retail-control-roomlisted

# retail-control-room The per-table scorecard answers "where is THIS table"; the control room answers "where is the WHOLE portfolio, and which table do I touch next". It is a read-only JOIN over evidence that already exists per table -- the portfolio-level sibling of `readiness-scorecard.md`. It introduces no new validator and no new gate (roadmap rule 8; Principle VIII); it aggregates and presents, then STOPS. ## Scope boundary (read first) - **Aggregates, never re-derives.** The only evidence shown is evidence already committed: `seshat check` WARNs, `retail validate` ERRORs (V-RC2/V-RC15/V-RC16), and the per-table `data-issues.md` / `blocking-reasons.md` / `readiness-status.yaml` rows. It runs NO new check. - **Read-only.** It never edits a per-table artifact, never clears a blocker, never writes a `pass`, never runs SQL, never opens a DB connection. Clearing a blocker stays a per-table action by its named owner (Principle V). - **No fake confidence.** Every line carries a MEASURED NUMBER as evidence (a row count, an orphan count, a penny delta, an open-blocker count, a finding-id) -- never an adjective, never a fabricated health score (roadmap rule #9). A numeric score is OPTIONAL and DEFERRED; the control room MUST NOT emit one. - **Every cell traces to a committed source.** A number with no traceable source path (and row/line where applicable) is a defect. - **Generic.** No worked-example specifics (billing codes, segments, PII column names, per-t