[Proxicon]

Guided NetRatel setup required reverse orchestration resources even when the operator only wanted monitoring incidents. This companion prerelease adds an explicitly negotiated incident-only profile: RatelDesk receives incidents while the reverse credential can only verify/control the connection, with no agent, catalog or task access.

The three-step setup uses friendly organization/customer choices, managed installation readiness with deployment locks and revision checks, and automatic continuation through normal browser sign-in. Connected now requires authenticated peer and Flow readiness checks. Existing v1 grant meanings, canonical vectors, credential protection, rotation, resume and revocation remain intact.

• Compatible pair: NetRatel 0.1.1-beta.3 / RatelDesk 0.1.1-beta.17 (RatelDesk-0.1.1-beta.17). Upgrade RatelDesk first, then NetRatel, before creating an incident-only connection; existing links remain usable during mixed-version rollout.
• Adds matched capability/schema/fixture documents and PostgreSQL/SQLite managed-settings migrations; preserves the installed instance and signing issuer/key identity.
• Validation: 99 focused backend/contract/readiness checks passed in 12s; four protected sign-in continuation checks passed in 502ms; final test-project build passed in 2m14.95s. Changed-source Slopwatch: zero findings across 40 non-generated files; the final four-file correction scan also reported zero findings.
• Rendered light/dark desktop/narrow setup and deployment-lock review completed against actual Razor components. Seven rendered cases, including authenticated connected state and deployment locks, completed with zero page errors or horizontal overflow. The bounded source/API exercise verified activation, ready connector adoption and inert tests; delivery returned HTTP 500 without a committed incident/receipt and the subsequent fixture check hit the genuine expired presence lease. Controlled data/link cleanup completed. Real committed delivery, identical retry and reverse initiation remain explicit acceptance checks.
• Hosted checks and release publication are separate states. No tag, release artifact or image has been published by this work.

Tracks #136; companion implementation: BostonTechnologies/netratel#171. Related existing integration work: #119, #121, #124, #128.

Companion PR: BostonTechnologies/netratel#172. Final source head: 5816346d071ca61a03aafe5e478f6c82a340e909. Required hosted validation: provider acceptance passed 220/220, zero failures/skips (7m03.725s tests / 9m44s job); its completeness gate and static/layout/disclosure/Compose checks passed. Full .NET passed 2,091 tests, zero failures, with six unchanged baseline fixture skips (legacy RevisitCodex / JWT-fixture TODOs). Tests took 16m36.830s, .NET job 19m08s, whole workflow 19m10s. Seven deep acceptance jobs remain explicitly opt-in. No assertions or skip attributes were weakened for this change.

Focused corrections passed 64 cases: four SQLite/PostgreSQL pinned-authority/continuation regressions (68.494s), and 60 browser-route/consent/API inventory cases (61.075s). A reproduced retired task-checkbox callback could expand later manual consent; it now preserves the current exact consent. Fixture corrections retain production authority checks and all original assertions.