Bottom line

Trail #641 is checked out, rebased cleanly on origin/main, all 5 findings addressed, and the working tree passes CI-style lint + the touched-package tests. Nothing committed — yours to review/commit. One finding turned out to be inverted by the rebase (see below).

What the trail said (5 medium findings, all in resolveref.go + 2 stale)

• #1 case-sensitivity (conf 0.70): pickProject/pickOrg re-filtered case-sensitively after the server's name filter — case-mismatched query silently fails.
• #2 empty AccountId (0.65): resolveAccountRef forwarded "" as the owner ULID into project-create.
• #3 resolvers untested (0.60): the network-branching resolveXRef funcs had no tests.
• 2 stale: "don't drop the //nolint:ireturn directives or CI breaks."

What I changed (per your "all four" + "normalise case both sides")

• #1: strings.EqualFold in pickOrg, pickProject, andfilterProjectsByName — matches the server's lower(name) uniqueness you described. The CLI side is done; the server-side normalization lives in the entire.io repo, not this worktree — that part is on you/another change.
• #2: guard returning handle %q resolved to no account on empty AccountId.
• #3: TestResolveOrgRef/ProjectRef/AccountRef asserting the load-bearing invariant — ULID ref = 0 HTTP calls, name/handle = exactly 1 — plus case-insensitive and empty-account cases, via an httptest server with a request counter.

The twist — the 2 stale findings inverted

After rebasing, origin/main's .golangci.yaml now allowlists checkpoint.CommittedStore/TemporaryStore for ireturn. So the three //nolint:ireturn directives (which branch commit 182b9702c6 had restored) are now redundant, and CI's nolintlint fails on them as "directive unused." I verified this directly: golangci-lint without --fix reports 3 errors with them present, 0 with them removed. So the correct post-rebase state is the opposite of what those findings said — directives removed. They're now removed in the working tree (you'll see open.go and manual_commit.go in the diff).

Trail state

All 5 findings closed: 3 resolved (with notes), 2 dismissed (notes corrected to explain the inversion). 0 open.

Diff: resolveref.go (+33/-17 incl. tests file), resolveref_test.go (+237), open.go/manual_commit.go (directive removals). Want me to commit?

Summary

• Commit 789678d091 pushed to feat/control-plane-friendly-names (force-with-lease, since the rebase rewrote the 4 commits).
• 0 open findings: 3 resolved (case-insensitivity, empty-AccountId guard, resolver tests) each annotated with the SHA; 2 dismissed (the ireturn ones, with corrected notes explaining the rebase inverted them).
• CI-style lint clean (golangci-lint without --fix) and touched-package tests pass.

One non-blocking note: the server-side half of the case normalization (lower(name) uniqueness) lives in the entire.io repo, not this one — only the CLI side shipped here.