# Bottom line

Trail #641 is checked out, rebased cleanly on `origin/main`, all 5 findings addressed, and the working tree passes CI-style lint + the touched-package tests. **Nothing committed — yours to review/commit.** One finding turned out to be _inverted_ by the rebase (see below).

# What the trail said (5 medium findings, all in `resolveref.go` \+ 2 stale)

- **#1 case-sensitivity** (conf 0.70): `pickProject`/`pickOrg` re-filtered case-sensitively after the server's name filter — case-mismatched query silently fails.
- **#2 empty AccountId** (0.65): `resolveAccountRef` forwarded `""` as the owner ULID into project-create.
- **#3 resolvers untested** (0.60): the network-branching `resolveXRef` funcs had no tests.
- **2 stale**: "don't drop the `//nolint:ireturn` directives or CI breaks."

# What I changed (per your "all four" + "normalise case both sides")

- **#1**: `strings.EqualFold` in `pickOrg`, `pickProject`, **and**`filterProjectsByName` — matches the server's `lower(name)` uniqueness you described. The CLI side is done; the **server-side normalization lives in the entire.io repo, not this worktree** — that part is on you/another change.
- **#2**: guard returning `handle %q resolved to no account` on empty `AccountId`.
- **#3**: `TestResolveOrgRef/ProjectRef/AccountRef` asserting the load-bearing invariant — ULID ref = **0 HTTP calls**, name/handle = **exactly 1** — plus case-insensitive and empty-account cases, via an httptest server with a request counter.

# The twist — the 2 stale findings inverted

After rebasing, `origin/main`'s `.golangci.yaml` now allowlists `checkpoint.CommittedStore`/`TemporaryStore` for `ireturn`. So the three `//nolint:ireturn` directives (which branch commit `182b9702c6` had _restored_) are now **redundant**, and CI's `nolintlint` **fails** on them as "directive unused." I verified this directly: `golangci-lint` without `--fix` reports 3 errors with them present, 0 with them removed. So the correct post-rebase state is the **opposite** of what those findings said — directives removed. They're now removed in the working tree (you'll see `open.go` and `manual_commit.go` in the diff).

# Trail state

All 5 findings closed: 3 resolved (with notes), 2 dismissed (notes corrected to explain the inversion). 0 open.

Diff: `resolveref.go` (+33/-17 incl. tests file), `resolveref_test.go` (+237), `open.go`/`manual_commit.go` (directive removals). Want me to commit?

## Summary

- **Commit `789678d091`** pushed to `feat/control-plane-friendly-names` (force-with-lease, since the rebase rewrote the 4 commits).
- **0 open findings**: 3 resolved (case-insensitivity, empty-AccountId guard, resolver tests) each annotated with the SHA; 2 dismissed (the `ireturn` ones, with corrected notes explaining the rebase inverted them).
- CI-style lint clean (`golangci-lint` without `--fix`) and touched-package tests pass.

One non-blocking note: the **server-side** half of the case normalization (`lower(name)` uniqueness) lives in the entire.io repo, not this one — only the CLI side shipped here.