checkpoint ISAC registries and system monitoring

docs/DEPLOYMENT.md

@@ -288,6 +288,14 @@ Transparent icon uploads skip remove.bg. Opaque sources use its preview output,
 then pass through local trimming, white normalization, WebP conversion, and
 storage.
 
+The application stores a remove.bg capacity snapshot and refreshes it from the
+internal scheduler. `REMOVE_BG_CREDIT_CHECK_HOURS` controls the account lookup
+interval and defaults to six hours. Low-capacity alerts require both remaining
+pools to cross their thresholds: `REMOVE_BG_LOW_CREDIT_THRESHOLD` defaults to
+five paid credits, and `REMOVE_BG_LOW_FREE_CALL_THRESHOLD` defaults to ten free
+calls. Alerts are mandatory ISAC notifications for active Administrators and
+are deduplicated for each warning or critical episode.
+
 ```sh
 npm run images:export
 ```

docs/DESIGN_SYSTEM.md

@@ -414,6 +414,12 @@ squeezed beside long module headings on mobile.
 - The administrative system is named ISAC. Separate navigation into explicit
   operational domains such as User Operations and Data Management; visibility
   must reflect server-provided capabilities.
+- In the ISAC rail, operational-domain headers are compact disclosure bars, not
+  module destinations. Give them a stronger surface, bold uppercase text, a
+  count, and a short leading status rail that turns orange while expanded.
+  Module destinations sit on the darker recessed surface below, use sentence
+  case and an additional left inset, and reserve the full orange rail for the
+  current module. Preserve this hierarchy when the rail becomes a mobile grid.
 - ISAC module navigation uses complete, game-facing names such as `Weapons`,
   `Talents`, and `OS Protocols`. Do not expose internal abbreviations such as
   `WPN`, `TLNT`, or `OSPR`. Canonical game icons may supplement visible labels
@@ -445,7 +451,13 @@ squeezed beside long module headings on mobile.
   Each provides context-appropriate filters and namespaced pagination controls
   so changing one history page does not reset the others.
 - Each module starts with `module-toolbar`, followed by `module-kpis`.
-- Editors use `dashboard-editor` and appear before the affected table.
+- Editors use `dashboard-editor`. New-record editors appear before the affected
+  table. Editing an existing record expands the same editor directly beneath
+  its selected row, which gains an orange selection rail and an explicit
+  expanded relationship for assistive technology. Inline editors stay aligned
+  to the visible registry viewport when the table scrolls horizontally. A
+  short clipped reveal confirms the expansion; reduced-motion preferences
+  remove that animation.
 - Optional record descriptions use a full-width narrative field beneath the
   identity controls. Preserve the same full-width placement in Oversight
   before/after previews so reviewers can compare meaning without reading raw
@@ -488,7 +500,11 @@ squeezed beside long module headings on mobile.
   restrained ten-second interval. Metrics must not expose environment values,
   credentials, full filesystem paths, or other deployment secrets. The
   `metrics.view` permission is independent of mutation access and is included
-  in the read-only Auditor role.
+  in the read-only Auditor role. External-service capacity reuses the same
+  metric panel: show distinct provider pools, the last authoritative check,
+  configured alert thresholds, and explicit `OK`, `WARNING`, `CRITICAL`, or
+  unavailable text. Green, orange, and red reinforce these states but never
+  replace their labels.
 - Account deletion uses a collapsed danger zone, explicit identity confirmation,
   and plain-language retention guidance. Soft-deleted accounts retain authored
   content under a deleted-agent identity while releasing credentials, usernames,
@@ -613,10 +629,13 @@ back to its weapon rather than opening the shared-talent editor.
 
 Large relationship sets use the searchable assignment control instead of
 checkbox walls. It keeps assigned records visible as removable chips, filters
-available records by name, renders at most thirty results at once, and exposes
-counts for both assignments and matches. Mutually exclusive pools pass their
-assigned IDs to one another as exclusions so invalid combinations cannot be
-selected. Keyboard focus, pressed state, empty results, and overflow remain
+available records by identity, renders at most thirty results at once, and
+exposes counts for both assignments and matches. When records can share a name,
+show the identity-defining qualifier below it in both selected chips and search
+results. Attribute assignments use `UNIT · %`, `UNIT · s`, or `UNIT · FLAT`;
+search and accessible names include that unit. Mutually exclusive pools pass
+their assigned IDs to one another as exclusions so invalid combinations cannot
+be selected. Keyboard focus, pressed state, empty results, and overflow remain
 explicit.
 Where a relationship has a global slot invariant, filter each assignment
 control at the data boundary instead of presenting cross-slot choices. Weapon
@@ -749,9 +768,9 @@ never silently describe only the visible page. On narrow screens, retain
 previous, next, current page, and page-size controls before optional page
 numbers.
 
-When only one page exists, omit page navigation and row-count presets; retain
-only the useful result range and any registry search. Do not render disabled
-pagination controls to preserve the rail's shape.
+The row-count presets remain available even when the current result fits on one
+page. Omit only the page navigation when there is no second page. Do not render
+disabled pagination controls merely to preserve the rail's shape.
 
 Registries with a meaningful name, title, or agent-identity column place the
 shared server-side search inside this pagination rail. Results update after a
@@ -770,6 +789,29 @@ and navigation controls. At mobile widths all groups stack, the input retains a
 usable width, and search, clear, previous, and next remain explicit keyboard
 and touch targets.
 
+### Sortable registry columns
+
+Every meaningful data column in an ISAC table uses the shared sortable-column
+header. The first activation sorts a new column in its most useful default
+direction; later activations reverse the direction. Place a neutral
+bidirectional indicator immediately before each inactive column label and an
+orange directional indicator immediately before the active column label.
+Action columns do not sort.
+
+Sorting applies on the server before pagination. Store the selected column and
+direction in the URL, preserve active search, filters, and row-count settings,
+and return to page one when the sort changes. Server loaders must map public
+sort keys to fixed, allowlisted SQL expressions or in-memory comparators. Never
+interpolate a query-string value into SQL. Composite columns use a documented,
+stable primary value and deterministic tie-breaker. Pending contribution rows
+remain ahead of published records unless the registry explicitly defines a
+different moderation order.
+
+Sortable headers must expose column-header semantics and `aria-sort`, remain
+keyboard operable, and show visible hover, focus, active, and selected states.
+At narrow widths, retain the table's existing horizontal overflow behavior so
+labels and sort state do not collapse into ambiguous controls.
+
 ### Registry metric filters
 
 The KPI row above an ISAC registry is an operational filter surface, not passive
@@ -962,11 +1004,12 @@ responsive editor layouts.
 Large many-to-many selections use the shared searchable assignment control,
 including weapon talent pools, gear talent compatibility, and compatible brand
 sets. The control keeps assigned records visible as removable chips, filters
-available records by name, limits the rendered result set, and submits canonical
-hidden inputs. Configure its subject labels and empty-state copy for the entity
-being assigned rather than embedding talent-specific language in the shared
-component. Pending contributor records retain their orange treatment and named
-proposer in both search results and dependency workflows.
+available records by their displayed identity, limits the rendered result set,
+and submits canonical hidden inputs. Configure its subject labels, qualifiers,
+and empty-state copy for the entity being assigned rather than embedding
+talent-specific language in the shared component. Pending contributor records
+retain their orange treatment and named proposer in both search results and
+dependency workflows.
 
 Audit History may use a five-column KPI filter rail when all durable operational
 domains need first-class visibility. It retains the standard compact KPI height

docs/architecture.md

@@ -182,6 +182,15 @@ and historical analysis should eventually use a dedicated external telemetry
 system. This surface deliberately omits secrets, environment-variable values,
 and full database paths.
 
+The same surface reports remove.bg paid credits and free API calls as separate
+capacity pools. The scheduler reconciles the account balance no more often than
+the configured interval, while successful image processing applies the
+provider's `X-Credits-Charged` value to the persisted estimate. Warning and
+critical transitions create one alert episode with a unique delivery for each
+active Administrator. A later critical transition may alert again; repeated
+scheduler runs within the same episode do not. Provider errors preserve the
+last known balance and never expose the API key or raw response body.
+
 # Weapon-owned exotic talents
 
 Standard weapon talent pools remain globally reusable and classified by Talent