "--no-require-t3-signoff" not in helptext
+    assert "require-t3-signoff" not in helptext
     src = "".join(p.read_text(encoding="utf-8") for p in (ROOT / "scripts").rglob("*.py"))
     assert "SHOWCASE_REQUIRE_T3_SIGNOFF" not in src and "no-require-t3-signoff" not in src
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 5767bdc..c850995 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1,8 +1,7 @@
 """`--allow-t3` sign-off enforcement (issue 23): `--allow-t3` needs a valid, unexpired sign-off record in the file named by
 `--t3-signoff-file` (env SHOWCASE_T3_SIGNOFF_FILE) or, by default, in the private estate bundle
 (`<estate root>/decisions/t3-signoffs.yaml`; tests/test_t3_signoff_default.py). The enforcement is default-on and
-there is no opt-out (tests/test_t3_signoff_default.py::test_there_is_no_opt_out); `--require-t3-signoff` is an accepted
-no-op flag.
+there is no opt-out (tests/test_t3_signoff_default.py::test_there_is_no_opt_out).
 
 Synthetic records only (owner Pick-Your-AI is the brand.yaml T3 owner; the ids and dates are made up). The existing
 tests/test_allow_t3_global.py pins the refusals without `--allow-t3`; it only gained the record-file environment that
@@ -63,32 +62,32 @@ def _out(r):
 
 
 def test_missing_record_refuses(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, _bundle(tmp_path, []), "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
 
 
 def test_unapproved_record_counts_as_missing(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-9", "approved": False}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:missing" in _out(r), _out(r)
 
 
 def test_expired_record_refuses(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-1", "expires": "2020-01-01"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:expired" in _out(r), _out(r)
 
 
 def test_record_scoped_to_other_repo_refuses(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-2", "repos": ["some-other-repo"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
 
 
 def test_valid_wildcard_and_repo_scoped_records_are_honoured(tmp_path):
     for repos in (["*"], ["northwind-synthetic"], [f"{OWNER}/northwind-synthetic"]):
         b = _bundle(tmp_path / "_".join(repos).replace("/", "_").replace("*", "star"), [{"id": "t3s-3", "repos": repos}])
-        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+        r = _run(tmp_path, b, "--allow-t3", "describe")
         assert r.returncode != 2 and "t3-signoff" not in _out(r), (repos, _out(r))
 
 
@@ -101,20 +100,20 @@ def test_unrelated_env_cannot_disable_enforcement(tmp_path, value):
 
 # Guard test: pins the unchanged refusal when --allow-t3 is absent, even with the (no-op) flag.
 def test_flag_without_allow_t3_still_refuses_as_before(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "--require-t3-signoff", "describe")
+    r = _run(tmp_path, _bundle(tmp_path, [{"id": "t3s-4"}]), "describe")
     assert r.returncode == 2 and "t3-signoff" in _out(r)
 
 
 def test_excluded_owner_is_refused_even_with_a_record(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-5", "owner": "BunsDev"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe", owner="BunsDev")
+    r = _run(tmp_path, b, "--allow-t3", "describe", owner="BunsDev")
     assert r.returncode == 2, _out(r)
     assert "t3-signoff" not in _out(r) or "exempt" in _out(r)
 
 
 def test_doctor_shows_the_signoff_id(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-7", "expires": "2099-01-02"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", "json")
+    r = _run(tmp_path, b, "--allow-t3", "doctor", "--format", "json")
     row = json.loads(r.stdout)
     assert row["signoff_id"] == "t3s-7" and row["signoff_expires"] == "2099-01-02", r.stdout
     plain = _run(tmp_path, b, "doctor", "--format", "json")
@@ -133,8 +132,8 @@ def test_writer_jobs_carry_the_signoff_id(tmp_path):
                       "approval_id": "ent-009"},
                      {"id": "c", "phase": "p", "kind": "repo-settings", "repo": "Other-Org/z", "argv": []}])
         a, b, c = (json.loads(x) for x in out.read_text(encoding="utf-8").splitlines())
-        assert a["signoff_id"] == "t3s-8" and a["approval_id"] == "t3s-8"
-        assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # an existing approval is kept
+        assert a["signoff_id"] == "t3s-8" and "approval_id" not in a  # approval_id names an APPROVED_ACTIONS row: never stamped
+        assert b["signoff_id"] == "t3s-8" and b["approval_id"] == "ent-009"  # a pre-existing approval_id is preserved
         assert "signoff_id" not in c
     finally:
         signoff.reset()
@@ -164,10 +163,10 @@ def test_evaluate_scope_rules(repo, expect):
 def test_repo_scoped_record_is_honoured_by_repository_commands(tmp_path, argv):
     """Regression: only gate_owner/doctor passed the repo, so a repo-scoped record hit t3-signoff:scope elsewhere."""
     b = _bundle(tmp_path, [{"id": "t3s-9", "repos": ["northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", *argv)
+    r = _run(tmp_path, b, "--allow-t3", *argv)
     assert "t3-signoff" not in _out(r), _out(r)
     other = _bundle(tmp_path / "o", [{"id": "t3s-9", "repos": ["some-other-repo"]}])
-    r = _run(tmp_path, other, "--require-t3-signoff", "--allow-t3", *argv)
+    r = _run(tmp_path, other, "--allow-t3", *argv)
     assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
 
 
@@ -224,7 +223,7 @@ def test_project_gate_registers_the_grant_and_reports_the_reason(tmp_path, monke
 def test_default_doctor_renderers_show_the_signoff_id(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-13"}])
     for fmt in ("tsv", "md"):
-        r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "doctor", "--format", fmt)
+        r = _run(tmp_path, b, "--allow-t3", "doctor", "--format", fmt)
         assert "t3s-13" in r.stdout, _out(r)
         plain = _run(tmp_path, b, "doctor", "--format", fmt)
         assert "t3s-13" not in plain.stdout and "signoff_id" not in plain.stdout  # no --allow-t3: output unchanged
@@ -240,27 +239,27 @@ def _raw_bundle(tmp_path, body):
 
 
 def test_doctor_without_allow_t3_still_reports_hold_under_the_flag(tmp_path):
-    r = _run(tmp_path, _bundle(tmp_path, []), "--require-t3-signoff", "doctor", "--format", "json")
+    r = _run(tmp_path, _bundle(tmp_path, []), "doctor", "--format", "json")
     assert r.returncode in (0, 1) and "t3-signoff:missing" not in _out(r), _out(r)
     assert "hold" in _out(r)
 
 
 def test_qualified_scope_for_another_owner_refuses(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-4", "repos": ["Other-Org/northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:scope" in _out(r), _out(r)
 
 
 def test_garbage_expiry_never_validates(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-5", "expires": "2099-12-31garbage"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "expires" in _out(r), _out(r)
 
 
 def test_malformed_repos_refuses_instead_of_raising(tmp_path):
     b = _raw_bundle(tmp_path, f"  - id: t3s-6\n    owner: {OWNER}\n    repos: 7\n    approved: true\n"
                               "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, b, "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "repos" in _out(r), _out(r)
     assert "t3-signoff:scope" not in _out(r) and "Traceback" not in _out(r), _out(r)
 
@@ -276,7 +275,7 @@ def test_malformed_or_empty_repos_is_invalid_with_a_needs_star_message(tmp_path,
 
 def test_adopt_and_content_links_honour_repo_scoped_record(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-7", "repos": ["northwind-synthetic"]}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
     assert "t3-signoff" not in _out(r), _out(r)
 
 
@@ -292,7 +291,7 @@ def test_report_jobs_carry_signoff_id(tmp_path):
         _finish(argparse.Namespace(jobs=None, report=str(rp)),
                 {"job": {"phase": 3, "org": OWNER, "repo": f"{OWNER}/northwind-synthetic"}}, 0)
         saved = json.loads(rp.read_text(encoding="utf-8"))["job"]
-        assert saved["signoff_id"] == "t3s-8" and saved["approval_id"] == "t3s-8"
+        assert saved["signoff_id"] == "t3s-8" and "approval_id" not in saved
     finally:
         signoff.reset()
 
@@ -323,7 +322,7 @@ def test_malformed_signoff_file_refuses_instead_of_raising(tmp_path, body):
     d = tmp_path / "bundle" / "decisions"
     d.mkdir(parents=True)
     (d / "t3-signoffs.yaml").write_text(body, encoding="utf-8")
-    r = _run(tmp_path, tmp_path / "bundle", "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, tmp_path / "bundle", "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:missing" in _out(r) and "Traceback" not in _out(r), _out(r)
 
 
@@ -331,7 +330,7 @@ def test_malformed_signoff_file_refuses_instead_of_raising(tmp_path, body):
 def test_keyed_sidebar_batch_does_not_swallow_signoff_refusals(tmp_path, records, why):
     facts = tmp_path / "facts.json"
     facts.write_text(json.dumps({f"{OWNER}/northwind-synthetic": {}}), encoding="utf-8")
-    r = _run(tmp_path, _bundle(tmp_path, records), "--require-t3-signoff", "--allow-t3",
+    r = _run(tmp_path, _bundle(tmp_path, records), "--allow-t3",
              "content", "sidebar", "--facts", str(facts))
     assert r.returncode == 2 and f"t3-signoff:{why}" in _out(r), _out(r)
 
@@ -414,7 +413,7 @@ def test_record_file_may_have_any_name_and_come_from_env(tmp_path):
     chosen = tmp_path / "elsewhere" / "my-approved-actions.yaml"
     chosen.parent.mkdir()
     chosen.write_text(src.read_text(encoding="utf-8"), encoding="utf-8")
-    r = _run(tmp_path, None, "--require-t3-signoff", "--allow-t3", "describe",
+    r = _run(tmp_path, None, "--allow-t3", "describe",
              env={"SHOWCASE_ESTATE_ROOT": str(tmp_path / "nowhere"), "SHOWCASE_T3_SIGNOFF_FILE": str(chosen)})
     assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
 
@@ -451,14 +450,14 @@ def test_audit_fields_are_required(tmp_path, drop):
     body = (f"  - id: t3s-a\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n"
             "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
     body = "\n".join(line for line in body.split("\n") if not line.strip().startswith(drop + ":"))
-    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and drop in _out(r), _out(r)
 
 
 def test_approved_as_a_string_is_reported_invalid_not_missing(tmp_path):
     body = (f"  - id: t3s-s\n    owner: {OWNER}\n    repos: ['*']\n    approved: 'true'\n"
             "    approver: x\n    approved_on: 2026-01-01\n    expires: 2099-12-31\n")
-    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "t3s-s" in _out(r), _out(r)
 
 
@@ -496,7 +495,7 @@ def test_topics_change_records_carry_the_signoff_id(tmp_path):
     """#26: change records (records.record(), no `phase`) carry signoff_id, and no approval_id (not a writer job)."""
     b = _bundle(tmp_path, [{"id": "t3s-cr"}])
     out = tmp_path / "rec.jsonl"
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "topics", "--records", str(out))
+    r = _run(tmp_path, b, "--allow-t3", "topics", "--records", str(out))
     assert "t3-signoff" not in _out(r) and out.is_file(), _out(r)
     recs = [json.loads(x) for x in out.read_text(encoding="utf-8").splitlines()]
     assert recs and all(x["signoff_id"] == "t3s-cr" and "approval_id" not in x for x in recs), recs
@@ -504,7 +503,7 @@ def test_topics_change_records_carry_the_signoff_id(tmp_path):
 
 def test_adopt_json_output_stamps_change_records_and_jobs(tmp_path):
     b = _bundle(tmp_path, [{"id": "t3s-ad"}])
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
+    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{OWNER}/northwind-synthetic")
     obj = json.loads(r.stdout)
     assert obj.get("records") and all(x.get("signoff_id") == "t3s-ad" for x in obj["records"]), obj.get("records")
     assert all(x.get("signoff_id") == "t3s-ad" for x in obj.get("jobs") or []), obj.get("jobs")
@@ -551,7 +550,7 @@ def test_star_list_jobs_for_a_t3_org_carry_its_signoff(tmp_path, monkeypatch, br
         signoff.require(OWNER)
         res = O.star_list_plan(est, OWNER, lists_capture=lists, allow_t3=True)
         assert res["jobs"] and all(j["org"] == O.USER_LOGIN for j in res["jobs"]), res
-        assert all(j["signoff_id"] == "t3s-sl" and j["approval_id"] == "t3s-sl" for j in res["jobs"]), res["jobs"]
+        assert all(j["signoff_id"] == "t3s-sl" and "approval_id" not in j for j in res["jobs"]), res["jobs"]
     finally:
         signoff.restore(run)
         reset_t3_signed_off(t3)
@@ -579,7 +578,7 @@ def _schema_accepts(value, *defs):
 @pytest.mark.parametrize("value", _WHEN)
 def test_problems_follow_the_schema_string_patterns(value):
     """Python 3.11+ fromisoformat accepts compact, week-date and `+00` forms the schema rejects; problems() used to
-    accept them, so --require-t3-signoff granted a record the published schema refuses. Both now agree."""
+    accept them, so --allow-t3 granted a record the published schema refuses. Both now agree."""
     from ctshowcase import signoff
     base = {"id": "t3s-p", "owner": OWNER, "repos": "*", "approved": True, "approver": "x",
             "approved_on": "2026-01-15", "expires": "2099-12-31"}
@@ -605,7 +604,7 @@ def test_compact_and_week_dates_refuse_invalid(tmp_path, field, value):
     vals = {"approved_on": "2026-01-15", "expires": "2099-12-31", field: value}
     body = (f"  - id: t3s-cmp\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n    approver: x\n"
             f"    approved_on: '{vals['approved_on']}'\n    expires: '{vals['expires']}'\n")
-    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and field in _out(r), _out(r)
 
 
@@ -613,7 +612,7 @@ def test_mixed_type_unknown_keys_refuse_invalid(tmp_path):
     """`unexpected: true` beside `7: unexpected`: sorting str and int keys raised TypeError out of showcase.main()."""
     body = (f"  - id: t3s-mix\n    owner: {OWNER}\n    repos: ['*']\n    approved: true\n    approver: x\n"
             "    approved_on: 2026-01-15\n    expires: 2099-12-31\n    unexpected: true\n    7: unexpected\n")
-    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, _raw_bundle(tmp_path, body), "--allow-t3", "describe")
     assert r.returncode == 2 and "t3-signoff:invalid" in _out(r) and "unknown field" in _out(r), _out(r)
     assert "Traceback" not in _out(r), _out(r)
 
@@ -638,7 +637,7 @@ def test_t1_star_list_item_for_a_t3_favorite_carries_the_favorites_signoff(tmp_p
         res = O.star_list_plan(est, t1, lists_capture=lists, allow_t3=True, repo_ids={fav: "R_synthetic"})
         items = [j for j in res["jobs"] if "list-item" in j["id"]]
         assert len(items) == 1 and items[0]["org"] == O.USER_LOGIN, res
-        assert items[0]["signoff_id"] == "t3s-fav" and items[0]["approval_id"] == "t3s-fav", items
+        assert items[0]["signoff_id"] == "t3s-fav" and "approval_id" not in items[0], items
     finally:
         signoff.restore(run)
         reset_t3_signed_off(t3)
@@ -667,7 +666,7 @@ def _transfer_estate(brand, favorites=()):
 
 
 class _Strict:
-    """`--allow-t3` (unless allow_t3=False) plus `--require-t3-signoff` in this context, reading the given file."""
+    """`--allow-t3` (unless allow_t3=False) in this context, reading the given file."""
 
     def __init__(self, monkeypatch, path, allow_t3=True):
         self.monkeypatch, self.path, self.allow_t3 = monkeypatch, path, allow_t3
@@ -703,7 +702,7 @@ def test_org_labels_gate_the_t3_owner_a_transfer_resolves_to(tmp_path, monkeypat
         jobs = [j for j in res["jobs"] if f"{OWNER}/northwind-member" in j.get("argv", [])]
         assert jobs, res
         signoff.stamp(jobs)  # showcase.main stamps every emitted job list the same way
-        assert all(j["signoff_id"] == "t3s-lbl" for j in jobs), jobs
+        assert all(j["signoff_id"] == "t3s-lbl" and "approval_id" not in j for j in jobs), jobs  # label jobs: no approval_id
     # no --allow-t3: the base behaviour is kept (the transfer-target hold is opt-in via the T3 flag, not via the
     # default-on enforcement), so T1/T2 org output does not change
     with _Strict(monkeypatch, _file(_bundle(tmp_path / "noflag", [{"id": "t3s-x"}])), allow_t3=False):
@@ -743,7 +742,7 @@ def test_t3_also_in_association_carries_its_signoff_id(tmp_path):
     assert topic
     b = _bundle(tmp_path, [{"id": "t3s-assoc"}])
     out = tmp_path / "rec.jsonl"
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "topics", "--also-in", OWNER, "--records", str(out),
+    r = _run(tmp_path, b, "--allow-t3", "topics", "--also-in", OWNER, "--records", str(out),
              owner=T1)
     obj = json.loads(r.stdout)
     assert topic in obj["proposed"] and obj.get("signoff_ids") == ["t3s-assoc"], _out(r)
@@ -771,7 +770,7 @@ def test_file_envelope_follows_the_schema(tmp_path, doc, ok):
     d = tmp_path / "bundle" / "decisions"
     d.mkdir(parents=True)
     (d / "t3-signoffs.yaml").write_text(json.dumps(doc), encoding="utf-8")  # JSON is YAML
-    r = _run(tmp_path, tmp_path / "bundle", "--require-t3-signoff", "--allow-t3", "describe")
+    r = _run(tmp_path, tmp_path / "bundle", "--allow-t3", "describe")
     if ok:
         assert r.returncode != 2 and "t3-signoff" not in _out(r), _out(r)
     else:
@@ -808,7 +807,7 @@ def test_transfer_to_a_t3_org_is_unchanged_without_the_flag(monkeypatch, brand):
 
 
 def test_home_repository_held_by_a_t3_org_is_omitted_without_its_record(tmp_path, monkeypatch, brand):
-    """`org profile CompleteTech-Skills` under --require-t3-signoff: northwind-member is homed in the T1 org but the
+    """`org profile CompleteTech-Skills` under --allow-t3: northwind-member is homed in the T1 org but the
     T3 org holds it today. public_slice built its home list through estate.is_public only, so with no record the
     profile README and data still named Pick-Your-AI/northwind-member (featured and sections)."""
     from ctshowcase import org as O
@@ -836,16 +835,16 @@ def test_adopt_topics_job_carries_the_also_in_signoff(tmp_path):
     topic = org_topic(load_brand(), OWNER)[1]
     b = _bundle(tmp_path, [{"id": "t3s-adopt"}])
     extra = {"also_in": [OWNER]}
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1,
+    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{T1}/northwind-synthetic", owner=T1,
              meta_extra=extra)
     obj = json.loads(r.stdout)
     jobs = [j for j in obj["jobs"] if j["kind"] == "topics"]
     recs = [x for x in obj["records"] if x.get("kind") == "topics"]
     assert len(jobs) == 1 and any(topic in a for a in jobs[0]["argv"]), obj["jobs"]
-    assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "t3s-adopt", jobs
+    assert jobs[0]["signoff_id"] == "t3s-adopt" and "approval_id" not in jobs[0], jobs
     assert recs and all(x["signoff_id"] == "t3s-adopt" and "approval_id" not in x for x in recs), obj["records"]
     # an existing approval_id on the job is kept
-    r = _run(tmp_path, b, "--require-t3-signoff", "--allow-t3", "adopt", f"{T1}/northwind-synthetic",
+    r = _run(tmp_path, b, "--allow-t3", "adopt", f"{T1}/northwind-synthetic",
              "--approval-id", "q-synthetic", owner=T1, meta_extra=extra)
     jobs = [j for j in json.loads(r.stdout)["jobs"] if j["kind"] == "topics"]
     assert jobs[0]["signoff_id"] == "t3s-adopt" and jobs[0]["approval_id"] == "q-synthetic", jobs
@@ -986,7 +985,7 @@ def test_t3_favorite_and_t3_list_org_keep_both_grants(tmp_path, monkeypatch, bra
         items = [j for j in plan["jobs"] if "list-item" in j["id"]]
         assert len(items) == 1, plan["jobs"]
         assert items[0]["signoff_id"] == "t3s-fav" and items[0]["signoff_ids"] == ["t3s-fav", "t3s-dest"], items
-        assert items[0]["approval_id"] == "t3s-fav", items  # the first id; an existing approval_id is never replaced
+        assert "approval_id" not in items[0], items  # sign-off ids never populate approval_id
 
 
 # --- review round 6: dates that make a record unusable, malformed-vs-scope, no opt-out ---
@@ -1119,12 +1118,13 @@ def test_false_record_dated_before_the_grant_does_not_revoke():
     assert why is None and got["id"] == "a"
 
 
-def test_false_record_scoped_to_one_repo_does_not_revoke_a_star_grant():
+def test_false_record_scoped_to_one_repo_revokes_only_that_repo_of_a_star_grant():
+    """Per-repository veto (review finding): the withdrawal of X refuses X and leaves the rest of the `*` grant."""
     from ctshowcase import signoff
     narrow = _rec(id="b", approved=False, approved_on="2026-10-01", repos=["X"])
-    for repo in ("foo", "X"):
-        got, why = signoff.evaluate([OWNER], repo, records=[A_TRUE, narrow])
-        assert why is None and got["id"] == "a", repo
+    got, why = signoff.evaluate([OWNER], "foo", records=[A_TRUE, narrow])
+    assert why is None and got["id"] == "a"
+    assert signoff.evaluate([OWNER], "X", records=[A_TRUE, narrow]) == (None, "revoked")
 
 
 def test_false_record_for_another_owner_does_not_revoke():
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
new file mode 100644
index 0000000..e2880b9
--- /dev/null
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -0,0 +1,143 @@
+"""Per-repository T3 sign-off withdrawals (issue 23): an `approved: false` record vetoes the grant for every repository
+it covers (`*` covers all), dated on or after the grant, so a co-owner can withdraw one repository from a `*` or
+multi-repo grant. A malformed withdrawal that could cover the request fails closed (`t3-signoff:invalid`).
+Synthetic records only."""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+OWN = "Acme"
+
+
+def _rec(id_, repos, approved=True, on="2026-01-01", owner=OWN, **extra):
+    r = {"id": id_, "owner": owner, "repos": repos, "approved": approved, "approver": "synthetic-co-owner",
+         "approved_on": on}
+    if approved:
+        r["expires"] = "2099-12-31"
+    r.update(extra)
+    return r
+
+
+def _ev(records, repo, owners=(OWN,)):
+    from ctshowcase import signoff
+    rec, err = signoff.evaluate(list(owners), repo, records=records)
+    return (rec["id"] if rec else None), err
+
+
+def test_withdrawal_of_one_repo_from_a_multi_repo_grant():
+    recs = [_rec("g1", ["a", "b"]), _rec("w1", ["a"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "a") == (None, "revoked")
+    assert _ev(recs, "b") == ("g1", None)
+
+
+def test_withdrawal_of_one_repo_from_a_star_grant():
+    recs = [_rec("g1", ["*"]), _rec("w1", ["a"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "a") == (None, "revoked")
+    assert _ev(recs, "site") == ("g1", None)
+
+
+def test_star_withdrawal_vetoes_every_repository():
+    recs = [_rec("g1", ["a", "b"]), _rec("w1", ["*"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "a") == (None, "revoked") and _ev(recs, "b") == (None, "revoked")
+
+
+def test_same_day_withdrawal_vetoes_and_earlier_does_not():
+    same = [_rec("g1", ["*"], on="2026-06-01"), _rec("w1", ["a"], approved=False, on="2026-06-01")]
+    assert _ev(same, "a") == (None, "revoked")
+    earlier = [_rec("g1", ["*"], on="2026-06-01"), _rec("w1", ["a"], approved=False, on="2026-05-31")]
+    assert _ev(earlier, "a") == ("g1", None)
+
+
+def test_owner_name_and_bare_name_forms_and_aliases_revoke_each_other():
+    bare_grant = [_rec("g1", ["a"]), _rec("w1", [f"{OWN}/a"], approved=False, on="2026-06-01")]
+    assert _ev(bare_grant, "a") == (None, "revoked")
+    full_grant = [_rec("g1", [f"{OWN}/a", "b"]), _rec("w1", ["a"], approved=False, on="2026-06-01")]
+    assert _ev(full_grant, "a") == (None, "revoked") and _ev(full_grant, "b") == ("g1", None)
+    # another account's OWNER/NAME stays distinct
+    other = [_rec("g1", ["a"]), _rec("w1", ["Other/a"], approved=False, on="2026-06-01")]
+    assert _ev(other, "a") == ("g1", None)
+
+
+def test_regrant_after_withdrawal_is_not_vetoed():
+    recs = [_rec("g1", ["*"]), _rec("w1", ["a"], approved=False, on="2026-06-01"),
+            _rec("g2", ["a"], on="2026-07-01")]
+    assert _ev(recs, "a") == ("g2", None)
+    assert _ev(recs, "site") == ("g1", None)
+
+
+@pytest.mark.parametrize("extra,problem", [
+    ({"reason": "co-owner withdrew"}, "reason"),
+    ({"approved_on": "2026-10-01T12:00:00Z"}, "approved_on"),
+    ({"note": 7}, "note"),
+    ({"repos": [1]}, "repos"),
+    ({"repos": []}, "repos"),
+])
+def test_malformed_withdrawal_fails_closed(extra, problem):
+    w = dict(_rec("w1", ["*"], approved=False, on="2026-10-01"), **extra)
+    recs = [_rec("g1", ["*"]), w]
+    got, err = _ev(recs, "site")
+    assert got is None and err and err.startswith("invalid:w1:"), (got, err)
+
+
+def test_malformed_withdrawal_for_an_unrelated_repo_does_not_block_another_repo():
+    recs = [_rec("g1", ["*"]), _rec("w1", ["a"], approved=False, on="2026-10-01", reason="x")]
+    assert _ev(recs, "b") == ("g1", None)
+    got, err = _ev(recs, "a")
+    assert got is None and err.startswith("invalid:w1:")
+
+
+def test_malformed_record_for_another_owner_has_no_effect():
+    recs = [_rec("g1", ["*"]), _rec("w9", ["*"], approved=False, on="2026-10-01", owner="Other", reason="x")]
+    assert _ev(recs, "site") == ("g1", None)
+
+
+def test_record_for_honours_the_per_repository_veto(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    p = tmp_path / "s.yaml"
+    p.write_text(json.dumps({"signoffs": [_rec("g1", ["*"]), _rec("w1", ["a"], approved=False, on="2026-06-01")]}),
+                 encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(p))
+    run = signoff.reset()
+    try:
+        signoff._grant(OWN.lower(), _rec("g1", ["*"]))
+        assert signoff.record_for(OWN, "a") is None
+        assert signoff.record_for(OWN, "site")["id"] == "g1"
+    finally:
+        signoff.restore(run)
+
+
+def _cli(tmp_path, records, *argv, repo="northwind-synthetic"):
+    f = tmp_path / "t3-signoffs.yaml"
+    f.write_text(json.dumps({"signoffs": records}), encoding="utf-8")
+    meta = tmp_path / "meta.json"
+    meta.write_text(json.dumps(dict(META, owner="Pick-Your-AI", repo=repo)), encoding="utf-8")
+    env = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(tmp_path))
+    env.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
+    return subprocess.run([*SHOWCASE, "--meta", str(meta), "--no-repo-dir", "--t3-signoff-file", str(f), "--allow-t3",
+                           *argv], cwd=ROOT, env=env, capture_output=True, text=True, encoding="utf-8")
+
+
+def test_cli_refuses_a_withdrawn_repository_and_a_malformed_withdrawal(tmp_path):
+    own = "Pick-Your-AI"
+    withdrawn = [_rec("g1", ["*"], owner=own), _rec("w1", ["northwind-synthetic"], approved=False, on="2026-06-01", owner=own)]
+    (tmp_path / "a").mkdir()
+    r = _cli(tmp_path / "a", withdrawn, "describe")
+    assert r.returncode == 2 and "t3-signoff:revoked" in r.stdout + r.stderr, r.stdout + r.stderr
+    bad = [_rec("g1", ["*"], owner=own), _rec("w1", ["*"], approved=False, on="2026-06-01", owner=own, reason="x")]
+    (tmp_path / "b").mkdir()
+    r = _cli(tmp_path / "b", bad, "describe")
+    assert r.returncode == 2 and "t3-signoff:invalid" in r.stdout + r.stderr, r.stdout + r.stderr
+    (tmp_path / "c").mkdir()
+    ok = [_rec("g1", ["*"], owner=own), _rec("w1", ["some-other-repo"], approved=False, on="2026-06-01", owner=own)]
+    r = _cli(tmp_path / "c", ok, "describe")
+    assert r.returncode == 0, r.stdout + r.stderr

From da723e138072c0b4c1c7d1d4dbcbd039d8d37ede Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:36:45 -0400
Subject: [PATCH 37/79] Refuse non-boolean approved values as possible
 withdrawals (#23)

_malformed_withdrawal skipped every record whose approved was not literally
False, so a malformed record with approved "false", 0, null, "true" or 1
beside a valid older grant was silently ignored and evaluate() returned the
grant. Only a literal true is now skipped; any other value is checked by
problems() and refuses t3-signoff:invalid when it could cover the repository.
Unrelated-owner and other-repository isolation is unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index a3f0785..53af434 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -331,11 +331,14 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
 
 
 def _malformed_withdrawal(ours: list[dict], repo: str | None, logins: list[str], today: _dt.date) -> str | None:
-    """The refusal for a malformed withdrawal (approved: false, failing problems()) that could withdraw a grant for REPO,
-    else None. Possibly relevant: its `repos` is malformed, its approved_on is not a date (none, or a timestamp), REPO
-    is empty, or it covers REPO. A malformed withdrawal clearly for another named repository does not block."""
+    """The refusal for a malformed withdrawal that could withdraw a grant for REPO, else None. A record is a possible
+    withdrawal unless its `approved` is the boolean true: a literal false, or any non-boolean value ("false", "true",
+    0, 1, null, missing), is treated as a withdrawal and fails closed. Only a true grant is skipped here. It is never
+    coerced to a grant or a withdrawal. Possibly relevant: its `repos` is malformed, its approved_on is not a date (none,
+    or a timestamp), REPO is empty, or it covers REPO. A malformed record clearly for another named repository does not
+    block."""
     for r in ours:
-        if r.get("approved") is not False:
+        if r.get("approved") is True:
             continue
         probs = problems(r, today)
         if not probs:
@@ -350,9 +353,11 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
              records: list[dict] | None = None, now: _dt.datetime | None = None) -> tuple[dict | None, str | None]:
     """(record, None) when signed off, else (None, 'no-file' | 'missing' | 'invalid:<id>: <problem>' | 'expired' | 'scope' |
     'revoked'). The veto is per requested REPO: 'revoked' means every otherwise-grantable record was vetoed for that
-    repository by a withdrawal (see _withdrawn). Fail closed: when a malformed withdrawal (approved: false, failing
-    problems()) could cover REPO, no record is returned and the result is 'invalid:<id>: <problem>'. A malformed
-    withdrawal clearly for another repository does not block. Only owners in the logins are considered.
+    repository by a withdrawal (see _withdrawn). Fail closed: when a malformed withdrawal (a literal approved: false failing
+    problems(), or a record whose `approved` is not a boolean, which is treated as a possible withdrawal and never
+    coerced to a grant or a withdrawal) could cover REPO, no record is returned and the result is
+    'invalid:<id>: <problem>'. A malformed withdrawal clearly for another repository does not block. Only owners in
+    the logins are considered.
     `today` (a date) is kept for callers that only care about date expiries; `now` is an aware instant."""
     if now is None:
         now = _dt.datetime.now(_dt.timezone.utc)

From d1c0d407569fbd02104ca7f2c0b6938d99c8d145 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:37:03 -0400
Subject: [PATCH 38/79] test: regression cases for non-boolean approved beside
 a grant (#23)

Synthetic regression matrix for malformed withdrawals whose `approved`
is not a literal boolean ("false", "true", 0, 1, null). Such records must
refuse as t3-signoff:invalid and never be ignored in favour of an older
grant. Adds unrelated-owner and other-repository isolation cases and the
literal-False withdrawal and valid-grant controls.

The beside-grant and dated-before-grant cases fail on 848f968 because
signoff._malformed_withdrawal skips anything not literally False; the
code fix is tracked separately.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_signoff_withdrawal.py | 47 +++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index e2880b9..a56cedb 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -141,3 +141,50 @@ def test_cli_refuses_a_withdrawn_repository_and_a_malformed_withdrawal(tmp_path)
     ok = [_rec("g1", ["*"], owner=own), _rec("w1", ["some-other-repo"], approved=False, on="2026-06-01", owner=own)]
     r = _cli(tmp_path / "c", ok, "describe")
     assert r.returncode == 0, r.stdout + r.stderr
+
+
+# Non-boolean `approved` values on a record beside a valid grant (synthetic). Only a literal False is a withdrawal, so
+# a string "false", 0, null, or any other non-boolean must refuse as invalid, never be ignored in favour of g1.
+NON_BOOLEAN_APPROVED = ["false", "true", 0, 1, None]
+
+
+@pytest.mark.parametrize("bad", NON_BOOLEAN_APPROVED)
+@pytest.mark.parametrize("repos,repo", [(["*"], "site"), (["site"], "site"), (["*"], None), (["site"], None)])
+def test_non_boolean_approved_beside_valid_grant_fails_closed(bad, repos, repo):
+    records = [_rec("g1", ["*"]), {**_rec("w1", repos, approved=False, on="2026-06-01"), "approved": bad}]
+    got, err = _ev(records, repo)
+    assert got is None and err and err.startswith("invalid:w1:") and "approved" in err, (got, err)
+
+
+@pytest.mark.parametrize("bad", NON_BOOLEAN_APPROVED)
+def test_non_boolean_approved_dated_before_the_grant_still_fails_closed(bad):
+    records = [_rec("g1", ["*"]), {**_rec("w1", ["*"], approved=False, on="2020-01-01"), "approved": bad}]
+    got, err = _ev(records, "site")
+    assert got is None and err and err.startswith("invalid:w1:") and "approved" in err, (got, err)
+
+
+@pytest.mark.parametrize("bad", NON_BOOLEAN_APPROVED)
+def test_non_boolean_approved_for_an_unrelated_owner_does_not_block(bad):
+    records = [_rec("g1", ["*"]),
+               {**_rec("w1", ["*"], approved=False, on="2026-06-01", owner="Other"), "approved": bad}]
+    assert _ev(records, "site") == ("g1", None)
+
+
+@pytest.mark.parametrize("bad", NON_BOOLEAN_APPROVED)
+def test_non_boolean_approved_for_another_repository_does_not_block(bad):
+    records = [_rec("g1", ["*"]), {**_rec("w1", ["other"], approved=False, on="2026-06-01"), "approved": bad}]
+    assert _ev(records, "site") == ("g1", None)
+
+
+def test_literal_false_withdrawal_and_valid_grant_controls():
+    withdrawn = [_rec("g1", ["*"]), _rec("w1", ["*"], approved=False, on="2026-06-01")]
+    assert _ev(withdrawn, "site") == (None, "revoked")
+    assert _ev([_rec("g1", ["*"])], "site") == ("g1", None)
+
+
+@pytest.mark.parametrize("bad", NON_BOOLEAN_APPROVED)
+def test_non_boolean_approved_is_never_a_valid_approval(bad):
+    records = [{**_rec("g1", ["*"]), "approved": bad}]
+    got, err = _ev(records, "site")
+    assert got is None and err and err.startswith("invalid:"), (got, err)
+

From f9f5bd7dee0e0005f660b44f1dfaafa79b5c9027 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:38:45 -0400
Subject: [PATCH 39/79] Document that a non-boolean approved fails closed as
 t3-signoff:invalid (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 references/t3-signoff.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index f96c887..6ee53b4 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -50,7 +50,7 @@ Each refusal exits 2 with result `refused`.
 
 ## Withdrawal
 
-The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing.
+The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing. A record for the owner whose `approved` is not a boolean (the string `"false"` or `"true"`, `0`, `1`, `null` or a missing key) is likewise a possible withdrawal that fails closed as `t3-signoff:invalid`; it is never coerced into a grant or a withdrawal.
 
 `project estate-plan --allow-t3` omits every T3 org that has no valid record and records `t3-signoff:<code>:<login>` (code `missing`, `expired`, `scope`, `revoked` or `invalid`) in the plan's `logs` for each one, so the operator sees why the org is absent.
 

From 2b45b829df7e304ad81ca4266248c4c8477cd0c5 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 16:56:47 -0400
Subject: [PATCH 40/79] test: cover wildcard grant with narrow T3 withdrawal
 (#23)

Adds synthetic regressions for a Pick-Your-AI wildcard grant beside a
per-repository withdrawal: owner-wide evaluate, record_for stamping,
malformed non-boolean withdrawals beside a wildcard grant, and
unrelated-owner withdrawal isolation.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_signoff_withdrawal.py | 46 +++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index a56cedb..8d76d7d 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -188,3 +188,49 @@ def test_non_boolean_approved_is_never_a_valid_approval(bad):
     got, err = _ev(records, "site")
     assert got is None and err and err.startswith("invalid:"), (got, err)
 
+
+
+# Owner-wide wildcard grant with a narrow per-repository withdrawal (synthetic records only).
+PYA = "Pick-Your-AI"
+
+
+def _wildcard_pair():
+    g1 = _rec("g1", ["*"], owner=PYA, approver="coowner", on="2026-01-01")
+    w1 = _rec("w1", ["northwind-member"], approved=False, owner=PYA, approver="coowner", on="2026-06-01")
+    return [g1, w1]
+
+
+def test_wildcard_grant_with_narrow_withdrawal_refuses_only_that_repo():
+    recs = _wildcard_pair()
+    assert _ev(recs, "northwind-member", owners=(PYA,)) == (None, "revoked")
+    assert _ev(recs, "kept-y", owners=(PYA,)) == ("g1", None)
+    # owner-wide authorization is kept; the per-repo check lives in the emitters
+    assert _ev(recs, None, owners=(PYA,)) == ("g1", None)
+
+
+def test_record_for_never_stamps_withdrawn_repo(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    p = tmp_path / "s.yaml"
+    p.write_text(json.dumps({"signoffs": _wildcard_pair()}), encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(p))
+    run = signoff.reset()
+    try:
+        signoff._grant(PYA.lower(), _wildcard_pair()[0])
+        assert signoff.record_for(PYA, "northwind-member") is None
+        assert signoff.record_for(PYA, "kept-y")["id"] == "g1"
+    finally:
+        signoff.restore(run)
+
+
+@pytest.mark.parametrize("bad", ["false", 0, None])
+def test_malformed_withdrawal_beside_wildcard_grant_stays_invalid(bad):
+    g1 = _rec("g1", ["*"], owner=PYA, approver="coowner", on="2026-01-01")
+    w1 = {**_rec("w1", ["*"], approved=False, owner=PYA, approver="coowner", on="2026-06-01"), "approved": bad}
+    got, err = _ev([g1, w1], "northwind-member", owners=(PYA,))
+    assert got is None and err and err.startswith("invalid"), (got, err)
+
+
+def test_unrelated_owner_withdrawal_is_isolated():
+    recs = [_wildcard_pair()[0],
+            _rec("w2", ["northwind-member"], approved=False, owner="Other-Org", approver="coowner", on="2026-06-01")]
+    assert _ev(recs, "northwind-member", owners=(PYA,)) == ("g1", None)

From 84f7a9447243c78dd54f97bb2420816137e49e14 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 17:00:59 -0400
Subject: [PATCH 41/79] Hold withdrawn repositories in T3 org profile, pins and
 captured Org options (#23)

A wildcard grant stays valid org-wide after a per-repository withdrawal, so
org profile and org pins now check each repository they name (t3-signoff:<code>:<org>/<repo>),
and project estate-plan holds the Org option update and README when a captured
Org option names a T3 org without a valid record. Documents signoff_id vs approval_id (#26).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |   2 +-
 SKILL.md                         |   2 +-
 references/t3-signoff.md         |   4 ++
 scripts/ctshowcase/org.py        |  26 ++++++++
 scripts/ctshowcase/project.py    |  51 ++++++++++++++-
 tests/test_t3_signoff_require.py | 107 +++++++++++++++++++++++++++++++
 6 files changed, 188 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a8006e..081db38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
-- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused.
+- Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
 - Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
diff --git a/SKILL.md b/SKILL.md
index 4ad7cc2..ad570f6 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 6ee53b4..924d4a6 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -52,6 +52,10 @@ Each refusal exits 2 with result `refused`.
 
 The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing. A record for the owner whose `approved` is not a boolean (the string `"false"` or `"true"`, `0`, `1`, `null` or a missing key) is likewise a possible withdrawal that fails closed as `t3-signoff:invalid`; it is never coerced into a grant or a withdrawal.
 
+An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`.
+
+**`signoff_id` and `approval_id` (issue #26).** Task #26 says "add `approval_id` to jobs created under the flag". This implementation names the sign-off in a separate `signoff_id` (`signoff_ids` for several) and never sets `approval_id`, because `approval_id` names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up, and a sign-off id is not one. Read #26 as "carry the sign-off id as `signoff_id`".
+
 `project estate-plan --allow-t3` omits every T3 org that has no valid record and records `t3-signoff:<code>:<login>` (code `missing`, `expired`, `scope`, `revoked` or `invalid`) in the plan's `logs` for each one, so the operator sees why the org is absent.
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 383c07c..d2c788f 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -401,6 +401,24 @@ def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     return r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name))
 
 
+def _t3_repo_refusal(estate: Estate, login: str, name: str, allow_t3: bool) -> str | None:
+    """The refusal code (`revoked`, `scope`, ...) when LOGIN is a T3 org, --allow-t3 is passed and NAME has no valid
+    sign-off of its own, else None. The command gate checks the owner-wide record, which a wildcard grant satisfies even
+    after a later withdrawal of one repository; every repository the org's own profile or pins would name or act on is
+    therefore checked again here (signoff.evaluate with the repository), so a withdrawn repository is held while the
+    org's unrelated repositories stay authorized. No-op without --allow-t3 (the base behaviour is unchanged) and for
+    owners that are not T3. Callers log `t3-signoff:<code>:<login>/<name>`
+    (tests/test_t3_signoff_require.py::test_wildcard_grant_with_a_repo_withdrawal_holds_that_repo_in_profile_and_pins)."""
+    r = estate.resolver
+    if not allow_t3 or not name or r.owner_status(login) != "t3":
+        return None
+    from . import signoff
+    rec, why = signoff.evaluate([login, *r.aliases(login)], name)
+    if rec is not None:
+        return None
+    return (why or "missing").partition(":")[0]
+
+
 def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
                  allow_t3: bool = False) -> tuple[dict, list[str]]:
     """The sanitized data the profile is rendered from (and committed as profile/data.json): no private repo, no
@@ -426,6 +444,11 @@ def public_slice(estate: Estate, org: str, lists_capture: dict | None = None, *,
     for n in moved_held:
         logs.append(f"t3-signoff:{estate.current(r.slug(f'{login}/{n}'))}")
     public = [n for n in public if n not in moved_held]
+    # A repository whose own sign-off was withdrawn (a wildcard grant stays valid org-wide) is never named either.
+    repo_held = {n: c for n in public if (c := _t3_repo_refusal(estate, login, n, allow_t3))}
+    for n, c in repo_held.items():
+        logs.append(f"t3-signoff:{c}:{login}/{n}")
+    public = [n for n in public if n not in repo_held]
     for n in names:
         if n != ".github" and estate.visibility(f"{login}/{n}") == "unknown":
             moving = estate.pending_move(f"{login}/{n}")
@@ -1483,6 +1506,9 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
                 logs.append(f"pin-gated:{pin}:{dep or (hit or ('', ''))[1]}")
             if held:
                 res, detail = "hold", "org on HOLD (STANDARD §12.5 #4): pins only report"
+            elif (t3c := _t3_repo_refusal(estate, login, pin, allow_t3)):
+                res, detail = "hold", f"t3-signoff:{t3c}:{login}/{pin}"
+                logs.append(f"t3-signoff:{t3c}:{login}/{pin}")
             checks.append({"target": target, "position": i, "repo": pin, "result": res, "detail": detail,
                            "depends_on": dep or None, "gate": gate})
             order[target].append(pin)
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index a734d6d..b5d3f05 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -681,6 +681,41 @@ def _readme_repos(spec: dict, owner: str, role: str, resolver, repos) -> tuple[l
     return repos, []
 
 
+def held_captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: bool) -> list[str]:
+    """The refusals (`t3-signoff:<code>:<login>`) for T3 orgs that the CAPTURED Estate Org field already names (an option
+    whose description is `T3: <login>`, or whose name is a T3 org's display name) while --allow-t3 is passed and no
+    valid sign-off record covers the org. copy_plan keeps every captured option (ids are never dropped) and the README
+    documents them, so a withdrawn association would otherwise survive into the option-update job and the README
+    (tests/test_t3_signoff_require.py::test_estate_replan_holds_a_captured_t3_org_after_withdrawal). Empty without
+    --allow-t3 (the base behaviour is unchanged) or without a resolver."""
+    if not allow_t3 or resolver is None:
+        return []
+    have = _field(spec or {}, "Org")
+    if not have:
+        return []
+    from . import signoff
+    t3 = {}
+    for key in (resolver.registry.get("orgs") or {}):
+        try:
+            row = resolver.brand_org(key)
+        except NeedsInput:
+            continue
+        if str(row.get("tier") or "").split()[0] == "T3":
+            t3[resolver.canonical(key).lower()] = key
+            t3[str(row.get("display_name") or key).lower()] = key
+    out = []
+    for o in have.get("options") or []:
+        desc = str(o.get("description") or "")
+        ident = desc[len(TIER_PREFIX_T3):] if desc.startswith(TIER_PREFIX_T3) else str(o.get("name") or "")
+        key = t3.get(ident.strip().lower())
+        if key is None:
+            continue
+        rec, why = signoff.evaluate([key, *resolver.aliases(key)])
+        if rec is None:
+            out.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{resolver.canonical(key)}")
+    return list(dict.fromkeys(out))
+
+
 def copy_plan(target: str, *, role: str = "org", source: str | None = None, title: str | None = None,
               display_name: str | None = None, copied: dict | None = None, workstreams: list[dict] | None = None,
               repositories: list[str] | None = None, approval_id: str | None = None, resolver: Resolver | None = None,
@@ -744,8 +779,16 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     # 1. fields: create what is missing, fix standard options keeping ids
     std_fields = list(FIELDS) + list(extra_fields or [])
     planned: dict[str, list] = {}  # the options each field will have once these jobs run (for the README)
+    held_t3 = held_captured_t3(resolver, spec, allow_t3) if role == "estate" else []
+    logs += held_t3
     for f in std_fields:
         have = _field(spec, f["name"])
+        if held_t3 and f["name"] == "Org" and have is not None:
+            # a captured T3 association lost its sign-off: leave the option list as captured (no ids dropped) and plan
+            # no option write or README that would carry it on
+            logs.append("hold:org-options (a captured T3 org option has no valid sign-off)")
+            planned[f["name"]] = have.get("options") or []
+            continue
         if have is None:
             if not f.get("required") and f["dataType"] == "MULTI_SELECT":
                 logs.append(f"optional-field-skipped:{f['name']}")
@@ -819,7 +862,11 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     text = readme_text
     readme_repos, lg = _readme_repos(spec, owner, role, resolver, repositories)
     logs += lg
-    if text is None:
+    if held_t3:
+        text = None
+        pending.append({"why": "README held: the Org field names a T3 org with no valid sign-off record",
+                        "needs": "a valid record in the sign-off file, or remove the option on the board"})
+    elif text is None:
         try:
             text, lg = readme(owner, name, number, nums, repositories=readme_repos,
                               out_of_scope=out_of_scope, reviewed=reviewed, views=vlist, estate=role == "estate",
@@ -1209,7 +1256,7 @@ def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict |
                      display_name="CompleteTech Estate", status_update=False, allow_t3=allow_t3)
     plan["action"] = "estate-plan"
     plan["orgs"] = orgs
-    plan["logs"] = [*plan.get("logs", []), *dict.fromkeys(t3_refusals)]
+    plan["logs"] = list(dict.fromkeys([*plan.get("logs", []), *t3_refusals]))
     plan["reads"] +=[{"name": f"estate-items:{o['login']}",
                        "argv": ["gh", "search", "issues", "--owner", o["login"], "--label", "estate", "--state", "open",
                                 "--json", "url", "--limit", "200"]} for o in orgs]
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index c850995..e29d24d 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1254,3 +1254,110 @@ def test_malformed_repos_beside_a_valid_unrelated_grant_is_invalid_not_scope(bad
     got, why = signoff.evaluate([OWNER], "northwind-synthetic", records=[good, bad])
     assert got is None and why.startswith("invalid:t3s-2: repos"), (got, why)
     assert signoff.evaluate([OWNER], "northwind-synthetic", records=[good]) == (None, "scope")
+
+
+# --- round 5: a wildcard grant followed by a per-repository withdrawal (synthetic records and slugs only) ---
+
+_WILD = [{"id": "t3s-all", "repos": ["*"], "approved_on": "2026-01-15"},
+         {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+
+
+def _pya_estate(brand):
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    reg = {"orgs": {OWNER: {"final_repos": ["withdrawn-x", "kept-y"], "pins_public": ["withdrawn-x", "kept-y"],
+                            "sections": [{"title": "Tools", "repos": ["withdrawn-x", "kept-y"]}],
+                            "star_list": {"name": "Pick Your AI", "description": ""}}}}
+    metas = {n: {"owner": OWNER, "repo": n, "visibility": "public", "description": "synthetic"}
+             for n in ("withdrawn-x", "kept-y")}
+    return O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "extra": [], "actions": []}),
+                    metas), reg
+
+
+def test_wildcard_grant_with_a_repo_withdrawal_holds_that_repo_in_profile_and_pins(tmp_path, monkeypatch, brand):
+    """A `*` grant plus a later withdrawal of withdrawn-x: the owner-wide gate still passes (the grant covers the org),
+    but `org profile` data and `org pins` named and pinned withdrawn-x under the grant's id. The other repository stays."""
+    from ctshowcase import org as O, signoff
+    est, _ = _pya_estate(brand)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, _WILD))):
+        assert signoff.evaluate([OWNER], "withdrawn-x") == (None, "revoked")
+        data, logs = O.public_slice(est, OWNER, allow_t3=True)
+        text = json.dumps(data)
+        assert "withdrawn-x" not in text and "kept-y" in text, data
+        assert f"t3-signoff:revoked:{OWNER}/withdrawn-x" in logs, logs
+        res, _ = O.pins(est, OWNER, allow_t3=True)
+        signoff.stamp(res["jobs"])
+        assert "withdrawn-x" not in json.dumps(res["jobs"]) and res["order"]["public"] == ["withdrawn-x", "kept-y"], res
+        held = [c for c in res["checks"] if c["repo"] == "withdrawn-x"]
+        assert held and all(c["result"] == "hold" for c in held), res["checks"]
+        pins = [j for j in res["jobs"] if "kept-y" in json.dumps(j)]
+        assert pins and all(j["signoff_id"] == "t3s-all" for j in pins), res["jobs"]
+        assert f"t3-signoff:revoked:{OWNER}/withdrawn-x" in res["logs"], res["logs"]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", _WILD[:1]))):  # control: no withdrawal, both repositories
+        data, _ = O.public_slice(est, OWNER, allow_t3=True)
+        assert "withdrawn-x" in json.dumps(data) and "kept-y" in json.dumps(data), data
+        res, _ = O.pins(est, OWNER, allow_t3=True)
+        assert sum("pin-public" in j["id"] or "-pin-public-" in j["id"] for j in res["jobs"]) >= 2, res["jobs"]
+
+
+def test_without_the_flag_the_profile_is_unchanged_by_a_repo_withdrawal(tmp_path, brand):
+    """Control: without --allow-t3 the profile is the base behaviour (nothing newly held)."""
+    from ctshowcase import org as O
+    est, _ = _pya_estate(brand)
+    b = _bundle(tmp_path, _WILD)
+    from ctshowcase import signoff
+    from ctshowcase.config import set_t3_signed_off, reset_t3_signed_off
+    os.environ["SHOWCASE_T3_SIGNOFF_FILE"] = str(_file(b))
+    t3, run = set_t3_signed_off(False), signoff.reset()
+    try:
+        data, logs = O.public_slice(est, OWNER, allow_t3=False)  # no --allow-t3: base behaviour, nothing newly held
+        assert "withdrawn-x" in json.dumps(data) and not any(x.startswith("t3-signoff") for x in logs), logs
+    finally:
+        signoff.restore(run)
+        reset_t3_signed_off(t3)
+        os.environ.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
+
+
+def test_estate_replan_holds_a_captured_t3_org_after_withdrawal(tmp_path, monkeypatch, brand):
+    """A previously populated Estate board whose Org field already holds the T3 option, re-planned with --allow-t3 after
+    the org's grant was withdrawn: no option-replacement job and no README may carry the withdrawn org (copy_plan kept
+    every captured option), the existing option ids are not deleted, and the refusal is logged. With a valid grant the
+    plan is unchanged."""
+    from ctshowcase import project as PJ
+    from ctshowcase.config import load_yaml_text
+    from ctshowcase.resolver import Resolver
+    reg = load_yaml_text((ROOT / "tests" / "fixtures" / "org" / "registry.yaml").read_text(encoding="utf-8"))
+    reg["profile"]["org_directory"].append({"group": "T3", "orgs": [OWNER]})
+    reg["orgs"][OWNER] = {}
+    res = Resolver(brand, reg, {"rows": {("create-project", "@me", "*", "")}, "ids": set(), "answers": {},
+                                "actions": [], "extra": []})
+    cap = json.loads((ROOT / "tests" / "fixtures" / "project" / "estate-copy-capture.json").read_text(encoding="utf-8"))
+    name = brand.raw["orgs"][OWNER]["display_name"]
+    def with_t3_option(c):
+        c = json.loads(json.dumps(c))
+        c["data"]["user"]["projectV2"]["fields"]["nodes"].append({
+            "__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099, "name": "Org",
+            "dataType": "SINGLE_SELECT", "isIssueField": False, "options": [
+                {"id": "opt-t3-synthetic", "name": name, "color": "GRAY", "description": f"T3: {OWNER}"},
+                {"id": "opt-t1-synthetic", "name": "CompleteTech Skills", "color": "BLUE",
+                 "description": "T1: CompleteTech-Skills"}]})
+        return c
+
+    captured = with_t3_option(cap)
+    withdrawn = [{"id": "t3s-g", "approved_on": "2026-01-15"},
+                 {"id": "t3s-w", "approved": False, "approved_on": "2026-10-01"}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "rev", withdrawn))):
+        plan = PJ.estate_plan(res, copied=captured, user_id=100, allow_t3=True)
+    blob = json.dumps(plan["jobs"], ensure_ascii=False)
+    assert OWNER not in blob and name not in blob, [j["id"] for j in plan["jobs"] if name in json.dumps(j, ensure_ascii=False)]
+    assert not any("-options-org" in j["id"] for j in plan["jobs"]), plan["jobs"]
+    assert not any("--readme" in j.get("argv", []) for j in plan["jobs"]), plan["jobs"]
+    assert any("README held" in p.get("why", "") for p in plan["pending"]), plan["pending"]
+    assert f"t3-signoff:revoked:{OWNER}" in plan["logs"], plan["logs"]
+    ok = [{"id": "t3s-g", "approved_on": "2026-01-15"}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", ok))):
+        plan = PJ.estate_plan(res, copied=captured, user_id=100, allow_t3=True)
+    opt = [j for j in plan["jobs"] if "-options-org" in j["id"]]
+    assert opt and name in json.dumps(opt, ensure_ascii=False) and opt[0]["signoff_id"] == "t3s-g", plan["jobs"]
+    assert not any("README held" in p.get("why", "") for p in plan["pending"]), plan["pending"]
+    assert not [x for x in plan["logs"] if str(x).startswith("t3-signoff:")], plan["logs"]

From f672ebc1e6596405c2f29ae09085b11eee356a1d Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 18:18:04 -0400
Subject: [PATCH 42/79] Fix r6 T3 sign-off findings: padded withdrawal scopes,
 personal-profile activity, per-repo pin records, former-login captured
 options, R7 docs (#23)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |  2 +-
 SKILL.md                            |  2 +-
 scripts/ctshowcase/org.py           | 24 +++++++++++
 scripts/ctshowcase/project.py       | 10 ++++-
 scripts/ctshowcase/signoff.py       |  1 +
 tests/test_allow_t3_docs.py         |  5 ++-
 tests/test_t3_signoff_require.py    | 67 +++++++++++++++++++++++++++++
 tests/test_t3_signoff_withdrawal.py |  7 +++
 8 files changed, 113 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 081db38..dbd2a6f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,7 +9,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
-- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is `hold` only without the flag; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
+- Global `--allow-t3` (before the command) signs off a T3 co-owned repository for one invocation across every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`. The default still refuses T3 owners (exit 2, `t3-signoff`), except repository `doctor` (always admits T3 owners; R7 is evaluated normally only with the flag and a valid covering record, otherwise it stays `hold`; it still refuses excluded and HOLD owners), local `meta` normalization and `fingerprint`, which never refuse a T3 owner; excluded and HOLD owners stay refused. Pick Your AI also gets its own palette, mark and attribution (PR #20).
 
 ### Fixed
 
diff --git a/SKILL.md b/SKILL.md
index ad570f6..c40ea6c 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and forces the R7 cell to `hold` only without `--allow-t3` (with the flag R7 is evaluated normally); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index d2c788f..9c9270c 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -401,6 +401,19 @@ def _t3_moved_held(estate: Estate, full: str, allow_t3: bool) -> bool:
     return r.owner_status(owner) == "t3" and not (allow_t3 and _t3_granted(owner, name))
 
 
+def _pin_signoff(estate: Estate, login: str, pin: str, allow_t3: bool) -> str | None:
+    """The id of the sign-off record that authorizes LOGIN/PIN (signoff.evaluate with the repository: the per-repository
+    veto applies), else None. For a wildcard grant, a later withdrawal of PIN and a still-later repository-scoped
+    regrant this is the regrant, so a pin job never carries a wildcard grant that no longer authorizes that
+    repository. None without --allow-t3 or for an org that is not T3."""
+    r = estate.resolver
+    if not allow_t3 or r.owner_status(login) != "t3":
+        return None
+    from . import signoff
+    rec = signoff.record(login, pin, r.aliases(login))
+    return str(rec["id"]) if rec and rec.get("id") else None
+
+
 def _t3_repo_refusal(estate: Estate, login: str, name: str, allow_t3: bool) -> str | None:
     """The refusal code (`revoked`, `scope`, ...) when LOGIN is a T3 org, --allow-t3 is passed and NAME has no valid
     sign-off of its own, else None. The command gate checks the owner-wide record, which a wildcard grant satisfies even
@@ -1117,6 +1130,9 @@ def entry(full: str) -> dict | None:
         full = m["_full"]
         if m["_owner"].lower() not in shown_orgs or not estate.is_public(full) or m.get("fork"):
             continue
+        if _t3_held(estate, full, allow_t3):  # a wildcard-granted org still holds a repository whose sign-off was withdrawn
+            logs.append(f"t3-signoff:{full}")
+            continue
         for lang, n in (m.get("languages") or {}).items():
             if isinstance(n, int):
                 langs[lang] = langs.get(lang, 0) + n
@@ -1457,6 +1473,7 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
          repo_ids: dict | None = None) -> tuple[dict, int]:
     login, row, reg = _gate(estate, org, allow_t3=allow_t3, allow_hold=True)
     checks, jobs, logs, order = [], [], [], {"public": [], "members": []}
+    pin_records: dict[str, list[str]] = {}
     held = _star_held(estate, org) == "hold"  # STANDARD §12.5 #4: a HOLD org's pins only report, as `profile` refuses
     if held:
         logs.append("pins:hold")
@@ -1523,6 +1540,10 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
                  f"Open https://github.com/{login} and check that {pin} now shows in the {label.lower()} row."],
                 org=login, ui_action="org-pin", depends_on=dep or None,
                 note=f"Decision 14 pin {i} of {len(entries)} ({target}); {gate or 'no dependency'}."))
+            _pin_rec = _pin_signoff(estate, login, pin, allow_t3)  # the record that covers THIS repository, not the owner-wide first grant
+            if _pin_rec:
+                jobs[-1]["signoff_id"] = _pin_rec
+                pin_records.setdefault(target, []).append(_pin_rec)
     for target, label, view in (("public", "Public pins", "Public"), ("members", "Members-only pins", "Member")):
         bad = ("fail", "blocked", "unknown", "hold") if target == "public" else ("fail", "blocked", "hold")
         keep = [c["repo"] for c in checks if c.get("target") == target and c.get("repo") and c["result"] not in bad]
@@ -1537,6 +1558,9 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
              "Drag the pins into that order, then click 'Save pins'.",
              f"Reload 'View as: {view}' and screenshot the pinned row into state/screens/{login}/."],
             org=login, ui_action="org-pin-order", note=f"Final {target} pin order from the registry (VER-01 check)."))
+        if pin_records.get(target):  # the order job names every repository record behind the pins it sets
+            from . import signoff
+            signoff.stamp_associations(jobs[-1], pin_records[target])
     lists = star_list_plan(estate, org, lists_capture=lists_capture, repo_ids=repo_ids, allow_t3=allow_t3)
     failed = any(c["result"] == "fail" for c in checks)
     res = {"command": "org", "action": "pins", "owner": login,
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index b5d3f05..f376b99 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -701,13 +701,21 @@ def held_captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: boo
         except NeedsInput:
             continue
         if str(row.get("tier") or "").split()[0] == "T3":
+            for alias in resolver.aliases(key):  # a description written under a former login still names this org
+                t3[alias.lower()] = key
             t3[resolver.canonical(key).lower()] = key
             t3[str(row.get("display_name") or key).lower()] = key
     out = []
     for o in have.get("options") or []:
         desc = str(o.get("description") or "")
         ident = desc[len(TIER_PREFIX_T3):] if desc.startswith(TIER_PREFIX_T3) else str(o.get("name") or "")
-        key = t3.get(ident.strip().lower())
+        ident = ident.strip().lower()
+        key = t3.get(ident)
+        if key is None and ident:  # an approved rename: resolve the identifier to its current login
+            try:
+                key = t3.get(resolver.canonical(ident).lower())
+            except NeedsInput:
+                key = None
         if key is None:
             continue
         rec, why = signoff.evaluate([key, *resolver.aliases(key)])
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 53af434..d93145a 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -426,6 +426,7 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
         repos = [repos]
     if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
         return False
+    repos = [x.strip() for x in repos]  # same normalisation as _scope_key: padding never hides a scope
     if "*" in repos:
         return True
     name = (repo or "").split("/")[-1].lower()
diff --git a/tests/test_allow_t3_docs.py b/tests/test_allow_t3_docs.py
index 6219ecf..5b525dd 100644
--- a/tests/test_allow_t3_docs.py
+++ b/tests/test_allow_t3_docs.py
@@ -35,10 +35,11 @@ def test_skill_documents_refusals():
 
 
 def test_skill_states_which_commands_do_not_enforce_owner_eligibility():
-    """doctor forces R7=hold only without the flag; local meta and fingerprint never refuse (verified in code/tests)."""
+    """doctor holds R7 unless the flag and a valid record are present; local meta and fingerprint never refuse (verified in code/tests)."""
     skill = _read("SKILL.md")
     para = skill[skill.index(MARKER):].split("\n\n", 1)[0]
-    assert "only without `--allow-t3`" in para, para
+    assert "unless `--allow-t3` is passed and a valid sign-off record covers" in para, para
+    assert "forces the R7 cell to `hold` only without" not in para
     assert "evaluated normally" in para, para
     assert "`fingerprint`" in para and "--from-gh" in para, para
     assert "with or without the flag, with the R7" not in para
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index e29d24d..5eaaff5 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1361,3 +1361,70 @@ def with_t3_option(c):
     assert opt and name in json.dumps(opt, ensure_ascii=False) and opt[0]["signoff_id"] == "t3s-g", plan["jobs"]
     assert not any("README held" in p.get("why", "") for p in plan["pending"]), plan["pending"]
     assert not [x for x in plan["logs"] if str(x).startswith("t3-signoff:")], plan["logs"]
+
+
+def test_personal_profile_latest_and_languages_omit_a_withdrawn_repository(tmp_path, monkeypatch, brand):
+    """The personal README's recent activity and tech stack are computed from every captured repository of a shown org.
+    A `*` grant with a later withdrawal of withdrawn-x must not let that repository into `latest` or the language
+    share (a wildcard grant passes the org-level gate); the control without the withdrawal names both."""
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    est, reg = _pya_estate(brand)
+    reg["profile"] = {"org_directory": [{"group": "T3", "orgs": [OWNER]}]}
+    metas = {n: {"owner": OWNER, "repo": n, "visibility": "public", "description": "synthetic",
+                 "languages": {lang: 100}, "last_substantive_commit": "2026-09-01T00:00:00Z"}
+             for n, lang in (("withdrawn-x", "Rust"), ("kept-y", "Go"))}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "extra": [], "actions": []}),
+                   metas)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "w", _WILD))):
+        data, logs = O.user_slice(est, "CompleteDotTech", allow_t3=True)
+        blob = json.dumps(data["latest"]) + json.dumps(data["tech_stack"])
+        assert "kept-y" in blob and "Go" in blob, data
+        assert "withdrawn-x" not in blob and "Rust" not in blob, data
+        assert f"t3-signoff:{OWNER}/withdrawn-x" in logs, logs
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", _WILD[:1]))):
+        data, _ = O.user_slice(est, "CompleteDotTech", allow_t3=True)
+        blob = json.dumps(data["latest"]) + json.dumps(data["tech_stack"])
+        assert "withdrawn-x" in blob and "Rust" in blob, data
+
+
+def test_pin_jobs_carry_the_repository_regrant_not_the_withdrawn_wildcard(tmp_path, monkeypatch, brand):
+    """Wildcard grant G, a later withdrawal of withdrawn-x, then a still-later repository-scoped regrant R: the pin job
+    for withdrawn-x names R (G no longer authorizes it), the other pin keeps G, and the final order job names both."""
+    from ctshowcase import org as O, signoff
+    est, _ = _pya_estate(brand)
+    recs = [*_WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, recs))):
+        res, _ = O.pins(est, OWNER, allow_t3=True)
+        signoff.stamp(res["jobs"])  # the command-level stamp must not overwrite the per-repository record
+        by_repo = {j["id"]: j for j in res["jobs"]}
+        px = [j for i, j in by_repo.items() if i.endswith("-pin-public-1")]
+        py = [j for i, j in by_repo.items() if i.endswith("-pin-public-2")]
+        assert px and px[0]["signoff_id"] == "t3s-regrant", res["jobs"]
+        assert py and py[0]["signoff_id"] == "t3s-all", res["jobs"]
+        order = by_repo[f"p{O.PHASE['pins']}-{OWNER}-pin-public-order"]
+        assert set(order["signoff_ids"]) == {"t3s-regrant", "t3s-all"}, order
+
+
+def test_estate_replan_holds_a_captured_option_written_under_a_former_login(tmp_path, monkeypatch, brand):
+    """An approved rename Pick-Your-AI -> Pick-Your-Stack leaves a captured Org option described `T3: Pick-Your-AI`.
+    After the sign-off is withdrawn, the replan still holds the Org options (no option write, no README naming it)."""
+    from ctshowcase import project as PJ
+    from ctshowcase.config import load_yaml_text
+    from ctshowcase.resolver import Resolver
+    reg = load_yaml_text((ROOT / "tests" / "fixtures" / "org" / "registry.yaml").read_text(encoding="utf-8"))
+    reg["orgs"][OWNER] = {}
+    res = Resolver(brand, reg, {"rows": {("create-project", "@me", "*", "")}, "ids": set(), "answers": {},
+                                "actions": [], "extra": [{"action": "org-rename", "owner": OWNER,
+                                                          "new_name": "Pick-Your-Stack"}]})
+    assert res.canonical(OWNER) == "Pick-Your-Stack"
+    cap = json.loads((ROOT / "tests" / "fixtures" / "project" / "estate-copy-capture.json").read_text(encoding="utf-8"))
+    cap["data"]["user"]["projectV2"]["fields"]["nodes"].append({
+        "__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099, "name": "Org",
+        "dataType": "SINGLE_SELECT", "isIssueField": False, "options": [
+            {"id": "opt-t3-former", "name": "Former Synthetic Name", "color": "GRAY", "description": f"T3: {OWNER}"}]})
+    withdrawn = [{"id": "t3s-g", "approved_on": "2026-01-15"},
+                 {"id": "t3s-w", "approved": False, "approved_on": "2026-10-01"}]
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, withdrawn))):
+        held = PJ.held_captured_t3(res, PJ.normalize(cap), True)
+    assert held and held[0].startswith("t3-signoff:revoked:"), held
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index 8d76d7d..23f2373 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -234,3 +234,10 @@ def test_unrelated_owner_withdrawal_is_isolated():
     recs = [_wildcard_pair()[0],
             _rec("w2", ["northwind-member"], approved=False, owner="Other-Org", approver="coowner", on="2026-06-01")]
     assert _ev(recs, "northwind-member", owners=(PYA,)) == ("g1", None)
+
+
+@pytest.mark.parametrize("repos", [" * ", ["* "], [" site"], " site ", ["Acme/site "]])
+def test_whitespace_padded_withdrawal_scope_still_vetoes_a_single_repository(repos):
+    """A schema-valid but padded `repos` entry must scope the same way for a single repository as for the owner."""
+    recs = [_rec("g1", ["*"]), _rec("w1", repos, approved=False, on="2026-06-01")]
+    assert _ev(recs, "site") == (None, "revoked")

From de0861e5d2ae838b7d74fb3a655d8a11035ab9d9 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sat, 31 Oct 2026 23:57:31 -0400
Subject: [PATCH 43/79] fix(project): enforce T3 sign-off per repository link
 and captured org identity

- copy-plan: when --allow-t3 and the owner is T3, each repository link is checked against the sign-off record for that repository; a held link is logged (t3-signoff:<code>:<repo>, link-held) and not emitted; a valid link carries the repository-specific signoff_id.
- captured_t3: returns (refusals, retained). Identities resolve through the brand as well as the registry, and a former login resolves via brand former_slugs, so an org missing from registry.orgs is still held. held_captured_t3 keeps its signature and returns the refusals.
- estate-plan: retained captured T3 identities are stamped on Org-update and README jobs even when excluded from the desired org directory.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 119 ++++++++++++++++++++++++++--------
 1 file changed, 91 insertions(+), 28 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index f376b99..cd4a40e 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -681,31 +681,56 @@ def _readme_repos(spec: dict, owner: str, role: str, resolver, repos) -> tuple[l
     return repos, []
 
 
-def held_captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: bool) -> list[str]:
-    """The refusals (`t3-signoff:<code>:<login>`) for T3 orgs that the CAPTURED Estate Org field already names (an option
-    whose description is `T3: <login>`, or whose name is a T3 org's display name) while --allow-t3 is passed and no
-    valid sign-off record covers the org. copy_plan keeps every captured option (ids are never dropped) and the README
-    documents them, so a withdrawn association would otherwise survive into the option-update job and the README
-    (tests/test_t3_signoff_require.py::test_estate_replan_holds_a_captured_t3_org_after_withdrawal). Empty without
-    --allow-t3 (the base behaviour is unchanged) or without a resolver."""
+def _is_t3(row: dict) -> bool:
+    """A brand or registry org row whose tier starts with T3 (a row with no tier is never T3)."""
+    words = str(row.get("tier") or "").split()
+    return bool(words) and words[0] == "T3"
+
+
+def _captured_spec(copied: dict | None) -> dict | None:
+    """The normalized spec of a captured board; copy_plan and estate_plan derive it the same way."""
+    if copied is None:
+        return None
+    return copied if "fields" in copied and "views" in copied and "std" in copied else normalize(copied)
+
+
+def captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: bool) -> tuple[list[str], list[dict]]:
+    """Sign-off check of the T3 orgs that the CAPTURED Estate Org field names (an option whose description is
+    `T3: <login>`, or whose name is a T3 org's display name) while --allow-t3 is passed. Returns (refusals, retained):
+    refusals are `t3-signoff:<code>:<login>` for each such org with no valid sign-off record, and retained are
+    {login, name, tier, signoff_id} for each such org whose record is valid. Identities resolve through
+    references/brand.yaml (current logins, former slugs, approved renames) as well as the registry, so an org that is
+    no longer in registry.orgs is still checked. copy_plan keeps every captured option (ids are never dropped) and the
+    README documents them, so a withdrawn association would otherwise survive into the option-update job and the README
+    (tests/test_t3_signoff_require.py::test_estate_replan_holds_a_captured_t3_org_after_withdrawal). This only reads.
+    Empty without --allow-t3 or without a resolver."""
     if not allow_t3 or resolver is None:
-        return []
+        return [], []
     have = _field(spec or {}, "Org")
     if not have:
-        return []
+        return [], []
     from . import signoff
-    t3 = {}
-    for key in (resolver.registry.get("orgs") or {}):
-        try:
-            row = resolver.brand_org(key)
-        except NeedsInput:
-            continue
-        if str(row.get("tier") or "").split()[0] == "T3":
-            for alias in resolver.aliases(key):  # a description written under a former login still names this org
-                t3[alias.lower()] = key
-            t3[resolver.canonical(key).lower()] = key
-            t3[str(row.get("display_name") or key).lower()] = key
-    out = []
+    t3, rows = {}, {}
+
+    def _index(key: str, row: dict) -> None:
+        rows[key] = row
+        for alias in resolver.aliases(key):  # a description written under a former login still names this org
+            t3[alias.lower()] = key
+        t3[resolver.canonical(key).lower()] = key
+        t3[str(row.get("display_name") or key).lower()] = key
+
+    sources = [list(resolver.registry.get("orgs") or {})]
+    if resolver.brand is not None:
+        sources.append(list((resolver.brand.raw.get("orgs") or {}).keys()))
+    for keys in sources:
+        for key in keys:
+            try:
+                row = resolver.brand_org(key)
+            except NeedsInput:
+                continue
+            if _is_t3(row):
+                _index(key, row)
+    refusals, retained, seen = [], [], set()
     for o in have.get("options") or []:
         desc = str(o.get("description") or "")
         ident = desc[len(TIER_PREFIX_T3):] if desc.startswith(TIER_PREFIX_T3) else str(o.get("name") or "")
@@ -716,12 +741,36 @@ def held_captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: boo
                 key = t3.get(resolver.canonical(ident).lower())
             except NeedsInput:
                 key = None
+        if key is None and ident:  # a former login: brand former_slugs resolve it without registry membership
+            bk = resolver.brand_key(ident)
+            if bk is not None:
+                try:
+                    row = resolver.brand_org(bk)
+                except NeedsInput:
+                    row = {}
+                if _is_t3(row):
+                    key = bk
+                    rows[bk] = row
         if key is None:
             continue
+        login = resolver.canonical(key)
         rec, why = signoff.evaluate([key, *resolver.aliases(key)])
         if rec is None:
-            out.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{resolver.canonical(key)}")
-    return list(dict.fromkeys(out))
+            refusals.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{login}")
+            continue
+        if login.lower() in seen:
+            continue
+        seen.add(login.lower())
+        retained.append({"login": login, "name": (rows.get(key) or {}).get("display_name") or key, "tier": "T3",
+                         "signoff_id": str(rec["id"])})
+    return list(dict.fromkeys(refusals)), retained
+
+
+def held_captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: bool) -> list[str]:
+    """The refusals (`t3-signoff:<code>:<login>`) for the captured T3 orgs that have no valid sign-off record while
+    --allow-t3 is passed. Identities resolve through references/brand.yaml as well as the registry; see captured_t3,
+    whose refusals this returns. Empty without --allow-t3 or without a resolver."""
+    return captured_t3(resolver, spec, allow_t3)[0]
 
 
 def copy_plan(target: str, *, role: str = "org", source: str | None = None, title: str | None = None,
@@ -777,7 +826,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
         return {"command": "project", "action": "copy-plan", "owner": owner, "role": role, "stage": 1, "title": title,
                 "short_description": short, "result": "ok", "jobs": jobs, "reads": reads, "pending": pending,
                 "files": files, "logs": logs}
-    spec = copied if "fields" in copied and "views" in copied and "std" in copied else normalize(copied)
+    spec = _captured_spec(copied)
     number, project_id = spec.get("number"), spec.get("id")
     if not number or not project_id:
         raise ShowcaseError("the --copied capture has no project number or id", log="usage")
@@ -898,10 +947,22 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
             r = f"{owner}/{r.split('/', 1)[1]}"  # a former login of the org links under its current one (CQ-03)
             if r.lower() in linked:
                 continue  # listed twice: one link job
+            rec = None
+            if allow_t3 and resolver is not None and resolver.owner_status(owner) == "t3":
+                # the owner-wide grant does not settle a repository that a later withdrawal names: check each link
+                from . import signoff
+                rec, why = signoff.evaluate([owner, *resolver.aliases(owner)], r.split("/", 1)[1])
+                if rec is None:
+                    logs.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{r}")
+                    logs.append(f"link-held:{r} (no valid T3 sign-off covers this repository)")
+                    continue
             linked.add(r.lower())
-            jobs.append(_job(f"{pid}-{num}-link-{_repo_key(r.split('/', 1)[1])}", "project",
-                             ["gh", "project", "link", num, "--owner", owner, "--repo", r], owner,
-                             "Link before the §10.1 settings pass, or re-run R5 afterwards (§13.11)."))
+            link = _job(f"{pid}-{num}-link-{_repo_key(r.split('/', 1)[1])}", "project",
+                        ["gh", "project", "link", num, "--owner", owner, "--repo", r], owner,
+                        "Link before the §10.1 settings pass, or re-run R5 afterwards (§13.11).")
+            if rec is not None and rec.get("id"):  # the repository's own granting id; approval_id is never touched
+                signoff.stamp_associations(link, [str(rec["id"])])
+            jobs.append(link)
         reads.append({"name": "org-projects-setting", "argv": ["gh", "api", f"orgs/{owner}", "--jq", ".has_organization_projects"]})
     # 6. browser: UI-only view settings, workflows, insights, default repo, auto-add, recommended template
     url = project_url(owner, number)
@@ -1276,7 +1337,9 @@ def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict |
                                      [f"Open {url}/settings.", "Check that 'Visibility' reads Private; change nothing.",
                                       "Screenshot it into state/screens/projects/me/."], "project-check",
                                      "§13.2: the Estate stays private."))
-    _stamp_estate_orgs(plan["jobs"], orgs)
+    _, retained = captured_t3(resolver, _captured_spec(copied), allow_t3)
+    listed = {o["login"].lower() for o in orgs}
+    _stamp_estate_orgs(plan["jobs"], orgs + [o for o in retained if o["login"].lower() not in listed])
     return plan
 
 

From aa90e828e7e7e9dc074cab709a0efbddee0be1af Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 00:03:16 -0400
Subject: [PATCH 44/79] fix(signoff): normalise record owners once; add
 emission-scope and padded-owner regressions

Owner matching in evaluate, _withdrawn and record_for strips all surrounding
whitespace before case-folding, so a padded withdrawal owner can no longer
leave an older grant standing. Adds integration regressions for per-repository
link holds, registry-independent captured T3 options and retained-option
sign-off stamping, plus a CHANGELOG line.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |   1 +
 scripts/ctshowcase/signoff.py       |  19 ++-
 tests/test_t3_emission_scope.py     | 180 ++++++++++++++++++++++++++++
 tests/test_t3_signoff_withdrawal.py |  81 +++++++++++++
 4 files changed, 275 insertions(+), 6 deletions(-)
 create mode 100644 tests/test_t3_emission_scope.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a453f11..3031b2f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
+- T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
 - `content icon normalize` flattens a vignetted kept night tile with a feathered ramp (6 dE) instead of a hard threshold, and the transparent key uses a soft alpha ramp, so a glow around a solid glyph keeps its continuity with no hard outer ring; the glyph edge stays hard. `--ground-tolerance` is covered through the CLI (a raised value is applied; `nan` and negative values exit 2), and the estate-template numbered BACKGROUND paragraph is replaced by the flat-ground wording, including explicit colour or radial-gradient text.
 - `org labels ORG --repos-from-gh` plans labels across accessible repositories without the private estate registry, with paginated read-only GitHub capture, optional verified local checkouts, unchanged reference guards, and a documented org-default-forms-first workflow. Registry-backed plans still require the org registry row, and checkout repository names match GitHub case-insensitively, including resolved pending renames. Registry-free runs also isolate lazy brand lookups from estate decision files, and held reference rewrites retain their file/line guidance with an incomplete result. Workflow/labeler/release/Renovate references remain final skips rather than unresolved input requests. Missing Windows device-named checkouts fall back to captured metadata instead of aborting the org plan. Pending transfers check the repository's current owner's default issue forms and hold renames when that evidence is unavailable. Sparse or partially missing checkouts retain reference holds based on captured paths and the Git index, while unrelated omitted files remain allowed.
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index d93145a..5a3bbcb 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -118,7 +118,7 @@ def register_aliases(logins: list[str]) -> None:
     """Remember that these logins name one org, so a record under a former login still matches wherever the owner is
     re-checked (doctor rows, org and project helpers) without each caller passing the aliases again."""
     granted, aliases = _run_state()
-    group = {x.lower() for x in logins if x}
+    group = {_owner_key(x) for x in logins if x}
     for x in list(group):
         group |= aliases.get(x, frozenset())
     new = dict(aliases)
@@ -127,9 +127,16 @@ def register_aliases(logins: list[str]) -> None:
     _RUN.set((granted, new))
 
 
+def _owner_key(owner) -> str:
+    """The ONE owner identity used to match grants, withdrawals and the cached run grants: all surrounding whitespace
+    (tab, newline, NBSP included) stripped, then case-folded as before. A padded spelling of an owner is that owner, so
+    it can neither escape its own withdrawal nor be read as a different owner."""
+    return owner.strip().lower() if isinstance(owner, str) else ""
+
+
 def _expand(owners: list[str]) -> list[str]:
     aliases = _aliases()
-    out = {o.lower() for o in owners if o}
+    out = {_owner_key(o) for o in owners if o} - {""}
     for o in list(out):
         out |= aliases.get(o, frozenset())
     return sorted(out)
@@ -309,10 +316,10 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
     g_repos = _repo_list(grant.get("repos"))
     if g_on is None or g_repos is None or isinstance(g_on, _dt.datetime):
         return False
-    owners = {x.lower() for x in logins} if logins is not None else None
+    owners = {_owner_key(x) for x in logins} if logins is not None else None
     g_keys = {_scope_key(x, logins) for x in g_repos}
     for f in withdrawals:
-        if owners is not None and str(f.get("owner") or "").lower() not in owners:
+        if owners is not None and _owner_key(f.get("owner")) not in owners:
             continue
         f_on = _parse_when(f.get("approved_on"))
         f_repos = _repo_list(f.get("repos"))
@@ -377,7 +384,7 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
         if rid and rid in seen:
             return None, f"invalid:{rid}: duplicate id (record ids must be unique within the file)"
         seen.add(rid)
-    ours = [r for r in records if str(r.get("owner") or "").lower() in logins]
+    ours = [r for r in records if _owner_key(r.get("owner")) in logins]
     today = now.astimezone().date()
     valid = [r for r in ours if not problems(r, today)]
     withdrawals = [r for r in valid if r.get("approved") is False]
@@ -474,7 +481,7 @@ def record_for(owner: str, repo: str | None = None) -> dict | None:
     logins = _expand([owner or ""])  # a grant cached under a former login still applies once the alias is registered
     granted = _granted()
     withdrawals = [r for r in load_records() if r.get("approved") is False] if granted else []
-    for login in dict.fromkeys([(owner or "").lower(), *logins]):
+    for login in dict.fromkeys([_owner_key(owner), *logins]):
         for rec in granted.get(login, ()):
             if _covers(rec, repo, logins) and not _withdrawn(rec, withdrawals, logins, repo):
                 return rec
diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
new file mode 100644
index 0000000..9f56252
--- /dev/null
+++ b/tests/test_t3_emission_scope.py
@@ -0,0 +1,180 @@
+"""Emission-boundary T3 sign-off regressions (issue 23): an owner-wide grant or captured metadata must not reintroduce a
+scope that a later withdrawal removed. copy-plan repository links are checked per repository, captured Org options are
+held whether or not the org is still in registry.orgs, and an authorized retained option carries its record id.
+Synthetic records only."""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+OWNER = "Pick-Your-AI"
+FIX = ROOT / "tests" / "fixtures" / "project"
+
+
+def _file(tmp_path, records):
+    d = tmp_path / "decisions"
+    d.mkdir(parents=True, exist_ok=True)
+    full = []
+    for r in records:
+        base = {"owner": OWNER, "repos": ["*"], "approved": True, "approver": "synthetic-co-owner",
+                "approved_on": "2026-01-15"}
+        if r.get("approved", True):
+            base["expires"] = "2099-12-31"
+        full.append({**base, **r})
+    p = d / "t3-signoffs.yaml"
+    p.write_text(json.dumps({"signoffs": full}), encoding="utf-8")
+    return p
+
+
+class _Strict:
+    """`--allow-t3` in this context, reading the given record file."""
+
+    def __init__(self, monkeypatch, path):
+        self.monkeypatch, self.path = monkeypatch, path
+
+    def __enter__(self):
+        from ctshowcase import signoff
+        from ctshowcase.config import set_t3_signed_off
+        self.monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(self.path))
+        self.tokens = (set_t3_signed_off(True), signoff.reset())
+        return self
+
+    def __exit__(self, *exc):
+        from ctshowcase import signoff
+        from ctshowcase.config import reset_t3_signed_off
+        t3, run = self.tokens
+        signoff.restore(run)
+        reset_t3_signed_off(t3)
+
+
+def _resolver(brand, registry=None, extra=()):
+    from ctshowcase.resolver import Resolver
+    return Resolver(brand, registry or {}, {"rows": {("create-project", "@me", "*", "")}, "ids": set(), "answers": {},
+                                            "actions": [], "extra": list(extra)})
+
+
+def _links(plan):
+    return {j["id"]: j for j in plan["jobs"] if "-link-" in j["id"]}
+
+
+WILD = [{"id": "t3s-all"}, {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+
+
+def _copy(brand, repos):
+    from ctshowcase import project as PJ
+    c = json.loads((FIX / "copy-capture.json").read_text(encoding="utf-8"))
+    p = c["data"]["organization"]["projectV2"]
+    p["url"] = f"https://github.com/orgs/{OWNER}/projects/{p['number']}"
+    return PJ.copy_plan(OWNER, role="org", copied=c, resolver=_resolver(brand), repositories=repos, allow_t3=True,
+                        reviewed="2026-10-25")
+
+
+def test_copy_plan_does_not_link_a_withdrawn_repository(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"])
+    links = _links(plan)
+    assert not [i for i in links if i.endswith("-link-withdrawn-x")], list(links)
+    assert any(i.endswith("-link-ok-y") for i in links), list(links)
+    assert any(str(x).startswith(f"t3-signoff:revoked:{OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+    assert any(str(x).startswith(f"link-held:{OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+    ok = [j for i, j in links.items() if i.endswith("-link-ok-y")][0]
+    assert ok.get("signoff_id") == "t3s-all", ok
+
+
+def test_copy_plan_link_carries_the_repository_regrant(tmp_path, monkeypatch, brand):
+    recs = [*WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"])
+    links = _links(plan)
+    wx = [j for i, j in links.items() if i.endswith("-link-withdrawn-x")]
+    oy = [j for i, j in links.items() if i.endswith("-link-ok-y")]
+    assert wx and wx[0].get("signoff_id") == "t3s-regrant", links
+    assert oy and oy[0].get("signoff_id") == "t3s-all", links
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+
+
+def _add_org_field(cap, option_desc):
+    cap["data"]["user"]["projectV2"]["fields"]["nodes"].append({
+        "__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099, "name": "Org",
+        "dataType": "SINGLE_SELECT", "isIssueField": False, "options": [
+            {"id": "opt-t3-synthetic", "name": "Pick Your AI", "color": "GRAY", "description": option_desc},
+            {"id": "opt-t1-synthetic", "name": "CompleteTech Skills", "color": "BLUE",
+             "description": "T1: CompleteTech-Skills"}]})
+    return cap
+
+
+def _captured(option_desc):
+    return _add_org_field(json.loads((FIX / "estate-copy-capture.json").read_text(encoding="utf-8")), option_desc)
+
+
+def _registry(include_owner):
+    from ctshowcase.config import load_yaml_text
+    reg = load_yaml_text((ROOT / "tests" / "fixtures" / "org" / "registry.yaml").read_text(encoding="utf-8"))
+    reg["orgs"].pop(OWNER, None)
+    if include_owner:
+        reg["orgs"][OWNER] = {}
+    for g in reg["profile"]["org_directory"]:
+        g["orgs"] = [o for o in g.get("orgs", []) if o != OWNER]
+    return reg
+
+
+WITHDRAWN = [{"id": "t3s-g"}, {"id": "t3s-w", "approved": False, "approved_on": "2026-10-01"}]
+
+
+@pytest.mark.parametrize("records", [WITHDRAWN, []], ids=["withdrawn", "missing"])
+def test_estate_replan_holds_a_captured_t3_option_whose_org_left_the_registry(tmp_path, monkeypatch, brand, records):
+    from ctshowcase import project as PJ
+    reg = _registry(False)
+    assert OWNER not in reg["orgs"]
+    with _Strict(monkeypatch, _file(tmp_path, records)):
+        plan = PJ.estate_plan(_resolver(brand, reg), copied=_captured(f"T3: {OWNER}"), user_id=100, allow_t3=True)
+    assert any(str(x).startswith("t3-signoff:") and x.endswith(OWNER) for x in plan["logs"]), plan["logs"]
+    assert any(str(x).startswith("hold:org-options") for x in plan["logs"]), plan["logs"]
+    blob = json.dumps(plan["jobs"], ensure_ascii=False)
+    assert "Pick Your AI" not in blob and OWNER not in blob, [j["id"] for j in plan["jobs"]]
+    assert not any("-options-org" in j["id"] for j in plan["jobs"]), "a T1 option update was emitted with the T3 option"
+    assert not any("--readme" in j.get("argv", []) for j in plan["jobs"]), plan["jobs"]
+
+
+def test_estate_replan_holds_a_registry_free_captured_option_under_a_former_login(tmp_path, monkeypatch, brand):
+    """An approved rename leaves the captured option described `T3: Pick-Your-AI` while the org is absent from
+    registry.orgs and its sign-off is withdrawn: the hold still applies (no option write, no README naming it)."""
+    from ctshowcase import project as PJ
+    res = _resolver(brand, _registry(False), extra=[{"action": "org-rename", "owner": OWNER, "new_name": "Pick-Your-Stack"}])
+    assert res.canonical(OWNER) == "Pick-Your-Stack"
+    with _Strict(monkeypatch, _file(tmp_path, WITHDRAWN)):
+        held = PJ.held_captured_t3(res, PJ.normalize(_captured(f"T3: {OWNER}")), True)
+        plan = PJ.estate_plan(res, copied=_captured(f"T3: {OWNER}"), user_id=100, allow_t3=True)
+    assert held and held[0].startswith("t3-signoff:revoked:"), held
+    assert not any("-options-org" in j["id"] for j in plan["jobs"]), plan["jobs"]
+    assert not any("--readme" in j.get("argv", []) for j in plan["jobs"]), plan["jobs"]
+
+
+def test_registry_free_captured_t3_option_is_kept_when_authorized(tmp_path, monkeypatch, brand):
+    """Control: with a valid wildcard record the same capture is not held."""
+    from ctshowcase import project as PJ
+    with _Strict(monkeypatch, _file(tmp_path, [{"id": "t3s-all"}])):
+        held = PJ.held_captured_t3(_resolver(brand, _registry(False)), PJ.normalize(_captured(f"T3: {OWNER}")), True)
+    assert held == [], held
+
+
+def test_retained_authorized_captured_t3_option_carries_its_signoff_id(tmp_path, monkeypatch, brand):
+    """The org keeps a valid wildcard record and is in registry.orgs, but a nonempty profile.org_directory excludes it:
+    the captured option is retained, so the Org-update and README jobs naming it must carry the sign-off id."""
+    from ctshowcase import project as PJ
+    from test_t3_signoff_require import _complete_estate_capture
+    reg = _registry(True)
+    assert reg["profile"]["org_directory"]
+    full = _complete_estate_capture()
+    full["data"]["user"]["projectV2"]["fields"]["nodes"][-1]["options"].append(
+        {"id": "opt-t1-synthetic", "name": "CompleteTech Skills", "color": "BLUE", "description": "T1: CompleteTech-Skills"})
+    with _Strict(monkeypatch, _file(tmp_path, [{"id": "t3s-all"}])):
+        plan = PJ.estate_plan(_resolver(brand, reg), copied=full, user_id=100, allow_t3=True)
+    named = [j for j in plan["jobs"] if "Pick Your AI" in json.dumps(j, ensure_ascii=False) or OWNER in json.dumps(j)]
+    assert any("--readme" in j.get("argv", []) for j in named), [j["id"] for j in plan["jobs"]]
+    assert all(j.get("signoff_id") == "t3s-all" or "t3s-all" in (j.get("signoff_ids") or []) for j in named), named
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index 23f2373..6b91a1a 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -241,3 +241,84 @@ def test_whitespace_padded_withdrawal_scope_still_vetoes_a_single_repository(rep
     """A schema-valid but padded `repos` entry must scope the same way for a single repository as for the owner."""
     recs = [_rec("g1", ["*"]), _rec("w1", repos, approved=False, on="2026-06-01")]
     assert _ev(recs, "site") == (None, "revoked")
+
+
+# One owner-normalisation policy (strip all surrounding whitespace, then case-fold) for evaluate(), _withdrawn() and
+# record_for(): a padded spelling of an owner is that owner, never a different one that escapes its withdrawal.
+PADDED = [" Acme", "Acme ", " Acme ", "\tAcme\n", " Acme "]
+
+
+def _pad(template, name):
+    return template.replace("Acme", name)
+
+
+@pytest.mark.parametrize("padded", PADDED)
+@pytest.mark.parametrize("repo", ["site", None])
+def test_padded_owner_withdrawal_revokes_the_grant(padded, repo):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["*"], approved=False, on="2026-06-01", owner=padded)]
+    assert _ev(recs, repo) == (None, "revoked")
+
+
+def test_plain_owner_withdrawal_control():
+    recs = [_rec("g1", ["*"]), _rec("w1", ["*"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "site") == (None, "revoked") and _ev(recs, None) == (None, "revoked")
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_padded_grant_owner_with_a_clean_withdrawal_is_revoked(padded):
+    recs = [_rec("g1", ["*"], owner=padded), _rec("w1", ["*"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "site") == (None, "revoked") and _ev(recs, None) == (None, "revoked")
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_padded_grant_owner_alone_still_grants(padded):
+    assert _ev([_rec("g1", ["*"], owner=padded)], "site") == ("g1", None)
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_padded_unrelated_owner_withdrawal_is_isolated(padded):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["*"], approved=False, on="2026-06-01", owner=_pad(padded, "Other"))]
+    assert _ev(recs, "site") == ("g1", None) and _ev(recs, None) == ("g1", None)
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_require_refuses_a_padded_owner_withdrawal(padded, tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    from ctshowcase.errors import Refused
+    p = tmp_path / "s.yaml"
+    p.write_text(json.dumps({"signoffs": [_rec("g1", ["*"]),
+                                          _rec("w1", ["*"], approved=False, on="2026-06-01", owner=padded)]}),
+                 encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(p))
+    run = signoff.reset()
+    try:
+        for repo in ("site", None):
+            with pytest.raises(Refused) as ei:
+                signoff.require(OWN, repo)
+            assert ei.value.log == "t3-signoff:revoked", ei.value.log
+    finally:
+        signoff.restore(run)
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_record_for_never_stamps_a_grant_withdrawn_under_a_padded_owner(padded, tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    recs = [_rec("g1", ["*"]), _rec("w1", ["a"], approved=False, on="2026-06-01", owner=padded)]
+    p = tmp_path / "s.yaml"
+    p.write_text(json.dumps({"signoffs": recs}), encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(p))
+    run = signoff.reset()
+    try:
+        signoff._grant(OWN.lower(), recs[0])
+        assert signoff.record_for(OWN, "a") is None
+        assert signoff.record_for(OWN, "site")["id"] == "g1"
+    finally:
+        signoff.restore(run)
+
+
+@pytest.mark.parametrize("padded", PADDED)
+def test_cli_refuses_a_padded_owner_withdrawal(padded, tmp_path):
+    own = "Pick-Your-AI"
+    recs = [_rec("g1", ["*"], owner=own), _rec("w1", ["*"], approved=False, on="2026-06-01", owner=_pad(padded, own))]
+    r = _cli(tmp_path, recs, "describe")
+    assert r.returncode == 2 and "t3-signoff:revoked" in r.stdout + r.stderr, r.stdout + r.stderr

From d061be7cc185d1932b0c6a8c87cced362603da37 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 00:18:49 -0400
Subject: [PATCH 45/79] fix(signoff): derive project settings job from
 sign-off-filtered repositories

The Project SETTINGS browser job named repositories[0] from the unfiltered
repository list, so a withdrawn or unauthorized repository could be chosen as
default repository and auto-add target. copy_plan now collects only the
repositories that passed the link checks (same owner, not duplicate, valid
sign-off record for T3 owners) and builds the settings job from that list.
If no authorized repository remains, the settings job is held with a logged
settings-held reason. An authorized target's sign-off record id is stamped on
the settings job.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 29 ++++++++++++++++++++---------
 1 file changed, 20 insertions(+), 9 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index cd4a40e..e9ac355 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -938,6 +938,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     jobs.append(_job(f"{pid}-{num}-text-{_digest(edit)}", "project", edit, owner,
                      "§13.2 short description" + (" and §13.7 README" if text is not None else " (README after re-capture)")))
     # 5. repository links (org boards: same owner only), then R5 re-run
+    authorized: list[tuple[str, dict | None]] = []  # (repo, sign-off record or None): the only repos the settings job may name
     if role == "org":
         linked = set()
         for r in repositories or []:
@@ -957,6 +958,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                     logs.append(f"link-held:{r} (no valid T3 sign-off covers this repository)")
                     continue
             linked.add(r.lower())
+            authorized.append((r, rec))
             link = _job(f"{pid}-{num}-link-{_repo_key(r.split('/', 1)[1])}", "project",
                         ["gh", "project", "link", num, "--owner", owner, "--repo", r], owner,
                         "Link before the §10.1 settings pass, or re-run R5 afterwards (§13.11).")
@@ -1005,15 +1007,24 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                               f"templates', tick '{title}' and save.", "Screenshot the setting."],
                              "project-recommended-template", "§13.9 step 6: offer the template in the org's dialog."))
     if role == "org":
-        main = (repositories or [None])[0]
-        steps = [f"Open {url}/settings.",
-                 f"Under 'Default repository', choose {main}." if main else "Under 'Default repository', choose the org's main repository.",
-                 f"Open {url}/workflows, select 'Auto-add to project', click 'Edit', choose {main or 'the main repository'} "
-                 "and the filter is:issue,pr is:open, then click 'Save and turn on workflow'.",
-                 "Check every view against the template screenshots and fix any UI-only setting that differs.",
-                 f"Screenshot every view into state/screens/projects/{sid}/."]
-        jobs.append(_browser(f"{pid}-{num}-settings", owner, f"{url}/settings", steps, "project-settings",
-                             "§13.9 step 7: default repository, auto-add and view checks (UI only)."))
+        if repositories and not authorized:
+            # every listed repository is withdrawn, unauthorized or on another owner: the default-repository and
+            # auto-add steps would name one of them, so the settings job is held instead of emitted
+            logs.append("settings-held:default-repository-and-auto-add (no authorized repository remains to choose; links held or skipped)")
+        else:
+            main, main_rec = authorized[0] if authorized else (None, None)
+            steps = [f"Open {url}/settings.",
+                     f"Under 'Default repository', choose {main}." if main else "Under 'Default repository', choose the org's main repository.",
+                     f"Open {url}/workflows, select 'Auto-add to project', click 'Edit', choose {main or 'the main repository'} "
+                     "and the filter is:issue,pr is:open, then click 'Save and turn on workflow'.",
+                     "Check every view against the template screenshots and fix any UI-only setting that differs.",
+                     f"Screenshot every view into state/screens/projects/{sid}/."]
+            settings_job = _browser(f"{pid}-{num}-settings", owner, f"{url}/settings", steps, "project-settings",
+                                    "§13.9 step 7: default repository, auto-add and view checks (UI only).")
+            if main_rec is not None and main_rec.get("id"):  # the granting record of the repository the job names
+                from . import signoff
+                signoff.stamp_associations(settings_job, [str(main_rec["id"])])
+            jobs.append(settings_job)
         if status_update and spec.get("status_updates"):
             # createProjectV2StatusUpdate is not idempotent: a board that already has an update never gets another "first"
             logs.append("status-update:exists")

From 84d5d1c8adfc976615fb97cc37282b66eaf74f2e Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 00:19:10 -0400
Subject: [PATCH 46/79] test(signoff): regress project settings job against
 withdrawn repositories

Add four synthetic copy-plan regressions for the Project settings browser job:
a withdrawn repository is excluded from Default repository and auto-add, an
all-withdrawn board holds the settings job with a settings-held log, an
authorized regrant keeps its record id on the settings job, and a plan with no
repositories keeps the generic settings text. The first three fail until
project.py derives the settings steps from the sign-off filtered list.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_emission_scope.py | 56 +++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
index 9f56252..20cf741 100644
--- a/tests/test_t3_emission_scope.py
+++ b/tests/test_t3_emission_scope.py
@@ -98,6 +98,62 @@ def test_copy_plan_link_carries_the_repository_regrant(tmp_path, monkeypatch, br
     assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
 
 
+def _settings(plan):
+    return [j for j in plan["jobs"] if j["id"].endswith("-settings")]
+
+
+def test_copy_plan_settings_excludes_withdrawn_repository(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"])
+    settings = _settings(plan)
+    assert len(settings) == 1, [j["id"] for j in plan["jobs"]]
+    steps = settings[0]["steps"]
+    default = [s for s in steps if "Default repository" in s]
+    auto = [s for s in steps if "Auto-add" in s]
+    assert default and "ok-y" in default[0] and "withdrawn-x" not in default[0], default
+    assert auto and "ok-y" in auto[0] and "withdrawn-x" not in auto[0], auto
+    for j in plan["jobs"]:
+        if j.get("kind") == "browser":
+            assert not any("withdrawn-x" in s for s in j["steps"]), j["id"]
+    assert settings[0].get("signoff_id") == "t3s-all", settings[0]
+    assert any(str(x).startswith(f"link-held:{OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+
+
+def test_copy_plan_settings_held_when_all_repositories_withdrawn(tmp_path, monkeypatch, brand):
+    recs = [{"id": "t3s-all"},
+            {"id": "t3s-drop-x", "repos": ["withdrawn-x", "withdrawn-z"], "approved": False, "approved_on": "2026-10-01"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/withdrawn-z"])
+    assert not _settings(plan), [j["id"] for j in plan["jobs"]]
+    assert any(str(x).startswith("settings-held:") for x in plan["logs"]), plan["logs"]
+    for j in plan["jobs"]:
+        if j.get("kind") == "browser":
+            steps = " ".join(j["steps"])
+            assert "withdrawn-x" not in steps and "withdrawn-z" not in steps, j["id"]
+    assert not [j for j in plan["jobs"] if "-link-" in j["id"]], [j["id"] for j in plan["jobs"]]
+
+
+def test_copy_plan_settings_keeps_regrant_ids(tmp_path, monkeypatch, brand):
+    recs = [*WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"])
+    settings = _settings(plan)
+    assert len(settings) == 1, [j["id"] for j in plan["jobs"]]
+    default = [s for s in settings[0]["steps"] if "Default repository" in s]
+    assert default and "withdrawn-x" in default[0], default
+    assert settings[0].get("signoff_id") == "t3s-regrant", settings[0]
+    assert not any(str(x).startswith("settings-held:") for x in plan["logs"]), plan["logs"]
+
+
+def test_copy_plan_without_repositories_keeps_generic_settings(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy(brand, None)
+    settings = _settings(plan)
+    assert len(settings) == 1, [j["id"] for j in plan["jobs"]]
+    assert any("the org's main repository" in s for s in settings[0]["steps"]), settings[0]["steps"]
+    assert not any(str(x).startswith("settings-held:") for x in plan["logs"]), plan["logs"]
+
+
 def _add_org_field(cap, option_desc):
     cap["data"]["user"]["projectV2"]["fields"]["nodes"].append({
         "__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099, "name": "Org",

From 5f00a1e53dbb49f3863b041365ba00012f7fc546 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 00:19:49 -0400
Subject: [PATCH 47/79] docs(signoff): settings pass uses authorized
 repositories only; changelog

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 1 +
 references/projects.md   | 2 ++
 references/t3-signoff.md | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3031b2f..9d0d643 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 ### Added
 
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
+- `project copy-plan --allow-t3` builds the §13.9 step 7 settings job (default repository, auto-add) from the sign-off-authorized repositories only: a withdrawn or unauthorized repository is never chosen, the job is held with `settings-held:` when none remains, and the job carries the `signoff_id` of the repository it names (issue 23).
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
diff --git a/references/projects.md b/references/projects.md
index 55bbedc..c292e56 100644
--- a/references/projects.md
+++ b/references/projects.md
@@ -54,3 +54,5 @@ Jobs follow the shared contract `{id, phase: "6.3", kind, org, approval_id?, arg
 ## Without the estate bundle
 
 `capture-query`, `normalize`, `lint` and `readme` work on any capture file. `copy-plan` and `estate-plan` use `references/brand.yaml` for display names and read approvals and the registry only when given (`--registry`, `--approved`) or found beside the skill (`$SHOWCASE_ESTATE_ROOT`); with none, every approval is "not yet given" and logged. Synthetic captures for trying the commands are in `tests/fixtures/project/`.
+
+Settings pass (§13.9 step 7): with `--allow-t3`, the Default repository and auto-add steps use only sign-off-authorized repositories, are held with `settings-held:` when none remain, and the settings job carries `signoff_id`/`signoff_ids` (see t3-signoff.md).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 924d4a6..7dfcfbe 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -61,3 +61,5 @@ An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gate
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
 The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it.
+
+Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.

From d874a4a683032d2a372b51d3d995b45963955598 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 00:26:57 -0400
Subject: [PATCH 48/79] docs(signoff): store t3-signoff.md section sign as
 UTF-8

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 references/t3-signoff.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 7dfcfbe..df807e0 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -62,4 +62,4 @@ Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the recor
 
 The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it.
 
-Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.
+Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.

From e12a9515fe275427a7bf1bac121fe4ed6c59c746 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:00:21 -0400
Subject: [PATCH 49/79] test(signoff): regress workflow and README emission
 scope (#23)

Add failing regressions for the emission-boundary findings: the -workflows
browser job must not keep an auto-add step when no repository is authorized,
must name only the authorized repository with its granting id, and the README
job must omit withdrawn links and carry the repository regrant id rather than
the cached wildcard. The no-repositories case stays unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_emission_scope.py | 85 +++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)

diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
index 20cf741..67cc2c7 100644
--- a/tests/test_t3_emission_scope.py
+++ b/tests/test_t3_emission_scope.py
@@ -234,3 +234,88 @@ def test_retained_authorized_captured_t3_option_carries_its_signoff_id(tmp_path,
     named = [j for j in plan["jobs"] if "Pick Your AI" in json.dumps(j, ensure_ascii=False) or OWNER in json.dumps(j)]
     assert any("--readme" in j.get("argv", []) for j in named), [j["id"] for j in plan["jobs"]]
     assert all(j.get("signoff_id") == "t3s-all" or "t3s-all" in (j.get("signoff_ids") or []) for j in named), named
+
+
+# ---------------------------------------------------------------------------------------------- workflows and README
+def _workflows(plan):
+    return [j for j in plan["jobs"] if j["id"].endswith("-workflows")]
+
+
+def _readme_jobs(plan):
+    return [j for j in plan["jobs"] if "--readme" in (j.get("argv") or [])]
+
+
+def _private_board():
+    """The copy capture with every required view numbered (My items and Shipped added), still private."""
+    c = json.loads((FIX / "copy-capture.json").read_text(encoding="utf-8"))
+    p = c["data"]["organization"]["projectV2"]
+    p["url"] = f"https://github.com/orgs/{OWNER}/projects/{p['number']}"
+    p["views"]["nodes"] += [
+        {**p["views"]["nodes"][2], "id": "PVTV_n6", "number": 6, "name": "My items", "filter": "assignee:@me -status:Done"},
+        {**p["views"]["nodes"][2], "id": "PVTV_n7", "number": 7, "name": "Shipped", "filter": "status:Done updated:>=@today-30d"}]
+    assert p["public"] is False, p["public"]
+    return c
+
+
+def _copy_private(brand, repos):
+    from ctshowcase import project as PJ
+    return PJ.copy_plan(OWNER, role="org", copied=_private_board(), resolver=_resolver(brand), repositories=repos,
+                        allow_t3=True, reviewed="2026-10-25")
+
+
+def test_copy_plan_workflows_job_omits_auto_add_when_all_withdrawn(tmp_path, monkeypatch, brand):
+    recs = [{"id": "t3s-all"},
+            {"id": "t3s-drop-x", "repos": ["withdrawn-x", "withdrawn-z"], "approved": False, "approved_on": "2026-10-01"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/withdrawn-z"])
+    for j in _workflows(plan):
+        steps = " ".join(j["steps"])
+        assert "withdrawn-x" not in steps and "withdrawn-z" not in steps, (j["id"], j["steps"])
+        assert not any("auto-add" in s.lower() for s in j["steps"]), (j["id"], j["steps"])
+    assert not _settings(plan), [j["id"] for j in plan["jobs"]]
+    assert any(str(x).startswith(("workflows-held:", "settings-held:")) for x in plan["logs"]), plan["logs"]
+
+
+def test_copy_plan_workflows_job_names_authorized_repo_and_id(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"])
+    wf = _workflows(plan)
+    assert len(wf) == 1, [j["id"] for j in plan["jobs"]]
+    steps = wf[0]["steps"]
+    auto = [s for s in steps if "auto-add" in s.lower()]
+    assert auto and "ok-y" in auto[0] and "withdrawn-x" not in auto[0], steps
+    assert not any("withdrawn-x" in s for s in steps), steps
+    assert wf[0].get("signoff_id") == "t3s-all", wf[0]
+
+
+def test_copy_plan_readme_omits_withdrawn_link_and_stamps_grant(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy_private(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"])
+    rd = _readme_jobs(plan)
+    assert len(rd) == 1, [j["id"] for j in plan["jobs"]]
+    text = rd[0]["argv"][rd[0]["argv"].index("--readme") + 1]
+    assert "withdrawn-x" not in text, text
+    assert "kept-y" in text, text
+    assert rd[0].get("signoff_id") == "t3s-all", rd[0]
+
+
+def test_copy_plan_readme_stamps_regrant_not_cached_wildcard(tmp_path, monkeypatch, brand):
+    recs = [*WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _copy_private(brand, [f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"])
+    rd = _readme_jobs(plan)
+    assert len(rd) == 1, [j["id"] for j in plan["jobs"]]
+    text = rd[0]["argv"][rd[0]["argv"].index("--readme") + 1]
+    assert "withdrawn-x" in text and "kept-y" in text, text
+    ids = set(rd[0].get("signoff_ids") or [])
+    assert {"t3s-regrant", "t3s-all"} <= ids, rd[0]
+
+
+def test_copy_plan_without_repositories_readme_and_workflows_unchanged(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy(brand, None)
+    wf = _workflows(plan)
+    assert len(wf) == 1, [j["id"] for j in plan["jobs"]]
+    assert any("auto-add" in s.lower() for s in wf[0]["steps"]), wf[0]["steps"]
+    assert "signoff_id" not in wf[0], wf[0]
+    assert not any(str(x).startswith("settings-held:") for x in plan["logs"]), plan["logs"]

From 34a5a25ebcc602acc060ca899e3995a7d6b31eef Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:04:22 -0400
Subject: [PATCH 50/79] fix(signoff): decide copy-plan repositories once before
 README and browser jobs

Hoist the repository sign-off loop in copy_plan ahead of the README text
job. Withdrawn or unauthorized repositories are held before any job names
them: README links, default repository, and the auto-add workflow step.
The workflows job now omits auto-add when no repository is authorized and
names the authorized one otherwise. Granting ids are stamped on the text
and workflows jobs as well as the link jobs. Captured repositories the README
names are checked the same way when --repos is not given.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 105 +++++++++++++++++++++++++---------
 1 file changed, 77 insertions(+), 28 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index e9ac355..d0931ff 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -913,32 +913,15 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
         if ui:
             want = dict(want, ui=list(want.get("ui") or []) + ui)
         vlist[i] = want
-    # 4. text: short description and README (README needs every view number)
-    nums = view_numbers(spec)
-    edit = ["gh", "project", "edit", num, "--owner", own_flag, "--description", short]
-    text = readme_text
+    # 0. repository sign-off (org boards), decided before the README and the browser steps: the links, the README text,
+    # the default repository and auto-add all take their repositories from this one filtered set, so a withdrawn one is
+    # named by none of them
+    authorized: list[tuple[str, dict | None]] = []  # (repo, sign-off record or None): the only repos the settings job may name
+    link_jobs: list[dict] = []  # repository-link jobs, emitted right after the text job
+    held_lower: set[str] = set()  # lowercase owner/repo names held for lack of a valid sign-off
+    grants: dict[str, dict | None] = {}  # lowercase owner/repo -> the sign-off record that covers it
     readme_repos, lg = _readme_repos(spec, owner, role, resolver, repositories)
     logs += lg
-    if held_t3:
-        text = None
-        pending.append({"why": "README held: the Org field names a T3 org with no valid sign-off record",
-                        "needs": "a valid record in the sign-off file, or remove the option on the board"})
-    elif text is None:
-        try:
-            text, lg = readme(owner, name, number, nums, repositories=readme_repos,
-                              out_of_scope=out_of_scope, reviewed=reviewed, views=vlist, estate=role == "estate",
-                              fields=doc_fields(spec, planned, estate=role == "estate"))
-            logs += lg
-        except NeedsInput:
-            pending.append({"why": "README needs every view number: re-capture after the view jobs run"})
-    if text is not None:
-        edit += ["--readme", text]
-    # ids carry a content hash: the README-bearing re-plan (after the view jobs ran) is a new job, never the earlier id
-    # with other content, which the writer refuses together with its whole batch
-    jobs.append(_job(f"{pid}-{num}-text-{_digest(edit)}", "project", edit, owner,
-                     "§13.2 short description" + (" and §13.7 README" if text is not None else " (README after re-capture)")))
-    # 5. repository links (org boards: same owner only), then R5 re-run
-    authorized: list[tuple[str, dict | None]] = []  # (repo, sign-off record or None): the only repos the settings job may name
     if role == "org":
         linked = set()
         for r in repositories or []:
@@ -956,16 +939,71 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                 if rec is None:
                     logs.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{r}")
                     logs.append(f"link-held:{r} (no valid T3 sign-off covers this repository)")
+                    held_lower.add(r.lower())
                     continue
             linked.add(r.lower())
             authorized.append((r, rec))
+            grants[r.lower()] = rec
             link = _job(f"{pid}-{num}-link-{_repo_key(r.split('/', 1)[1])}", "project",
                         ["gh", "project", "link", num, "--owner", owner, "--repo", r], owner,
                         "Link before the §10.1 settings pass, or re-run R5 afterwards (§13.11).")
             if rec is not None and rec.get("id"):  # the repository's own granting id; approval_id is never touched
                 signoff.stamp_associations(link, [str(rec["id"])])
-            jobs.append(link)
+            link_jobs.append(link)
+        if allow_t3 and resolver is not None and resolver.owner_status(owner) == "t3":
+            # captured repositories that the README names (and --repos does not) face the same check: a withdrawn one is held
+            from . import signoff
+            for r0 in readme_repos:
+                if "/" not in r0 or not resolver_same(resolver, r0.split("/", 1)[0], owner):
+                    continue
+                r = f"{owner}/{r0.split('/', 1)[1]}"
+                if r.lower() in grants or r.lower() in held_lower:
+                    continue
+                rec, why = signoff.evaluate([owner, *resolver.aliases(owner)], r.split("/", 1)[1])
+                if rec is None:
+                    logs.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{r}")
+                    held_lower.add(r.lower())
+                else:
+                    grants[r.lower()] = rec
         reads.append({"name": "org-projects-setting", "argv": ["gh", "api", f"orgs/{owner}", "--jq", ".has_organization_projects"]})
+    # 4. text: short description and README (README needs every view number)
+    nums = view_numbers(spec)
+    edit = ["gh", "project", "edit", num, "--owner", own_flag, "--description", short]
+    text = readme_text
+    if role == "org":  # a repository held for lack of a valid sign-off is named by no README link
+        readme_repos = [r for r in readme_repos if "/" not in r or f"{owner}/{r.split('/', 1)[1]}".lower() not in held_lower]
+    if held_t3:
+        text = None
+        pending.append({"why": "README held: the Org field names a T3 org with no valid sign-off record",
+                        "needs": "a valid record in the sign-off file, or remove the option on the board"})
+    elif text is None:
+        try:
+            text, lg = readme(owner, name, number, nums, repositories=readme_repos,
+                              out_of_scope=out_of_scope, reviewed=reviewed, views=vlist, estate=role == "estate",
+                              fields=doc_fields(spec, planned, estate=role == "estate"))
+            logs += lg
+        except NeedsInput:
+            pending.append({"why": "README needs every view number: re-capture after the view jobs run"})
+    if text is not None:
+        edit += ["--readme", text]
+    # ids carry a content hash: the README-bearing re-plan (after the view jobs ran) is a new job, never the earlier id
+    # with other content, which the writer refuses together with its whole batch
+    text_job = _job(f"{pid}-{num}-text-{_digest(edit)}", "project", edit, owner,
+                    "§13.2 short description" + (" and §13.7 README" if text is not None else " (README after re-capture)"))
+    if role == "org" and text is not None:
+        # the granting records of the repositories the README names (a retained authorized one carries its own)
+        ids: list[str] = []
+        for r in readme_repos:
+            if "/" in r and resolver_same(resolver, r.split("/", 1)[0], owner):
+                rec = grants.get(f"{owner}/{r.split('/', 1)[1]}".lower())
+                if rec and rec.get("id"):
+                    ids.append(str(rec["id"]))
+        if ids:
+            from . import signoff
+            signoff.stamp_associations(text_job, list(dict.fromkeys(ids)))
+    jobs.append(text_job)
+    # 5. repository links (org boards: same owner only), decided in step 0 and emitted here, before the browser steps
+    jobs.extend(link_jobs)
     # 6. browser: UI-only view settings, workflows, insights, default repo, auto-add, recommended template
     url = project_url(owner, number)
     for v in vlist:
@@ -983,15 +1021,26 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
         on = on_tpl if role == "template" else on_org
         if words == "auto-add" and role == "estate":
             continue
+        if words == "auto-add" and role == "org" and repositories and not authorized:
+            # no repository may be chosen for the auto-add rule: the step names none, so it is held rather than emitted
+            logs.append("workflows-held:auto-add (no authorized repository remains to choose; links held or skipped)")
+            continue
         have = next((w for w in spec.get("workflows") or [] if words.split()[-1] in (w.get("name") or "").lower()), None)
         label = have.get("name") if have else words.title()
-        if on:
+        if on and words == "auto-add" and role == "org" and authorized:
+            wf_steps.append(f"Select '{label}', click 'Edit', choose {authorized[0][0]}, set {WORKFLOW_UI[words]} "
+                            "Click 'Save and turn on workflow'.")
+        elif on:
             wf_steps.append(f"Select '{label}', click 'Edit', set {WORKFLOW_UI[words]} Click 'Save and turn on workflow'.")
         else:
             wf_steps.append(f"Leave '{label}' off on the template (auto-add is set per org after the copy).")
     wf_steps.append(f"Screenshot the workflows list into state/screens/projects/{sid}/workflows.png.")
-    jobs.append(_browser(f"{pid}-{num}-workflows", owner, f"{url}/workflows", wf_steps, "project-workflows",
-                         "§13.6 built-in workflows: UI only; never delete a workflow (no API can recreate it)."))
+    wf_job = _browser(f"{pid}-{num}-workflows", owner, f"{url}/workflows", wf_steps, "project-workflows",
+                      "§13.6 built-in workflows: UI only; never delete a workflow (no API can recreate it).")
+    if authorized and authorized[0][1] and authorized[0][1].get("id"):  # the granting record of the repository auto-add names
+        from . import signoff
+        signoff.stamp_associations(wf_job, [str(authorized[0][1]["id"])])
+    jobs.append(wf_job)
     if role == "template":
         jobs.append(_browser(f"{pid}-{num}-insights", owner, f"{url}/insights",
                              [f"Open {url}/insights.", "Keep the default 'Burn up' chart.",

From 4d988514245fd083062f315d996f0821ddb86dc1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:05:35 -0400
Subject: [PATCH 51/79] docs(signoff): copy-plan README, auto-add and settings
 follow per-repository authorization

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 1 +
 references/t3-signoff.md | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a0eae4..cf3bb7d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - `project copy-plan --allow-t3` builds the §13.9 step 7 settings job (default repository, auto-add) from the sign-off-authorized repositories only: a withdrawn or unauthorized repository is never chosen, the job is held with `settings-held:` when none remains, and the job carries the `signoff_id` of the repository it names (issue 23).
+- `project copy-plan --allow-t3` decides the repository sign-off once, before the README and browser jobs (issue 23): a withdrawn or unauthorized repository (listed in `--repos` or only captured in the board's README) is named by no README link, and the README job carries the granting ids of the links it keeps (a repository-specific regrant, not the cached wildcard). The `-workflows` browser job omits its auto-add step (log `workflows-held:auto-add`) when no repository is authorized, otherwise names the authorized repository and carries its granting `signoff_id`. Job order and ids are unchanged; standalone `project readme` is unchanged.
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index df807e0..e45cdd0 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -63,3 +63,5 @@ Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the recor
 The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it.
 
 Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.
+
+Copy-plan sign-off scope: the per-repository authorization is decided once, before any job names a repository. The README job (links and default repository), the auto-add step of the `-workflows` browser job and the settings job all follow it. A withdrawn or unauthorized repository, whether from `--repos` or only captured in the board's README, appears in none of them. When no repository is authorized the auto-add step is omitted (`workflows-held:auto-add`). Each of these jobs carries the granting `signoff_id` of the repository records it names, so a later repository-specific regrant is stamped instead of the cached wildcard grant. Standalone `project readme` generation is unchanged.

From 7c2d32dc3e2a03fcb1ebde919d1c7dc10eaf3380 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:03:42 -0500
Subject: [PATCH 52/79] fix(#23): authorize each README repository on its own
 resolved owner

Captured and explicit README repositories are authorized per candidate by
_authorize_readme_repos for every role, not only the board owner's T3
status. Denied references are logged and omitted; granted ones carry their
sign-off id into the README writer job. Link jobs are unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 65 ++++++++++++++++++++++++-----------
 1 file changed, 45 insertions(+), 20 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index d0931ff..9973ca3 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -681,6 +681,46 @@ def _readme_repos(spec: dict, owner: str, role: str, resolver, repos) -> tuple[l
     return repos, []
 
 
+def _grant_key(resolver, ro: str, rn: str) -> str:
+    """The lowercase RESOLVED `<canonical owner>/<repo>` key of grants and held_lower: a former login of an org keys
+    the same as its current one, so a same-owner reference matches the link loop's key."""
+    owner_key = resolver.canonical(ro) if resolver is not None else ro
+    return f"{owner_key}/{rn}".lower()
+
+
+def _authorize_readme_repos(readme_repos, resolver, allow_t3: bool, grants: dict, held_lower: set,
+                            logs: list) -> list[str]:
+    """Keep the README repositories this copy may name. A T3 owner's repository needs a valid sign-off record that
+    covers that repository itself (checked on its own owner and name, whatever the board owner is); a denied one is
+    logged and dropped, a granted one is recorded in grants for the README job's sign-off ids. Other references are
+    kept unchanged, and so is everything when --allow-t3 is not passed."""
+    from . import signoff
+    kept: list[str] = []
+    for r0 in readme_repos:
+        if "/" not in r0:
+            kept.append(r0)
+            continue
+        ro, rn = r0.split("/", 1)
+        if not (allow_t3 and resolver is not None and resolver.owner_status(ro) == "t3"):
+            kept.append(r0)
+            continue
+        key = _grant_key(resolver, ro, rn)
+        if key in grants:  # already authorized by the link loop or an earlier reference
+            kept.append(r0)
+            continue
+        if key in held_lower:
+            continue
+        rec, why = signoff.evaluate([ro, *resolver.aliases(ro)], rn)
+        if rec is None:
+            logs.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{ro}/{rn}")
+            logs.append(f"readme-held:{ro}/{rn} (no valid T3 sign-off covers this repository)")
+            held_lower.add(key)
+            continue
+        grants[key] = rec
+        kept.append(r0)
+    return kept
+
+
 def _is_t3(row: dict) -> bool:
     """A brand or registry org row whose tier starts with T3 (a row with no tier is never T3)."""
     words = str(row.get("tier") or "").split()
@@ -950,28 +990,13 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
             if rec is not None and rec.get("id"):  # the repository's own granting id; approval_id is never touched
                 signoff.stamp_associations(link, [str(rec["id"])])
             link_jobs.append(link)
-        if allow_t3 and resolver is not None and resolver.owner_status(owner) == "t3":
-            # captured repositories that the README names (and --repos does not) face the same check: a withdrawn one is held
-            from . import signoff
-            for r0 in readme_repos:
-                if "/" not in r0 or not resolver_same(resolver, r0.split("/", 1)[0], owner):
-                    continue
-                r = f"{owner}/{r0.split('/', 1)[1]}"
-                if r.lower() in grants or r.lower() in held_lower:
-                    continue
-                rec, why = signoff.evaluate([owner, *resolver.aliases(owner)], r.split("/", 1)[1])
-                if rec is None:
-                    logs.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{r}")
-                    held_lower.add(r.lower())
-                else:
-                    grants[r.lower()] = rec
         reads.append({"name": "org-projects-setting", "argv": ["gh", "api", f"orgs/{owner}", "--jq", ".has_organization_projects"]})
+    # every README repository (explicit or captured) is authorized on its own resolved owner and name, for every role
+    readme_repos = _authorize_readme_repos(readme_repos, resolver, allow_t3, grants, held_lower, logs)
     # 4. text: short description and README (README needs every view number)
     nums = view_numbers(spec)
     edit = ["gh", "project", "edit", num, "--owner", own_flag, "--description", short]
     text = readme_text
-    if role == "org":  # a repository held for lack of a valid sign-off is named by no README link
-        readme_repos = [r for r in readme_repos if "/" not in r or f"{owner}/{r.split('/', 1)[1]}".lower() not in held_lower]
     if held_t3:
         text = None
         pending.append({"why": "README held: the Org field names a T3 org with no valid sign-off record",
@@ -990,12 +1015,12 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     # with other content, which the writer refuses together with its whole batch
     text_job = _job(f"{pid}-{num}-text-{_digest(edit)}", "project", edit, owner,
                     "§13.2 short description" + (" and §13.7 README" if text is not None else " (README after re-capture)"))
-    if role == "org" and text is not None:
+    if text is not None:
         # the granting records of the repositories the README names (a retained authorized one carries its own)
         ids: list[str] = []
         for r in readme_repos:
-            if "/" in r and resolver_same(resolver, r.split("/", 1)[0], owner):
-                rec = grants.get(f"{owner}/{r.split('/', 1)[1]}".lower())
+            if "/" in r:
+                rec = grants.get(_grant_key(resolver, *r.split("/", 1)))
                 if rec and rec.get("id"):
                     ids.append(str(rec["id"]))
         if ids:

From 2485cedc8d817552716a865f6108d3429ca3b709 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:05:38 -0500
Subject: [PATCH 53/79] test(#23): cross-owner README repositories are
 authorized on their own owner

Regressions for explicit and captured T3-owner repositories on a non-T3
board (missing, withdrawn, granted, regrant) plus same-owner, non-T3,
no-flag and standalone readme controls; CHANGELOG note.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |   1 +
 tests/test_t3_signoff_withdrawal.py | 125 ++++++++++++++++++++++++++++
 2 files changed, 126 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f349fa5..cef69c6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - `project copy-plan --allow-t3` builds the §13.9 step 7 settings job (default repository, auto-add) from the sign-off-authorized repositories only: a withdrawn or unauthorized repository is never chosen, the job is held with `settings-held:` when none remains, and the job carries the `signoff_id` of the repository it names (issue 23).
 - `project copy-plan --allow-t3` decides the repository sign-off once, before the README and browser jobs (issue 23): a withdrawn or unauthorized repository (listed in `--repos` or only captured in the board's README) is named by no README link, and the README job carries the granting ids of the links it keeps (a repository-specific regrant, not the cached wildcard). The `-workflows` browser job omits its auto-add step (log `workflows-held:auto-add`) when no repository is authorized, otherwise names the authorized repository and carries its granting `signoff_id`. Job order and ids are unchanged; standalone `project readme` is unchanged.
+- `project copy-plan --allow-t3` authorizes every README repository on its own resolved owner and name, not on the board owner's tier (issue 23): a T3 owner's repository named on a non-T3 board, whether listed in `--repos` or only captured in the board's repositories, needs a valid record covering that repository. A missing or withdrawn one is omitted from the README and logs `t3-signoff:<code>:OWNER/REPO` and `readme-held:OWNER/REPO`; a permitted one stays and its granting `signoff_id` (a repository-specific regrant, not the cached wildcard) is carried on the README job. No link job is created for a captured repository, other owners' repositories and runs without `--allow-t3` are unchanged, and standalone `project readme` is unchanged.
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index 6b91a1a..ef45671 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -322,3 +322,128 @@ def test_cli_refuses_a_padded_owner_withdrawal(padded, tmp_path):
     recs = [_rec("g1", ["*"], owner=own), _rec("w1", ["*"], approved=False, on="2026-06-01", owner=_pad(padded, own))]
     r = _cli(tmp_path, recs, "describe")
     assert r.returncode == 2 and "t3-signoff:revoked" in r.stdout + r.stderr, r.stdout + r.stderr
+
+
+# ------------------------------------------------------------------ cross-owner README repositories (issue 23, r5)
+# A README names repositories of owners other than the board's. Each is authorized on ITS OWN resolved owner and name,
+# whatever the board owner's tier: a T3 owner's repository on a non-T3 board is gated like any T3 repository.
+T3_OWNER = "Pick-Your-AI"
+BOARD_OWNER = "CompleteTech-Skills"
+T3_WILD = [{"id": "t3s-all"},
+           {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+
+
+def _xo_capture(captured=None, owner=BOARD_OWNER):
+    """The private copy capture on `owner`'s board, every view numbered; `captured` fills spec.repositories."""
+    from test_t3_emission_scope import _private_board
+    c = _private_board()
+    p = c["data"]["organization"]["projectV2"]
+    p["url"] = f"https://github.com/orgs/{owner}/projects/{p['number']}"
+    p["repositories"] = {"nodes": [{"nameWithOwner": n} for n in captured or []]}
+    return c
+
+
+def _xo_plan(brand, tmp_path, monkeypatch, records, repos, captured=None, allow_t3=True, owner=BOARD_OWNER):
+    from test_t3_emission_scope import _Strict, _file, _resolver
+    from ctshowcase import project as PJ
+    with _Strict(monkeypatch, _file(tmp_path, records)):
+        return PJ.copy_plan(owner, role="org", copied=_xo_capture(captured, owner), resolver=_resolver(brand),
+                            repositories=repos, allow_t3=allow_t3, reviewed="2026-10-25")
+
+
+def _xo_readme(plan):
+    rd = [j for j in plan["jobs"] if "--readme" in (j.get("argv") or [])]
+    assert len(rd) == 1, [j["id"] for j in plan["jobs"]]
+    return rd[0], rd[0]["argv"][rd[0]["argv"].index("--readme") + 1]
+
+
+def _xo_ids(job):
+    return set(job.get("signoff_ids") or []) | ({job["signoff_id"]} if job.get("signoff_id") else set())
+
+
+def test_cross_owner_board_is_not_t3(brand):
+    """Precondition: the board owner is not T3, the repository owner is (so the board-owner check cannot gate it)."""
+    from test_t3_emission_scope import _resolver
+    r = _resolver(brand)
+    assert r.owner_status(BOARD_OWNER) != "t3" and r.owner_status(T3_OWNER) == "t3"
+
+
+def test_cross_owner_explicit_no_grant_omits_readme_repo(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [], [f"{T3_OWNER}/withdrawn-x"])
+    _, text = _xo_readme(plan)
+    assert "withdrawn-x" not in text, text
+    assert any(str(x).startswith(f"t3-signoff:missing:{T3_OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+
+
+def test_cross_owner_explicit_withdrawn_omitted_kept_retained_with_grant_id(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, T3_WILD, [f"{T3_OWNER}/withdrawn-x", f"{T3_OWNER}/kept-y"])
+    job, text = _xo_readme(plan)
+    assert "withdrawn-x" not in text and "kept-y" in text, text
+    assert "t3s-all" in _xo_ids(job), job
+    assert any(str(x).startswith(f"t3-signoff:revoked:{T3_OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+
+
+def test_cross_owner_explicit_valid_grant_retained_and_stamped(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [{"id": "t3s-all"}], [f"{T3_OWNER}/kept-y"])
+    job, text = _xo_readme(plan)
+    assert "kept-y" in text, text
+    assert "t3s-all" in _xo_ids(job), job
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+
+
+def test_cross_owner_explicit_regrant_stamps_repository_record(brand, tmp_path, monkeypatch):
+    recs = [*T3_WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    plan = _xo_plan(brand, tmp_path, monkeypatch, recs, [f"{T3_OWNER}/withdrawn-x"])
+    job, text = _xo_readme(plan)
+    assert "withdrawn-x" in text, text
+    assert "t3s-regrant" in _xo_ids(job), job
+
+
+def test_cross_owner_captured_repositories_withdrawn_vs_kept(brand, tmp_path, monkeypatch):
+    """repositories=None: the README names the board's captured spec.repositories, each checked on its own owner."""
+    plan = _xo_plan(brand, tmp_path, monkeypatch, T3_WILD, None,
+                    captured=[f"{T3_OWNER}/withdrawn-x", f"{T3_OWNER}/kept-y"])
+    job, text = _xo_readme(plan)
+    assert "withdrawn-x" not in text and "kept-y" in text, text
+    assert "t3s-all" in _xo_ids(job), job
+    assert any(str(x).startswith(f"t3-signoff:revoked:{T3_OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+    assert not [j for j in plan["jobs"] if "-link-" in j["id"]], [j["id"] for j in plan["jobs"]]  # no link job for captured
+
+
+def test_cross_owner_captured_without_grant_omits_repository(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [], None, captured=[f"{T3_OWNER}/withdrawn-x"])
+    _, text = _xo_readme(plan)
+    assert "withdrawn-x" not in text, text
+    assert any(str(x).startswith(f"t3-signoff:missing:{T3_OWNER}/withdrawn-x") for x in plan["logs"]), plan["logs"]
+
+
+def test_control_cross_owner_non_t3_repository_untouched(brand, tmp_path, monkeypatch):
+    other = "Northwind-Trading-Co"
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [], [f"{other}/some-repo"], captured=[f"{other}/cap-repo"])
+    _, text = _xo_readme(plan)
+    assert "some-repo" in text, text
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+
+
+def test_control_same_owner_behaviour_unchanged(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, T3_WILD, [f"{T3_OWNER}/withdrawn-x", f"{T3_OWNER}/kept-y"],
+                    owner=T3_OWNER)
+    job, text = _xo_readme(plan)
+    assert "withdrawn-x" not in text and "kept-y" in text, text
+    assert "t3s-all" in _xo_ids(job), job
+
+
+def test_control_without_allow_t3_path_unchanged(brand, tmp_path, monkeypatch):
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [], [f"{T3_OWNER}/withdrawn-x"], allow_t3=False)
+    _, text = _xo_readme(plan)
+    assert "withdrawn-x" in text, text
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+
+
+def test_control_standalone_project_readme_unchanged(brand):
+    """`project readme` is read-only text: it names the repositories it is given, with no sign-off lookup."""
+    from ctshowcase import project as PJ
+    text, logs = PJ.readme(BOARD_OWNER, "Skills", 3, {v["name"]: i + 1 for i, v in enumerate(PJ.VIEWS)},
+                           repositories=[f"{T3_OWNER}/withdrawn-x"], reviewed="2026-10-25")
+    assert "withdrawn-x" in text, text
+    assert not any(str(x).startswith("t3-signoff:") for x in logs), logs

From 5a0be78409a81edd7c314a6e9d5befc4182dfc6f Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:27:53 -0500
Subject: [PATCH 54/79] fix(#23): merge association sign-off ids instead of
 replacing them

stamp_associations now keeps ids already on the item (signoff_id and
signoff_ids), then the owner's own grant, then the association ids, with
no duplicates. A repository-specific regrant stamped earlier survives a
later Org/association stamp.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 5a3bbcb..598f19c 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -526,14 +526,24 @@ def stamp_associations(item: dict, association_ids, owner: str | None = None, re
     brings in without targeting it: topics.merge `signoff_ids` for an `also_in` membership topic, project.estate_plan
     for a T3 org in the personal Estate's Org field). `signoff_id` is the first id and `signoff_ids` lists all of them
     only when there is more than one. Jobs carry only these sign-off ids: approval_id is never read or set here, since
-    it names the decisions/APPROVED_ACTIONS.yaml row. No-op when there are no association ids.
+    it names the decisions/APPROVED_ACTIONS.yaml row. Ids already on ITEM (`signoff_id`/`signoff_ids`) are kept and
+    merged, never replaced, so a repository-specific regrant stamped earlier survives a later Org/association stamp
+    (tests/test_t3_signoff_withdrawal.py::test_estate_org_option_keeps_repository_regrant).
+    No-op when there are no association ids.
     Shared by showcase.cmd_topics, intake.adopt and project.estate_plan
     (tests/test_t3_signoff_require.py::test_adopt_topics_job_carries_the_also_in_signoff,
     ::test_estate_plan_jobs_carry_the_t3_orgs_signoff)."""
     if not association_ids or not isinstance(item, dict):
         return item
+    existing: list[str] = []
+    if item.get("signoff_id"):
+        existing.append(str(item["signoff_id"]))
+    listed = item.get("signoff_ids")
+    if isinstance(listed, list) and listed:
+        existing += [str(x) for x in listed if x]
     own = record_for(owner, repo) if owner else None
-    ids = list(dict.fromkeys(([str(own["id"])] if own and own.get("id") else []) + [str(x) for x in association_ids]))
+    own_ids = [str(own["id"])] if own and own.get("id") else []
+    ids = list(dict.fromkeys(existing + own_ids + [str(x) for x in association_ids]))
     item["signoff_id"] = ids[0]
     if len(ids) > 1:
         item["signoff_ids"] = ids

From dec1c60313eed61bf0e3426a688f602f87780381 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:28:32 -0500
Subject: [PATCH 55/79] fix(#23): copy-plan estate stamps captured T3 Org
 records on the README job

The shared copy_plan emission path now keeps the retained captured T3 Org
records and stamps the README text job with them, so direct
`copy-plan --role estate` agrees with estate_plan. Repository ids already on
the job are preserved by stamp_associations; name-only Org entries mark shared
display names as ambiguous.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 9973ca3..30c00fc 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -876,7 +876,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     # 1. fields: create what is missing, fix standard options keeping ids
     std_fields = list(FIELDS) + list(extra_fields or [])
     planned: dict[str, list] = {}  # the options each field will have once these jobs run (for the README)
-    held_t3 = held_captured_t3(resolver, spec, allow_t3) if role == "estate" else []
+    held_t3, retained_t3 = captured_t3(resolver, spec, allow_t3) if role == "estate" else ([], [])
     logs += held_t3
     for f in std_fields:
         have = _field(spec, f["name"])
@@ -1026,6 +1026,18 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
         if ids:
             from . import signoff
             signoff.stamp_associations(text_job, list(dict.fromkeys(ids)))
+    if text is not None and retained_t3:
+        # the shared emission path stamps the captured Org options, so direct `copy-plan --role estate` and estate_plan agree
+        orgs_for_stamp = list(retained_t3)
+        known = {x.lower() for o in retained_t3 for x in (o["login"], o["name"])}
+        for o in (_field(spec, "Org") or {}).get("options") or []:
+            name = str(o.get("name") or "")
+            desc = str(o.get("description") or "")
+            ident = re.sub(r"^T[0-9]:\s*", "", desc).strip() or name
+            if not ident or ident.lower() in known or name.lower() in known:
+                continue
+            orgs_for_stamp.append({"login": ident, "name": name})  # name-only: marks a shared display name as ambiguous
+        _stamp_estate_orgs([text_job], orgs_for_stamp)
     jobs.append(text_job)
     # 5. repository links (org boards: same owner only), decided in step 0 and emitted here, before the browser steps
     jobs.extend(link_jobs)

From 12dd13f81c77cf27c4b306c5d10bd21998695f03 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:31:40 -0500
Subject: [PATCH 56/79] test(#23): regressions for merged association sign-off
 ids and direct copy-plan estate Org stamping

Estate Org option keeps a repository regrant, stamp_associations merges ids already on a job,
and direct 'project copy-plan --role estate' stamps captured T3 Org options (controls: no flag,
no record, withdrawn org, non-T3 option). CHANGELOG and SKILL.md note both behaviours.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |   1 +
 SKILL.md                            |   2 +-
 tests/test_t3_signoff_withdrawal.py | 144 ++++++++++++++++++++++++++++
 3 files changed, 146 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index cef69c6..2fe569f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - `project copy-plan --allow-t3` authorizes every README repository on its own resolved owner and name, not on the board owner's tier (issue 23): a T3 owner's repository named on a non-T3 board, whether listed in `--repos` or only captured in the board's repositories, needs a valid record covering that repository. A missing or withdrawn one is omitted from the README and logs `t3-signoff:<code>:OWNER/REPO` and `readme-held:OWNER/REPO`; a permitted one stays and its granting `signoff_id` (a repository-specific regrant, not the cached wildcard) is carried on the README job. No link job is created for a captured repository, other owners' repositories and runs without `--allow-t3` are unchanged, and standalone `project readme` is unchanged.
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
+- T3 sign-off association ids (issue 23): sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does. Tests: tests/test_t3_signoff_withdrawal.py.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
 - `content icon normalize` flattens a vignetted kept night tile with a feathered ramp (6 dE) instead of a hard threshold, and the transparent key uses a soft alpha ramp, so a glow around a solid glyph keeps its continuity with no hard outer ring; the glyph edge stays hard. `--ground-tolerance` is covered through the CLI (a raised value is applied; `nan` and negative values exit 2), and the estate-template numbered BACKGROUND paragraph is replaced by the flat-ground wording, including explicit colour or radial-gradient text.
 - `content icon check` and `content icon normalize` take `--ocr` (opt-in, off by default) to read the icon with `tesseract` on `PATH` for text: words of 2 or more alphanumerics warn (fail with `--strict`); without the tool the check is skipped with `needs-input:ocr-unavailable` and `no-text` stays a manual review, so the result and exit code do not change. An unreadable or undecodable PNG (bad structure, or valid structure with corrupt compressed data) fails the icon as a structured `png` check, so `content icon check` then prints a JSON result with a `logs` list and exits 1 (bad arguments still exit 2); `logs` names the unreadable image as `unreadable-image:<path>`, with and without `--ocr`; the command never ends in a traceback. `content icon normalize` handles an unreadable or undecodable `--in` candidate the same way (exit 1, no file written, with and without `--ocr`; `logs` names the `--in` source as `unreadable-image:<path>` plus `art-fail:icon-qa`); a missing `--in` file stays a usage error (exit 2).
diff --git a/SKILL.md b/SKILL.md
index 5acfa39..76cfe57 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index ef45671..7c1e985 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -447,3 +447,147 @@ def test_control_standalone_project_readme_unchanged(brand):
                            repositories=[f"{T3_OWNER}/withdrawn-x"], reviewed="2026-10-25")
     assert "withdrawn-x" in text, text
     assert not any(str(x).startswith("t3-signoff:") for x in logs), logs
+
+
+# ------------------------------------------------------------------ Estate Org options and association ids (issue 23, r6)
+# A job that already holds a repository-specific regrant keeps it when the Org/association grant is stamped later; the
+# direct `project copy-plan --role estate` path stamps the captured T3 Org option exactly as estate_plan does.
+SITE = f"{T3_OWNER}/site"
+REGRANT_RECORDS = [{"id": "t3s-g"},
+                   {"id": "t3s-w", "repos": ["site"], "approved": False, "approved_on": "2026-10-01"},
+                   {"id": "t3s-r", "repos": ["site"], "approved_on": "2026-10-02"}]
+
+
+def _estate_capture(option_name="Pick Your AI", option_desc=f"T3: {T3_OWNER}", repositories=()):
+    """A complete private Estate capture (every view numbered) whose Org field holds one option."""
+    from test_t3_signoff_require import _complete_estate_capture
+    cap = _complete_estate_capture()
+    board = cap["data"]["user"]["projectV2"]
+    org = [f for f in board["fields"]["nodes"] if f["name"] == "Org"][0]
+    org["options"] = [{"id": "optorg1", "name": option_name, "color": "YELLOW", "description": option_desc}]
+    board["repositories"] = {"nodes": [{"nameWithOwner": n} for n in repositories]}
+    assert board["public"] is False
+    return cap
+
+
+def _estate_resolver(brand, in_directory=True):
+    from test_t3_emission_scope import _registry, _resolver
+    reg = _registry(True)
+    if in_directory:
+        reg["profile"]["org_directory"].append({"group": "T3", "orgs": [T3_OWNER]})
+    return _resolver(brand, reg)
+
+
+def _ids_of(job):
+    return list(job.get("signoff_ids") or ([job["signoff_id"]] if job.get("signoff_id") else []))
+
+
+@pytest.mark.parametrize("in_directory", [True, False], ids=["org-listed", "org-retained-from-capture"])
+def test_estate_org_option_keeps_repository_regrant(brand, tmp_path, monkeypatch, in_directory):
+    """Grant G covers `*`, a withdrawal revokes site, and a repository-scoped regrant R reauthorizes site. The Estate
+    README links site (authorized by R) and names the Pick-Your-AI Org option (authorized by G): it carries both, and the
+    Org stamp must not replace R with G."""
+    from test_t3_emission_scope import _Strict, _file
+    from ctshowcase import project as PJ, signoff
+    with _Strict(monkeypatch, _file(tmp_path, REGRANT_RECORDS)):
+        assert signoff.evaluate([T3_OWNER], "site")[0]["id"] == "t3s-r"  # precondition: R is what authorizes site
+        plan = PJ.estate_plan(_estate_resolver(brand, in_directory), copied=_estate_capture(repositories=[SITE]),
+                              user_id=100, allow_t3=True, reviewed="2026-10-25")
+    readme = [j for j in plan["jobs"] if "--readme" in (j.get("argv") or [])]
+    assert len(readme) == 1, [j["id"] for j in plan["jobs"]]
+    text = readme[0]["argv"][readme[0]["argv"].index("--readme") + 1]
+    assert "site" in text and "Pick Your AI" in text, text
+    ids = _ids_of(readme[0])
+    assert "t3s-r" in ids and "t3s-g" in ids and len(ids) == len(set(ids)), readme[0]
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+
+
+def test_stamp_associations_keeps_ids_already_on_the_item():
+    from ctshowcase import signoff
+    item = {"id": "j", "signoff_id": "t3s-r"}
+    signoff.stamp_associations(item, ["t3s-g"])
+    assert item["signoff_id"] == "t3s-r" and item["signoff_ids"] == ["t3s-r", "t3s-g"], item
+    listed = {"id": "j", "signoff_ids": ["t3s-r", "t3s-x"]}  # signoff_ids input, deduplicated with the new ids
+    signoff.stamp_associations(listed, ["t3s-x", "t3s-g", "t3s-g"])
+    assert listed["signoff_id"] == "t3s-r" and listed["signoff_ids"] == ["t3s-r", "t3s-x", "t3s-g"], listed
+    again = {"id": "j", "signoff_id": "t3s-g"}  # the same id is neither duplicated nor turned into a list
+    signoff.stamp_associations(again, ["t3s-g"])
+    assert again["signoff_id"] == "t3s-g" and "signoff_ids" not in again, again
+    bare = {"id": "j"}
+    signoff.stamp_associations(bare, [])  # no association ids: untouched
+    assert bare == {"id": "j"}, bare
+
+
+# the direct CLI path (`project copy-plan --target @me --role estate`) ----------------------------------------------
+def _direct_estate(tmp_path, capture, records, *flags):
+    from test_t3_emission_scope import _file
+    cap = tmp_path / "capture.json"
+    cap.write_text(json.dumps(capture), encoding="utf-8")
+    sf = _file(tmp_path, records)
+    e = dict(os.environ)
+    e.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
+    e.pop("SHOWCASE_ESTATE_ROOT", None)
+    r = subprocess.run([*SHOWCASE, "--t3-signoff-file", str(sf), "project", "copy-plan", "--target", "@me",
+                        "--role", "estate", "--copied", str(cap), "--files-dir", str(tmp_path / "bodies"),
+                        "--user-id", "100", "--reviewed", "2026-10-25", *flags],
+                       cwd=ROOT, env=e, capture_output=True, text=True, encoding="utf-8")
+    try:
+        out = json.loads(r.stdout)
+    except ValueError:
+        out = {}
+    return r, out
+
+
+def _readme_job(out):
+    jobs = [j for j in out.get("jobs", []) if "--readme" in (j.get("argv") or [])]
+    return jobs[0] if jobs else None
+
+
+def test_direct_copy_plan_estate_stamps_captured_t3_org(tmp_path):
+    r, out = _direct_estate(tmp_path, _estate_capture(), [{"id": "t3s-g"}], "--allow-t3")
+    assert r.returncode == 0, r.stdout + r.stderr
+    job = _readme_job(out)
+    assert job is not None, [j["id"] for j in out["jobs"]]
+    assert "Pick Your AI" in job["argv"][job["argv"].index("--readme") + 1]
+    assert _ids_of(job) == ["t3s-g"], job
+    assert not any(str(x).startswith("t3-signoff:") for x in out["logs"]), out["logs"]
+
+
+def test_direct_copy_plan_estate_repository_regrant_survives_org_stamp(tmp_path):
+    r, out = _direct_estate(tmp_path, _estate_capture(repositories=[SITE]), REGRANT_RECORDS, "--allow-t3")
+    assert r.returncode == 0, r.stdout + r.stderr
+    job = _readme_job(out)
+    assert job is not None and "site" in job["argv"][job["argv"].index("--readme") + 1], out["jobs"]
+    assert set(_ids_of(job)) == {"t3s-g", "t3s-r"}, job
+
+
+def test_direct_copy_plan_estate_control_without_the_flag_stamps_nothing(tmp_path):
+    r, out = _direct_estate(tmp_path, _estate_capture(), [{"id": "t3s-g"}])
+    assert "t3s-g" not in r.stdout, r.stdout  # nothing is stamped from a run without --allow-t3
+    assert not any(_ids_of(j) for j in out.get("jobs", [])), out.get("jobs")
+
+
+def test_direct_copy_plan_estate_control_without_a_record_is_held(tmp_path):
+    r, out = _direct_estate(tmp_path, _estate_capture(), [], "--allow-t3")
+    assert f"t3-signoff:missing:{T3_OWNER}" in r.stdout + r.stderr, r.stdout + r.stderr
+    assert "t3s-" not in r.stdout, r.stdout
+    assert _readme_job(out) is None, out.get("jobs")
+    assert "Pick Your AI" not in json.dumps(out.get("jobs", [])), out.get("jobs")
+
+
+def test_direct_copy_plan_estate_withdrawn_captured_org_leaves_no_readme_and_no_stamp(tmp_path):
+    recs = [{"id": "t3s-g"}, {"id": "t3s-w", "approved": False, "approved_on": "2026-10-01"}]
+    r, out = _direct_estate(tmp_path, _estate_capture(), recs, "--allow-t3")
+    assert f"t3-signoff:revoked:{T3_OWNER}" in out.get("logs", []), r.stdout + r.stderr
+    assert _readme_job(out) is None, out["jobs"]  # the README is held with the withdrawn Org
+    assert "Pick Your AI" not in json.dumps(out["jobs"]), out["jobs"]
+    assert not any(_ids_of(j) for j in out["jobs"]), [j for j in out["jobs"] if _ids_of(j)]
+
+
+def test_direct_copy_plan_estate_control_non_t3_org_option_gets_no_stamp(tmp_path):
+    cap = _estate_capture(option_name="CompleteTech Skills", option_desc="T1: CompleteTech-Skills")
+    r, out = _direct_estate(tmp_path, cap, [{"id": "t3s-g"}], "--allow-t3")
+    assert r.returncode == 0, r.stdout + r.stderr
+    job = _readme_job(out)
+    assert job is not None and "CompleteTech Skills" in job["argv"][job["argv"].index("--readme") + 1], out["jobs"]
+    assert not any(_ids_of(j) for j in out["jobs"]), [j for j in out["jobs"] if _ids_of(j)]

From ccb6e48203af5fb4b7c2e9b1e8b78f6d19e91a6e Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:52:22 -0500
Subject: [PATCH 57/79] test(#23): CLI and captured-repository T3 copy-plan
 consent regressions

Adds a new test file (no production edits). CLI-level org-role copy-plan
README regressions run the real scripts/showcase.py: mixed explicit and
captured repositories omit the withdrawn repo and keep the kept one, the
regrant carries both sign-off ids, and no record refuses the whole run.
In-library same-owner captured-repository regressions cover the README,
workflows and settings jobs (withdrawn omitted, kept retained, regrant ids
carried) and a no-repository control.

Synthetic records only.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_cli_copy_plan_consent.py | 172 +++++++++++++++++++++++++
 1 file changed, 172 insertions(+)
 create mode 100644 tests/test_t3_cli_copy_plan_consent.py

diff --git a/tests/test_t3_cli_copy_plan_consent.py b/tests/test_t3_cli_copy_plan_consent.py
new file mode 100644
index 0000000..1d951bc
--- /dev/null
+++ b/tests/test_t3_cli_copy_plan_consent.py
@@ -0,0 +1,172 @@
+"""CLI-level and captured-repository T3 sign-off regressions for project copy-plan (issue 23). Synthetic records only.
+
+Binding context: t23-adjudication-full-plan-consent-d874.md (UPDATE: the CLI-emitted README job must omit withdrawn
+repositories, keep kept repositories and carry the regrant ids) and t23-adjudication-captured-readme-authorization.md
+(captured repositories need their own authorization in the README, the workflows job and the settings job).
+"""
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+sys.path.insert(0, str(ROOT / "tests"))
+
+BASE = [{"id": "grant", "repos": ["*"], "approved_on": "2026-01-01"},
+        {"id": "withdraw", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+REGRANT = BASE + [{"id": "regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+
+
+def _cli_run(tmp_path, records, repos=None, captured=None):
+    """Run the real `scripts/showcase.py project copy-plan` (org role) and return (result, jobs)."""
+    from test_t3_signoff_require import _bundle, _run, OWNER
+    from test_project import cap_of
+    root = tmp_path
+    bundle = _bundle(root, records)
+    cap = cap_of("copy-capture.json", OWNER)
+    board = cap["data"]["organization"]["projectV2"]
+    board["public"] = False
+    for number, name, filter_ in [(6, "My items", "assignee:@me -status:Done"),
+                                  (7, "Shipped", "status:Done updated:>=@today-30d")]:
+        board["views"]["nodes"].append(dict(board["views"]["nodes"][2], id=f"PVTV_n{number}", number=number,
+                                            name=name, filter=filter_))
+    if captured:
+        board["repositories"] = {"nodes": [{"nameWithOwner": x} for x in captured]}
+    capfile = root / "capture.json"
+    capfile.write_text(json.dumps(cap), encoding="utf-8")
+    jobsfile = root / "jobs.jsonl"
+    result = _run(root, bundle, "--allow-t3", "project", "copy-plan", "--target", OWNER, "--copied", str(capfile),
+                  "--jobs", str(jobsfile), "--files-dir", str(root / "bodies"),
+                  *(["--repos", ",".join(repos)] if repos else []))
+    jobs = []
+    if jobsfile.exists():
+        jobs = [json.loads(line) for line in jobsfile.read_text(encoding="utf-8").splitlines() if line.strip()]
+    return result, jobs
+
+
+def _cli_readme(tmp_path, records, repos=None, captured=None):
+    """The single README job the CLI emits, as (job, readme_text, all_jobs)."""
+    result, jobs = _cli_run(tmp_path, records, repos=repos, captured=captured)
+    assert result.returncode == 0, result.stdout + result.stderr
+    readmes = [j for j in jobs if "--readme" in j.get("argv", [])]
+    assert len(readmes) == 1, [j.get("id") for j in jobs]
+    job = readmes[0]
+    text = job["argv"][job["argv"].index("--readme") + 1]
+    return job, text, jobs
+
+
+def _ids(job):
+    return set(job.get("signoff_ids") or []) | ({job["signoff_id"]} if job.get("signoff_id") else set())
+
+
+# B) subprocess CLI, org role, explicit --repos -------------------------------------------------------------------
+def test_cli_org_readme_mixed_explicit_omits_withdrawn_keeps_kept(tmp_path):
+    from test_t3_signoff_require import OWNER
+    job, text, _ = _cli_readme(tmp_path, BASE, repos=[f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"])
+    assert "withdrawn-x" not in text, text
+    assert "kept-y" in text, text
+    ids = _ids(job)
+    assert "grant" in ids, job
+    assert "regrant" not in ids, job
+
+
+def test_cli_org_readme_regrant_keeps_repo_and_carries_both_ids(tmp_path):
+    from test_t3_signoff_require import OWNER
+    job, text, _ = _cli_readme(tmp_path, REGRANT, repos=[f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"])
+    assert "withdrawn-x" in text and "kept-y" in text, text
+    assert {"grant", "regrant"} <= _ids(job), job
+
+
+def test_cli_org_readme_mixed_captured_omits_withdrawn(tmp_path):
+    from test_t3_signoff_require import OWNER
+    job, text, jobs = _cli_readme(tmp_path, BASE, repos=None,
+                                  captured=[f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"])
+    assert "withdrawn-x" not in text, text
+    assert "kept-y" in text, text
+    assert "grant" in _ids(job), job
+    assert not [j["id"] for j in jobs if "-link-" in j["id"]], [j["id"] for j in jobs]
+
+
+def test_cli_org_readme_no_grant_refuses_whole_run(tmp_path):
+    """No record at all. Observed CLI behaviour (not a per-repository omission): the whole run is refused with
+    rc 2, result 'refused', log 't3-signoff:missing', and no jobs file is written, so no README is emitted."""
+    from test_t3_signoff_require import OWNER
+    repos = [f"{OWNER}/withdrawn-x", f"{OWNER}/kept-y"]
+    result, jobs = _cli_run(tmp_path, [], repos=repos)
+    combined = result.stdout + result.stderr
+    assert result.returncode == 2, combined
+    out = json.loads(result.stdout)
+    assert out.get("result") == "refused", out
+    assert "t3-signoff:missing" in out.get("logs", []), out
+    assert jobs == [], [j.get("id") for j in jobs]
+
+
+# C) in-library same-owner captured-repository regressions (all three jobs) ----------------------------------------
+def _same_owner_plan(brand, tmp_path, monkeypatch, records, captured, repositories=None):
+    from test_t3_emission_scope import _Strict, _file, _resolver, _private_board, OWNER
+    from ctshowcase import project as PJ
+    board = _private_board()
+    board["data"]["organization"]["projectV2"]["repositories"] = {
+        "nodes": [{"nameWithOwner": f"{OWNER}/{x}"} for x in captured]}
+    with _Strict(monkeypatch, _file(tmp_path, records)):
+        return PJ.copy_plan(OWNER, role="org", copied=board, resolver=_resolver(brand), repositories=repositories,
+                            allow_t3=True, reviewed="2026-10-25")
+
+
+def test_same_owner_captured_withdrawn_omitted_across_all_jobs(brand, tmp_path, monkeypatch):
+    from test_t3_emission_scope import _workflows, _settings, _readme_jobs
+    from test_t3_signoff_withdrawal import T3_WILD
+    # repositories=None: workflows and settings derive repositories only from explicit --repos; captured repositories
+    # feed the README only. The README authorises its captured repositories on its own (t23 captured-readme note).
+    plan = _same_owner_plan(brand, tmp_path, monkeypatch, T3_WILD, ["withdrawn-x", "kept-y"])
+    readmes = _readme_jobs(plan)
+    assert len(readmes) == 1, [j["id"] for j in plan["jobs"]]
+    text = readmes[0]["argv"][readmes[0]["argv"].index("--readme") + 1]
+    assert "withdrawn-x" not in text, text
+    assert "kept-y" in text, text
+    assert "t3s-all" in _ids(readmes[0]), readmes[0]
+    for j in plan["jobs"]:
+        assert "withdrawn-x" not in json.dumps(j), j["id"]
+    workflows = _workflows(plan)
+    assert workflows, [j["id"] for j in plan["jobs"]]
+    assert any("auto-add" in s.lower() for j in workflows for s in j["steps"]), workflows
+    settings = _settings(plan)
+    assert settings, [j["id"] for j in plan["jobs"]]
+    for j in settings:
+        assert not any("withdrawn-x" in s for s in j["steps"]), (j["id"], j["steps"])
+    assert not [j["id"] for j in plan["jobs"] if "-link-" in j["id"]], [j["id"] for j in plan["jobs"]]
+
+
+def test_same_owner_captured_regrant_retained_across_jobs(brand, tmp_path, monkeypatch):
+    from test_t3_emission_scope import _readme_jobs
+    from test_t3_signoff_withdrawal import T3_WILD
+    recs = [*T3_WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    plan = _same_owner_plan(brand, tmp_path, monkeypatch, recs, ["withdrawn-x", "kept-y"])
+    readmes = _readme_jobs(plan)
+    assert len(readmes) == 1, [j["id"] for j in plan["jobs"]]
+    text = readmes[0]["argv"][readmes[0]["argv"].index("--readme") + 1]
+    assert "withdrawn-x" in text and "kept-y" in text, text
+    ids = _ids(readmes[0])
+    assert "t3s-regrant" in ids and "t3s-all" in ids, readmes[0]
+
+
+# 7) distinct controls -----------------------------------------------------------------------------------------------
+def test_control_no_repositories_and_no_capture(brand, tmp_path, monkeypatch):
+    from test_t3_emission_scope import _Strict, _file, _resolver, _private_board, _readme_jobs, OWNER
+    from ctshowcase import project as PJ
+    from test_t3_signoff_withdrawal import T3_WILD
+    board = _private_board()
+    board["data"]["organization"]["projectV2"]["repositories"] = {"nodes": []}
+    with _Strict(monkeypatch, _file(tmp_path, T3_WILD)):
+        plan = PJ.copy_plan(OWNER, role="org", copied=board, resolver=_resolver(brand), repositories=None,
+                            allow_t3=True, reviewed="2026-10-25")
+    readmes = _readme_jobs(plan)
+    text = " ".join(j["argv"][j["argv"].index("--readme") + 1] for j in readmes)
+    assert "withdrawn-x" not in text and "kept-y" not in text, text
+    assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+    assert readmes, [j["id"] for j in plan["jobs"]]

From a18f4b17dd70547a48f76f09a91f342b0a425939 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 01:56:32 -0500
Subject: [PATCH 58/79] fix(#23): captured same-owner repositories feed
 copy-plan workflows and settings; CLI and captured consent regressions

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  1 +
 scripts/ctshowcase/project.py          | 15 +++++++++++--
 tests/test_t3_cli_copy_plan_consent.py | 30 ++++++++++++++++++++++----
 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2fe569f..dcee636 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -13,6 +13,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 - Also lands #28 (context-local sign-off, ContextVar) and #31 (global --allow-t3 docs), merged from epic/E1 (see Fixed below).
 - T3 sign-off owner and emission scope (issue 23): record owners are matched by one normalisation (all surrounding whitespace stripped, then case-folded) in `evaluate`, withdrawals and `record_for`, so a padded owner can no longer escape its own withdrawal; `project copy-plan --allow-t3` checks every repository link against the sign-off for that repository (a withdrawn link is not emitted and logs `t3-signoff:<code>:<repo>` and `link-held`, a permitted link carries its own `signoff_id`); and captured T3 Org options are held (and their option ids kept) whether or not the org is still in `registry.orgs`, with authorized retained options stamped with their sign-off id on the Org-update and README jobs.
 - T3 sign-off association ids (issue 23): sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does. Tests: tests/test_t3_signoff_withdrawal.py.
+- T3 copy-plan consent at CLI level and for captured repositories (issue 23): `project copy-plan --allow-t3` without `--repos` now uses the captured same-owner repositories, each authorized on its own resolved owner and name, for the workflows auto-add and settings default repository (a regrant names the regranted repository with its id; a populated capture that is all withdrawn names no repository and holds both; an absent capture keeps the generic control; no link job is created for a captured repository). Tests: tests/test_t3_cli_copy_plan_consent.py runs the real `scripts/showcase.py project copy-plan` (README omits the withdrawn repository, keeps the kept one, carries the regrant ids; no record refuses the run) and the same-owner captured README, workflows and settings jobs.
 - `content icon normalize` auto mode keys any uniform ground to transparent unless it is a dark night tile (luminance < 0.2 and not within dE 12 of the card colour), so a flat pale ground on a dark card no longer needs `--ground transparent`; `--ground keep|transparent` are unchanged. New `--ground-tolerance DE` (default 3.0) widens the corner match for slightly vignetted grounds (e.g. `--ground-tolerance 5`); above it `icon-ground` names the measured corner dE and the flag. A raised tolerance widens the keying threshold only above 3.0 and flattens a kept night tile so QA accepts it. Auto falls back to keying when a kept night tile would exceed the 300 KB budget; non-finite or negative `--ground-tolerance` is a usage error, and `--ground-tolerance 0` accepts identical corners as one ground (a positive tolerance keeps the strict boundary). The option A icon prompt (bundled and estate-format templates) states the exact flat `card_fill` ground with no vignette, texture, gradient, shadow or glow; the estate BACKGROUND heading now says one flat ground (not the avatar night tile), and the exact ground clause is now appended whenever a BACKGROUND replacement removed it (checked after all replacements). The soft 3 dE key alpha ramp applies only with a raised `--ground-tolerance`; the default transparent key is unchanged (original 0/255 step).
 - `content icon normalize` flattens a vignetted kept night tile with a feathered ramp (6 dE) instead of a hard threshold, and the transparent key uses a soft alpha ramp, so a glow around a solid glyph keeps its continuity with no hard outer ring; the glyph edge stays hard. `--ground-tolerance` is covered through the CLI (a raised value is applied; `nan` and negative values exit 2), and the estate-template numbered BACKGROUND paragraph is replaced by the flat-ground wording, including explicit colour or radial-gradient text.
 - `content icon check` and `content icon normalize` take `--ocr` (opt-in, off by default) to read the icon with `tesseract` on `PATH` for text: words of 2 or more alphanumerics warn (fail with `--strict`); without the tool the check is skipped with `needs-input:ocr-unavailable` and `no-text` stays a manual review, so the result and exit code do not change. An unreadable or undecodable PNG (bad structure, or valid structure with corrupt compressed data) fails the icon as a structured `png` check, so `content icon check` then prints a JSON result with a `logs` list and exits 1 (bad arguments still exit 2); `logs` names the unreadable image as `unreadable-image:<path>`, with and without `--ocr`; the command never ends in a traceback. `content icon normalize` handles an unreadable or undecodable `--in` candidate the same way (exit 1, no file written, with and without `--ocr`; `logs` names the `--in` source as `unreadable-image:<path>` plus `art-fail:icon-qa`); a missing `--in` file stays a usage error (exit 2).
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 30c00fc..8c00d59 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -959,6 +959,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     authorized: list[tuple[str, dict | None]] = []  # (repo, sign-off record or None): the only repos the settings job may name
     link_jobs: list[dict] = []  # repository-link jobs, emitted right after the text job
     held_lower: set[str] = set()  # lowercase owner/repo names held for lack of a valid sign-off
+    captured_populated = False  # a populated captured repository list with no explicit --repos
     grants: dict[str, dict | None] = {}  # lowercase owner/repo -> the sign-off record that covers it
     readme_repos, lg = _readme_repos(spec, owner, role, resolver, repositories)
     logs += lg
@@ -991,6 +992,16 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                 signoff.stamp_associations(link, [str(rec["id"])])
             link_jobs.append(link)
         reads.append({"name": "org-projects-setting", "argv": ["gh", "api", f"orgs/{owner}", "--jq", ".has_organization_projects"]})
+        if not repositories:
+            # no explicit list: the captured same-owner repositories feed the default repository and auto-add, each
+            # authorized on its own resolved owner and name. They never create a link job (no new association).
+            captured_repos = [str(x) for x in (spec.get("repositories") or [])]
+            captured_populated = bool(captured_repos)
+            same = [x for x in captured_repos if "/" in x and resolver_same(resolver, x.split("/", 1)[0], owner)]
+            for r in _authorize_readme_repos([f"{owner}/{x.split('/', 1)[1]}" for x in same], resolver, allow_t3,
+                                             grants, held_lower, logs):
+                if r.lower() not in {a.lower() for a, _ in authorized}:
+                    authorized.append((r, grants.get(_grant_key(resolver, *r.split("/", 1)))))
     # every README repository (explicit or captured) is authorized on its own resolved owner and name, for every role
     readme_repos = _authorize_readme_repos(readme_repos, resolver, allow_t3, grants, held_lower, logs)
     # 4. text: short description and README (README needs every view number)
@@ -1058,7 +1069,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
         on = on_tpl if role == "template" else on_org
         if words == "auto-add" and role == "estate":
             continue
-        if words == "auto-add" and role == "org" and repositories and not authorized:
+        if words == "auto-add" and role == "org" and (repositories or captured_populated) and not authorized:
             # no repository may be chosen for the auto-add rule: the step names none, so it is held rather than emitted
             logs.append("workflows-held:auto-add (no authorized repository remains to choose; links held or skipped)")
             continue
@@ -1093,7 +1104,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                               f"templates', tick '{title}' and save.", "Screenshot the setting."],
                              "project-recommended-template", "§13.9 step 6: offer the template in the org's dialog."))
     if role == "org":
-        if repositories and not authorized:
+        if (repositories or captured_populated) and not authorized:
             # every listed repository is withdrawn, unauthorized or on another owner: the default-repository and
             # auto-add steps would name one of them, so the settings job is held instead of emitted
             logs.append("settings-held:default-repository-and-auto-add (no authorized repository remains to choose; links held or skipped)")
diff --git a/tests/test_t3_cli_copy_plan_consent.py b/tests/test_t3_cli_copy_plan_consent.py
index 1d951bc..e9f5f3d 100644
--- a/tests/test_t3_cli_copy_plan_consent.py
+++ b/tests/test_t3_cli_copy_plan_consent.py
@@ -121,8 +121,8 @@ def _same_owner_plan(brand, tmp_path, monkeypatch, records, captured, repositori
 def test_same_owner_captured_withdrawn_omitted_across_all_jobs(brand, tmp_path, monkeypatch):
     from test_t3_emission_scope import _workflows, _settings, _readme_jobs
     from test_t3_signoff_withdrawal import T3_WILD
-    # repositories=None: workflows and settings derive repositories only from explicit --repos; captured repositories
-    # feed the README only. The README authorises its captured repositories on its own (t23 captured-readme note).
+    # repositories=None: the captured same-owner repositories feed README, workflows auto-add and settings alike
+    # (t23-adjudication-captured-workflows-settings-12dd.md); each is authorised on its own owner and name.
     plan = _same_owner_plan(brand, tmp_path, monkeypatch, T3_WILD, ["withdrawn-x", "kept-y"])
     readmes = _readme_jobs(plan)
     assert len(readmes) == 1, [j["id"] for j in plan["jobs"]]
@@ -134,11 +134,14 @@ def test_same_owner_captured_withdrawn_omitted_across_all_jobs(brand, tmp_path,
         assert "withdrawn-x" not in json.dumps(j), j["id"]
     workflows = _workflows(plan)
     assert workflows, [j["id"] for j in plan["jobs"]]
-    assert any("auto-add" in s.lower() for j in workflows for s in j["steps"]), workflows
+    adds = [s for j in workflows for s in j["steps"] if "auto-add" in s.lower()]
+    assert adds and all("kept-y" in s for s in adds), adds
+    assert "t3s-all" in _ids(workflows[0]), workflows[0]
     settings = _settings(plan)
     assert settings, [j["id"] for j in plan["jobs"]]
     for j in settings:
-        assert not any("withdrawn-x" in s for s in j["steps"]), (j["id"], j["steps"])
+        assert any("kept-y" in s for s in j["steps"]), j["steps"]
+        assert "t3s-all" in _ids(j), j
     assert not [j["id"] for j in plan["jobs"] if "-link-" in j["id"]], [j["id"] for j in plan["jobs"]]
 
 
@@ -153,6 +156,25 @@ def test_same_owner_captured_regrant_retained_across_jobs(brand, tmp_path, monke
     assert "withdrawn-x" in text and "kept-y" in text, text
     ids = _ids(readmes[0])
     assert "t3s-regrant" in ids and "t3s-all" in ids, readmes[0]
+    from test_t3_emission_scope import _workflows, _settings
+    adds = [s for j in _workflows(plan) for s in j["steps"] if "auto-add" in s.lower()]
+    assert adds and all("withdrawn-x" in s for s in adds), adds
+    assert "t3s-regrant" in _ids(_workflows(plan)[0])
+    for j in _settings(plan):
+        assert any("withdrawn-x" in s for s in j["steps"]), j["steps"]
+        assert "t3s-regrant" in _ids(j), j
+
+
+def test_same_owner_captured_all_withdrawn_names_no_repository(brand, tmp_path, monkeypatch):
+    from test_t3_emission_scope import _workflows, _settings
+    from test_t3_signoff_withdrawal import T3_WILD
+    recs = [{"id": "t3s-all", "repos": ["*"], "approved_on": "2026-01-01"},
+            {"id": "t3s-wd", "repos": ["withdrawn-x", "withdrawn-z"], "approved": False, "approved_on": "2026-10-01"}]
+    plan = _same_owner_plan(brand, tmp_path, monkeypatch, recs, ["withdrawn-x", "withdrawn-z"])
+    for j in plan["jobs"]:
+        assert "withdrawn-x" not in json.dumps(j) and "withdrawn-z" not in json.dumps(j), j["id"]
+    assert not [s for j in _workflows(plan) for s in j["steps"] if "auto-add" in s.lower()]
+    assert not _settings(plan), [j["id"] for j in plan["jobs"]]
 
 
 # 7) distinct controls -----------------------------------------------------------------------------------------------

From c257b9756a420dd770efc0d445f7b9b59d08b6c0 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 02:02:28 -0500
Subject: [PATCH 59/79] test(#23): remove three unused imports from copy-plan
 consent tests

Drop module-level subprocess and pytest imports and the unused
T3_WILD import in test_same_owner_captured_all_withdrawn_names_no_repository.
Fixes ruff F401 on the exact head a18f4b17 with no behaviour change.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_cli_copy_plan_consent.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tests/test_t3_cli_copy_plan_consent.py b/tests/test_t3_cli_copy_plan_consent.py
index e9f5f3d..ed6dde6 100644
--- a/tests/test_t3_cli_copy_plan_consent.py
+++ b/tests/test_t3_cli_copy_plan_consent.py
@@ -7,12 +7,9 @@
 from __future__ import annotations
 
 import json
-import subprocess
 import sys
 from pathlib import Path
 
-import pytest
-
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / "scripts"))
 sys.path.insert(0, str(ROOT / "tests"))
@@ -167,7 +164,6 @@ def test_same_owner_captured_regrant_retained_across_jobs(brand, tmp_path, monke
 
 def test_same_owner_captured_all_withdrawn_names_no_repository(brand, tmp_path, monkeypatch):
     from test_t3_emission_scope import _workflows, _settings
-    from test_t3_signoff_withdrawal import T3_WILD
     recs = [{"id": "t3s-all", "repos": ["*"], "approved_on": "2026-01-01"},
             {"id": "t3s-wd", "repos": ["withdrawn-x", "withdrawn-z"], "approved": False, "approved_on": "2026-10-01"}]
     plan = _same_owner_plan(brand, tmp_path, monkeypatch, recs, ["withdrawn-x", "withdrawn-z"])

From 781c64d9b92383acb7122702e878267c0e5361e4 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <timothywaynegregg@gmail.com>
Date: Sun, 1 Nov 2026 02:19:07 -0500
Subject: [PATCH 60/79] fix(signoff): pass the board owner to README
 association stamping

The README job's association stamping omitted the T3 board owner's own
grant, so a copy-plan emitting a board update could lose the authorization
record for its target when repositories were also named.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 8c00d59..95c9f73 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1027,7 +1027,8 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     text_job = _job(f"{pid}-{num}-text-{_digest(edit)}", "project", edit, owner,
                     "§13.2 short description" + (" and §13.7 README" if text is not None else " (README after re-capture)"))
     if text is not None:
-        # the granting records of the repositories the README names (a retained authorized one carries its own)
+        # the board owner's own grant is merged first (owner passed), then the granting records of the repositories
+        # the README names (a retained authorized one carries its own)
         ids: list[str] = []
         for r in readme_repos:
             if "/" in r:
@@ -1036,7 +1037,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
                     ids.append(str(rec["id"]))
         if ids:
             from . import signoff
-            signoff.stamp_associations(text_job, list(dict.fromkeys(ids)))
+            signoff.stamp_associations(text_job, list(dict.fromkeys(ids)), owner)
     if text is not None and retained_t3:
         # the shared emission path stamps the captured Org options, so direct `copy-plan --role estate` and estate_plan agree
         orgs_for_stamp = list(retained_t3)

From 7e56cba871dee643695612501f6466619e7da9e9 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 02:21:17 -0500
Subject: [PATCH 61/79] test(#23): board owner grant leads README signoff ids
 with a distinct T3 repository owner (stdout and --jobs)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_t3_cli_copy_plan_consent.py | 45 ++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/tests/test_t3_cli_copy_plan_consent.py b/tests/test_t3_cli_copy_plan_consent.py
index ed6dde6..13622ca 100644
--- a/tests/test_t3_cli_copy_plan_consent.py
+++ b/tests/test_t3_cli_copy_plan_consent.py
@@ -188,3 +188,48 @@ def test_control_no_repositories_and_no_capture(brand, tmp_path, monkeypatch):
     assert "withdrawn-x" not in text and "kept-y" not in text, text
     assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
     assert readmes, [j["id"] for j in plan["jobs"]]
+
+
+# 8) distinct T3 board owner and repository owner: the README job names the board grant first ------------------------
+# Both owners are brand.yaml T3 owners (the board owner of the fixture and a second T3 org); records are synthetic.
+REPO_OWNER = "Jevelopers-neatHack-2026"
+BOARD_GRANT = {"id": "grant-board", "repos": ["*"], "approved_on": "2026-01-01"}
+REPO_GRANT = {"id": "grant-repo", "owner": REPO_OWNER, "repos": ["site"], "approved_on": "2026-01-02"}
+
+
+def _readme_from(jobs):
+    readmes = [j for j in jobs if "--readme" in j.get("argv", [])]
+    assert len(readmes) == 1, [j.get("id") for j in jobs]
+    return readmes[0]
+
+
+def _cli_both(tmp_path, records, repos):
+    """The README job from both channels: the --jobs file and the stdout plan."""
+    result, jobs = _cli_run(tmp_path, records, repos=repos)
+    assert result.returncode == 0, result.stdout + result.stderr
+    return _readme_from(jobs), _readme_from(json.loads(result.stdout)["jobs"])
+
+
+def test_cli_board_owner_grant_leads_the_readme_signoff_ids(tmp_path):
+    for job in _cli_both(tmp_path, [BOARD_GRANT, REPO_GRANT], [f"{REPO_OWNER}/site"]):
+        assert "site" in job["argv"][job["argv"].index("--readme") + 1], job
+        assert job.get("signoff_id") == "grant-board", job
+        assert job.get("signoff_ids") == ["grant-board", "grant-repo"], job
+
+
+def test_cli_single_owner_grant_covering_board_and_repository_has_no_duplicates(tmp_path):
+    # a record covers one owner, so the single-grant control is a repository of the board owner itself
+    for job in _cli_both(tmp_path, [BOARD_GRANT], ["Pick-Your-AI/site"]):
+        assert job.get("signoff_id") == "grant-board", job
+        assert "signoff_ids" not in job, job
+
+
+def test_cli_withdrawn_repository_is_still_omitted_with_a_board_grant(tmp_path):
+    withdraw = {"id": "withdraw-repo", "owner": REPO_OWNER, "repos": ["site"], "approved": False,
+                "approved_on": "2026-10-01"}
+    result, jobs = _cli_run(tmp_path, [BOARD_GRANT, REPO_GRANT, withdraw], repos=[f"{REPO_OWNER}/site"])
+    assert result.returncode == 0, result.stdout + result.stderr
+    job = _readme_from(jobs)
+    text = job["argv"][job["argv"].index("--readme") + 1]
+    assert f"{REPO_OWNER}/site" not in text, text
+    assert "grant-repo" not in _ids(job), job

From ef2d8ac74d68111a9c64a6cb485ba1be25f74077 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <timothywaynegregg@gmail.com>
Date: Sun, 1 Nov 2026 02:33:19 -0500
Subject: [PATCH 62/79] fix(#23): canonicalize requested repository in T3
 sign-off evaluation

evaluate() and _covers() now canonicalize a non-empty requested repository
(canonical_repo): surrounding whitespace, trailing slashes and one trailing
.git are stripped, so `site/`, ` site`, `site.git` and `site/.git` name the
same repository as `site`. A '*' grant no longer covers a request that
names a withdrawn repository under another spelling, and an empty or
invalid name (not [A-Za-z0-9._-]+) fails closed as invalid:repo.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 43 ++++++++++++++++++++++++++++++++---
 1 file changed, 40 insertions(+), 3 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index 598f19c..bfb07a1 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -287,6 +287,31 @@ def _repos_malformed(rec: dict) -> bool:
     return True
 
 
+_REPO_PART_RE = re.compile(r"[A-Za-z0-9._-]+")
+
+
+def canonical_repo(value) -> str | None:
+    """The canonical spelling of a repository (`NAME` or `OWNER/NAME`), or None when it is invalid. Surrounding
+    whitespace, trailing `/` and one trailing `.git` are stripped, so `site/`, ` site`, `site.git` and `site/.git` all
+    name `site`. The name, and the owner when given, must match [A-Za-z0-9._-]+ (`.` and `..` are not names). Empty,
+    `/`, `.git` and `a b` are None, so a caller fails closed. Case is kept."""
+    if not isinstance(value, str):
+        return None
+    v = value.strip().rstrip("/")
+    if v[-4:].lower() == ".git":
+        v = v[:-4].rstrip("/")
+    v = v.strip()
+    owner, sep, name = v.rpartition("/")
+    if name in (".", "..") or not _REPO_PART_RE.fullmatch(name):
+        return None
+    if not sep:
+        return name
+    owner = owner.strip()
+    if not _REPO_PART_RE.fullmatch(owner):
+        return None
+    return f"{owner}/{name}"
+
+
 def _scope_key(entry: str, logins: list[str] | None) -> str:
     """A canonical key for one `repos` entry, so equivalent scopes compare equal. `*` stays `*`. A bare NAME is its
     lowercased name. OWNER/NAME for one of LOGINS (the owner's own logins, aliases included) is the bare name, the same
@@ -365,6 +390,8 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
     coerced to a grant or a withdrawal) could cover REPO, no record is returned and the result is
     'invalid:<id>: <problem>'. A malformed withdrawal clearly for another repository does not block. Only owners in
     the logins are considered.
+    A non-empty REPO is canonicalized first (canonical_repo): `site/`, ` site`, `site.git` and `site/.git` are `site`,
+    and an empty or invalid name is 'invalid:repo: ...' (fail closed, never a grant). None or '' is owner-wide.
     `today` (a date) is kept for callers that only care about date expiries; `now` is an aware instant."""
     if now is None:
         now = _dt.datetime.now(_dt.timezone.utc)
@@ -377,6 +404,11 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
         if not path.is_file():
             return None, f"no-file:{path}"
         records = load_records()
+    if isinstance(repo, str) and repo:
+        c = canonical_repo(repo)
+        if c is None:
+            return None, "invalid:repo: requested repository name is empty or not [A-Za-z0-9._-]+ (fail closed)"
+        repo = c
     logins = set(_expand([o for o in owners if o]))
     seen: set[str] = set()
     for r in records:  # signoff_id is the audit key carried onto jobs, so an id must name exactly one record
@@ -425,15 +457,20 @@ def evaluate(owners: list[str], repo: str | None = None, today: _dt.date | None
 def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> bool:
     """`*` covers everything; a bare name covers that repository; OWNER/NAME needs the owner to be one of `logins`
     (the requested owner and its org aliases) as well as the name. A repository given as OWNER/NAME is covered only
-    when that owner is one of `logins` too (only `*` covers another account's repository). A malformed `repos` (not a string or a list of
-    strings) covers nothing; evaluate() reports such a record as t3-signoff:invalid through problems(), not as
-    t3-signoff:scope."""
+    when that owner is one of `logins` too (only `*` covers another account's repository). A non-empty REPO is
+    canonicalized (canonical_repo) before the `*` shortcut, so an invalid name is covered by nothing, not even `*`.
+    A malformed `repos` (not a string or a list of strings) covers nothing; evaluate() reports such a record as
+    t3-signoff:invalid through problems(), not as t3-signoff:scope."""
     repos = rec.get("repos")
     if isinstance(repos, str):
         repos = [repos]
     if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
         return False
     repos = [x.strip() for x in repos]  # same normalisation as _scope_key: padding never hides a scope
+    if isinstance(repo, str) and repo:
+        repo = canonical_repo(repo)
+        if repo is None:
+            return False
     if "*" in repos:
         return True
     name = (repo or "").split("/")[-1].lower()

From 796bd753c89246c2002a79444da64131ad8c3bef Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 02:35:26 -0500
Subject: [PATCH 63/79] fix(#23): normalise README and --repos repository
 entries in copy-plan

- Add _parse_repos_arg: split --repos on ',', strip, skip empties, canonicalise through
  signoff.canonical_repo; a malformed entry refuses the command (usage).
- Add _normalize_repo_entries: canonical OWNER/NAME entries, once; a bare name on an org board
  becomes <board owner>/<name>; malformed entries are dropped with repos-malformed.
- _authorize_readme_repos normalises first, holds entries whose owner cannot be resolved,
  drops T3 owners without --allow-t3 (t3-signoff:readme:<owner>/<repo>), and authorises on
  the canonical owner. Both internal calls pass board_owner and role.
- copy_plan normalises the explicit repositories list before the link loop and README.
- Standalone project readme only strips and validates --repos (no sign-off lookup).

Depends on signoff.canonical_repo from the parallel signoff.py change.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 82 +++++++++++++++++++++++++++++------
 1 file changed, 68 insertions(+), 14 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 95c9f73..e92ecc5 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -688,22 +688,58 @@ def _grant_key(resolver, ro: str, rn: str) -> str:
     return f"{owner_key}/{rn}".lower()
 
 
+def _normalize_repo_entries(entries, board_owner: str | None, role: str, resolver, logs: list) -> list[str]:
+    """Each repository entry in canonical form, once: `NAME` or `OWNER/NAME`, stripped, with no trailing `/` and no
+    `.git` (signoff.canonical_repo). A malformed entry is dropped and logged (`repos-malformed:`). On an org board a bare
+    NAME means <board owner>/<NAME>; on any other board it stays bare, which no sign-off can authorise. Duplicates fold
+    case-insensitively, keeping the first spelling and the order."""
+    from . import signoff
+    out: list[str] = []
+    seen: set[str] = set()
+    for entry in entries or []:
+        c = signoff.canonical_repo(entry)
+        if c is None:
+            logs.append(f"repos-malformed:{entry!r}")
+            continue
+        if "/" not in c:
+            if role == "org" and board_owner and board_owner != "@me":
+                c = f"{board_owner}/{c}"
+        else:
+            owner, name = c.split("/", 1)
+            c = f"{owner.strip()}/{name}"
+        if c.lower() in seen:
+            continue
+        seen.add(c.lower())
+        out.append(c)
+    return out
+
+
 def _authorize_readme_repos(readme_repos, resolver, allow_t3: bool, grants: dict, held_lower: set,
-                            logs: list) -> list[str]:
-    """Keep the README repositories this copy may name. A T3 owner's repository needs a valid sign-off record that
-    covers that repository itself (checked on its own owner and name, whatever the board owner is); a denied one is
-    logged and dropped, a granted one is recorded in grants for the README job's sign-off ids. Other references are
-    kept unchanged, and so is everything when --allow-t3 is not passed."""
+                            logs: list, *, board_owner: str | None = None, role: str = "org") -> list[str]:
+    """Keep the README repositories this copy may name. Every entry is normalised once first (_normalize_repo_entries).
+    An entry whose owner cannot be resolved (a bare name off an org board, no resolver, or an unknown status) is held.
+    A T3 owner's repository is dropped with `t3-signoff:readme:<owner>/<repo>` when --allow-t3 is not passed; with it,
+    the repository needs a valid sign-off record that covers it on its own owner and name (checked on its own owner and
+    name, whatever the board owner is). A denied one is logged and dropped, a granted one is recorded in grants for the
+    README job's sign-off ids. Other owners' references are kept unchanged."""
     from . import signoff
     kept: list[str] = []
-    for r0 in readme_repos:
-        if "/" not in r0:
-            kept.append(r0)
+    for r0 in _normalize_repo_entries(readme_repos, board_owner, role, resolver, logs):
+        if "/" not in r0 or resolver is None:
+            logs.append(f"readme-held:{r0} (owner cannot be resolved)")
             continue
         ro, rn = r0.split("/", 1)
-        if not (allow_t3 and resolver is not None and resolver.owner_status(ro) == "t3"):
+        ro = resolver.canonical(ro)
+        status = resolver.owner_status(ro)
+        if status not in (None, "excluded", "hold", "t3", "watching"):
+            logs.append(f"readme-held:{r0} (owner cannot be resolved)")
+            continue
+        if status != "t3":
             kept.append(r0)
             continue
+        if not allow_t3:
+            logs.append(f"t3-signoff:readme:{ro}/{rn}")
+            continue
         key = _grant_key(resolver, ro, rn)
         if key in grants:  # already authorized by the link loop or an earlier reference
             kept.append(r0)
@@ -961,6 +997,8 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     held_lower: set[str] = set()  # lowercase owner/repo names held for lack of a valid sign-off
     captured_populated = False  # a populated captured repository list with no explicit --repos
     grants: dict[str, dict | None] = {}  # lowercase owner/repo -> the sign-off record that covers it
+    if repositories:  # the explicit list, normalised once: canonical OWNER/NAME entries for the link loop and the README
+        repositories = _normalize_repo_entries(repositories, owner, role, resolver, logs)
     readme_repos, lg = _readme_repos(spec, owner, role, resolver, repositories)
     logs += lg
     if role == "org":
@@ -999,11 +1037,12 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
             captured_populated = bool(captured_repos)
             same = [x for x in captured_repos if "/" in x and resolver_same(resolver, x.split("/", 1)[0], owner)]
             for r in _authorize_readme_repos([f"{owner}/{x.split('/', 1)[1]}" for x in same], resolver, allow_t3,
-                                             grants, held_lower, logs):
+                                             grants, held_lower, logs, board_owner=owner, role=role):
                 if r.lower() not in {a.lower() for a, _ in authorized}:
                     authorized.append((r, grants.get(_grant_key(resolver, *r.split("/", 1)))))
     # every README repository (explicit or captured) is authorized on its own resolved owner and name, for every role
-    readme_repos = _authorize_readme_repos(readme_repos, resolver, allow_t3, grants, held_lower, logs)
+    readme_repos = _authorize_readme_repos(readme_repos, resolver, allow_t3, grants, held_lower, logs,
+                                           board_owner=owner, role=role)
     # 4. text: short description and README (README needs every view number)
     nums = view_numbers(spec)
     edit = ["gh", "project", "edit", num, "--owner", own_flag, "--description", short]
@@ -1511,6 +1550,22 @@ def _resolver(args) -> Resolver:
                                getattr(args, "approved_yaml", None), getattr(args, "actions", None))
 
 
+def _parse_repos_arg(raw: str | None) -> list[str]:
+    """The --repos list: split on ',', every entry stripped, empty entries skipped (a trailing comma is fine), each one
+    canonicalised (signoff.canonical_repo). A malformed entry refuses the whole command (usage), so nothing is planned."""
+    from . import signoff
+    out: list[str] = []
+    for piece in (raw or "").split(","):
+        entry = piece.strip()
+        if not entry:
+            continue
+        canon = signoff.canonical_repo(entry)
+        if canon is None:
+            raise ShowcaseError(f"--repos entry {entry!r} is not a valid [OWNER/]REPO name", log="usage")
+        out.append(canon)
+    return out
+
+
 def cmd_project(args):
     from .org import append_jobs
     act = args.action
@@ -1554,8 +1609,7 @@ def cmd_project(args):
             raise NeedsInput("display-name", f"{owner} has no display_name in references/brand.yaml (pass --display-name)")
         canon = r.canonical(owner) if not estate else "@me"
         # the same privacy gate as copy-plan: a board that is public or may go public names no repository
-        repos, gate = _readme_repos(spec, canon, "estate" if estate else "org", r,
-                                    [x for x in (args.repos or "").split(",") if x])
+        repos, gate = _readme_repos(spec, canon, "estate" if estate else "org", r, _parse_repos_arg(args.repos))
         text, logs = readme(canon, name, spec.get("number"), view_numbers(spec),
                             fields=doc_fields(spec, estate=estate), repositories=repos,
                             out_of_scope=args.out_of_scope, reviewed=args.reviewed, estate=estate)
@@ -1573,7 +1627,7 @@ def cmd_project(args):
             raise ShowcaseError("copy-plan needs --target ORG (or @me)", log="usage")
         ws = _load(args.workstreams)
         res = copy_plan(args.target, role=args.role, source=args.source, title=args.title, display_name=args.display_name,
-                        copied=copied, workstreams=ws, repositories=[x for x in (args.repos or "").split(",") if x] or None,
+                        copied=copied, workstreams=ws, repositories=_parse_repos_arg(args.repos) or None,
                         approval_id=args.approval_id, resolver=r, user_id=args.user_id, out_of_scope=args.out_of_scope,
                         reviewed=args.reviewed, status_update=not args.no_status_update, allow_t3=getattr(args, "allow_t3", False))
     if args.jobs and res.get("files") and not args.files_dir:

From b4164970f406a4735af8172adc3a6d28b864781e Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 02:39:18 -0500
Subject: [PATCH 64/79] test+docs(#23): repo canonicalization adjudication
 (t23-adjudication-repo-canonicalization-50f) regressions and docs

Owner integration of Haiku results ef2d8ac (signoff.canonical_repo, evaluate/_covers canonicalization) and 796bd75
(project copy-plan --repos validation, README entry normalisation, no-flag T3 README omission).
- canonical_repo rejects `.`/`..` owners (`../x` fails closed).
- Tests: evaluate spellings (x/, ' x', 'x ', x.git, x/.git) beside a `*` grant plus withdrawal; invalid names fail
  closed; CLI spellings (slash, .git, comma-space, bare, padded owner) omit withdrawn-x from stdout and --jobs; malformed
  --repos usage refusal; no-flag cross-owner omission (test_control_without_allow_t3_path_unchanged inverted).
- Docs: references/t3-signoff.md spelling rules and issue #24 field mapping; CHANGELOG entry.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                           |  1 +
 references/t3-signoff.md               | 10 ++++++
 scripts/ctshowcase/signoff.py          |  2 +-
 tests/test_t3_cli_copy_plan_consent.py | 50 ++++++++++++++++++++++++--
 tests/test_t3_emission_scope.py        | 20 +++++++++++
 tests/test_t3_signoff_withdrawal.py    | 47 +++++++++++++++++++++++-
 6 files changed, 126 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index dcee636..74b79c9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- T3 sign-off repository spelling canonicalization (issue 23, adjudication t23-adjudication-repo-canonicalization-50f): the requested repository is canonicalized (whitespace, trailing `/`, `.git`) before the `*` shortcut in `signoff.evaluate()`/`_covers()`, so a per-repository withdrawal can no longer be bypassed by `x/`, ` x`, `x.git`; an empty or invalid name fails closed (`invalid:repo:`). `project copy-plan --repos` entries are stripped and validated (a malformed entry is a usage refusal), README and link entries are normalised once (a bare name on an org board is `<board owner>/<name>`, owners stripped and resolved, unresolvable owners held), and without `--allow-t3` a T3 repository on a non-T3 board README is omitted and logged `t3-signoff:readme:<owner>/<repo>`. `references/t3-signoff.md` documents the spelling rules and maps the record fields `repos`, `approved_on` and `expires` to the issue #24 wording. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_cli_copy_plan_consent.py, tests/test_t3_emission_scope.py.
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - `project copy-plan --allow-t3` builds the §13.9 step 7 settings job (default repository, auto-add) from the sign-off-authorized repositories only: a withdrawn or unauthorized repository is never chosen, the job is held with `settings-held:` when none remains, and the job carries the `signoff_id` of the repository it names (issue 23).
 - `project copy-plan --allow-t3` decides the repository sign-off once, before the README and browser jobs (issue 23): a withdrawn or unauthorized repository (listed in `--repos` or only captured in the board's README) is named by no README link, and the README job carries the granting ids of the links it keeps (a repository-specific regrant, not the cached wildcard). The `-workflows` browser job omits its auto-add step (log `workflows-held:auto-add`) when no repository is authorized, otherwise names the authorized repository and carries its granting `signoff_id`. Job order and ids are unchanged; standalone `project readme` is unchanged.
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index e45cdd0..b361b2f 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -33,6 +33,8 @@ signoffs:
 | `expires` | no | optional; absent means no expiry. When present: date `YYYY-MM-DD`, or a timestamp with `Z` or `+HH:MM`; a timestamp without an offset is invalid; not earlier than `approved_on` |
 | `note` | no | string |
 
+Field names follow the issue #24 wording: `repos` is the scope (the issue's repository list), `approved_on` is the sign-off date and `expires` the optional expiry.
+
 No other fields are allowed. The file itself is an object with the one key `signoffs`, a list of record objects; a top-level list, any other top-level key or a non-object entry makes the whole file authorize nothing (`t3-signoff:missing`), as the schema refuses it.
 
 ## Refusals
@@ -65,3 +67,11 @@ The owner checked is also the one that holds the repository today: a repository
 Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.
 
 Copy-plan sign-off scope: the per-repository authorization is decided once, before any job names a repository. The README job (links and default repository), the auto-add step of the `-workflows` browser job and the settings job all follow it. A withdrawn or unauthorized repository, whether from `--repos` or only captured in the board's README, appears in none of them. When no repository is authorized the auto-add step is omitted (`workflows-held:auto-add`). Each of these jobs carries the granting `signoff_id` of the repository records it names, so a later repository-specific regrant is stamped instead of the cached wildcard grant. Standalone `project readme` generation is unchanged.
+
+## Repository spelling (canonicalization, fail closed)
+
+The requested repository is canonicalized once, at the top of `evaluate()` and in `_covers()`, before the `*` shortcut (`signoff.canonical_repo`): surrounding whitespace, a trailing `/` and one trailing `.git` are stripped, so `x/`, ` x`, `x `, `x.git` and `x/.git` all name `x` and are vetoed by a withdrawal of `x` even beside a `*` grant, while a different repository in the same spellings still gets the grant. An empty or invalid remaining name (not `[A-Za-z0-9._-]+`; for example `a b`, `/`, `.git`, `   `, `../x`) fails closed as `invalid:repo: ...` (`t3-signoff:invalid`) and is never covered, not even by `*`.
+
+`project copy-plan --repos` splits on `,`, strips every entry, skips empty ones and canonicalizes each; a malformed entry refuses the command with a `usage` log and nothing is planned. README and link entries are normalised once before any authorization: a bare `NAME` on an org board means `<board owner>/<NAME>`, the owner is stripped and resolved to its canonical login, and an entry whose owner cannot be resolved is held (`readme-held:`), not kept. A malformed entry from any source is dropped with `repos-malformed:`.
+
+Without `--allow-t3`, a T3 owner's repository referenced from a non-T3 board README is omitted too, never kept unchecked (that would be less restrictive than passing the flag): the plan logs `t3-signoff:readme:<owner>/<repo>`. Standalone read-only `project readme` is unchanged apart from stripping and validating `--repos`.
diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index bfb07a1..dafb67f 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -307,7 +307,7 @@ def canonical_repo(value) -> str | None:
     if not sep:
         return name
     owner = owner.strip()
-    if not _REPO_PART_RE.fullmatch(owner):
+    if owner in (".", "..") or not _REPO_PART_RE.fullmatch(owner):
         return None
     return f"{owner}/{name}"
 
diff --git a/tests/test_t3_cli_copy_plan_consent.py b/tests/test_t3_cli_copy_plan_consent.py
index 13622ca..c92c2b1 100644
--- a/tests/test_t3_cli_copy_plan_consent.py
+++ b/tests/test_t3_cli_copy_plan_consent.py
@@ -10,6 +10,8 @@
 import sys
 from pathlib import Path
 
+import pytest
+
 ROOT = Path(__file__).resolve().parents[1]
 sys.path.insert(0, str(ROOT / "scripts"))
 sys.path.insert(0, str(ROOT / "tests"))
@@ -19,7 +21,7 @@
 REGRANT = BASE + [{"id": "regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
 
 
-def _cli_run(tmp_path, records, repos=None, captured=None):
+def _cli_run(tmp_path, records, repos=None, captured=None, repos_raw=None):
     """Run the real `scripts/showcase.py project copy-plan` (org role) and return (result, jobs)."""
     from test_t3_signoff_require import _bundle, _run, OWNER
     from test_project import cap_of
@@ -39,7 +41,7 @@ def _cli_run(tmp_path, records, repos=None, captured=None):
     jobsfile = root / "jobs.jsonl"
     result = _run(root, bundle, "--allow-t3", "project", "copy-plan", "--target", OWNER, "--copied", str(capfile),
                   "--jobs", str(jobsfile), "--files-dir", str(root / "bodies"),
-                  *(["--repos", ",".join(repos)] if repos else []))
+                  *(["--repos", repos_raw if repos_raw is not None else ",".join(repos)] if repos or repos_raw else []))
     jobs = []
     if jobsfile.exists():
         jobs = [json.loads(line) for line in jobsfile.read_text(encoding="utf-8").splitlines() if line.strip()]
@@ -233,3 +235,47 @@ def test_cli_withdrawn_repository_is_still_omitted_with_a_board_grant(tmp_path):
     text = job["argv"][job["argv"].index("--readme") + 1]
     assert f"{REPO_OWNER}/site" not in text, text
     assert "grant-repo" not in _ids(job), job
+
+
+# 9) repository spelling canonicalization through the real CLI (adjudication t23-adjudication-repo-canonicalization-50f)
+# Every valid spelling of a withdrawn repository is omitted, the kept one retained, in stdout AND the --jobs file.
+OWN = "Pick-Your-AI"
+SPELL_CASES = {
+    "trailing-slash": f"{OWN}/kept-y,{OWN}/withdrawn-x/",
+    "dot-git": f"{OWN}/kept-y,{OWN}/withdrawn-x.git",
+    "comma-space": f"{OWN}/kept-y, {OWN}/withdrawn-x",
+    "bare-name": f"{OWN}/kept-y,withdrawn-x",
+    "padded-owner": f"{OWN}/kept-y, {OWN} /withdrawn-x",
+}
+
+
+def _withdrawn_absent_everywhere(result, jobsfile_text):
+    out = json.loads(result.stdout)
+    plan_text = json.dumps(out.get("jobs", []))
+    for where, text in (("stdout jobs", plan_text), ("jobs file", jobsfile_text)):
+        assert "withdrawn-x" not in text, (where, text)
+    assert "kept-y" in plan_text and "kept-y" in jobsfile_text
+
+
+@pytest.mark.parametrize("case", sorted(SPELL_CASES))
+def test_cli_repo_spelling_cannot_resurrect_a_withdrawn_repository(case, tmp_path):
+    result, jobs = _cli_run(tmp_path, BASE, repos_raw=SPELL_CASES[case])
+    assert result.returncode == 0, result.stdout + result.stderr
+    _withdrawn_absent_everywhere(result, "\n".join(json.dumps(j) for j in jobs))
+    readme = [j for j in jobs if "--readme" in j.get("argv", [])]
+    assert len(readme) == 1 and "grant" in _ids(readme[0]), readme
+    assert not [j for j in jobs if "withdrawn-x" in json.dumps(j)], [j["id"] for j in jobs]  # no link job either
+
+
+@pytest.mark.parametrize("bad", ["a b", "/", ".git", f"{OWN}/kept-y,a b", "../x"])
+def test_cli_malformed_repos_entry_is_a_usage_refusal(bad, tmp_path):
+    result, jobs = _cli_run(tmp_path, BASE, repos_raw=bad)
+    out = json.loads(result.stdout)
+    assert result.returncode != 0 and "usage" in json.dumps(out.get("logs", out)), result.stdout + result.stderr
+    assert jobs == [], [j.get("id") for j in jobs]
+
+
+def test_cli_trailing_comma_and_empty_entries_are_skipped(tmp_path):
+    result, jobs = _cli_run(tmp_path, BASE, repos_raw=f"{OWN}/kept-y,, ,")
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "kept-y" in json.dumps(jobs)
diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
index 67cc2c7..9c1525f 100644
--- a/tests/test_t3_emission_scope.py
+++ b/tests/test_t3_emission_scope.py
@@ -319,3 +319,23 @@ def test_copy_plan_without_repositories_readme_and_workflows_unchanged(tmp_path,
     assert any("auto-add" in s.lower() for s in wf[0]["steps"]), wf[0]["steps"]
     assert "signoff_id" not in wf[0], wf[0]
     assert not any(str(x).startswith("settings-held:") for x in plan["logs"]), plan["logs"]
+
+
+# repository spelling canonicalization (t23-adjudication-repo-canonicalization-50f): in-library copy-plan, every valid
+# spelling of a withdrawn repository is omitted from the README, workflows and link jobs; kept-y is retained.
+@pytest.mark.parametrize("withdrawn", [f"{OWNER}/withdrawn-x/", f"{OWNER}/withdrawn-x.git", f" {OWNER}/withdrawn-x",
+                                       f" {OWNER} /withdrawn-x", "withdrawn-x"])
+def test_copy_plan_spelling_of_withdrawn_repository_is_omitted_everywhere(tmp_path, monkeypatch, brand, withdrawn):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy_private(brand, [f"{OWNER}/kept-y", withdrawn])
+    rd = _readme_jobs(plan)
+    assert len(rd) == 1, [j["id"] for j in plan["jobs"]]
+    assert "kept-y" in rd[0]["argv"][rd[0]["argv"].index("--readme") + 1]
+    assert "withdrawn-x" not in json.dumps(plan["jobs"]), [j["id"] for j in plan["jobs"]]
+
+
+def test_copy_plan_malformed_repository_entry_is_dropped_with_a_log(tmp_path, monkeypatch, brand):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _copy_private(brand, [f"{OWNER}/kept-y", "a b"])
+    assert any(str(x).startswith("repos-malformed:") for x in plan["logs"]), plan["logs"]
+    assert "a b" not in json.dumps(plan["jobs"])
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index 7c1e985..4891f76 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -434,12 +434,57 @@ def test_control_same_owner_behaviour_unchanged(brand, tmp_path, monkeypatch):
 
 
 def test_control_without_allow_t3_path_unchanged(brand, tmp_path, monkeypatch):
+    """Without --allow-t3 a T3 repository of another owner is dropped from a non-T3 board README (no sign-off lookup,
+    but never less restrictive than passing the flag); the omission is logged as t3-signoff:readme:<owner>/<repo>."""
     plan = _xo_plan(brand, tmp_path, monkeypatch, [], [f"{T3_OWNER}/withdrawn-x"], allow_t3=False)
     _, text = _xo_readme(plan)
-    assert "withdrawn-x" in text, text
+    assert "withdrawn-x" not in text, text
+    assert f"t3-signoff:readme:{T3_OWNER}/withdrawn-x" in plan["logs"], plan["logs"]
+
+
+def test_no_flag_non_t3_repository_is_still_named(brand, tmp_path, monkeypatch):
+    """A repository of a non-T3 owner is unaffected by the no-flag omission (a T3 board itself refuses without the flag)."""
+    other = "Northwind-Trading-Co"
+    plan = _xo_plan(brand, tmp_path, monkeypatch, [], [f"{other}/some-repo"], allow_t3=False)
+    _, text = _xo_readme(plan)
+    assert "some-repo" in text, text
     assert not any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
 
 
+# ------------------------------------------------------------------ repository spelling canonicalization (issue 23)
+# A trailing slash, padding or `.git` never hides a withdrawal behind a `*` grant: the requested repository is
+# canonicalized once, and an invalid remaining name fails closed.
+SPELLINGS = ["x/", " x", "x ", "x.git", "x/.git", "  x.git/ ", "X/"]
+
+
+@pytest.mark.parametrize("spelling", SPELLINGS)
+def test_requested_repo_spelling_cannot_bypass_a_withdrawal(spelling):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["x"], approved=False, on="2026-06-01")]
+    assert _ev(recs, "x") == (None, "revoked")
+    assert _ev(recs, spelling) == _ev(recs, "x") == (None, "revoked")
+
+
+@pytest.mark.parametrize("spelling", SPELLINGS)
+def test_requested_repo_spelling_of_another_repo_still_gets_the_grant(spelling):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["x"], approved=False, on="2026-06-01")]
+    other = spelling.replace("x", "y").replace("X", "y")
+    assert _ev(recs, other) == ("g1", None)
+
+
+@pytest.mark.parametrize("bad", ["a b", "/", ".git", "   ", "a//b/c", "../x", "x y.git"])
+def test_invalid_requested_repo_name_fails_closed(bad):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["x"], approved=False, on="2026-06-01")]
+    got, err = _ev(recs, bad)
+    assert got is None and err and err.startswith("invalid:repo:"), (got, err)
+
+
+def test_canonical_repo_helper():
+    from ctshowcase import signoff
+    assert signoff.canonical_repo(" Acme/site.git/ ") == "Acme/site"
+    assert signoff.canonical_repo("site/.git") == "site"
+    assert [signoff.canonical_repo(v) for v in ("", "/", ".git", "a b", None, 3)] == [None] * 6
+
+
 def test_control_standalone_project_readme_unchanged(brand):
     """`project readme` is read-only text: it names the repositories it is given, with no sign-off lookup."""
     from ctshowcase import project as PJ

From f575dd01c84c3cbe0d35d39cfbaef1c7f1a6a66a Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:16:12 -0500
Subject: [PATCH 65/79] fix(org): hold exact-set pin order job for
 sign-off-held targets

The pins order job tells the writer to make the ticked set exactly the
kept list and untick every other repository. That would also withdraw a
pin held for co-owner sign-off. Track targets with a T3 sign-off hold and
skip the exact-set order job for them, logging pins-order-held:<target>:t3-signoff.
The individual authorized pin jobs are unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/org.py | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 9c9270c..66ec74d 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -1474,6 +1474,7 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
     login, row, reg = _gate(estate, org, allow_t3=allow_t3, allow_hold=True)
     checks, jobs, logs, order = [], [], [], {"public": [], "members": []}
     pin_records: dict[str, list[str]] = {}
+    t3_held: set[str] = set()  # targets with a pin held for co-owner sign-off (see the order-job loop below)
     held = _star_held(estate, org) == "hold"  # STANDARD §12.5 #4: a HOLD org's pins only report, as `profile` refuses
     if held:
         logs.append("pins:hold")
@@ -1524,6 +1525,7 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
             if held:
                 res, detail = "hold", "org on HOLD (STANDARD §12.5 #4): pins only report"
             elif (t3c := _t3_repo_refusal(estate, login, pin, allow_t3)):
+                t3_held.add(target)
                 res, detail = "hold", f"t3-signoff:{t3c}:{login}/{pin}"
                 logs.append(f"t3-signoff:{t3c}:{login}/{pin}")
             checks.append({"target": target, "position": i, "repo": pin, "result": res, "detail": detail,
@@ -1544,11 +1546,18 @@ def pins(estate: Estate, org: str, *, allow_t3: bool = False, lists_capture: dic
             if _pin_rec:
                 jobs[-1]["signoff_id"] = _pin_rec
                 pin_records.setdefault(target, []).append(_pin_rec)
+    # The exact-set order job below tells the writer to make the ticked set EXACTLY the kept list and untick every
+    # other repository. That would also withdraw a pin held for co-owner sign-off (withdrawn or unauthorized), so
+    # for a target with any such held pin the exact-set job is held and logged. The individual authorized pin jobs
+    # above (each adds one repository and keeps the others) are still emitted, so authorized kept pins remain.
     for target, label, view in (("public", "Public pins", "Public"), ("members", "Members-only pins", "Member")):
         bad = ("fail", "blocked", "unknown", "hold") if target == "public" else ("fail", "blocked", "hold")
         keep = [c["repo"] for c in checks if c.get("target") == target and c.get("repo") and c["result"] not in bad]
         if not keep:
             continue
+        if target in t3_held:
+            logs.append(f"pins-order-held:{target}:t3-signoff")
+            continue
         listing = "; ".join(f"{i}. {n}" for i, n in enumerate(keep, 1))
         jobs.append(browser_job(
             f"p{PHASE['pins']}-{login}-pin-{target}-order", PHASE["pins"], f"https://github.com/{login}",

From de73d42f77dd7dd14e34ea1c2dd29afb2210b067 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:16:22 -0500
Subject: [PATCH 66/79] fix(t3-signoff): canonicalize stored repos scopes and
 fail closed on bad entries

Stored grant and withdrawal scopes are now canonicalized the same way as the
requested repository (_canon_entries, `*` preserved), in _covers, _scope_key
and _withdrawn. `site/`, ` site` and `site.git` name `site`. An entry that
cannot be canonicalized makes the record malformed (problems() reports
`repos:`), so a withdrawal with such a scope is never silently ignored.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/signoff.py | 75 +++++++++++++++++++++++------------
 1 file changed, 49 insertions(+), 26 deletions(-)

diff --git a/scripts/ctshowcase/signoff.py b/scripts/ctshowcase/signoff.py
index dafb67f..9ddad7f 100644
--- a/scripts/ctshowcase/signoff.py
+++ b/scripts/ctshowcase/signoff.py
@@ -222,10 +222,9 @@ def problems(rec: dict, today: _dt.date | None = None) -> list[str]:
     for key in ("id", "owner", "approver"):
         if not isinstance(rec.get(key), str) or not rec[key].strip():
             out.append(f"{key}: needs a non-empty string")
-    repos = rec.get("repos")
-    if not (isinstance(repos, str) and repos.strip()) and not (
-            isinstance(repos, list) and repos and all(isinstance(x, str) and x.strip() for x in repos)):
-        out.append("repos: needs '*', a repository name or a non-empty list of them")
+    if _canon_entries(rec.get("repos")) is None:
+        out.append("repos: needs '*' or repository names ([A-Za-z0-9._-]+, optionally OWNER/NAME) or a "
+                   "non-empty list of them")
     if not isinstance(rec.get("approved"), bool):
         out.append("approved: needs true or false (a boolean, not a string)")
     approved_on = _parse_when(rec.get("approved_on"))
@@ -277,14 +276,9 @@ def _repo_list(repos) -> list[str] | None:
 
 
 def _repos_malformed(rec: dict) -> bool:
-    """True when problems() reports the `repos:` break: `repos` is neither a non-empty string nor a non-empty list of
-    non-empty strings."""
-    repos = rec.get("repos")
-    if isinstance(repos, str) and repos.strip():
-        return False
-    if isinstance(repos, list) and repos and all(isinstance(x, str) and x.strip() for x in repos):
-        return False
-    return True
+    """True when problems() reports the `repos:` break: `repos` has no canonical form (_canon_entries is None), so it is
+    not a non-empty string or list of non-empty strings, or an entry is neither `*` nor a valid repository name."""
+    return _canon_entries(rec.get("repos")) is None
 
 
 _REPO_PART_RE = re.compile(r"[A-Za-z0-9._-]+")
@@ -312,13 +306,41 @@ def canonical_repo(value) -> str | None:
     return f"{owner}/{name}"
 
 
+def _canon_entries(repos) -> list[str] | None:
+    """The canonical entries of a `repos` value (a string, or a list of strings; a bare string is one entry): each `*`
+    entry stays `*`, every other entry is canonical_repo() (case kept). None when `repos` is not a string or a list of
+    strings, is empty, or any non-`*` entry cannot be canonicalized. Stored scopes are read through this, so a malformed
+    scope is never half-honoured (fail closed)."""
+    if isinstance(repos, str):
+        items = [repos]
+    elif isinstance(repos, list) and repos and all(isinstance(x, str) for x in repos):
+        items = repos
+    else:
+        return None
+    out: list[str] = []
+    for x in items:
+        if x.strip() == "*":
+            out.append("*")
+            continue
+        c = canonical_repo(x)
+        if c is None:
+            return None
+        out.append(c)
+    return out
+
+
 def _scope_key(entry: str, logins: list[str] | None) -> str:
-    """A canonical key for one `repos` entry, so equivalent scopes compare equal. `*` stays `*`. A bare NAME is its
-    lowercased name. OWNER/NAME for one of LOGINS (the owner's own logins, aliases included) is the bare name, the same
-    repository. OWNER/NAME for another account keeps its full lowercased form. With logins None, the lowercased entry."""
-    e = entry.strip().lower()
+    """A canonical key for one `repos` entry, so equivalent scopes compare equal. Stored entries are canonicalized the
+    same way as the requested repository (canonical_repo), so `site/`, ` site` and `site.git` are `site`; `*` stays `*`.
+    A bare NAME is its lowercased name. OWNER/NAME for one of LOGINS (the owner's own logins, aliases included) is the
+    bare name, the same repository. OWNER/NAME for another account keeps its full lowercased form. An entry that cannot
+    be canonicalized keeps its lowercased raw form here; _canon_entries() rejects such a record before it is compared
+    (fail closed)."""
+    e = entry.strip()
     if e == "*":
         return "*"
+    c = canonical_repo(e)
+    e = (c if c is not None else e).lower()
     head, sep, tail = e.rpartition("/")
     if not sep:
         return e
@@ -336,9 +358,12 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
     withdrawn for [a] is refused for a and still grants b. Without REPO the whole-grant rule applies: the withdrawal
     has `*`, or every scope of the grant appears among its own. Scopes are compared owner- and alias-aware: a bare
     name equals OWNER/NAME when OWNER is one of the owner's own LOGINS, so the two forms revoke each other, and another
-    account's OWNER/NAME stays distinct."""
+    account's OWNER/NAME stays distinct. Stored scopes are canonicalized the same way as the requested repository
+    (_canon_entries, `*` preserved), so `site/`, ` site` and `site.git` name `site`. An entry that cannot be
+    canonicalized is malformed (fail closed): a grant with one is never withdrawn here, and a withdrawal with one never
+    withdraws."""
     g_on = _parse_when(grant.get("approved_on"))
-    g_repos = _repo_list(grant.get("repos"))
+    g_repos = _canon_entries(grant.get("repos"))
     if g_on is None or g_repos is None or isinstance(g_on, _dt.datetime):
         return False
     owners = {_owner_key(x) for x in logins} if logins is not None else None
@@ -347,7 +372,7 @@ def _withdrawn(grant: dict, withdrawals: list[dict], logins: list[str] | None =
         if owners is not None and _owner_key(f.get("owner")) not in owners:
             continue
         f_on = _parse_when(f.get("approved_on"))
-        f_repos = _repo_list(f.get("repos"))
+        f_repos = _canon_entries(f.get("repos"))
         if f_on is None or f_repos is None or isinstance(f_on, _dt.datetime) or f_on < g_on:
             continue
         if repo:
@@ -459,14 +484,12 @@ def _covers(rec: dict, repo: str | None, logins: list[str] | None = None) -> boo
     (the requested owner and its org aliases) as well as the name. A repository given as OWNER/NAME is covered only
     when that owner is one of `logins` too (only `*` covers another account's repository). A non-empty REPO is
     canonicalized (canonical_repo) before the `*` shortcut, so an invalid name is covered by nothing, not even `*`.
-    A malformed `repos` (not a string or a list of strings) covers nothing; evaluate() reports such a record as
-    t3-signoff:invalid through problems(), not as t3-signoff:scope."""
-    repos = rec.get("repos")
-    if isinstance(repos, str):
-        repos = [repos]
-    if not isinstance(repos, list) or not all(isinstance(x, str) for x in repos):
+    Stored `repos` are canonicalized the same way (_canon_entries, `*` preserved), so `site/` and `site.git` cover
+    `site`. A malformed `repos` (not a string or a list of strings, or an entry that cannot be canonicalized) covers
+    nothing; evaluate() reports such a record as t3-signoff:invalid through problems(), not as t3-signoff:scope."""
+    repos = _canon_entries(rec.get("repos"))
+    if repos is None:
         return False
-    repos = [x.strip() for x in repos]  # same normalisation as _scope_key: padding never hides a scope
     if isinstance(repo, str) and repo:
         repo = canonical_repo(repo)
         if repo is None:

From b1d12ef780895bec41c9105df7964041106f3c5b Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:21:24 -0500
Subject: [PATCH 67/79] fix(#23): stamp proposals, regression matrix and docs
 for stored scopes and held pin order

Owner integration of round 13: _finish and showcase main stamp writer-shaped
proposals (kept out of the writer queue); tests for canonicalized stored
scopes, invalid booleans, held exact-set pin order and proposal stamping;
docs and CHANGELOG.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                        |   1 +
 references/t3-signoff.md            |   6 +-
 scripts/ctshowcase/content.py       |   4 +
 scripts/showcase.py                 |   2 +-
 tests/test_t3_signoff_proposals.py  | 121 ++++++++++++++++++++++++++++
 tests/test_t3_signoff_require.py    |  39 +++++++++
 tests/test_t3_signoff_withdrawal.py |  79 ++++++++++++++++++
 7 files changed, 249 insertions(+), 3 deletions(-)
 create mode 100644 tests/test_t3_signoff_proposals.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2bf3011..954e056 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- T3 sign-off stored scopes, held pin order and proposal stamping (issue 23, round 13): stored `repos` entries of grants and withdrawals are canonicalized like the requested repository (`site/`, ` site`, `site.git` equal `site`, `*` kept) in `evaluate`, `_covers` and the withdrawal match, and an entry that cannot be canonicalized makes the record malformed (`t3-signoff:invalid`, fails closed for a withdrawal, never authorizes for a grant); a non-boolean `approved` on a scoped record fails closed for that scope only. `org pins --allow-t3` holds the exact-set order job of a target that has a pin held for sign-off (`pins-order-held:<target>:t3-signoff`) while the authorized pin jobs remain, so a held pin is not unticked. Writer-shaped `proposals` (the `content actions` workflow-toggle) carry `signoff_id` in the report and on stdout and stay out of the `--jobs` queue. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_signoff_require.py, tests/test_t3_signoff_proposals.py.
 - T3 sign-off repository spelling canonicalization (issue 23, adjudication t23-adjudication-repo-canonicalization-50f): the requested repository is canonicalized (whitespace, trailing `/`, `.git`) before the `*` shortcut in `signoff.evaluate()`/`_covers()`, so a per-repository withdrawal can no longer be bypassed by `x/`, ` x`, `x.git`; an empty or invalid name fails closed (`invalid:repo:`). `project copy-plan --repos` entries are stripped and validated (a malformed entry is a usage refusal), README and link entries are normalised once (a bare name on an org board is `<board owner>/<name>`, owners stripped and resolved, unresolvable owners held), and without `--allow-t3` a T3 repository on a non-T3 board README is omitted and logged `t3-signoff:readme:<owner>/<repo>`. `references/t3-signoff.md` documents the spelling rules and maps the record fields `repos`, `approved_on` and `expires` to the issue #24 wording. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_cli_copy_plan_consent.py, tests/test_t3_emission_scope.py.
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
 - `project copy-plan --allow-t3` builds the §13.9 step 7 settings job (default repository, auto-add) from the sign-off-authorized repositories only: a withdrawn or unauthorized repository is never chosen, the job is held with `settings-held:` when none remains, and the job carries the `signoff_id` of the repository it names (issue 23).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index b361b2f..0be3165 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -54,7 +54,7 @@ Each refusal exits 2 with result `refused`.
 
 The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing. A record for the owner whose `approved` is not a boolean (the string `"false"` or `"true"`, `0`, `1`, `null` or a missing key) is likewise a possible withdrawal that fails closed as `t3-signoff:invalid`; it is never coerced into a grant or a withdrawal.
 
-An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`.
+An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. The exact-set order job (`...-pin-<target>-order`, "make the ticked set exactly this list and untick every other repository") would also untick a held pin, so when any pin of a target is held for sign-off that target's order job is held too and the run logs `pins-order-held:<target>:t3-signoff`; the authorized individual pin jobs remain, and nothing is deleted from the plan data. Without a held pin the order job is emitted and carries the `signoff_ids` of the pins it lists. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`.
 
 **`signoff_id` and `approval_id` (issue #26).** Task #26 says "add `approval_id` to jobs created under the flag". This implementation names the sign-off in a separate `signoff_id` (`signoff_ids` for several) and never sets `approval_id`, because `approval_id` names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up, and a sign-off id is not one. Read #26 as "carry the sign-off id as `signoff_id`".
 
@@ -62,7 +62,7 @@ An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gate
 
 Excluded owners (`exempt`) and HOLD owners (`hold`) are refused before the record is read. Repository `doctor` stays read-only: it reports R7 `hold` instead of refusing, and with `--allow-t3` shows the granting record as `signoff_id`.
 
-The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it.
+The owner checked is also the one that holds the repository today: a repository named under one org whose approved pending transfer resolves to a T3 org is gated as that T3 org's (org label jobs, profile home repositories, favorites and star-List items). A T3 org's association carries that org's record id (`signoff_id`; `signoff_ids` lists every id when more than one record applies, for example a star-List item job that adds a T3 repository to a T3 org's List carries the favorite's record and the List org's record): the topics change record of `topics --also-in`, the topics job and change record of `adopt` for a repository whose metadata lists the org in `also_in`, and the `project estate-plan` jobs that put the org in the personal board's Org field (its `orgs` entry shows the id too). Jobs and change records carry `signoff_id` (and `signoff_ids`). `approval_id` is left untouched, because it names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up; a job's existing `approval_id` is kept and a sign-off id is never written into it. Writer-shaped entries under `proposals` (for example the `workflow-toggle` job `content actions` proposes for a kept fork until `--approval` names an approved id) carry `signoff_id` in the `--report` file and on stdout, but stay out of the writer queue (`--jobs`) until approved; diff-style proposals without a `phase` are untouched.
 
 Project settings pass (`project copy-plan --allow-t3`, §13.9 step 7): the 'Default repository' and 'Auto-add to project' browser steps name only a repository that passed its own sign-off check (the first link actually emitted), never a withdrawn, unauthorized or other-owner one. When repositories are listed but none is authorized, the settings job is held and the plan logs `settings-held:default-repository-and-auto-add`. The settings job carries `signoff_id` (and `signoff_ids`) of the record that grants the repository it names, like the link jobs.
 
@@ -70,6 +70,8 @@ Copy-plan sign-off scope: the per-repository authorization is decided once, befo
 
 ## Repository spelling (canonicalization, fail closed)
 
+Stored `repos` entries in grants and withdrawals are canonicalized the same way as the requested repository: `site/`, ` site` and `site.git` equal `site`, and `*` is preserved. A withdrawal of `site/` therefore vetoes a `*` grant for `site`, and a grant stored as `site/` is withdrawn by `site` and the reverse. An entry that cannot be canonicalized (`a b`, `/`, `..`) makes the record malformed (`problems()` reports a `repos:` line, `t3-signoff:invalid`): a grant with one never authorizes, and a withdrawal with one fails closed for any repository, because a malformed withdrawal could cover anything. `references/t3-signoff.schema.json` stays permissive on the entry text; `signoff.problems()` is the stricter check.
+
 The requested repository is canonicalized once, at the top of `evaluate()` and in `_covers()`, before the `*` shortcut (`signoff.canonical_repo`): surrounding whitespace, a trailing `/` and one trailing `.git` are stripped, so `x/`, ` x`, `x `, `x.git` and `x/.git` all name `x` and are vetoed by a withdrawal of `x` even beside a `*` grant, while a different repository in the same spellings still gets the grant. An empty or invalid remaining name (not `[A-Za-z0-9._-]+`; for example `a b`, `/`, `.git`, `   `, `../x`) fails closed as `invalid:repo: ...` (`t3-signoff:invalid`) and is never covered, not even by `*`.
 
 `project copy-plan --repos` splits on `,`, strips every entry, skips empty ones and canonicalizes each; a malformed entry refuses the command with a `usage` log and nothing is planned. README and link entries are normalised once before any authorization: a bare `NAME` on an org board means `<board owner>/<NAME>`, the owner is stripped and resolved to its canonical login, and an entry whose owner cannot be resolved is held (`readme-held:`), not kept. A malformed entry from any source is dropped with `repos-malformed:`.
diff --git a/scripts/ctshowcase/content.py b/scripts/ctshowcase/content.py
index b91706c..64b8b56 100644
--- a/scripts/ctshowcase/content.py
+++ b/scripts/ctshowcase/content.py
@@ -2591,6 +2591,10 @@ def _finish(args, obj: dict, code: int):
     jobs = list(obj.get("jobs") or []) + ([obj["job"]] if obj.get("job") else [])
     from .signoff import stamp
     stamp(jobs)  # before any serialization (--jobs, --report)
+    # Writer-shaped proposals (phase/kind/repo/argv, e.g. a workflow-toggle awaiting --approval) carry the granting
+    # sign-off in the report and stdout but are NOT added to `jobs`, so they stay out of the writer queue. stamp() only
+    # touches dicts with `phase` or std/owner/repo, so diff-style proposals (no phase) are left untouched.
+    stamp([p for p in (obj.get('proposals') or []) if isinstance(p, dict)])
     if getattr(args, "jobs", None) and jobs:  # writer jobs only; unapproved proposals stay in the report
         from .records import append
         append(args.jobs, jobs)
diff --git a/scripts/showcase.py b/scripts/showcase.py
index 07219d1..3814edc 100644
--- a/scripts/showcase.py
+++ b/scripts/showcase.py
@@ -1284,7 +1284,7 @@ def _main(argv=None) -> int:
             print(f"{args.command}: {obj['error']}", file=sys.stderr)
             return code
     if obj is not None:
-        for key in ("jobs", "records"):  # writer jobs and change records (adopt, new, enterprise plan)
+        for key in ("jobs", "records", "proposals"):  # writer jobs, change records, writer-shaped proposals
             if isinstance(obj.get(key), list):
                 signoff.stamp(obj[key])  # the granting record
         emit(args, obj)
diff --git a/tests/test_t3_signoff_proposals.py b/tests/test_t3_signoff_proposals.py
new file mode 100644
index 0000000..a196746
--- /dev/null
+++ b/tests/test_t3_signoff_proposals.py
@@ -0,0 +1,121 @@
+"""Writer-shaped proposals carry the granting sign-off (issue 23, round 13). `content actions --allow-t3` on a kept fork of
+a T3 owner with upstream-only automation proposes a `workflow-toggle` writer job under `proposals` (no --approval, so it is
+not queued). The proposal carries `signoff_id` in the --report file and on stdout, stays out of the --jobs writer queue
+and never gains an approval_id. Synthetic records and slugs only."""
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+SHOWCASE = [sys.executable, str(ROOT / "scripts" / "showcase.py")]
+META = json.loads((ROOT / "examples" / "meta" / "northwind-support-triage-agent.json").read_text(encoding="utf-8"))
+OWNER = "Pick-Your-AI"
+CLA = ("name: CLA\non: [pull_request_target]\njobs:\n  c:\n    runs-on: x\n    steps:\n"
+       "      - uses: contributor-assistant/github-action@v2\n")
+
+
+def _rec(repos):
+    return {"id": "t3s-fork", "owner": OWNER, "repos": repos, "approved": True, "approver": "synthetic-co-owner",
+            "approved_on": "2026-01-15", "expires": "2099-12-31"}
+
+
+def _setup(tmp_path, repos, repo="tool-fork"):
+    (tmp_path / "repo" / ".github" / "workflows").mkdir(parents=True)
+    (tmp_path / "repo" / ".github" / "workflows" / "cla.yml").write_text(CLA, encoding="utf-8")
+    (tmp_path / "meta.json").write_text(json.dumps(dict(META, owner=OWNER, repo=repo, fork=True,
+                                                         parent={"full_name": "upstream-org/tool"})), encoding="utf-8")
+    (tmp_path / "wf.json").write_text(json.dumps({"workflows": [
+        {"id": 21, "name": "CLA", "path": ".github/workflows/cla.yml", "state": "active"}]}), encoding="utf-8")
+    (tmp_path / "s.yaml").write_text(json.dumps({"signoffs": [_rec(repos)]}), encoding="utf-8")
+
+
+def _argv(tmp_path, *, allow=True):
+    t = tmp_path
+    return [*(["--allow-t3"] if allow else []), "--meta", str(t / "meta.json"), "--repo-dir", str(t / "repo"),
+            "--t3-signoff-file", str(t / "s.yaml"), "content", "actions", "--workflows", str(t / "wf.json"),
+            "--report", str(t / "report.json"), "--jobs", str(t / "jobs.jsonl")]
+
+
+def _cli(tmp_path, **kw):
+    env = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(tmp_path))
+    env.pop("SHOWCASE_T3_SIGNOFF_FILE", None)
+    r = subprocess.run([*SHOWCASE, *_argv(tmp_path, **kw)], cwd=ROOT, env=env, capture_output=True, text=True,
+                       encoding="utf-8")
+    assert r.returncode in (0, 1), r.stdout + r.stderr
+    return json.loads(r.stdout), json.loads((tmp_path / "report.json").read_text(encoding="utf-8"))
+
+
+def _toggle(obj):
+    t = [p for p in obj["proposals"] if p.get("kind") == "workflow-toggle" and p.get("argv") and p.get("phase")]
+    assert len(t) == 1, obj["proposals"]
+    return t[0]
+
+
+def _queued(tmp_path):
+    p = tmp_path / "jobs.jsonl"
+    return [json.loads(x) for x in p.read_text(encoding="utf-8").splitlines() if x.strip()] if p.is_file() else []
+
+
+def test_cli_stdout_and_report_proposal_carry_the_signoff_id(tmp_path):
+    _setup(tmp_path, ["tool-fork"])
+    out, rep = _cli(tmp_path)
+    for obj in (out, rep):
+        prop = _toggle(obj)
+        assert prop["signoff_id"] == "t3s-fork" and "approval_id" not in prop, prop
+        assert prop["repo"] == f"{OWNER}/tool-fork" and prop["argv"][:3] == ["gh", "workflow", "disable"]
+    assert out["jobs"] == [] and _queued(tmp_path) == [], "an unapproved proposal must not enter the writer queue"
+
+
+def test_wildcard_grant_stamps_the_proposal_too(tmp_path):
+    _setup(tmp_path, ["*"])
+    out, rep = _cli(tmp_path)
+    assert _toggle(out)["signoff_id"] == "t3s-fork" and _toggle(rep)["signoff_id"] == "t3s-fork"
+
+
+def test_control_without_allow_t3_stamps_nothing(tmp_path):
+    _setup(tmp_path, ["tool-fork"])
+    env = dict(os.environ, SHOWCASE_ESTATE_ROOT=str(tmp_path))
+    r = subprocess.run([*SHOWCASE, *_argv(tmp_path, allow=False)], cwd=ROOT, env=env, capture_output=True, text=True,
+                       encoding="utf-8")
+    assert "signoff_id" not in r.stdout, r.stdout
+    rep = tmp_path / "report.json"
+    assert not rep.is_file() or "signoff_id" not in rep.read_text(encoding="utf-8")
+
+
+def test_control_a_record_for_another_repository_stamps_nothing(tmp_path):
+    _setup(tmp_path, ["some-other-repo"])
+    r = subprocess.run([*SHOWCASE, *_argv(tmp_path)], cwd=ROOT, env=dict(os.environ, SHOWCASE_ESTATE_ROOT=str(tmp_path)),
+                       capture_output=True, text=True, encoding="utf-8")
+    assert r.returncode == 2 and "t3-signoff:scope" in r.stdout + r.stderr, r.stdout + r.stderr
+    assert "signoff_id" not in r.stdout
+
+
+def test_in_process_finish_stamps_proposals_but_not_the_queue(tmp_path, monkeypatch):
+    """cmd_content/_finish level: a writer-shaped proposal is stamped, a diff-style one (no phase) is untouched, and the
+    --jobs file receives only `jobs`."""
+    from types import SimpleNamespace
+    from ctshowcase import content as C, signoff
+    from ctshowcase.config import reset_t3_signed_off, set_t3_signed_off
+    _setup(tmp_path, ["tool-fork"])
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(tmp_path / "s.yaml"))
+    t3, run = set_t3_signed_off(True), signoff.reset()
+    try:
+        signoff.require(OWNER, "tool-fork")  # registers the grant, as the command's owner gate does
+        diff_style = {"path": "README.md", "old": "a", "new": "b"}
+        writer = C.writer_job("x", 3, "workflow-toggle", f"{OWNER}/tool-fork",
+                              ["gh", "workflow", "disable", "cla.yml", "-R", f"{OWNER}/tool-fork"], "n")
+        obj = {"jobs": [], "proposals": [writer, diff_style]}
+        args = SimpleNamespace(jobs=str(tmp_path / "q.jsonl"), report=str(tmp_path / "r.json"))
+        C._finish(args, obj, 0)
+        assert writer["signoff_id"] == "t3s-fork" and "signoff_id" not in diff_style
+        assert not (tmp_path / "q.jsonl").exists()
+        assert json.loads((tmp_path / "r.json").read_text(encoding="utf-8"))["proposals"][0]["signoff_id"] == "t3s-fork"
+    finally:
+        signoff.restore(run)
+        reset_t3_signed_off(t3)
diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 5eaaff5..10cb1d0 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1300,6 +1300,45 @@ def test_wildcard_grant_with_a_repo_withdrawal_holds_that_repo_in_profile_and_pi
         assert sum("pin-public" in j["id"] or "-pin-public-" in j["id"] for j in res["jobs"]) >= 2, res["jobs"]
 
 
+def test_held_pin_holds_the_exact_set_order_job_but_not_the_authorized_pin(tmp_path, monkeypatch, brand):
+    """The order job says "make the ticked set exactly the kept list and untick every other repository", which would
+    also untick the pin held for sign-off. So when any pin of a target is held, that target's order job is held
+    (`pins-order-held:<target>:t3-signoff`) and the authorized pin job for kept-y remains, with its signoff_id."""
+    from ctshowcase import org as O, signoff
+    est, _ = _pya_estate(brand)
+    with _Strict(monkeypatch, _file(_bundle(tmp_path, _WILD))):
+        res, _ = O.pins(est, OWNER, allow_t3=True)
+        signoff.stamp(res["jobs"])
+        ids = [j["id"] for j in res["jobs"]]
+        assert not any(i.endswith("-pin-public-order") for i in ids), ids
+        assert f"pins-order-held:public:t3-signoff" in res["logs"], res["logs"]
+        assert f"t3-signoff:revoked:{OWNER}/withdrawn-x" in res["logs"], res["logs"]
+        kept = [j for j in res["jobs"] if "kept-y" in json.dumps(j)]
+        assert kept and all(j["signoff_id"] == "t3s-all" for j in kept), res["jobs"]
+        assert res["order"]["public"] == ["withdrawn-x", "kept-y"]  # nothing deleted from the plan data
+    with _Strict(monkeypatch, _file(_bundle(tmp_path / "ok", _WILD[:1]))):  # control: no withdrawal
+        res, _ = O.pins(est, OWNER, allow_t3=True)
+        signoff.stamp(res["jobs"])
+        order = [j for j in res["jobs"] if j["id"].endswith("-pin-public-order")]
+        assert len(order) == 1 and order[0]["signoff_id"] == "t3s-all", res["jobs"]
+        assert "withdrawn-x" in json.dumps(order[0]) and "kept-y" in json.dumps(order[0]), order
+        assert not any(x.startswith("pins-order-held") for x in res["logs"]), res["logs"]
+
+
+def test_control_non_t3_org_pins_order_is_unchanged(brand):
+    from ctshowcase import org as O
+    from ctshowcase.resolver import Resolver
+    reg = {"orgs": {"CompleteTech-Skills": {"final_repos": ["a", "b"], "pins_public": ["a", "b"],
+                                            "sections": [{"title": "T", "repos": ["a", "b"]}]}}}
+    metas = {n: {"owner": "CompleteTech-Skills", "repo": n, "visibility": "public", "description": "synthetic"}
+             for n in ("a", "b")}
+    est = O.Estate(brand, Resolver(brand, reg, {"rows": set(), "ids": set(), "answers": {}, "extra": [], "actions": []}),
+                   metas)
+    res, _ = O.pins(est, "CompleteTech-Skills", allow_t3=False)
+    assert any(j["id"].endswith("-pin-public-order") for j in res["jobs"]), [j["id"] for j in res["jobs"]]
+    assert not any(x.startswith("pins-order-held") for x in res["logs"]), res["logs"]
+
+
 def test_without_the_flag_the_profile_is_unchanged_by_a_repo_withdrawal(tmp_path, brand):
     """Control: without --allow-t3 the profile is the base behaviour (nothing newly held)."""
     from ctshowcase import org as O
diff --git a/tests/test_t3_signoff_withdrawal.py b/tests/test_t3_signoff_withdrawal.py
index 4891f76..aa78ec7 100644
--- a/tests/test_t3_signoff_withdrawal.py
+++ b/tests/test_t3_signoff_withdrawal.py
@@ -636,3 +636,82 @@ def test_direct_copy_plan_estate_control_non_t3_org_option_gets_no_stamp(tmp_pat
     job = _readme_job(out)
     assert job is not None and "CompleteTech Skills" in job["argv"][job["argv"].index("--readme") + 1], out["jobs"]
     assert not any(_ids_of(j) for j in out["jobs"]), [j for j in out["jobs"] if _ids_of(j)]
+
+
+# ------------------------------------------------------------------ stored scope canonicalization (issue 23, round 13)
+# Stored `repos` entries in grants and withdrawals are canonicalized like the requested repository: `site/`, ` site` and
+# `site.git` name `site`, `*` is preserved, and an entry with no canonical form makes the record malformed (fail closed).
+STORED = ["site/", " site", "site ", "site.git", "site/.git", "Acme/site/", "Acme/site.git", "SITE/"]
+
+
+@pytest.mark.parametrize("spelling", STORED)
+def test_stored_withdrawal_spelling_cannot_be_ignored_behind_a_wildcard_grant(spelling):
+    recs = [_rec("g1", ["*"]), _rec("w1", [spelling], approved=False, on="2026-06-01")]
+    assert _ev(recs, "site") == (None, "revoked")
+    assert _ev(recs, "other") == ("g1", None)  # control: another repository keeps the grant
+
+
+@pytest.mark.parametrize("spelling", STORED)
+def test_stored_grant_and_withdrawal_spellings_revoke_each_other(spelling):
+    grant_padded = [_rec("g1", [spelling]), _rec("w1", ["site"], approved=False, on="2026-06-01")]
+    assert _ev(grant_padded, "site") == (None, "revoked")
+    withdrawal_padded = [_rec("g1", ["site"]), _rec("w1", [spelling], approved=False, on="2026-06-01")]
+    assert _ev(withdrawal_padded, "site") == (None, "revoked")
+    assert _ev([_rec("g1", [spelling])], "site") == ("g1", None)  # a padded stored grant still grants its repository
+
+
+@pytest.mark.parametrize("bad", [["a b"], ["/"], [".."], ["site", "a b"], [""]])
+def test_uncanonicalizable_withdrawal_scope_is_malformed_and_fails_closed(bad):
+    from ctshowcase import signoff
+    w = _rec("w1", bad, approved=False, on="2026-06-01")
+    assert any(p.startswith("repos:") for p in signoff.problems(w)), signoff.problems(w)
+    recs = [_rec("g1", ["*"]), w]
+    for repo in ("site", "other"):
+        got, err = _ev(recs, repo)
+        assert got is None and err and err.startswith("invalid:w1:"), (repo, got, err)
+
+
+@pytest.mark.parametrize("bad", [["a b"], ["/"], [".."], ["site", "a b"]])
+def test_uncanonicalizable_grant_scope_never_authorizes(bad):
+    from ctshowcase import signoff
+    g = _rec("g1", bad)
+    assert any(p.startswith("repos:") for p in signoff.problems(g)), signoff.problems(g)
+    for repo in ("site", "a", "b"):
+        got, _ = _ev([g], repo)
+        assert got is None
+
+
+@pytest.mark.parametrize("flag", ["false", 0, None, "true", 1, "yes"])
+def test_non_boolean_approved_on_a_scoped_record_fails_closed_for_that_scope_only(flag):
+    recs = [_rec("g1", ["*"]), _rec("w1", ["site/"], approved=flag, on="2026-06-01")]
+    got, err = _ev(recs, "site")
+    assert got is None and err and err.startswith("invalid:w1:"), (got, err)
+    assert _ev(recs, "other") == ("g1", None)  # an unrelated repository is not blocked
+
+
+def test_record_for_never_stamps_a_wildcard_grant_withdrawn_under_a_padded_spelling(tmp_path, monkeypatch):
+    from ctshowcase import signoff
+    recs = [_rec("g1", ["*"]), _rec("w1", [" site.git/"], approved=False, on="2026-06-01")]
+    p = tmp_path / "s.yaml"
+    p.write_text(json.dumps({"signoffs": recs}), encoding="utf-8")
+    monkeypatch.setenv("SHOWCASE_T3_SIGNOFF_FILE", str(p))
+    run = signoff.reset()
+    try:
+        signoff._grant(OWN.lower(), recs[0])
+        assert signoff.record_for(OWN, "site") is None
+        assert signoff.record_for(OWN, "other")["id"] == "g1"
+    finally:
+        signoff.restore(run)
+
+
+@pytest.mark.parametrize("scope,flag", [("site/", False), ("site.git", False), ("site/", "false"), ("a b", False)])
+def test_cli_refuses_a_padded_or_malformed_stored_withdrawal(scope, flag, tmp_path):
+    own = "Pick-Your-AI"
+    recs = [_rec("g1", ["*"], owner=own), _rec("w1", [scope], approved=flag, on="2026-06-01", owner=own)]
+    r = _cli(tmp_path, recs, "describe", repo="site")
+    out = r.stdout + r.stderr
+    assert r.returncode == 2 and ("t3-signoff:revoked" in out or "t3-signoff:invalid" in out), out
+    (tmp_path / "ok").mkdir()
+    if scope != "a b":  # control: an unrelated repository is not blocked (a malformed scope could cover anything)
+        other = _cli(tmp_path / "ok", recs, "describe", repo="other")
+        assert "t3-signoff:" not in other.stdout + other.stderr, other.stdout + other.stderr

From 92e89bc44bdc166175317e98ff129dea8be1aa0a Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:28:04 -0500
Subject: [PATCH 68/79] test(#23): drop extraneous f prefix on pins-order-held
 assert

Remove the f prefix from a placeholder-free string literal on line 1314
(ruff F541). No behaviour change.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_signoff_require.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/test_t3_signoff_require.py b/tests/test_t3_signoff_require.py
index 10cb1d0..65dda57 100644
--- a/tests/test_t3_signoff_require.py
+++ b/tests/test_t3_signoff_require.py
@@ -1311,7 +1311,7 @@ def test_held_pin_holds_the_exact_set_order_job_but_not_the_authorized_pin(tmp_p
         signoff.stamp(res["jobs"])
         ids = [j["id"] for j in res["jobs"]]
         assert not any(i.endswith("-pin-public-order") for i in ids), ids
-        assert f"pins-order-held:public:t3-signoff" in res["logs"], res["logs"]
+        assert "pins-order-held:public:t3-signoff" in res["logs"], res["logs"]
         assert f"t3-signoff:revoked:{OWNER}/withdrawn-x" in res["logs"], res["logs"]
         kept = [j for j in res["jobs"] if "kept-y" in json.dumps(j)]
         assert kept and all(j["signoff_id"] == "t3s-all" for j in kept), res["jobs"]

From a3af927351fbdd8f3e4b56db78f0c936674a9d6b Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:50:26 -0500
Subject: [PATCH 69/79] fix(#23): authorize repo: qualifiers of view filters
 before emitting them

Holds a view-filter mutation that names a repository without a valid T3 sign-off
and attaches the covering sign-off ids to permitted filter jobs.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 54 +++++++++++++++++++++++++++++++++--
 1 file changed, 52 insertions(+), 2 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index e92ecc5..789f0db 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -625,6 +625,30 @@ def token(m):
     return _FILTER_TOKEN.sub(token, flt)
 
 
+_REPO_QUALIFIER = re.compile(r"^repo:(.+)$", re.I)
+
+
+def _filter_repo_refs(flt: str) -> list[str]:
+    """Repository references named by the POSITIVE `repo:` qualifiers of a Projects view filter, in order and
+    de-duplicated case-insensitively. A comma list is split (`repo:A/x,B/y`) and quotes and whitespace are stripped from
+    each part. An empty part or one with a `*` wildcard names no single repository, so it is skipped. A negative
+    `-repo:` token is ignored: an exclusion names no association."""
+    out: list[str] = []
+    seen: set[str] = set()
+    for tok in _FILTER_TOKEN.findall(flt or ""):
+        m = _REPO_QUALIFIER.match(tok)
+        if not m:
+            continue
+        for part in re.findall(r'"[^"]*"|[^,]+', m.group(1)):
+            for piece in part.split(","):  # a quoted part may still hold a comma list: "A/x,A/y"
+                p = piece.strip().strip('"').strip()
+                if not p or "*" in p or p.lower() in seen:
+                    continue
+                seen.add(p.lower())
+                out.append(p)
+    return out
+
+
 def view_body(want: dict, spec: dict) -> tuple[dict, list[str]]:
     """REST view body with integer field ids (databaseId); a field without an id becomes a browser step."""
     ids = {(f.get("name") or "").lower(): f.get("databaseId") for f in spec.get("fields") or []}
@@ -965,6 +989,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     vlist = [dict(v) for v in (views or (ESTATE_VIEWS if role == "estate" else VIEWS))]
     base = (f"users/{user_id}/projectsV2/{num}/views" if owner == "@me" and user_id else
             f"orgs/{owner}/projectsV2/{num}/views")
+    filter_jobs: list[tuple[dict, str]] = []  # (view-filter job, its new filter): authorized after the README repos
     for i, want in enumerate(vlist):
         have = _view(spec, want["name"])
         if have is not None:
@@ -973,8 +998,10 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
             if i > 0 and flt != want["filter"] and role != "org":
                 new = want["filter"]
             if new != flt and have.get("id"):
-                jobs.append(_gql_job(f"{pid}-{num}-view-{have.get('number')}-filter", owner, m_view_filter(have["id"], new),
-                                     f"View '{want['name']}' filter (§13.5{'; renamed options' if renames else ''})."))
+                fj = _gql_job(f"{pid}-{num}-view-{have.get('number')}-filter", owner, m_view_filter(have["id"], new),
+                              f"View '{want['name']}' filter (§13.5{'; renamed options' if renames else ''}).")
+                jobs.append(fj)
+                filter_jobs.append((fj, new))
             continue
         if owner == "@me" and not user_id:
             pending.append({"view": want["name"], "why": "numeric user id (gh api user --jq .id) for the user views path"})
@@ -1043,6 +1070,29 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     # every README repository (explicit or captured) is authorized on its own resolved owner and name, for every role
     readme_repos = _authorize_readme_repos(readme_repos, resolver, allow_t3, grants, held_lower, logs,
                                            board_owner=owner, role=role)
+    # view filters: every repository a proposed filter names by a positive repo: qualifier is authorized like a README
+    # repository before the filter mutation goes out. A filter that names a denied repository is held (its job is
+    # removed); a permitted one carries the sign-off ids of the repositories it names. Bare names that do not resolve
+    # to an owner/name pair are left alone.
+    for fj, flt in filter_jobs:
+        refs = [r for r in _normalize_repo_entries(_filter_repo_refs(flt), owner, role, resolver, []) if "/" in r]
+        if not refs:
+            continue
+        kept = _authorize_readme_repos(refs, resolver, allow_t3, grants, held_lower, logs, board_owner=owner, role=role)
+        kept_keys = {_grant_key(resolver, *r.split("/", 1)) for r in kept if "/" in r}
+        if any(_grant_key(resolver, *r.split("/", 1)) not in kept_keys for r in refs):
+            jobs[:] = [j for j in jobs if j is not fj]
+            logs.append(f"view-filter-held:{fj['id']} (a repository in the proposed filter has no valid T3 sign-off or "
+                        "is not authorized)")
+            pending.append({"why": "view filter held: it names a repository without a valid T3 sign-off",
+                            "needs": "a valid record covering that repository, or remove it from the filter"})
+            continue
+        ids = [str(g["id"]) for r in kept if "/" in r
+               and (g := grants.get(_grant_key(resolver, *r.split("/", 1))))
+               and g.get("id")]
+        if ids:
+            from . import signoff
+            signoff.stamp_associations(fj, list(dict.fromkeys(ids)), owner)
     # 4. text: short description and README (README needs every view number)
     nums = view_numbers(spec)
     edit = ["gh", "project", "edit", num, "--owner", own_flag, "--description", short]

From f6a21d91e17aee83f7bed829bab3c4610fcb9201 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 03:52:48 -0500
Subject: [PATCH 70/79] fix(#23): authorize and stamp repo: qualifiers of
 proposed view filters; tests and docs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                       |   1 +
 references/t3-signoff.md           |   2 +
 scripts/ctshowcase/project.py      |   2 +-
 tests/test_t3_view_filter_repos.py | 209 +++++++++++++++++++++++++++++
 4 files changed, 213 insertions(+), 1 deletion(-)
 create mode 100644 tests/test_t3_view_filter_repos.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 954e056..aa495c3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- `project copy-plan --allow-t3` authorizes the `repo:` qualifiers of each proposed view filter before emitting its mutation (issue 23, adjudication t23-adjudication-view-filter-3100): a filter naming a denied or withdrawn repository is held (`view-filter-held` plus `t3-signoff:<code>`), a permitted one carries the covering `signoff_id`s, and a non-T3 owner's filter is unchanged. Negative, empty and wildcard `repo:` values are ignored. Regressions in `tests/test_t3_view_filter_repos.py`.
 - T3 sign-off stored scopes, held pin order and proposal stamping (issue 23, round 13): stored `repos` entries of grants and withdrawals are canonicalized like the requested repository (`site/`, ` site`, `site.git` equal `site`, `*` kept) in `evaluate`, `_covers` and the withdrawal match, and an entry that cannot be canonicalized makes the record malformed (`t3-signoff:invalid`, fails closed for a withdrawal, never authorizes for a grant); a non-boolean `approved` on a scoped record fails closed for that scope only. `org pins --allow-t3` holds the exact-set order job of a target that has a pin held for sign-off (`pins-order-held:<target>:t3-signoff`) while the authorized pin jobs remain, so a held pin is not unticked. Writer-shaped `proposals` (the `content actions` workflow-toggle) carry `signoff_id` in the report and on stdout and stay out of the `--jobs` queue. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_signoff_require.py, tests/test_t3_signoff_proposals.py.
 - T3 sign-off repository spelling canonicalization (issue 23, adjudication t23-adjudication-repo-canonicalization-50f): the requested repository is canonicalized (whitespace, trailing `/`, `.git`) before the `*` shortcut in `signoff.evaluate()`/`_covers()`, so a per-repository withdrawal can no longer be bypassed by `x/`, ` x`, `x.git`; an empty or invalid name fails closed (`invalid:repo:`). `project copy-plan --repos` entries are stripped and validated (a malformed entry is a usage refusal), README and link entries are normalised once (a bare name on an org board is `<board owner>/<name>`, owners stripped and resolved, unresolvable owners held), and without `--allow-t3` a T3 repository on a non-T3 board README is omitted and logged `t3-signoff:readme:<owner>/<repo>`. `references/t3-signoff.md` documents the spelling rules and maps the record fields `repos`, `approved_on` and `expires` to the issue #24 wording. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_cli_copy_plan_consent.py, tests/test_t3_emission_scope.py.
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 0be3165..920996d 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -77,3 +77,5 @@ The requested repository is canonicalized once, at the top of `evaluate()` and i
 `project copy-plan --repos` splits on `,`, strips every entry, skips empty ones and canonicalizes each; a malformed entry refuses the command with a `usage` log and nothing is planned. README and link entries are normalised once before any authorization: a bare `NAME` on an org board means `<board owner>/<NAME>`, the owner is stripped and resolved to its canonical login, and an entry whose owner cannot be resolved is held (`readme-held:`), not kept. A malformed entry from any source is dropped with `repos-malformed:`.
 
 Without `--allow-t3`, a T3 owner's repository referenced from a non-T3 board README is omitted too, never kept unchecked (that would be less restrictive than passing the flag): the plan logs `t3-signoff:readme:<owner>/<repo>`. Standalone read-only `project readme` is unchanged apart from stripping and validating `--repos`.
+
+Proposed view-filter repositories are authorized and stamped too: before a view-filter mutation is emitted, each positive `repo:` qualifier of the proposed filter (comma lists split; `-repo:`, empty and `*` values name no repository and are ignored) is checked like a README repository on its own owner and name. A filter that names a denied or withdrawn repository is held (`view-filter-held:<job id>` plus the `t3-signoff:<code>` log), and a permitted filter's job carries the covering record ids in `signoff_id` / `signoff_ids`. A non-T3 owner's filter is unchanged and unstamped. This adds no approval step.
diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 789f0db..6bec79b 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1074,7 +1074,7 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
     # repository before the filter mutation goes out. A filter that names a denied repository is held (its job is
     # removed); a permitted one carries the sign-off ids of the repositories it names. Bare names that do not resolve
     # to an owner/name pair are left alone.
-    for fj, flt in filter_jobs:
+    for fj, flt in (filter_jobs if resolver is not None else []):  # no resolver: nothing to authorize against, unchanged
         refs = [r for r in _normalize_repo_entries(_filter_repo_refs(flt), owner, role, resolver, []) if "/" in r]
         if not refs:
             continue
diff --git a/tests/test_t3_view_filter_repos.py b/tests/test_t3_view_filter_repos.py
new file mode 100644
index 0000000..010bb00
--- /dev/null
+++ b/tests/test_t3_view_filter_repos.py
@@ -0,0 +1,209 @@
+"""View-filter repository authorization (issue 23): a proposed view filter that names a repository by a positive `repo:`
+qualifier is authorized like a README repository before its updateProjectV2View mutation is emitted. A denied or
+withdrawn repository holds the job (`view-filter-held` plus a `t3-signoff:<code>` log); a permitted one carries the
+covering sign-off id. A non-T3 owner's filter is unchanged and unstamped. Synthetic records and names only."""
+from __future__ import annotations
+
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parents[1]
+sys.path.insert(0, str(ROOT / "scripts"))
+sys.path.insert(0, str(ROOT / "tests"))
+from test_t3_emission_scope import FIX, OWNER, _file, _resolver, _Strict  # noqa: E402
+
+WS = [{"name": "Pricing research", "kind": "Research", "description": "Price experiments"}]
+WILD = [{"id": "t3s-all"}, {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+T1 = "CompleteTech-Skills"
+BASE_FILTER = "status:Backlog,Ready workstream:Research"
+
+
+def _capture(owner, flt):
+    c = json.loads((FIX / "copy-capture.json").read_text(encoding="utf-8"))
+    p = c["data"]["organization"]["projectV2"]
+    p["url"] = f"https://github.com/orgs/{owner}/projects/{p['number']}"
+    for v in p["views"]["nodes"]:
+        if v["name"] == "Backlog":
+            v["filter"] = flt
+    return c
+
+
+def _plan(brand, flt, *, owner=T1, allow_t3=True):
+    from ctshowcase import project as PJ
+    return PJ.copy_plan(owner, role="org", copied=_capture(owner, flt), resolver=_resolver(brand), workstreams=WS,
+                        allow_t3=allow_t3, reviewed="2026-10-25")
+
+
+def _backlog(plan_or_jobs):
+    jobs = plan_or_jobs["jobs"] if isinstance(plan_or_jobs, dict) else plan_or_jobs
+    return [j for j in jobs if j["id"].endswith("-filter") and "Pricing research" in " ".join(j.get("argv") or [])]
+
+
+def _held(plan):
+    return [x for x in plan["logs"] if str(x).startswith("view-filter-held:")]
+
+
+def _t3_codes(plan):
+    return [x for x in plan["logs"] if str(x).startswith("t3-signoff:")]
+
+
+def test_rename_filter_job_is_emitted_for_a_plain_filter(brand):
+    """Control: the mutation exists when no repository is named, so the absence below is the authorization."""
+    plan = _plan(brand, BASE_FILTER)
+    assert len(_backlog(plan)) == 1, [j["id"] for j in plan["jobs"]]
+
+
+def test_withdrawn_repo_in_filter_holds_the_job(tmp_path, monkeypatch, brand):
+    flt = f"repo:{OWNER}/withdrawn-x workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+    assert not any("withdrawn-x" in " ".join(j.get("argv") or []) for j in plan["jobs"] if j["id"].endswith("-filter"))
+    assert _held(plan), plan["logs"]
+    assert _t3_codes(plan), plan["logs"]
+    assert any("view filter held" in str(p.get("why", "")) for p in plan["pending"]), plan["pending"]
+
+
+def test_kept_repo_in_filter_keeps_the_job_and_carries_the_signoff_id(tmp_path, monkeypatch, brand):
+    flt = f"repo:{OWNER}/kept-y workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    jobs = _backlog(plan)
+    assert len(jobs) == 1, [j["id"] for j in plan["jobs"]]
+    assert jobs[0].get("signoff_id") == "t3s-all", jobs[0]
+    assert "kept-y" in " ".join(jobs[0]["argv"])
+    assert not _held(plan) and not _t3_codes(plan), plan["logs"]
+
+
+def test_mixed_filter_holds_the_whole_job(tmp_path, monkeypatch, brand):
+    flt = f"repo:{OWNER}/kept-y,{OWNER}/withdrawn-x workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    assert not _backlog(plan) and _held(plan), plan["logs"]
+
+
+def test_regrant_stamps_both_records_on_the_filter_job(tmp_path, monkeypatch, brand):
+    recs = [*WILD, {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    flt = f"repo:{OWNER}/withdrawn-x,{OWNER}/kept-y workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _plan(brand, flt)
+    jobs = _backlog(plan)
+    assert len(jobs) == 1, plan["logs"]
+    ids = set(jobs[0].get("signoff_ids") or []) | {jobs[0].get("signoff_id")}
+    assert {"t3s-all", "t3s-regrant"} <= ids, jobs[0]
+
+
+def test_without_allow_t3_the_filter_is_held(tmp_path, monkeypatch, brand):
+    flt = f"repo:{OWNER}/kept-y workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt, allow_t3=False)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+    assert _held(plan), plan["logs"]
+    assert f"t3-signoff:readme:{OWNER}/kept-y" in plan["logs"], plan["logs"]
+
+
+def test_non_t3_owner_filter_is_unchanged_and_unstamped(tmp_path, monkeypatch, brand):
+    flt = "repo:Other-Org/some-repo workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt, owner="Northwind-Trading-Co")
+    jobs = _backlog(plan)
+    assert len(jobs) == 1, [j["id"] for j in plan["jobs"]]
+    assert "some-repo" in " ".join(jobs[0]["argv"]) and "signoff_id" not in jobs[0], jobs[0]
+    assert not _held(plan)
+
+
+@pytest.mark.parametrize("flt", [
+    f"-repo:{OWNER}/withdrawn-x workstream:Research",  # negative qualifier names no association
+    "repo:* workstream:Research",                      # wildcard names no single repository
+    "repo: workstream:Research",                       # empty value
+])
+def test_negative_and_wildcard_repo_tokens_are_ignored(tmp_path, monkeypatch, brand, flt):
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    assert not _held(plan), plan["logs"]
+    assert len(_backlog(plan)) == 1, [j["id"] for j in plan["jobs"]]
+
+
+def test_filter_repo_refs_parsing():
+    from ctshowcase.project import _filter_repo_refs as refs
+    assert refs('repo:A/x,B/y -repo:C/z repo:"A/X" repo:* repo:') == ["A/x", "B/y"]
+    assert refs("") == [] and refs(None) == []
+
+
+@pytest.mark.parametrize("bad", ["false", 0, None])
+def test_invalid_boolean_on_covering_record_holds_the_filter(tmp_path, monkeypatch, brand, bad):
+    recs = [{"id": "t3s-bad", "approved": bad, "expires": "2099-12-31"}]
+    flt = f"repo:{OWNER}/kept-y workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _plan(brand, flt)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+    assert _held(plan) and _t3_codes(plan), plan["logs"]
+
+
+def test_invalid_boolean_withdrawal_does_not_let_an_older_grant_cover_the_filter(tmp_path, monkeypatch, brand):
+    recs = [{"id": "t3s-all"}, {"id": "t3s-bad-w", "repos": ["withdrawn-x"], "approved": "false",
+                                "approved_on": "2026-10-01", "expires": "2099-12-31"}]
+    flt = f"repo:{OWNER}/withdrawn-x workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = _plan(brand, flt)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+
+
+def test_estate_role_never_carries_a_repo_qualifier_into_a_filter_job(tmp_path, monkeypatch, brand):
+    from ctshowcase import project as PJ
+    c = json.loads((FIX / "estate-copy-capture.json").read_text(encoding="utf-8"))
+    board = next(v for v in _walk(c) if isinstance(v, dict) and "views" in v and "fields" in v)
+    for v in board["views"]["nodes"][1:]:
+        v["filter"] = f"repo:{OWNER}/withdrawn-x"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = PJ.estate_plan(_resolver(brand), copied=c, user_id=100, allow_t3=True)
+    for j in plan["jobs"]:
+        if j["id"].endswith("-filter"):
+            assert "withdrawn-x" not in " ".join(j.get("argv") or []), j
+
+
+def _walk(o):
+    yield o
+    if isinstance(o, dict):
+        for v in o.values():
+            yield from _walk(v)
+    elif isinstance(o, list):
+        for v in o:
+            yield from _walk(v)
+
+
+# CLI path -------------------------------------------------------------------------------------------------------
+def _cli(tmp_path, records, flt):
+    from test_t3_signoff_require import _bundle, _run
+    bundle = _bundle(tmp_path, records)
+    capfile = tmp_path / "capture.json"
+    capfile.write_text(json.dumps(_capture(OWNER, flt)), encoding="utf-8")
+    wsfile = tmp_path / "ws.json"
+    wsfile.write_text(json.dumps(WS), encoding="utf-8")
+    jobsfile = tmp_path / "jobs.jsonl"
+    r = _run(tmp_path, bundle, "--allow-t3", "project", "copy-plan", "--target", OWNER, "--copied", str(capfile),
+             "--workstreams", str(wsfile), "--jobs", str(jobsfile), "--files-dir", str(tmp_path / "bodies"))
+    jobs = ([json.loads(x) for x in jobsfile.read_text(encoding="utf-8").splitlines() if x.strip()]
+            if jobsfile.exists() else [])
+    return r, jobs
+
+
+CLI_RECORDS = [{"id": "grant", "repos": ["*"], "approved_on": "2026-01-01"},
+               {"id": "withdraw", "repos": ["withdrawn-x"], "approved": False, "approved_on": "2026-10-01"}]
+
+
+def test_cli_copy_plan_holds_the_withdrawn_filter(tmp_path):
+    r, jobs = _cli(tmp_path, CLI_RECORDS, f"repo:{OWNER}/withdrawn-x workstream:Research")
+    assert r.returncode == 0, r.stdout + r.stderr
+    assert not _backlog(jobs), [j["id"] for j in jobs]
+    assert "view-filter-held" in r.stdout + r.stderr and "t3-signoff:" in r.stdout + r.stderr, r.stdout + r.stderr
+
+
+def test_cli_copy_plan_permitted_filter_carries_the_signoff_id(tmp_path):
+    r, jobs = _cli(tmp_path, CLI_RECORDS, f"repo:{OWNER}/kept-y workstream:Research")
+    assert r.returncode == 0, r.stdout + r.stderr
+    got = _backlog(jobs)
+    assert len(got) == 1 and got[0].get("signoff_id") == "grant", [j["id"] for j in jobs]

From ca5e815f9e9ca005ac076f545cf628a8443c0719 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 04:20:09 -0500
Subject: [PATCH 71/79] Carry retained T3 sign-off ids onto the README job
 directly

copy_plan rediscovered captured Org-option provenance from the rendered
README text, which loses the grant when a former login has a different
captured label. The README job now receives the signoff_id of every
retained_t3 entry through signoff.stamp_associations, merged with ids
already on the job.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 6bec79b..8aa1370 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -1128,17 +1128,13 @@ def copy_plan(target: str, *, role: str = "org", source: str | None = None, titl
             from . import signoff
             signoff.stamp_associations(text_job, list(dict.fromkeys(ids)), owner)
     if text is not None and retained_t3:
-        # the shared emission path stamps the captured Org options, so direct `copy-plan --role estate` and estate_plan agree
-        orgs_for_stamp = list(retained_t3)
-        known = {x.lower() for o in retained_t3 for x in (o["login"], o["name"])}
-        for o in (_field(spec, "Org") or {}).get("options") or []:
-            name = str(o.get("name") or "")
-            desc = str(o.get("description") or "")
-            ident = re.sub(r"^T[0-9]:\s*", "", desc).strip() or name
-            if not ident or ident.lower() in known or name.lower() in known:
-                continue
-            orgs_for_stamp.append({"login": ident, "name": name})  # name-only: marks a shared display name as ambiguous
-        _stamp_estate_orgs([text_job], orgs_for_stamp)
+        # the README documents every retained captured Org option, so the job carries the granting ids of retained_t3
+        # directly instead of rediscovering them from the rendered text (a former login with a different captured label
+        # has no match in the text) (tests/test_t3_emission_scope.py::test_captured_org_option_under_former_login_and_other_label_carries_signoff_id)
+        ids = [str(o["signoff_id"]) for o in retained_t3 if o.get("signoff_id")]
+        if ids:
+            from . import signoff
+            signoff.stamp_associations(text_job, list(dict.fromkeys(ids)), owner)
     jobs.append(text_job)
     # 5. repository links (org boards: same owner only), decided in step 0 and emitted here, before the browser steps
     jobs.extend(link_jobs)

From 6f59ed2375f4008a8b5bfea03228811174e00c92 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 04:20:21 -0500
Subject: [PATCH 72/79] org: hold the T3 org profile on a refused .github
 sign-off

public_slice excludes .github, so its repository check never saw the
profile's own destination. With --allow-t3 on a T3 owner, a refused
sign-off for <owner>/.github now raises Refused (log
t3-signoff:<code>:<login>/.github) before the README, data.json or
assets are built or written.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/org.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/scripts/ctshowcase/org.py b/scripts/ctshowcase/org.py
index 66ec74d..6d3af5d 100644
--- a/scripts/ctshowcase/org.py
+++ b/scripts/ctshowcase/org.py
@@ -928,6 +928,13 @@ def profile(estate: Estate, org: str, *, out_dir: str | Path | None = None, rend
             allow_unmeasured: bool = False, lists_capture: dict | None = None, meta_dir: str | None = None) -> tuple[dict, int]:
     """`org profile`: README + data.json + the asset list; writes only under out_dir, and only when the leak check passes."""
     login, row, reg = _gate(estate, org, allow_t3=allow_t3)
+    # public_slice excludes `.github`, so its repository check never sees the profile's own destination. A later
+    # withdrawal scoped to `.github` (a wildcard grant stays valid org-wide) must hold the generated README/data.json
+    # before anything is built or written (tests/test_t3_emission_scope.py::test_profile_holds_a_github_scoped_withdrawal).
+    if (code := _t3_repo_refusal(estate, login, ".github", allow_t3)):
+        from .errors import Refused
+        raise Refused(f"{login}/.github sign-off is {code}: the org profile is not generated or written",
+                      log=f"t3-signoff:{code}:{login}/.github")
     data, logs = public_slice(estate, org, lists_capture, allow_t3=allow_t3)
     email = _email(estate, login, reg, email_approved)[0]
     flagship = _tier(row) == "T1" and row.get("flagship")

From 0a388363c47570b48b299b3bd794a733074945c1 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 04:22:06 -0500
Subject: [PATCH 73/79] test(#23): .github-scoped profile hold and captured Org
 option provenance regressions

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 tests/test_t3_emission_scope.py | 151 ++++++++++++++++++++++++++++++++
 1 file changed, 151 insertions(+)

diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
index 9c1525f..a12783b 100644
--- a/tests/test_t3_emission_scope.py
+++ b/tests/test_t3_emission_scope.py
@@ -339,3 +339,154 @@ def test_copy_plan_malformed_repository_entry_is_dropped_with_a_log(tmp_path, mo
         plan = _copy_private(brand, [f"{OWNER}/kept-y", "a b"])
     assert any(str(x).startswith("repos-malformed:") for x in plan["logs"]), plan["logs"]
     assert "a b" not in json.dumps(plan["jobs"])
+
+
+# ---------------------------------------------------------------------------------------------- org profile destination
+GH_WITHDRAWN = [{"id": "t3s-all"}, {"id": "t3s-drop-gh", "repos": [".github"], "approved": False,
+                                    "approved_on": "2026-10-01"}]
+
+
+def _profile_checkout(tmp_path):
+    """A `.github` checkout holding a generated README (ours to refresh) and a data.json."""
+    from ctshowcase import org as O
+    prof = tmp_path / "gh" / "profile"
+    prof.mkdir(parents=True)
+    (prof / "README.md").write_text(O.GENERATED_MARK + " (synthetic prior output) -->\nprior readme\n", encoding="utf-8")
+    (prof / "data.json").write_text('{"prior": true}\n', encoding="utf-8")
+    return tmp_path / "gh", prof
+
+
+def _profile_estate(brand):
+    from test_t3_signoff_require import _pya_estate
+    return _pya_estate(brand)[0]
+
+
+def _snapshot(prof):
+    return (prof / "README.md").read_bytes(), (prof / "data.json").read_bytes()
+
+
+def test_profile_holds_a_github_scoped_withdrawal(tmp_path, monkeypatch, brand):
+    """public_slice excludes `.github`, so the repository checks never saw the profile's own destination: a wildcard
+    grant followed by a `.github` withdrawal still overwrote profile/README.md and profile/data.json."""
+    from ctshowcase import org as O
+    from ctshowcase.errors import Refused
+    out, prof = _profile_checkout(tmp_path)
+    before = _snapshot(prof)
+    with _Strict(monkeypatch, _file(tmp_path, GH_WITHDRAWN)):
+        with pytest.raises(Refused) as e:
+            O.profile(_profile_estate(brand), OWNER, out_dir=out, allow_t3=True)
+    assert str(e.value.log).startswith("t3-signoff:revoked:") and str(e.value.log).endswith("/.github"), e.value.log
+    assert _snapshot(prof) == before, "a held profile must leave the generated files untouched"
+
+
+def test_profile_regrant_after_the_github_withdrawal_restores_generation(tmp_path, monkeypatch, brand):
+    from ctshowcase import org as O
+    recs = [*GH_WITHDRAWN, {"id": "t3s-regrant-gh", "repos": [".github"], "approved_on": "2026-10-02"}]
+    out, prof = _profile_checkout(tmp_path)
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        res, code = O.profile(_profile_estate(brand), OWNER, out_dir=out, allow_t3=True)
+    assert not any(str(x).startswith("t3-signoff:") for x in res["logs"]), res["logs"]
+    assert (prof / "README.md").read_bytes() != b"" and b"prior readme" not in (prof / "README.md").read_bytes(), code
+
+
+def test_profile_wildcard_grant_alone_writes_normally(tmp_path, monkeypatch, brand):
+    from ctshowcase import org as O
+    out, prof = _profile_checkout(tmp_path)
+    with _Strict(monkeypatch, _file(tmp_path, [{"id": "t3s-all"}])):
+        O.profile(_profile_estate(brand), OWNER, out_dir=out, allow_t3=True)
+    assert b"prior readme" not in (prof / "README.md").read_bytes()
+    assert b'"prior"' not in (prof / "data.json").read_bytes()
+
+
+def test_profile_other_repository_withdrawal_still_writes_and_holds_only_that_repository(tmp_path, monkeypatch, brand):
+    from ctshowcase import org as O
+    recs = [{"id": "t3s-all"}, {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False,
+                                "approved_on": "2026-10-01"}]
+    out, prof = _profile_checkout(tmp_path)
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        res, _ = O.profile(_profile_estate(brand), OWNER, out_dir=out, allow_t3=True)
+    assert b"prior readme" not in (prof / "README.md").read_bytes()
+    assert "withdrawn-x" not in json.dumps(res["data"]) and "kept-y" in json.dumps(res["data"]), res["data"]
+    assert f"t3-signoff:revoked:{OWNER}/withdrawn-x" in res["logs"], res["logs"]
+    assert not any(str(x).endswith("/.github") for x in res["logs"]), res["logs"]
+
+
+def test_profile_without_the_flag_ignores_a_github_withdrawal(tmp_path, monkeypatch, brand):
+    """Control: a T3 owner without --allow-t3 is refused by the existing gate, and a non-T3 owner never consults the
+    sign-off file for its `.github` repository."""
+    from ctshowcase import org as O
+    from ctshowcase.errors import Refused
+    out, prof = _profile_checkout(tmp_path)
+    before = _snapshot(prof)
+    with _Strict(monkeypatch, _file(tmp_path, GH_WITHDRAWN)):
+        with pytest.raises(Refused) as e:
+            O.profile(_profile_estate(brand), OWNER, out_dir=out, allow_t3=False)
+    assert str(e.value.log) != "" and "/.github" not in str(e.value.log), e.value.log
+    assert _snapshot(prof) == before
+
+
+# ---------------------------------------------------------------------------------------------- captured option ids
+def _former_login_capture():
+    """A complete Estate capture whose Org option is described `T3: Pick-Your-AI` under another captured label."""
+    from test_t3_signoff_require import _complete_estate_capture
+    cap = _complete_estate_capture()
+    opt = cap["data"]["user"]["projectV2"]["fields"]["nodes"][-1]["options"][0]
+    opt["name"], opt["description"] = "Former Synthetic Name", f"T3: {OWNER}"
+    return cap
+
+
+def _renamed_resolver(brand):
+    res = _resolver(brand, _registry(False), extra=[{"action": "org-rename", "owner": OWNER,
+                                                     "new_name": "Pick-Your-Stack"}])
+    assert res.canonical(OWNER) == "Pick-Your-Stack"
+    return res
+
+
+def _ids(job):
+    return {job.get("signoff_id"), *(job.get("signoff_ids") or [])} - {None}
+
+
+def test_captured_org_option_under_former_login_and_other_label_carries_signoff_id(tmp_path, monkeypatch, brand):
+    """The job targets @me, so estate_plan's target-based stamp cannot recover the grant: copy_plan must put the
+    granting id of every retained captured Org option on the README job itself, not rediscover it from rendered text."""
+    from ctshowcase import project as PJ
+    with _Strict(monkeypatch, _file(tmp_path, [{"id": "t3s-all"}])):
+        plan = PJ.copy_plan("@me", role="estate", copied=_former_login_capture(), resolver=_renamed_resolver(brand),
+                            user_id=100, allow_t3=True, reviewed="2026-10-25")
+    readme = _readme_jobs(plan)
+    assert readme, [j["id"] for j in plan["jobs"]]
+    assert all("t3s-all" in _ids(j) for j in readme), readme
+    assert "Former Synthetic Name" in json.dumps(readme, ensure_ascii=False), readme
+
+
+def test_captured_org_option_under_former_login_is_held_when_withdrawn(tmp_path, monkeypatch, brand):
+    from ctshowcase import project as PJ
+    with _Strict(monkeypatch, _file(tmp_path, WITHDRAWN)):
+        plan = PJ.copy_plan("@me", role="estate", copied=_former_login_capture(), resolver=_renamed_resolver(brand),
+                            user_id=100, allow_t3=True, reviewed="2026-10-25")
+    assert any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+    blob = json.dumps([j for j in plan["jobs"] if "--readme" in j.get("argv", [])], ensure_ascii=False)
+    assert "Former Synthetic Name" not in blob and OWNER not in blob, blob
+    assert "t3s-g" not in json.dumps(plan["jobs"]), plan["jobs"]
+
+
+def _private_board_with_org_option():
+    c = _private_board()
+    c["data"]["organization"]["projectV2"]["fields"]["nodes"].append({
+        "__typename": "ProjectV2SingleSelectField", "id": "PVTF_org", "databaseId": 1099, "name": "Org",
+        "dataType": "SINGLE_SELECT", "isIssueField": False,
+        "options": [{"id": "optorg1", "name": "Former Synthetic Name", "color": "YELLOW", "description": f"T3: {OWNER}"}]})
+    return c
+
+
+def test_captured_org_option_ids_merge_with_a_repository_regrant_on_the_readme_job(tmp_path, monkeypatch, brand):
+    """Control: a repository-scoped regrant id already stamped on the README job is kept beside the option's id."""
+    from ctshowcase import project as PJ
+    recs = [{"id": "t3s-all"}, {"id": "t3s-drop-x", "repos": ["withdrawn-x"], "approved": False,
+                                "approved_on": "2026-10-01"},
+            {"id": "t3s-regrant", "repos": ["withdrawn-x"], "approved_on": "2026-10-02"}]
+    with _Strict(monkeypatch, _file(tmp_path, recs)):
+        plan = PJ.copy_plan(OWNER, role="org", copied=_private_board_with_org_option(), resolver=_resolver(brand),
+                            repositories=[f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"], allow_t3=True, reviewed="2026-10-25")
+    readme = _readme_jobs(plan)
+    assert readme and all({"t3s-all", "t3s-regrant"} <= _ids(j) for j in readme), readme

From 7811fd1b5e17d5cf283268b40ec21699f0ff3e43 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 04:23:10 -0500
Subject: [PATCH 74/79] docs(#23): .github profile sign-off and README job ids
 of retained captured Org options

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 1 +
 SKILL.md                 | 2 +-
 references/t3-signoff.md | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8d280c..975ca13 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- T3 sign-off at the profile destination and for captured Org option provenance (issue 23, round 4): `org profile --allow-t3` now also requires the org's `.github` repository sign-off, so a `.github`-scoped withdrawal holds the profile (`t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it, and the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option (merged with ids already on the job) instead of rediscovering them from rendered text. Regressions in `tests/test_t3_emission_scope.py`.
 - `project copy-plan --allow-t3` authorizes the `repo:` qualifiers of each proposed view filter before emitting its mutation (issue 23, adjudication t23-adjudication-view-filter-3100): a filter naming a denied or withdrawn repository is held (`view-filter-held` plus `t3-signoff:<code>`), a permitted one carries the covering `signoff_id`s, and a non-T3 owner's filter is unchanged. Negative, empty and wildcard `repo:` values are ignored. Regressions in `tests/test_t3_view_filter_repos.py`.
 - T3 sign-off stored scopes, held pin order and proposal stamping (issue 23, round 13): stored `repos` entries of grants and withdrawals are canonicalized like the requested repository (`site/`, ` site`, `site.git` equal `site`, `*` kept) in `evaluate`, `_covers` and the withdrawal match, and an entry that cannot be canonicalized makes the record malformed (`t3-signoff:invalid`, fails closed for a withdrawal, never authorizes for a grant); a non-boolean `approved` on a scoped record fails closed for that scope only. `org pins --allow-t3` holds the exact-set order job of a target that has a pin held for sign-off (`pins-order-held:<target>:t3-signoff`) while the authorized pin jobs remain, so a held pin is not unticked. Writer-shaped `proposals` (the `content actions` workflow-toggle) carry `signoff_id` in the report and on stdout and stay out of the `--jobs` queue. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_signoff_require.py, tests/test_t3_signoff_proposals.py.
 - T3 sign-off repository spelling canonicalization (issue 23, adjudication t23-adjudication-repo-canonicalization-50f): the requested repository is canonicalized (whitespace, trailing `/`, `.git`) before the `*` shortcut in `signoff.evaluate()`/`_covers()`, so a per-repository withdrawal can no longer be bypassed by `x/`, ` x`, `x.git`; an empty or invalid name fails closed (`invalid:repo:`). `project copy-plan --repos` entries are stripped and validated (a malformed entry is a usage refusal), README and link entries are normalised once (a bare name on an org board is `<board owner>/<name>`, owners stripped and resolved, unresolvable owners held), and without `--allow-t3` a T3 repository on a non-T3 board README is omitted and logged `t3-signoff:readme:<owner>/<repo>`. `references/t3-signoff.md` documents the spelling rules and maps the record fields `repos`, `approved_on` and `expires` to the issue #24 wording. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_cli_copy_plan_consent.py, tests/test_t3_emission_scope.py.
diff --git a/SKILL.md b/SKILL.md
index 548f124..823d36c 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized, and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized; `org profile` additionally requires the sign-off of the org's own `.github` repository, the profile's destination, so a `.github`-scoped withdrawal holds the profile (log `t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it; and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does: the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option directly (not rediscovered from the rendered text), so an option kept under a former login and a different captured label still names its record.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 920996d..ea7b2e9 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -54,7 +54,7 @@ Each refusal exits 2 with result `refused`.
 
 The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing. A record for the owner whose `approved` is not a boolean (the string `"false"` or `"true"`, `0`, `1`, `null` or a missing key) is likewise a possible withdrawal that fails closed as `t3-signoff:invalid`; it is never coerced into a grant or a withdrawal.
 
-An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. The exact-set order job (`...-pin-<target>-order`, "make the ticked set exactly this list and untick every other repository") would also untick a held pin, so when any pin of a target is held for sign-off that target's order job is held too and the run logs `pins-order-held:<target>:t3-signoff`; the authorized individual pin jobs remain, and nothing is deleted from the plan data. Without a held pin the order job is emitted and carries the `signoff_ids` of the pins it lists. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`.
+An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` also requires the sign-off of the org's own `.github` repository, because `public_slice` excludes it and the profile is written there: a `.github`-scoped withdrawal (after a `*` grant) refuses the profile with `t3-signoff:<code>:<login>/.github` before anything is built or written, leaving an existing `profile/README.md` and `profile/data.json` untouched, and a later `.github` regrant restores generation. Inside the profile it omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. The exact-set order job (`...-pin-<target>-order`, "make the ticked set exactly this list and untick every other repository") would also untick a held pin, so when any pin of a target is held for sign-off that target's order job is held too and the run logs `pins-order-held:<target>:t3-signoff`; the authorized individual pin jobs remain, and nothing is deleted from the plan data. Without a held pin the order job is emitted and carries the `signoff_ids` of the pins it lists. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`. For a retained captured Org option (valid record), `project copy-plan` merges the option's granting `signoff_id` onto the README job directly, so the provenance survives a former login and a captured label that differs from the current names; ids already on the job (a repository regrant) are kept.
 
 **`signoff_id` and `approval_id` (issue #26).** Task #26 says "add `approval_id` to jobs created under the flag". This implementation names the sign-off in a separate `signoff_id` (`signoff_ids` for several) and never sets `approval_id`, because `approval_id` names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up, and a sign-off id is not one. Read #26 as "carry the sign-off id as `signoff_id`".
 

From 3cf05137024eeb42f1cd1012b427484937595260 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 04:59:32 -0500
Subject: [PATCH 75/79] fix(#23): resolve captured T3 description and option
 name independently; carry labels to Org-option stamping

captured_t3 tries the description remainder (T3 prefix only) and then the option
name, so an unresolved description no longer hides a recognized T3 name. Retained
orgs carry their captured labels; an org retained from two options merges them.
_stamp_estate_orgs credits a job that quotes a label as a whole token, so the
Org-options mutation carries the retained org's signoff_id.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 52 +++++++++++++++++++++++++++--------
 1 file changed, 40 insertions(+), 12 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index 8aa1370..e79af36 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -798,7 +798,11 @@ def captured_t3(resolver: Resolver | None, spec: dict | None, allow_t3: bool) ->
     """Sign-off check of the T3 orgs that the CAPTURED Estate Org field names (an option whose description is
     `T3: <login>`, or whose name is a T3 org's display name) while --allow-t3 is passed. Returns (refusals, retained):
     refusals are `t3-signoff:<code>:<login>` for each such org with no valid sign-off record, and retained are
-    {login, name, tier, signoff_id} for each such org whose record is valid. Identities resolve through
+    {login, name, tier, signoff_id, labels} for each such org whose record is valid. The description remainder and the
+    option name are resolved independently: the remainder is tried first, and the option name only when the remainder
+    does not resolve (an empty remainder yields no candidate), so a T3 name is still checked when its description is
+    unresolved or obsolete. labels are the lowercased, stripped option name and description (empties omitted, duplicates
+    removed); an org retained from two options gets one entry whose labels are merged. Identities resolve through
     references/brand.yaml (current logins, former slugs, approved renames) as well as the registry, so an org that is
     no longer in registry.orgs is still checked. copy_plan keeps every captured option (ids are never dropped) and the
     README documents them, so a withdrawn association would otherwise survive into the option-update job and the README
@@ -830,18 +834,18 @@ def _index(key: str, row: dict) -> None:
                 continue
             if _is_t3(row):
                 _index(key, row)
-    refusals, retained, seen = [], [], set()
-    for o in have.get("options") or []:
-        desc = str(o.get("description") or "")
-        ident = desc[len(TIER_PREFIX_T3):] if desc.startswith(TIER_PREFIX_T3) else str(o.get("name") or "")
+    def _resolve(ident: str) -> str | None:
+        """The T3 org key that one captured identifier names (a login, rename, display name or former slug), or None."""
         ident = ident.strip().lower()
+        if not ident:
+            return None
         key = t3.get(ident)
-        if key is None and ident:  # an approved rename: resolve the identifier to its current login
+        if key is None:  # an approved rename: resolve the identifier to its current login
             try:
                 key = t3.get(resolver.canonical(ident).lower())
             except NeedsInput:
                 key = None
-        if key is None and ident:  # a former login: brand former_slugs resolve it without registry membership
+        if key is None:  # a former login: brand former_slugs resolve it without registry membership
             bk = resolver.brand_key(ident)
             if bk is not None:
                 try:
@@ -851,18 +855,36 @@ def _index(key: str, row: dict) -> None:
                 if _is_t3(row):
                     key = bk
                     rows[bk] = row
+        return key
+
+    refusals, retained, seen = [], [], set()
+    for o in have.get("options") or []:
+        desc = str(o.get("description") or "")
+        name = str(o.get("name") or "")
+        # the description remainder and the option name are resolved independently: the remainder first (only with the
+        # T3 prefix), the option name when the remainder does not resolve
+        candidates = [desc[len(TIER_PREFIX_T3):]] if desc.startswith(TIER_PREFIX_T3) else []
+        candidates.append(name)
+        key = None
+        for ident in candidates:
+            key = _resolve(ident)
+            if key is not None:
+                break
         if key is None:
             continue
+        labels = list(dict.fromkeys(x for x in (name.strip().lower(), desc.strip().lower()) if x))
         login = resolver.canonical(key)
         rec, why = signoff.evaluate([key, *resolver.aliases(key)])
         if rec is None:
             refusals.append(f"t3-signoff:{(why or 'missing').partition(':')[0]}:{login}")
             continue
-        if login.lower() in seen:
+        if login.lower() in seen:  # the same org under another captured option: its labels join the one entry
+            entry = next(r for r in retained if r["login"].lower() == login.lower())
+            entry["labels"] = list(dict.fromkeys([*entry["labels"], *labels]))
             continue
         seen.add(login.lower())
         retained.append({"login": login, "name": (rows.get(key) or {}).get("display_name") or key, "tier": "T3",
-                         "signoff_id": str(rec["id"])})
+                         "signoff_id": str(rec["id"]), "labels": labels})
     return list(dict.fromkeys(refusals)), retained
 
 
@@ -1483,7 +1505,8 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
     """Each job that names a signed-off T3 org (its Org-field option, its login) carries
     that org's record. The jobs target @me, so stamping by target owner never finds the T3 grant; several T3 orgs on
     one job give `signoff_ids` (signoff.stamp_associations). A `--readme` Markdown value names orgs inside its text,
-    so it is also searched by name. No-op when no org carries a signoff_id.
+    so it is also searched by name. An org's `labels` (its captured option names and descriptions, see captured_t3)
+    credit a job that quotes one of them as a whole token. No-op when no org carries a signoff_id.
     (tests/test_t3_signoff_require.py::test_estate_plan_jobs_carry_the_t3_orgs_signoff)"""
     from . import signoff
     t3 = [o for o in orgs if o.get("signoff_id")]
@@ -1498,7 +1521,8 @@ def _stamp_estate_orgs(jobs: list[dict], orgs: list[dict]) -> None:
         tokens = _job_tokens(j)
         ids = [o["signoff_id"] for o in t3
                if o["login"].lower() in tokens or f"{TIER_PREFIX_T3}{o['login']}".lower() in tokens
-               or (o["name"].lower() in tokens and o["name"].lower() not in others)]
+               or (o["name"].lower() in tokens and o["name"].lower() not in others)
+               or any(lab in tokens and lab not in others for lab in o.get("labels", []))]
         argv = j.get("argv") if isinstance(j.get("argv"), list) else []
         for i, arg in enumerate(argv[:-1]):
             if arg == "--readme" and isinstance(argv[i + 1], str):
@@ -1533,7 +1557,11 @@ def estate_plan(resolver: Resolver, *, source: str | None = None, copied: dict |
                                      "§13.2: the Estate stays private."))
     _, retained = captured_t3(resolver, _captured_spec(copied), allow_t3)
     listed = {o["login"].lower() for o in orgs}
-    _stamp_estate_orgs(plan["jobs"], orgs + [o for o in retained if o["login"].lower() not in listed])
+    # an org both listed and retained is stamped with its captured labels; copies keep plan["orgs"] unchanged
+    retained_labels = {r["login"].lower(): r["labels"] for r in retained}
+    stamp_orgs = [{**o, "labels": list(dict.fromkeys([*o.get("labels", []), *retained_labels[o["login"].lower()]]))}
+                  if o["login"].lower() in retained_labels else o for o in orgs]
+    _stamp_estate_orgs(plan["jobs"], stamp_orgs + [o for o in retained if o["login"].lower() not in listed])
     return plan
 
 

From fb36e9f138e645c906ac89c24e427712eb0cbe68 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 05:01:56 -0500
Subject: [PATCH 76/79] test(#23): regressions for independent captured T3
 name/description resolution and Org-options stamping; docs

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                    |  1 +
 SKILL.md                        |  2 +-
 references/t3-signoff.md        |  2 +-
 tests/test_t3_emission_scope.py | 72 +++++++++++++++++++++++++++++++++
 4 files changed, 75 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 975ca13..3c7fe2b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 ### Added
 
+- T3 captured Org option identity (issue 23, round 5): a captured Org option is resolved by its description (`T3: <login>`) and by its option name independently, so an unresolved or empty description no longer hides an option name that is a known T3 org's display name (the option is checked for a record and held with `t3-signoff:<code>:<login>` without one), and the Org-options mutation of a retained option carries its `signoff_id` (merged with existing ids) even when the captured label differs from the current names. Regressions in `tests/test_t3_emission_scope.py`.
 - T3 sign-off at the profile destination and for captured Org option provenance (issue 23, round 4): `org profile --allow-t3` now also requires the org's `.github` repository sign-off, so a `.github`-scoped withdrawal holds the profile (`t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it, and the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option (merged with ids already on the job) instead of rediscovering them from rendered text. Regressions in `tests/test_t3_emission_scope.py`.
 - `project copy-plan --allow-t3` authorizes the `repo:` qualifiers of each proposed view filter before emitting its mutation (issue 23, adjudication t23-adjudication-view-filter-3100): a filter naming a denied or withdrawn repository is held (`view-filter-held` plus `t3-signoff:<code>`), a permitted one carries the covering `signoff_id`s, and a non-T3 owner's filter is unchanged. Negative, empty and wildcard `repo:` values are ignored. Regressions in `tests/test_t3_view_filter_repos.py`.
 - T3 sign-off stored scopes, held pin order and proposal stamping (issue 23, round 13): stored `repos` entries of grants and withdrawals are canonicalized like the requested repository (`site/`, ` site`, `site.git` equal `site`, `*` kept) in `evaluate`, `_covers` and the withdrawal match, and an entry that cannot be canonicalized makes the record malformed (`t3-signoff:invalid`, fails closed for a withdrawal, never authorizes for a grant); a non-boolean `approved` on a scoped record fails closed for that scope only. `org pins --allow-t3` holds the exact-set order job of a target that has a pin held for sign-off (`pins-order-held:<target>:t3-signoff`) while the authorized pin jobs remain, so a held pin is not unticked. Writer-shaped `proposals` (the `content actions` workflow-toggle) carry `signoff_id` in the report and on stdout and stay out of the `--jobs` queue. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_signoff_require.py, tests/test_t3_signoff_proposals.py.
diff --git a/SKILL.md b/SKILL.md
index 823d36c..7164ee1 100644
--- a/SKILL.md
+++ b/SKILL.md
@@ -111,7 +111,7 @@ python3 $S --meta /tmp/meta.json doctor --header
 
 Checks (`describe`, `topics`, `labels`, `readme`, `footer`, `meta`, `fingerprint`, `config`) print one JSON object with `command`, `owner`, `repo`, `result` and `logs[]`; `lint` prints one JSON line per file; `org`, `project`, `enterprise` and `content` print one JSON object with `action` (`org doctor --doctor-format tsv|md` prints a row). Generators (`banner`, `card`, `org-banner`, `org-tile`, `intro`, `contact-sheet`) print a short text summary by default; pass the global `--format json` (before the command) for the same JSON object. `doctor` prints a TSV row (`--format json|md` after `doctor`). In text mode a refusal goes to stderr. Log codes are the standard's: `needs-input:<detail>`, `art-fail`, `topics-short`, `label-conflict`, `label-referenced`, `label-rewrite-first`, `needs-input:label-references` (a rename held because §6.4 rule 0 needs a checkout: re-plan with `--repo-dir`), `readme-shrink`, `dead-link`, `exempt`, `hold`, `t3-signoff`, `archived`, plus `needs-input:metadata` (a failed metadata capture, exit 4), `needs-input:file-tree` (no checkout and no tree in the metadata, so the type is provisional), `needs-input:visibility`, `needs-input:banner-chips` (fewer than two chips), `needs-input:key-chip` (no gold chip: the type category would repeat the eyebrow), `needs-input:subtitle` (no one-line subtitle: add `subtitle:`), `type-override:<type>`, `type-config:<type>` (from `.github/showcase.yml`) and `bootstrap:edited`.
 
-**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized; `org profile` additionally requires the sign-off of the org's own `.github` repository, the profile's destination, so a `.github`-scoped withdrawal holds the profile (log `t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it; and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does: the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option directly (not rediscovered from the rendered text), so an option kept under a former login and a different captured label still names its record.
+**Co-owner sign-off (`--allow-t3`).** `--allow-t3` is a global option placed before the command (`python3 $S --allow-t3 --meta meta.json banner`). It applies to every repository command, generator, `lint` and the `org`, `project` and `content` groups, not only `meta`; `meta`, `org` and `project` also accept it after the command name. Pass it only for one explicitly approved invocation, after an approved `t3-metadata` or `t3-signoff` row. Without it a T3 owner (Pick-Your-AI, Jevelopers-neatHack-2026) is refused: exit 2, result `refused`, log `t3-signoff`. Three commands never refuse a T3 owner and need no flag: repository `doctor` always admits T3 owners (the code passes `allow_t3=True`; it still refuses excluded owners, log `exempt`, and HOLD owners, log `hold`) and holds the R7 cell unless `--allow-t3` is passed and a valid sign-off record covers the owner and repository (then R7 is evaluated normally; otherwise it stays `hold`, and `doctor` is read-only so it logs no `t3-signoff` code); `meta` without `--from-gh` only normalizes a local file (only `--from-gh` is gated, and it never checks eligibility); and `fingerprint` never checks the owner. With the flag, excluded owners (log `exempt`) and HOLD owners (log `hold`) are still refused by repository commands and generators; the flag lifts only the T3 refusal. The org actions `about`, `pins`, `health` and `doctor` admit a HOLD org with or without the flag (they pass `allow_hold`), so the HOLD refusal does not apply to them. It holds for that one invocation only and is off again afterwards; the flag itself is never read from a config file or environment (only the record-file path `SHOWCASE_T3_SIGNOFF_FILE` is). Sign-off enforcement is on by default and cannot be turned off: `--allow-t3` is honoured only while a valid, unexpired sign-off record covers the owner and repository (step 1 above), otherwise exit 2 with log `t3-signoff:missing`, `t3-signoff:expired`, `t3-signoff:scope` or `t3-signoff:revoked` (a later or same-day `approved: false` record vetoes the grant for every repository the withdrawal covers, so a co-owner can withdraw one repository from a `*` or multi-repository grant, whether repositories are written as a bare name or `OWNER/NAME` under the owner or any alias; a malformed withdrawal that could cover the request is `t3-signoff:invalid`, never ignored; owner-wide `org profile` and `org pins` repeat the check per repository, so a repository withdrawn from a `*` grant is omitted or held (log `t3-signoff:<code>:<login>/<repo>`) while the org's other repositories stay authorized; `org profile` additionally requires the sign-off of the org's own `.github` repository, the profile's destination, so a `.github`-scoped withdrawal holds the profile (log `t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it; and `project estate-plan` also holds the Org option update and README when the board's captured Org options name a T3 org without a valid record; `project estate-plan --allow-t3` logs `t3-signoff:<code>:<login>` for every T3 org it omits for lack of a valid record; a malformed `repos` is always `t3-signoff:invalid`, even beside a valid unrelated grant; `expires` is optional and absent means no expiry; also `t3-signoff:no-file` when the resolved record file does not exist or no estate root resolves, and `t3-signoff:invalid` when the owner's records break [the schema](references/t3-signoff.schema.json)). There is no opt-out: no flag or environment variable turns the check off. A record dated in the future, or expiring before its approval date, is `t3-signoff:invalid`. Writer jobs carry the granting record as `signoff_id` only (`approval_id` stays untouched: it names the decisions/APPROVED_ACTIONS.yaml row), change records carry `signoff_id`, and repository `doctor` (read-only) adds a trailing `signoff_id` column only when `--allow-t3` is passed, so the documented row shape is unchanged otherwise. Record ids must be unique within the file (a repeated id refuses `t3-signoff:invalid`). Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed. The record file is read, never copied or created; its canonical private path is `<estate root>/decisions/t3-signoffs.yaml` (estate root: `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle), resolved in the order `--t3-signoff-file`, `SHOWCASE_T3_SIGNOFF_FILE`, then that default. Sign-off ids already on a job are merged, not replaced, when an Org or association grant is stamped, and direct `project copy-plan --role estate` stamps captured T3 Org options exactly as `project estate-plan` does: the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option directly (not rediscovered from the rendered text), so an option kept under a former login and a different captured label still names its record. A captured Org option is recognized by its description (`T3: <login>`) and by its option name independently: an unresolved or empty description (for example `T3: obsolete-login` or `T3: `) never hides an option name that is a known T3 org's display name, so that option is checked for a valid record and the Org option update and README are held (`t3-signoff:<code>:<login>`) when there is none. The Org-options mutation of a retained option carries the option's `signoff_id` (merged with ids already on the job), also when the captured label differs from the org's current names.
 
 ## Orgs, Projects, the Enterprise and Content
 
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index ea7b2e9..51b06c5 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -54,7 +54,7 @@ Each refusal exits 2 with result `refused`.
 
 The file is append-only, so no edit of the original grant is needed. An `approved: false` record for the same owner, with `approved_on` on or after a grant's `approved_on` (the same day counts; an earlier date does not), vetoes that grant for every repository the withdrawal covers (`*` covers all). The veto is per repository, so a co-owner can withdraw one repository from a `*` or multi-repository grant: grant `[a, b]` plus withdrawal `[a]` refuses `a` with `t3-signoff:revoked` and still grants `b`. Repositories compare as the same when written as a bare `NAME` or as `OWNER/NAME` under the owner or any of its aliases (a grant for `site` is withdrawn by `OWNER/site` and the reverse), while `OTHER/NAME` for another account stays distinct. A new `approved: true` record dated after the withdrawal grants again. A withdrawal that is malformed (it breaks the schema, for example an extra `reason` key) and could cover the request is never ignored: the run refuses `t3-signoff:invalid` naming the record id and the first problem, so a mistyped withdrawal never leaves a grant standing. A record for the owner whose `approved` is not a boolean (the string `"false"` or `"true"`, `0`, `1`, `null` or a missing key) is likewise a possible withdrawal that fails closed as `t3-signoff:invalid`; it is never coerced into a grant or a withdrawal.
 
-An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` also requires the sign-off of the org's own `.github` repository, because `public_slice` excludes it and the profile is written there: a `.github`-scoped withdrawal (after a `*` grant) refuses the profile with `t3-signoff:<code>:<login>/.github` before anything is built or written, leaving an existing `profile/README.md` and `profile/data.json` untouched, and a later `.github` regrant restores generation. Inside the profile it omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. The exact-set order job (`...-pin-<target>-order`, "make the ticked set exactly this list and untick every other repository") would also untick a held pin, so when any pin of a target is held for sign-off that target's order job is held too and the run logs `pins-order-held:<target>:t3-signoff`; the authorized individual pin jobs remain, and nothing is deleted from the plan data. Without a held pin the order job is emitted and carries the `signoff_ids` of the pins it lists. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`. For a retained captured Org option (valid record), `project copy-plan` merges the option's granting `signoff_id` onto the README job directly, so the provenance survives a former login and a captured label that differs from the current names; ids already on the job (a repository regrant) are kept.
+An owner-wide command (`org profile`, `org pins`, `project estate-plan`) is gated once for the owner, and a `*` grant with a later withdrawal of some repositories stays valid for the owner, so the per-repository check is repeated where a repository is named or acted on. With `--allow-t3`, `org profile` also requires the sign-off of the org's own `.github` repository, because `public_slice` excludes it and the profile is written there: a `.github`-scoped withdrawal (after a `*` grant) refuses the profile with `t3-signoff:<code>:<login>/.github` before anything is built or written, leaving an existing `profile/README.md` and `profile/data.json` untouched, and a later `.github` regrant restores generation. Inside the profile it omits a repository of a T3 org whose own sign-off is not granted (featured, sections, forks, archives) and `org pins` holds its pin (check result `hold`, no pin job, not in the order job), each logging `t3-signoff:<code>:<login>/<repo>`; the org's other repositories keep the grant's `signoff_id`. The exact-set order job (`...-pin-<target>-order`, "make the ticked set exactly this list and untick every other repository") would also untick a held pin, so when any pin of a target is held for sign-off that target's order job is held too and the run logs `pins-order-held:<target>:t3-signoff`; the authorized individual pin jobs remain, and nothing is deleted from the plan data. Without a held pin the order job is emitted and carries the `signoff_ids` of the pins it lists. `project estate-plan --allow-t3` also reads the Org options already captured on the board: a captured option naming a T3 org without a valid record holds the Org option update and the README (no option id is deleted) and logs `t3-signoff:<code>:<login>` with `hold:org-options`. For a retained captured Org option (valid record), `project copy-plan` merges the option's granting `signoff_id` onto the README job directly, so the provenance survives a former login and a captured label that differs from the current names; ids already on the job (a repository regrant) are kept. A captured Org option is recognized by its description (`T3: <login>`) and by its option name independently: an unresolved or empty description (for example `T3: obsolete-login` or `T3: `) never hides an option name that is a known T3 org's display name, so that option is checked for a valid record and the Org option update and README are held (`t3-signoff:<code>:<login>`) when there is none. The Org-options mutation of a retained option carries the option's `signoff_id` (merged with ids already on the job), also when the captured label differs from the org's current names.
 
 **`signoff_id` and `approval_id` (issue #26).** Task #26 says "add `approval_id` to jobs created under the flag". This implementation names the sign-off in a separate `signoff_id` (`signoff_ids` for several) and never sets `approval_id`, because `approval_id` names the `decisions/APPROVED_ACTIONS.yaml` row the writer guard looks up, and a sign-off id is not one. Read #26 as "carry the sign-off id as `signoff_id`".
 
diff --git a/tests/test_t3_emission_scope.py b/tests/test_t3_emission_scope.py
index a12783b..482980f 100644
--- a/tests/test_t3_emission_scope.py
+++ b/tests/test_t3_emission_scope.py
@@ -490,3 +490,75 @@ def test_captured_org_option_ids_merge_with_a_repository_regrant_on_the_readme_j
                             repositories=[f"{OWNER}/withdrawn-x", f"{OWNER}/ok-y"], allow_t3=True, reviewed="2026-10-25")
     readme = _readme_jobs(plan)
     assert readme and all({"t3s-all", "t3s-regrant"} <= _ids(j) for j in readme), readme
+
+
+# ---------------------------------------------------------------------------------------------- name vs description
+def _estate_capture(name, desc, recolor=False):
+    """A complete Estate capture whose only T3 Org option has the given name and description. recolor adds a Northwind
+    option with a wrong colour, so the plan must emit an Org-options mutation beside the README job."""
+    from test_t3_signoff_require import _complete_estate_capture
+    cap = _complete_estate_capture()
+    opts = cap["data"]["user"]["projectV2"]["fields"]["nodes"][-1]["options"]
+    opts[0]["name"], opts[0]["description"] = name, desc
+    if recolor:
+        opts.append({"id": "optnw", "name": "Northwind Trading Co.", "color": "RED", "description": "T1: Northwind-Trading-Co"})
+    return cap
+
+
+def _org_options_jobs(plan):
+    return [j for j in plan["jobs"] if j["id"].endswith("-options-org")]
+
+
+def _estate(brand, monkeypatch, tmp_path, records, cap, res=None):
+    from ctshowcase import project as PJ
+    with _Strict(monkeypatch, _file(tmp_path, records)):
+        return PJ.estate_plan(res or _resolver(brand, _registry(False)), copied=cap, user_id=100, allow_t3=True)
+
+
+@pytest.mark.parametrize("desc", ["T3: obsolete-login", "T3: "], ids=["obsolete-login", "empty-remainder"])
+def test_unresolved_description_does_not_hide_a_known_t3_option_name(tmp_path, monkeypatch, brand, desc):
+    """The option name `Pick Your AI` is a T3 display name even when its description cannot be resolved: with no
+    sign-off the estate plan holds the README and names the refusal for the recognized org."""
+    plan = _estate(brand, monkeypatch, tmp_path, [], _estate_capture("Pick Your AI", desc))
+    assert f"t3-signoff:missing:{OWNER}" in plan["logs"], plan["logs"]
+    assert not _readme_jobs(plan), [j["id"] for j in plan["jobs"]]
+    assert "Pick Your AI" not in json.dumps(plan["jobs"], ensure_ascii=False), plan["jobs"]
+
+
+@pytest.mark.parametrize("desc", ["T3: obsolete-login", "T3: "], ids=["obsolete-login", "empty-remainder"])
+def test_unresolved_description_with_a_covering_record_keeps_the_option_and_stamps_the_id(tmp_path, monkeypatch, brand, desc):
+    plan = _estate(brand, monkeypatch, tmp_path, [{"id": "t3s-all"}], _estate_capture("Pick Your AI", desc))
+    assert not [x for x in plan["logs"] if str(x).startswith("t3-signoff:")], plan["logs"]
+    readme = _readme_jobs(plan)
+    assert readme and all("t3s-all" in _ids(j) for j in readme), [j["id"] for j in plan["jobs"]]
+
+
+# ---------------------------------------------------------------------------------------------- Org-options stamping
+def test_org_options_mutation_carries_the_signoff_of_a_retained_option_under_another_label(tmp_path, monkeypatch, brand):
+    cap = _estate_capture("Former Synthetic Name", f"T3: {OWNER}", recolor=True)
+    plan = _estate(brand, monkeypatch, tmp_path, [{"id": "t3s-all"}], cap, _renamed_resolver(brand))
+    muts = _org_options_jobs(plan)
+    assert muts and all("t3s-all" in _ids(j) for j in muts), [j["id"] for j in plan["jobs"]]
+    assert "Former Synthetic Name" in json.dumps(muts, ensure_ascii=False), muts
+    readme = _readme_jobs(plan)
+    assert readme and all("t3s-all" in _ids(j) for j in readme), readme
+
+
+def test_org_options_mutation_merges_existing_signoff_ids(tmp_path, monkeypatch, brand):
+    from ctshowcase import project as PJ
+    orgs = [{"login": "Pick-Your-Stack", "name": "Pick Your AI", "tier": "T3", "signoff_id": "t3s-all",
+             "labels": ["former synthetic name", "t3: pick-your-ai"]}]
+    jobs = [{"id": "m", "phase": 1, "signoff_id": "t3s-other",
+             "argv": ["gh", "api", "graphql", "-f", 'query=m { o: [{name: "Former Synthetic Name"}] }']}]
+    with _Strict(monkeypatch, _file(tmp_path, [{"id": "t3s-all"}])):
+        PJ._stamp_estate_orgs(jobs, orgs)
+    assert _ids(jobs[0]) == {"t3s-all", "t3s-other"}, jobs[0]
+
+
+def test_org_options_mutation_and_readme_are_both_held_when_the_option_is_withdrawn(tmp_path, monkeypatch, brand):
+    cap = _estate_capture("Former Synthetic Name", f"T3: {OWNER}", recolor=True)
+    plan = _estate(brand, monkeypatch, tmp_path, WITHDRAWN, cap, _renamed_resolver(brand))
+    assert any(str(x).startswith("t3-signoff:") for x in plan["logs"]), plan["logs"]
+    assert not _org_options_jobs(plan) and not _readme_jobs(plan), [j["id"] for j in plan["jobs"]]
+    blob = json.dumps(plan["jobs"], ensure_ascii=False)
+    assert "Former Synthetic Name" not in blob and "t3s-g" not in blob, blob

From ef970ca11eee0e1e37bc0b662140aef9eef18f61 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 05:31:54 -0500
Subject: [PATCH 77/79] fix(ctshowcase): authorize repos named inside grouping
 parentheses in view filters

_filter_repo_refs tokenized the raw filter, so a positive repo: qualifier
wrapped in parentheses (e.g. '(repo:A/x) workstream:Research') was not
seen and its repository skipped sign-off enforcement and provenance
stamping. Grouping parentheses outside quoted values are now replaced
with spaces before tokenizing; quoted values are left unchanged.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 scripts/ctshowcase/project.py | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/scripts/ctshowcase/project.py b/scripts/ctshowcase/project.py
index e79af36..738585c 100644
--- a/scripts/ctshowcase/project.py
+++ b/scripts/ctshowcase/project.py
@@ -628,14 +628,33 @@ def token(m):
 _REPO_QUALIFIER = re.compile(r"^repo:(.+)$", re.I)
 
 
+def _strip_filter_groups(flt: str) -> str:
+    """Replace grouping parentheses outside double-quoted values with a space, so `(repo:A/x) workstream:Research`
+    tokenizes like `repo:A/x workstream:Research`. Parentheses inside quotes are copied unchanged."""
+    if not flt:
+        return ""
+    out: list[str] = []
+    in_quotes = False
+    for ch in flt:
+        if ch == '"':
+            in_quotes = not in_quotes
+            out.append(ch)
+        elif not in_quotes and ch in "()":
+            out.append(" ")
+        else:
+            out.append(ch)
+    return "".join(out)
+
+
 def _filter_repo_refs(flt: str) -> list[str]:
     """Repository references named by the POSITIVE `repo:` qualifiers of a Projects view filter, in order and
-    de-duplicated case-insensitively. A comma list is split (`repo:A/x,B/y`) and quotes and whitespace are stripped from
-    each part. An empty part or one with a `*` wildcard names no single repository, so it is skipped. A negative
-    `-repo:` token is ignored: an exclusion names no association."""
+    de-duplicated case-insensitively. Grouping parentheses outside quoted values are ignored for tokenizing, so a
+    grouped qualifier such as `(repo:A/x OR repo:B/y)` is still found. A comma list is split (`repo:A/x,B/y`) and
+    quotes and whitespace are stripped from each part. An empty part or one with a `*` wildcard names no single
+    repository, so it is skipped. A negative `-repo:` token is ignored: an exclusion names no association."""
     out: list[str] = []
     seen: set[str] = set()
-    for tok in _FILTER_TOKEN.findall(flt or ""):
+    for tok in _FILTER_TOKEN.findall(_strip_filter_groups(flt or "")):
         m = _REPO_QUALIFIER.match(tok)
         if not m:
             continue

From 1b520894b0bb5dc27437789339b27ec7f269f656 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 05:32:22 -0500
Subject: [PATCH 78/79] test(#23): grouped-filter repo regressions for missing,
 withdrawn and permitted records

Adds regressions for repo qualifiers wrapped in grouping parentheses:
parser cases for _filter_repo_refs, withdrawn holds with parity against
the ungrouped filter, missing-record holds, a permitted repo carrying
the sign-off id, and a T1-only control. The new grouping cases fail
against the current parser (the P1 bypass) until the production fix lands.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
---
 tests/test_t3_view_filter_repos.py | 59 ++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/tests/test_t3_view_filter_repos.py b/tests/test_t3_view_filter_repos.py
index 010bb00..fdfd238 100644
--- a/tests/test_t3_view_filter_repos.py
+++ b/tests/test_t3_view_filter_repos.py
@@ -207,3 +207,62 @@ def test_cli_copy_plan_permitted_filter_carries_the_signoff_id(tmp_path):
     assert r.returncode == 0, r.stdout + r.stderr
     got = _backlog(jobs)
     assert len(got) == 1 and got[0].get("signoff_id") == "grant", [j["id"] for j in jobs]
+
+
+# Grouping parentheses (issue 23, P1): a parenthesized positive qualifier authorizes and stamps like a bare one.
+def test_filter_repo_refs_ignores_grouping_parentheses():
+    from ctshowcase.project import _filter_repo_refs as refs
+    assert refs("(repo:A/x) workstream:Research") == ["A/x"]
+    assert refs("(repo:A/x OR repo:B/y)") == ["A/x", "B/y"]
+    assert refs("((repo:A/x))") == ["A/x"]
+    assert refs("(-repo:C/z)") == []
+    assert refs("-(repo:A/x)") == ["A/x"]  # fail closed: a negated group still names the repository
+    assert refs('repo:"A/(x)"') == ["A/(x)"]  # parentheses inside a quoted value are part of the name
+
+
+GROUPED_WITHDRAWN = [
+    f"(repo:{OWNER}/withdrawn-x) workstream:Research",
+    f"(repo:{OWNER}/kept-y repo:{OWNER}/withdrawn-x) workstream:Research",
+    f"workstream:Research (repo:{OWNER}/withdrawn-x)",
+]
+
+
+@pytest.mark.parametrize("flt", GROUPED_WITHDRAWN)
+def test_grouped_withdrawn_repo_holds_the_job_with_parity(tmp_path, monkeypatch, brand, flt):
+    bare = flt.replace("(", "").replace(")", "")
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+        ungrouped = _plan(brand, bare)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+    assert _held(plan), plan["logs"]
+    assert _t3_codes(plan), plan["logs"]
+    assert not _backlog(ungrouped) and _held(ungrouped) and _t3_codes(ungrouped), ungrouped["logs"]
+
+
+@pytest.mark.parametrize("flt", GROUPED_WITHDRAWN)
+def test_grouped_withdrawn_repo_without_a_record_holds_the_job(tmp_path, monkeypatch, brand, flt):
+    with _Strict(monkeypatch, _file(tmp_path, [])):
+        plan = _plan(brand, flt)
+    assert not _backlog(plan), [j["id"] for j in plan["jobs"]]
+    assert _held(plan), plan["logs"]
+    assert _t3_codes(plan), plan["logs"]
+
+
+def test_grouped_permitted_repo_keeps_the_job_and_carries_the_signoff_id(tmp_path, monkeypatch, brand):
+    flt = f"(repo:{OWNER}/kept-y) workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    jobs = _backlog(plan)
+    assert len(jobs) == 1, [j["id"] for j in plan["jobs"]]
+    assert jobs[0].get("signoff_id") == "t3s-all", jobs[0]
+    assert not _held(plan) and not _t3_codes(plan), plan["logs"]
+
+
+def test_grouped_t1_only_repo_emits_one_unstamped_job(tmp_path, monkeypatch, brand):
+    flt = f"(repo:{T1}/some-repo) workstream:Research"
+    with _Strict(monkeypatch, _file(tmp_path, WILD)):
+        plan = _plan(brand, flt)
+    jobs = _backlog(plan)
+    assert len(jobs) == 1, [j["id"] for j in plan["jobs"]]
+    assert "signoff_id" not in jobs[0], jobs[0]
+    assert not _held(plan), plan["logs"]

From 1d5f931c6e4d30b9b4cb624edef55e339c9e79e8 Mon Sep 17 00:00:00 2001
From: Timothy Wayne Gregg <Timothy.Gregg@complete.tech>
Date: Sun, 1 Nov 2026 05:33:43 -0500
Subject: [PATCH 79/79] docs(#23): view-filter repo qualifiers are authorized
 inside grouping parentheses

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md             | 2 +-
 references/t3-signoff.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 14c061d..b89b089 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,7 +8,7 @@ All notable changes to `github-showcase-skill` are recorded here. Versions follo
 
 - T3 captured Org option identity (issue 23, round 5): a captured Org option is resolved by its description (`T3: <login>`) and by its option name independently, so an unresolved or empty description no longer hides an option name that is a known T3 org's display name (the option is checked for a record and held with `t3-signoff:<code>:<login>` without one), and the Org-options mutation of a retained option carries its `signoff_id` (merged with existing ids) even when the captured label differs from the current names. Regressions in `tests/test_t3_emission_scope.py`.
 - T3 sign-off at the profile destination and for captured Org option provenance (issue 23, round 4): `org profile --allow-t3` now also requires the org's `.github` repository sign-off, so a `.github`-scoped withdrawal holds the profile (`t3-signoff:<code>:OWNER/.github`, nothing built or written, existing README and data.json untouched) while the individual repository checks still apply inside it, and the README job of a copied Estate board carries the granting ids of every retained captured T3 Org option (merged with ids already on the job) instead of rediscovering them from rendered text. Regressions in `tests/test_t3_emission_scope.py`.
-- `project copy-plan --allow-t3` authorizes the `repo:` qualifiers of each proposed view filter before emitting its mutation (issue 23, adjudication t23-adjudication-view-filter-3100): a filter naming a denied or withdrawn repository is held (`view-filter-held` plus `t3-signoff:<code>`), a permitted one carries the covering `signoff_id`s, and a non-T3 owner's filter is unchanged. Negative, empty and wildcard `repo:` values are ignored. Regressions in `tests/test_t3_view_filter_repos.py`.
+- `project copy-plan --allow-t3` authorizes the `repo:` qualifiers of each proposed view filter before emitting its mutation (issue 23, adjudication t23-adjudication-view-filter-3100): a filter naming a denied or withdrawn repository is held (`view-filter-held` plus `t3-signoff:<code>`), a permitted one carries the covering `signoff_id`s, and a non-T3 owner's filter is unchanged. Negative, empty and wildcard `repo:` values are ignored. Qualifiers inside grouping parentheses, such as `(repo:Owner/x) workstream:Research`, are authorized and stamped too. Regressions in `tests/test_t3_view_filter_repos.py`.
 - T3 sign-off stored scopes, held pin order and proposal stamping (issue 23, round 13): stored `repos` entries of grants and withdrawals are canonicalized like the requested repository (`site/`, ` site`, `site.git` equal `site`, `*` kept) in `evaluate`, `_covers` and the withdrawal match, and an entry that cannot be canonicalized makes the record malformed (`t3-signoff:invalid`, fails closed for a withdrawal, never authorizes for a grant); a non-boolean `approved` on a scoped record fails closed for that scope only. `org pins --allow-t3` holds the exact-set order job of a target that has a pin held for sign-off (`pins-order-held:<target>:t3-signoff`) while the authorized pin jobs remain, so a held pin is not unticked. Writer-shaped `proposals` (the `content actions` workflow-toggle) carry `signoff_id` in the report and on stdout and stay out of the `--jobs` queue. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_signoff_require.py, tests/test_t3_signoff_proposals.py.
 - T3 sign-off repository spelling canonicalization (issue 23, adjudication t23-adjudication-repo-canonicalization-50f): the requested repository is canonicalized (whitespace, trailing `/`, `.git`) before the `*` shortcut in `signoff.evaluate()`/`_covers()`, so a per-repository withdrawal can no longer be bypassed by `x/`, ` x`, `x.git`; an empty or invalid name fails closed (`invalid:repo:`). `project copy-plan --repos` entries are stripped and validated (a malformed entry is a usage refusal), README and link entries are normalised once (a bare name on an org board is `<board owner>/<name>`, owners stripped and resolved, unresolvable owners held), and without `--allow-t3` a T3 repository on a non-T3 board README is omitted and logged `t3-signoff:readme:<owner>/<repo>`. `references/t3-signoff.md` documents the spelling rules and maps the record fields `repos`, `approved_on` and `expires` to the issue #24 wording. Tests: tests/test_t3_signoff_withdrawal.py, tests/test_t3_cli_copy_plan_consent.py, tests/test_t3_emission_scope.py.
 - Default-on T3 sign-off enforcement (issue 23, tasks 24-27): `--allow-t3` is honoured only while an approved, unexpired record covers the owner (and the repository when the record is scoped). The record file is the private estate file `<estate root>/decisions/t3-signoffs.yaml` (`signoff.default_record_path()`; estate root from `SHOWCASE_ESTATE_ROOT`, else the skill's parent bundle); `--t3-signoff-file PATH` (env `SHOWCASE_T3_SIGNOFF_FILE`) overrides it, resolved in the order flag, env, default. When the resolved file does not exist, or no estate root resolves, the command exits 2 with `t3-signoff:no-file` naming the path; the tool never creates the file and never falls back to trusting the flag. There is no opt-out: no flag or environment variable turns the check off. `expires` is optional (absent means no expiry; null or unparseable is still invalid). An `approved: false` record dated on or after a grant (the same day counts), for the same owner, vetoes the grant for every repository the withdrawal covers (`*` covers all), so a co-owner can withdraw one repository from a `*` or multi-repository grant (`t3-signoff:revoked`); a malformed withdrawal that could cover the request fails closed with `t3-signoff:invalid` instead of leaving the grant standing; a `repos` that is not `"*"`, a name or a non-empty list is `t3-signoff:invalid`. A bare `--allow-t3` therefore no longer works without a record: this is a behaviour change for every T3 run. A repository given as `OWNER/NAME` is covered by a record only when that owner is the record's own org (only `*` covers another account's repository), and `project estate-plan` credits a job to a T3 org only by its login, its `T3: login` description or an unambiguous display name. Record ids must be unique within the file (a repeat refuses `t3-signoff:invalid`). `doctor` adds the trailing `signoff_id` column only when `--allow-t3` is passed. Transfer-target holds (an approved pending transfer into a T3 org) apply only when `--allow-t3` is passed, so T1/T2 org output is unchanged by default. A record whose `approved_on` is later than today, or whose `expires` is earlier than its `approved_on`, is invalid (`t3-signoff:invalid`) and grants nothing; a malformed `repos` value is always reported as `t3-signoff:invalid`, never `t3-signoff:scope`, even beside a valid grant for an unrelated repository. A withdrawal and a grant match when repositories are written as a bare name or `OWNER/NAME` under the owner or any of its aliases. `project estate-plan --allow-t3` records `t3-signoff:<code>:<login>` in the plan's `logs` for every T3 org it omits for lack of a valid record. Writer jobs for a signed-off T3 owner carry `signoff_id` only (`approval_id` is never set from a sign-off: it names the decisions/APPROVED_ACTIONS.yaml row), including the star-List jobs `org pins` plans on the personal account; an item job that adds a T3 repository to a T3 org's List keeps both grants in `signoff_ids` (the favorite's record, the List org's record and any newly added T3 destination List's record). Change records carry `signoff_id`, and a T3 association (`topics --also-in`, `adopt`'s `also_in`, `project estate-plan`) carries that org's record. A record file whose envelope breaks the schema (a top-level list, an extra top-level key, a non-object entry) authorizes nothing. Excluded and HOLD owners stay refused. A `*` grant with a later per-repository withdrawal no longer lets `org profile` name, or `org pins` pin, the withdrawn repository (it is omitted or held, log `t3-signoff:<code>:<login>/<repo>`, while the org's other repositories keep the grant), and `project estate-plan --allow-t3` holds the Org option update and README when the board's already captured Org options name a T3 org without a valid record (no option id is deleted). Issue #26 asks for `approval_id` on jobs; jobs carry `signoff_id` instead, because `approval_id` names the APPROVED_ACTIONS.yaml row (recorded in references/t3-signoff.md).
diff --git a/references/t3-signoff.md b/references/t3-signoff.md
index 51b06c5..c3924a1 100644
--- a/references/t3-signoff.md
+++ b/references/t3-signoff.md
@@ -78,4 +78,4 @@ The requested repository is canonicalized once, at the top of `evaluate()` and i
 
 Without `--allow-t3`, a T3 owner's repository referenced from a non-T3 board README is omitted too, never kept unchecked (that would be less restrictive than passing the flag): the plan logs `t3-signoff:readme:<owner>/<repo>`. Standalone read-only `project readme` is unchanged apart from stripping and validating `--repos`.
 
-Proposed view-filter repositories are authorized and stamped too: before a view-filter mutation is emitted, each positive `repo:` qualifier of the proposed filter (comma lists split; `-repo:`, empty and `*` values name no repository and are ignored) is checked like a README repository on its own owner and name. A filter that names a denied or withdrawn repository is held (`view-filter-held:<job id>` plus the `t3-signoff:<code>` log), and a permitted filter's job carries the covering record ids in `signoff_id` / `signoff_ids`. A non-T3 owner's filter is unchanged and unstamped. This adds no approval step.
+Proposed view-filter repositories are authorized and stamped too: before a view-filter mutation is emitted, each positive `repo:` qualifier of the proposed filter (comma lists split; `-repo:`, empty and `*` values name no repository and are ignored) is checked like a README repository on its own owner and name. A filter that names a denied or withdrawn repository is held (`view-filter-held:<job id>` plus the `t3-signoff:<code>` log), and a permitted filter's job carries the covering record ids in `signoff_id` / `signoff_ids`. A non-T3 owner's filter is unchanged and unstamped. Qualifiers are authorized even inside grouping parentheses, so `(repo:Owner/x) workstream:Research` is held or stamped exactly like the bare form (parentheses inside a quoted value are part of the name). This adds no approval step.