@bicon/mcp-composer 0.6.0 → 0.8.0

package/README.md

@@ -24,7 +24,7 @@ via API keys is a separate, security-reviewed phase.
 | Name | What it does |
 |---|---|
 | resource `initiative://schema` / tool `get_initiative_schema` | The field catalog: required fields, enum values, the four dimensions with their named sub-dimensions (EN/DE labels + help text, plus the wording the app uses in digital / innovation portfolios), the exact shape of every optional section, the EU-AI-Act vocabularies, and the handoff steps. **Read this first.** |
-| `assemble_initiative` | Compact spec (metadata + named sub-ratings 0–100 + confidence per dimension + optional sections, optionally the organisation's `context`) → fully-formed initiative validated against the API contract (`CreateInitiativeBody` from `@workspace/api-zod`). Mints the initiative id and every nested row id (decision-log entries, status reports, milestones, incidents — a client never invents ids), **derives** the four dimension scores (the app's own scoring function), accepts dates as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd, returns `{ok, initiative, derivedScores, warnings, errors, contextId}`. Pass `id` (an existing initiative's) only to **update** that initiative. |
+| `assemble_initiative` | Compact spec (metadata + named sub-ratings 0–100 + confidence per dimension + optional sections, optionally the organisation's `context`) → fully-formed initiative validated against the API contract (`CreateInitiativeBody` from `@workspace/api-zod`). Mints the initiative id and every nested row id (decision-log entries, status reports, milestones, risks, follow-ups, incidents — a client never invents ids; an id given to a milestone or risk is a label a follow-up's `milestoneId` / `riskId` can point at, and the link follows the minted id), **derives** the four dimension scores (the app's own scoring function), accepts dates as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd, returns `{ok, initiative, derivedScores, warnings, errors, contextId}`. Pass `id` (an existing initiative's) only to **update** that initiative. |
 | `export_initiative_file` | Takes the **same compact spec**, assembles it and wraps the result in the app's single-initiative JSON envelope; returns `{ok, filename, json, importInstructions, derivedScores, warnings}`. There is one pipeline — a hand-edited initiative object is not an input, so client-supplied scores or unknown keys can never bypass assembly. |
 | `read_portfolio_context` | Takes the organisation's **portfolio-context file** (see below) and returns the interview plan for that organisation — its own labels, help texts and rating notes per sub-dimension, which sub-dimensions are switched off, its business units, categories, tags, skills (id + name), non-archived initiatives (id + name) and the capability map's capabilities (id, name, domain, importance, current → target maturity; context version 2), currency, discount rate, whether the EU-AI-Act module is on — plus a short **contextId** that stands in for the file in the two other tools. |
 | `composer_version` | Returns `{composerVersion, capabilities}`. Every *successful* tool result also carries `composerVersion`. |
@@ -93,10 +93,14 @@ vocabularies (`aiActVocabularies` in the descriptor; the app drops unknown
 obligation keys and never shows unknown artifact keys), the score derivation —
 is checked in the assembler, which reports **all** problems of a call at once
 with the allowed values in the message (id shapes included). Row ids of
-decision-log entries, status reports, milestones and incidents are minted by the
-Composer — a client-supplied UUID is kept, anything else replaced — because
-the app keys those rows per initiative and a re-used id from another
-initiative is exactly what collided on import once.
+decision-log entries, status reports, milestones, risks, follow-ups and
+incidents are minted by the Composer — a client-supplied UUID is kept, anything
+else replaced — because the app keys those rows per initiative and a re-used id
+from another initiative is exactly what collided on import once. A follow-up
+links a milestone or risk by the id the spec gave that row (any label, `"m1"`),
+and the link is rewritten to the minted id; a label that names no row, or two
+rows, is an error, since the app would clear such a link on save without a
+word.
 
 Errors the SDK raises before a handler runs (`Input validation error: …`) carry
 no `composerVersion` — that is normal. A *successful* result without it means an

package/dist/index.mjs

@@ -12,7 +12,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 
 // src/version.ts
-var COMPOSER_VERSION = true ? "0.6.0" : readPackageVersion();
+var COMPOSER_VERSION = true ? "0.8.0" : readPackageVersion();
 
 // ../../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
@@ -4170,7 +4170,7 @@ var ListOrganizationMembersResponseItem = objectType({
   "email": stringType(),
   "displayName": stringType().nullable(),
   "role": enumType(["admin", "member", "viewer"]),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
 });
 var ListOrganizationMembersResponse = arrayType(ListOrganizationMembersResponseItem);
 var SyncOrganizationMembersResponse = objectType({
@@ -4180,18 +4180,23 @@ var SyncOrganizationMembersResponse = objectType({
 var GetMyOrganizationAccessResponse = objectType({
   "userId": stringType().describe(`The caller's own local user id (matches AuthorRef.userId on initiatives), so the client can tell its own changes apart from a teammate's \u2014 e.g. to suppress the "updated by X" collaboration banner when an edit echoing back is the caller's own save.`),
   "role": enumType(["admin", "member", "viewer"]),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks."),
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups."),
   "initiativeLimit": numberType().describe("The most initiatives this organisation may hold, archived ones included. Creating one more answers 507 with code initiative_limit_reached, so the client blocks New, Duplicate and Import up front.")
 });
+var ListOrganizationDirectoryResponseItem = objectType({
+  "userId": stringType().uuid(),
+  "name": stringType()
+});
+var ListOrganizationDirectoryResponse = arrayType(ListOrganizationDirectoryResponseItem);
 var UpdateOrganizationMemberPermissionsParams = objectType({
   "userId": coerce.string().uuid()
 });
 var UpdateOrganizationMemberPermissionsBody = objectType({
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
 });
 var UpdateOrganizationMemberPermissionsResponse = objectType({
   "userId": stringType().uuid(),
-  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks.")
+  "permissions": arrayType(stringType()).describe("App-managed permission overrides on top of the fixed role (free-form strings, not a closed enum). Known keys: manage_skills, manage_ai_act, manage_metadata, manage_stage_gate, manage_economics, manage_decision_log, manage_dependencies, manage_required_skills, manage_scoring, manage_status_report, manage_prioritisation, manage_capabilities, manage_capability_impact, manage_milestones, manage_risks, manage_follow_ups.")
 });
 var ListPermissionProfilesResponseItem = objectType({
   "id": stringType().uuid(),
@@ -4298,6 +4303,12 @@ var listSnapshotsResponseInitiativesItemRisksItemReviewDateRegExp = new RegExp("
 var listSnapshotsResponseInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listSnapshotsResponseInitiativesItemRisksItemNoteMax = 1e4;
 var listSnapshotsResponseInitiativesItemRisksMax = 50;
+var listSnapshotsResponseInitiativesItemFollowUpsItemTitleMax = 300;
+var listSnapshotsResponseInitiativesItemFollowUpsItemAssigneeNameMax = 300;
+var listSnapshotsResponseInitiativesItemFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listSnapshotsResponseInitiativesItemFollowUpsItemNoteMax = 1e4;
+var listSnapshotsResponseInitiativesItemFollowUpsMax = 50;
 var listSnapshotsResponseInitiativesItemDependsOnMax = 1e3;
 var listSnapshotsResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var listSnapshotsResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -4523,6 +4534,17 @@ var ListSnapshotsResponseItem = objectType({
       "occurredDate": stringType().regex(listSnapshotsResponseInitiativesItemRisksItemOccurredDateRegExp).optional(),
       "note": stringType().max(listSnapshotsResponseInitiativesItemRisksItemNoteMax).optional()
     }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemRisksMax).optional(),
+    "followUps": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(listSnapshotsResponseInitiativesItemFollowUpsItemTitleMax),
+      "assigneeUserId": stringType().uuid().optional(),
+      "assigneeName": stringType().max(listSnapshotsResponseInitiativesItemFollowUpsItemAssigneeNameMax).optional(),
+      "dueDate": stringType().regex(listSnapshotsResponseInitiativesItemFollowUpsItemDueDateRegExp),
+      "doneDate": stringType().regex(listSnapshotsResponseInitiativesItemFollowUpsItemDoneDateRegExp).optional(),
+      "milestoneId": stringType().optional(),
+      "riskId": stringType().optional(),
+      "note": stringType().max(listSnapshotsResponseInitiativesItemFollowUpsItemNoteMax).optional()
+    }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listSnapshotsResponseInitiativesItemFollowUpsMax).optional(),
     "dependsOn": arrayType(stringType()).max(listSnapshotsResponseInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -4678,6 +4700,12 @@ var createSnapshotBodyInitiativesItemRisksItemReviewDateRegExp = new RegExp("^\\
 var createSnapshotBodyInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createSnapshotBodyInitiativesItemRisksItemNoteMax = 1e4;
 var createSnapshotBodyInitiativesItemRisksMax = 50;
+var createSnapshotBodyInitiativesItemFollowUpsItemTitleMax = 300;
+var createSnapshotBodyInitiativesItemFollowUpsItemAssigneeNameMax = 300;
+var createSnapshotBodyInitiativesItemFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createSnapshotBodyInitiativesItemFollowUpsItemNoteMax = 1e4;
+var createSnapshotBodyInitiativesItemFollowUpsMax = 50;
 var createSnapshotBodyInitiativesItemDependsOnMax = 1e3;
 var createSnapshotBodyInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var createSnapshotBodyInitiativesItemRequiredSkillsMax = 1e3;
@@ -4903,6 +4931,17 @@ var CreateSnapshotBody = objectType({
       "occurredDate": stringType().regex(createSnapshotBodyInitiativesItemRisksItemOccurredDateRegExp).optional(),
       "note": stringType().max(createSnapshotBodyInitiativesItemRisksItemNoteMax).optional()
     }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemRisksMax).optional(),
+    "followUps": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(createSnapshotBodyInitiativesItemFollowUpsItemTitleMax),
+      "assigneeUserId": stringType().uuid().optional(),
+      "assigneeName": stringType().max(createSnapshotBodyInitiativesItemFollowUpsItemAssigneeNameMax).optional(),
+      "dueDate": stringType().regex(createSnapshotBodyInitiativesItemFollowUpsItemDueDateRegExp),
+      "doneDate": stringType().regex(createSnapshotBodyInitiativesItemFollowUpsItemDoneDateRegExp).optional(),
+      "milestoneId": stringType().optional(),
+      "riskId": stringType().optional(),
+      "note": stringType().max(createSnapshotBodyInitiativesItemFollowUpsItemNoteMax).optional()
+    }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createSnapshotBodyInitiativesItemFollowUpsMax).optional(),
     "dependsOn": arrayType(stringType()).max(createSnapshotBodyInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -5064,6 +5103,12 @@ var renameSnapshotResponseInitiativesItemRisksItemReviewDateRegExp = new RegExp(
 var renameSnapshotResponseInitiativesItemRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var renameSnapshotResponseInitiativesItemRisksItemNoteMax = 1e4;
 var renameSnapshotResponseInitiativesItemRisksMax = 50;
+var renameSnapshotResponseInitiativesItemFollowUpsItemTitleMax = 300;
+var renameSnapshotResponseInitiativesItemFollowUpsItemAssigneeNameMax = 300;
+var renameSnapshotResponseInitiativesItemFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var renameSnapshotResponseInitiativesItemFollowUpsItemNoteMax = 1e4;
+var renameSnapshotResponseInitiativesItemFollowUpsMax = 50;
 var renameSnapshotResponseInitiativesItemDependsOnMax = 1e3;
 var renameSnapshotResponseInitiativesItemRequiredSkillsItemRunFteMin = 0;
 var renameSnapshotResponseInitiativesItemRequiredSkillsMax = 1e3;
@@ -5289,6 +5334,17 @@ var RenameSnapshotResponse = objectType({
       "occurredDate": stringType().regex(renameSnapshotResponseInitiativesItemRisksItemOccurredDateRegExp).optional(),
       "note": stringType().max(renameSnapshotResponseInitiativesItemRisksItemNoteMax).optional()
     }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemRisksMax).optional(),
+    "followUps": arrayType(objectType({
+      "id": stringType(),
+      "title": stringType().min(1).max(renameSnapshotResponseInitiativesItemFollowUpsItemTitleMax),
+      "assigneeUserId": stringType().uuid().optional(),
+      "assigneeName": stringType().max(renameSnapshotResponseInitiativesItemFollowUpsItemAssigneeNameMax).optional(),
+      "dueDate": stringType().regex(renameSnapshotResponseInitiativesItemFollowUpsItemDueDateRegExp),
+      "doneDate": stringType().regex(renameSnapshotResponseInitiativesItemFollowUpsItemDoneDateRegExp).optional(),
+      "milestoneId": stringType().optional(),
+      "riskId": stringType().optional(),
+      "note": stringType().max(renameSnapshotResponseInitiativesItemFollowUpsItemNoteMax).optional()
+    }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(renameSnapshotResponseInitiativesItemFollowUpsMax).optional(),
     "dependsOn": arrayType(stringType()).max(renameSnapshotResponseInitiativesItemDependsOnMax),
     "requiredSkills": arrayType(objectType({
       "skillId": stringType(),
@@ -5445,6 +5501,12 @@ var listInitiativesResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2
 var listInitiativesResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var listInitiativesResponseRisksItemNoteMax = 1e4;
 var listInitiativesResponseRisksMax = 50;
+var listInitiativesResponseFollowUpsItemTitleMax = 300;
+var listInitiativesResponseFollowUpsItemAssigneeNameMax = 300;
+var listInitiativesResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var listInitiativesResponseFollowUpsItemNoteMax = 1e4;
+var listInitiativesResponseFollowUpsMax = 50;
 var listInitiativesResponseDependsOnMax = 1e3;
 var listInitiativesResponseRequiredSkillsItemRunFteMin = 0;
 var listInitiativesResponseRequiredSkillsMax = 1e3;
@@ -5664,6 +5726,17 @@ var ListInitiativesResponseItem = objectType({
     "occurredDate": stringType().regex(listInitiativesResponseRisksItemOccurredDateRegExp).optional(),
     "note": stringType().max(listInitiativesResponseRisksItemNoteMax).optional()
   }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(listInitiativesResponseRisksMax).optional(),
+  "followUps": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(listInitiativesResponseFollowUpsItemTitleMax),
+    "assigneeUserId": stringType().uuid().optional(),
+    "assigneeName": stringType().max(listInitiativesResponseFollowUpsItemAssigneeNameMax).optional(),
+    "dueDate": stringType().regex(listInitiativesResponseFollowUpsItemDueDateRegExp),
+    "doneDate": stringType().regex(listInitiativesResponseFollowUpsItemDoneDateRegExp).optional(),
+    "milestoneId": stringType().optional(),
+    "riskId": stringType().optional(),
+    "note": stringType().max(listInitiativesResponseFollowUpsItemNoteMax).optional()
+  }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(listInitiativesResponseFollowUpsMax).optional(),
   "dependsOn": arrayType(stringType()).max(listInitiativesResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -5816,6 +5889,12 @@ var createInitiativeBodyOneRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2
 var createInitiativeBodyOneRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var createInitiativeBodyOneRisksItemNoteMax = 1e4;
 var createInitiativeBodyOneRisksMax = 50;
+var createInitiativeBodyOneFollowUpsItemTitleMax = 300;
+var createInitiativeBodyOneFollowUpsItemAssigneeNameMax = 300;
+var createInitiativeBodyOneFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var createInitiativeBodyOneFollowUpsItemNoteMax = 1e4;
+var createInitiativeBodyOneFollowUpsMax = 50;
 var createInitiativeBodyOneDependsOnMax = 1e3;
 var createInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var createInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -6035,6 +6114,17 @@ var CreateInitiativeBody = objectType({
     "occurredDate": stringType().regex(createInitiativeBodyOneRisksItemOccurredDateRegExp).optional(),
     "note": stringType().max(createInitiativeBodyOneRisksItemNoteMax).optional()
   }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(createInitiativeBodyOneRisksMax).optional(),
+  "followUps": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(createInitiativeBodyOneFollowUpsItemTitleMax),
+    "assigneeUserId": stringType().uuid().optional(),
+    "assigneeName": stringType().max(createInitiativeBodyOneFollowUpsItemAssigneeNameMax).optional(),
+    "dueDate": stringType().regex(createInitiativeBodyOneFollowUpsItemDueDateRegExp),
+    "doneDate": stringType().regex(createInitiativeBodyOneFollowUpsItemDoneDateRegExp).optional(),
+    "milestoneId": stringType().optional(),
+    "riskId": stringType().optional(),
+    "note": stringType().max(createInitiativeBodyOneFollowUpsItemNoteMax).optional()
+  }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(createInitiativeBodyOneFollowUpsMax).optional(),
   "dependsOn": arrayType(stringType()).max(createInitiativeBodyOneDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -6197,6 +6287,12 @@ var getInitiativeResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2}-
 var getInitiativeResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var getInitiativeResponseRisksItemNoteMax = 1e4;
 var getInitiativeResponseRisksMax = 50;
+var getInitiativeResponseFollowUpsItemTitleMax = 300;
+var getInitiativeResponseFollowUpsItemAssigneeNameMax = 300;
+var getInitiativeResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var getInitiativeResponseFollowUpsItemNoteMax = 1e4;
+var getInitiativeResponseFollowUpsMax = 50;
 var getInitiativeResponseDependsOnMax = 1e3;
 var getInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var getInitiativeResponseRequiredSkillsMax = 1e3;
@@ -6416,6 +6512,17 @@ var GetInitiativeResponse = objectType({
     "occurredDate": stringType().regex(getInitiativeResponseRisksItemOccurredDateRegExp).optional(),
     "note": stringType().max(getInitiativeResponseRisksItemNoteMax).optional()
   }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(getInitiativeResponseRisksMax).optional(),
+  "followUps": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(getInitiativeResponseFollowUpsItemTitleMax),
+    "assigneeUserId": stringType().uuid().optional(),
+    "assigneeName": stringType().max(getInitiativeResponseFollowUpsItemAssigneeNameMax).optional(),
+    "dueDate": stringType().regex(getInitiativeResponseFollowUpsItemDueDateRegExp),
+    "doneDate": stringType().regex(getInitiativeResponseFollowUpsItemDoneDateRegExp).optional(),
+    "milestoneId": stringType().optional(),
+    "riskId": stringType().optional(),
+    "note": stringType().max(getInitiativeResponseFollowUpsItemNoteMax).optional()
+  }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(getInitiativeResponseFollowUpsMax).optional(),
   "dependsOn": arrayType(stringType()).max(getInitiativeResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -6570,6 +6677,12 @@ var updateInitiativeBodyOneRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{2
 var updateInitiativeBodyOneRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeBodyOneRisksItemNoteMax = 1e4;
 var updateInitiativeBodyOneRisksMax = 50;
+var updateInitiativeBodyOneFollowUpsItemTitleMax = 300;
+var updateInitiativeBodyOneFollowUpsItemAssigneeNameMax = 300;
+var updateInitiativeBodyOneFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeBodyOneFollowUpsItemNoteMax = 1e4;
+var updateInitiativeBodyOneFollowUpsMax = 50;
 var updateInitiativeBodyOneDependsOnMax = 1e3;
 var updateInitiativeBodyOneRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeBodyOneRequiredSkillsMax = 1e3;
@@ -6789,6 +6902,17 @@ var UpdateInitiativeBody = objectType({
     "occurredDate": stringType().regex(updateInitiativeBodyOneRisksItemOccurredDateRegExp).optional(),
     "note": stringType().max(updateInitiativeBodyOneRisksItemNoteMax).optional()
   }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(updateInitiativeBodyOneRisksMax).optional(),
+  "followUps": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeBodyOneFollowUpsItemTitleMax),
+    "assigneeUserId": stringType().uuid().optional(),
+    "assigneeName": stringType().max(updateInitiativeBodyOneFollowUpsItemAssigneeNameMax).optional(),
+    "dueDate": stringType().regex(updateInitiativeBodyOneFollowUpsItemDueDateRegExp),
+    "doneDate": stringType().regex(updateInitiativeBodyOneFollowUpsItemDoneDateRegExp).optional(),
+    "milestoneId": stringType().optional(),
+    "riskId": stringType().optional(),
+    "note": stringType().max(updateInitiativeBodyOneFollowUpsItemNoteMax).optional()
+  }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeBodyOneFollowUpsMax).optional(),
   "dependsOn": arrayType(stringType()).max(updateInitiativeBodyOneDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -6948,6 +7072,12 @@ var updateInitiativeResponseRisksItemReviewDateRegExp = new RegExp("^\\d{4}-\\d{
 var updateInitiativeResponseRisksItemOccurredDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
 var updateInitiativeResponseRisksItemNoteMax = 1e4;
 var updateInitiativeResponseRisksMax = 50;
+var updateInitiativeResponseFollowUpsItemTitleMax = 300;
+var updateInitiativeResponseFollowUpsItemAssigneeNameMax = 300;
+var updateInitiativeResponseFollowUpsItemDueDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseFollowUpsItemDoneDateRegExp = new RegExp("^\\d{4}-\\d{2}-\\d{2}$");
+var updateInitiativeResponseFollowUpsItemNoteMax = 1e4;
+var updateInitiativeResponseFollowUpsMax = 50;
 var updateInitiativeResponseDependsOnMax = 1e3;
 var updateInitiativeResponseRequiredSkillsItemRunFteMin = 0;
 var updateInitiativeResponseRequiredSkillsMax = 1e3;
@@ -7167,6 +7297,17 @@ var UpdateInitiativeResponse = objectType({
     "occurredDate": stringType().regex(updateInitiativeResponseRisksItemOccurredDateRegExp).optional(),
     "note": stringType().max(updateInitiativeResponseRisksItemNoteMax).optional()
   }).describe("A concrete project risk, or an issue when status is occurred (docs/risks-issues-follow-ups-concept-2026-10-19.md). Probability and impact are integers 1-5; the residual pair (after mitigation) is sent as a pair or not at all. Dates are yyyy-mm-dd.")).max(updateInitiativeResponseRisksMax).optional(),
+  "followUps": arrayType(objectType({
+    "id": stringType(),
+    "title": stringType().min(1).max(updateInitiativeResponseFollowUpsItemTitleMax),
+    "assigneeUserId": stringType().uuid().optional(),
+    "assigneeName": stringType().max(updateInitiativeResponseFollowUpsItemAssigneeNameMax).optional(),
+    "dueDate": stringType().regex(updateInitiativeResponseFollowUpsItemDueDateRegExp),
+    "doneDate": stringType().regex(updateInitiativeResponseFollowUpsItemDoneDateRegExp).optional(),
+    "milestoneId": stringType().optional(),
+    "riskId": stringType().optional(),
+    "note": stringType().max(updateInitiativeResponseFollowUpsItemNoteMax).optional()
+  }).describe("An agreed next step: who does what by when (docs/risks-issues-follow-ups-concept-2026-10-19.md). assigneeUserId is a member of the org (an id that is not is dropped on save, the name kept); milestoneId and riskId name the same initiative's milestones and risks (a link that does not is cleared on save). Dates are yyyy-mm-dd.")).max(updateInitiativeResponseFollowUpsMax).optional(),
   "dependsOn": arrayType(stringType()).max(updateInitiativeResponseDependsOnMax),
   "requiredSkills": arrayType(objectType({
     "skillId": stringType(),
@@ -7543,16 +7684,18 @@ var EN_DIGITAL = {
   "subHelp.dataAvailability": "Availability of the source systems, APIs and master data the solution depends on.",
   "subHelp.dataQuality": "Cleanliness, completeness and timeliness of the data flowing through the digital workflow.",
   "dim.feasibility.band1.meaning": "Data, solution or integration gaps make delivery uncertain.",
-  "dim.governance.band2.meaning": "Standard risk controls and monitoring required.",
-  "govBand.Low.desc": "0\u201320 \xB7 Low sensitivity \u2014 routine controls; no escalation required",
-  "govBand.Moderate.desc": "21\u201340 \xB7 Low sensitivity \u2014 routine controls suffice",
-  "govBand.Elevated.desc": "41\u201360 \xB7 Supervised operation \u2014 standard risk controls and monitoring required",
-  "govBand.High.desc": "61\u201380 \xB7 Restricted deployment \u2014 active board-level oversight, audit trail and access controls",
+  "dim.governance.band2.meaning": "Standard monitoring; periodic review of the system's operation.",
+  "dim.governance.band3.meaning": "Documented procedures, dual approvals and active monitoring required.",
+  "govBand.Low.desc": "0\u201320 \xB7 Minimal oversight \u2014 routine controls; no escalation required",
+  "govBand.Moderate.desc": "21\u201340 \xB7 Controlled operation \u2014 standard monitoring; periodic review",
+  "govBand.Elevated.desc": "41\u201360 \xB7 Supervised operation required \u2014 documented procedures, dual approvals, active monitoring",
+  "govBand.High.desc": "61\u201380 \xB7 Restricted rollout \u2014 active board-level oversight, audit trail and access controls",
   "govBand.Critical.desc": "81\u2013100 \xB7 High governance sensitivity \u2014 treat as material risk; ringfencing and continuous oversight",
   "govLabel.Controlled Automation": "Controlled Operation",
   "govLabel.Human-in-the-Loop Required": "Supervised Operation Required",
   "govLabel.Restricted Deployment": "Restricted Rollout",
   "memo.governance.intro": "{count} initiatives sit in the Restricted Rollout band or above (governance \u2265 61/100) and require active board-level monitoring.",
+  "settings.guardrails.maxHighGovernanceSharePct.hint": "At most this share of active initiatives may carry a governance score above 60 (Restricted Rollout or higher).",
   "subHelp.modelRobustness": "Stability of the solution under load, edge cases and unexpected inputs.",
   "subHelp.reproducibility": "Maturity of the underlying cloud / platform stack \u2014 proven and supported (managed services, mature regions, SLAs) vs experimental or self-hosted.",
   "subHelp.explainability": "How clearly the system's behaviour and outputs can be explained to operators and end-users.",
@@ -7579,7 +7722,7 @@ var EN_DIGITAL = {
   "settings.prio.longTermBets": "Multi-Year Programmes",
   "settings.prio.incremental": "Continuous Improvement",
   "settings.prio.operatingModel": "Operating Model Modernisation",
-  "settings.prio.subtitle": "Thresholds used by the Prioritisation page to assign each digital initiative to a strategic archetype. Rules are evaluated top-to-bottom and the first match wins. All values are scores out of 100 across the four dimensions: V = Value & Scale, F = Delivery Feasibility & Operability, C = Compliance & Operational Risk, S = Strategic Impact.",
+  "settings.prio.subtitle": "Thresholds used by the Prioritisation page to assign each digital initiative to a strategic archetype. Rules are listed in funding order, as on the Prioritisation page; each initiative is assigned by the first rule it matches, checked in the order of its precedence number. All values are scores out of 100 across the four dimensions: V = Value & Scale, F = Delivery Feasibility & Operability, C = Compliance & Operational Risk, S = Strategic Impact.",
   "inventory.col.scores": "Scores (V/F/C/S)",
   "concept.eyebrow": "Steering of AI, digital and transformation portfolios",
   "concept.title": "Turn fragmented digital projects into a managed portfolio.",
@@ -7642,10 +7785,10 @@ var EN_DIGITAL = {
   "method.s2.title": "2. Compliance & Operational Risk Classification",
   "method.s2.subtitle": "Compliance & operational-risk bands and what they imply for the control load.",
   "method.s2.intro": "Initiatives are classified into bands based on the Compliance & Operational Risk score:",
-  "method.s2.b2": "<strong>21\u201340 \xB7 Standard controls</strong>: standard monitoring; periodic review.",
-  "method.s2.b3": "<strong>41\u201360 \xB7 Enhanced operational controls</strong>: documented procedures, dual approvals, active monitoring.",
+  "method.s2.b2": "<strong>21\u201340 \xB7 Controlled operation</strong>: standard monitoring; periodic review.",
+  "method.s2.b3": "<strong>41\u201360 \xB7 Supervised operation required</strong>: documented procedures, dual approvals, active monitoring.",
   "method.s2.b4": "<strong>61\u201380 \xB7 Restricted rollout</strong>: active board-level oversight, audit trail and access controls.",
-  "method.s2.b5": "<strong>81\u2013100 \xB7 Board-level sponsorship required</strong>: treat as material risk; deploy only with explicit ringfencing.",
+  "method.s2.b5": "<strong>81\u2013100 \xB7 High governance sensitivity</strong>: treat as material risk; deploy only with explicit ringfencing.",
   "method.s4.subtitle": "How each initiative is positioned on the Business Impact \xD7 Delivery Feasibility plane.",
   "method.s4.intro": "The x-axis (<strong>Business Impact</strong>) is the equal-weighted average of Value & Scale and Strategic Impact: <code>BusinessImpact = (Value + Strategic) / 2</code>. The y-axis is Delivery Feasibility & Operability. Quadrants are split deterministically at 50 on both axes:",
   "method.s4.scale": "<strong>Roll out</strong> \u2014 Business Impact \u2265 50 and Delivery Feasibility \u2265 50. High impact, reliably deliverable \u2014 ready for enterprise roll-out.",
@@ -7655,7 +7798,7 @@ var EN_DIGITAL = {
   "method.s4.bubbles": "Bubble size additionally emphasises Strategic Impact on its own (so a strategic initiative reads as a larger bubble even when its value score is moderate); bubble colour reflects the compliance & operational-risk band.",
   "method.s5.governance": "<strong>High Compliance & Operational Risk</strong> (precedence 3) \u2014 compliance & operational-risk score \u2265 {g} (and the initiative was not already classified as Quick Wins or Strategic Core). Elevated regulatory, compliance or operational-risk exposure that must be addressed before scaling.",
   "memo.assumptions.signals": "No external regulatory, operational-risk or third-party assurance signals have been incorporated into these scores.",
-  "method.s6.p1": 'The <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman Index</a> is applied to four cuts of the portfolio: <strong>vendor strategy</strong>, <strong>solution type</strong>, <strong>digital category</strong>, and <strong>business unit</strong>.',
+  "method.s6.p1": 'The <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman Index</a> is applied to four cuts on the Concentration page: <strong>vendor strategy</strong>, <strong>digital category</strong>, <strong>business unit</strong> and <strong>compliance band</strong>. The board pack uses vendor, category, business unit and solution type, plus a weighted HHI.',
   "method.s6.p2": "A business-unit \xD7 digital-category cluster heatmap on the Concentration page surfaces specific over-exposed combinations beyond the aggregate.",
   "concept.problem.p1": "Many organisations are pursuing digital initiatives across a wide range of business processes. These initiatives often emerge from local experimentation within business units or technology teams rather than from a structured strategic process.",
   "concept.dim.value.body": "Economic leverage of the digital solution. Use cases addressing high-frequency, resource-intensive activities typically offer the greatest potential for economic impact; limited-scale or marginal-efficiency cases rarely justify the organisational effort required.",
@@ -7676,9 +7819,8 @@ var EN_DIGITAL = {
   "dim.valueScale.band1.meaning": "Confined to a single team or process with limited financial signal.",
   "dim.feasibility.band2.meaning": "Feasible but requires investment in data, integration or operability.",
   "dim.feasibility.band3.meaning": "Data, tooling and operability are in place to execute with confidence.",
-  "dim.governance.band2.label": "Supervised operation",
-  "dim.governance.band3.meaning": "Active board-level oversight, audit trail and access controls required for the digital system.",
-  "dim.strategic.band3.meaning": "Reshapes operating model, customer experience, or how data is used across the business.",
+  "dim.governance.band4.meaning": "Active board-level oversight, audit trail and access controls required for the digital system.",
+  "dim.strategic.band4.meaning": "Reshapes operating model, customer experience, or how data is used across the business.",
   "op.governance.detailLow": "Embedded delivery teams with part-time operational-risk coverage are typically sufficient at this load.",
   "boardPack.col.g": "C",
   // ── Concept & Methodology page theming ────────────────────────────────
@@ -7698,14 +7840,9 @@ var EN_DIGITAL = {
   "concept.features.f24.body": "Self-contained demo portfolios per mode (AI / Digital / Innovation) load with realistic initiatives and dependencies \u2014 so new users can explore every view immediately without entering data.",
   "concept.features.f29.body": "Run the console as a multi-tenant SaaS: each organisation is an isolated tenant with its own portfolio and data. Members sign in through managed authentication and get role-based access \u2014 admin, member or viewer \u2014 refined by granular per-section permissions an admin grants from Settings, enforced on both the server and the UI. Every governance-critical and Core Metadata change is captured in a per-field audit trail with the acting user and a timestamp, and each initiative shows who created and last edited it. Cloud sync keeps the shared portfolio consistent across the team, while local (no-account) mode still works for a single user. Privileged admin actions \u2014 access grants, role and permission changes, settings, profile and initiative changes \u2014 are additionally recorded in an organisation-level admin activity log in Settings.",
   "concept.features.f30.body": "A rules-based, severity-ranked list of the decisions the portfolio's own data calls for: stop/defer candidates, gate discipline, capacity and budget shortfalls, and concentration. Benefits-realisation rules flag production systems that under-deliver \u2014 or never measure \u2014 their promised value. Board-set guardrails add the red lines: admins define policy limits in Settings \u2014 a budget-concentration cap per business unit, a value floor for funded initiatives and a compliance-load ceiling \u2014 each showing a live pass/fail, and every breach lands here as a decide-now item.",
-  "method.rules.r1.formula": "Value \xD7 Delivery Feasibility \u2192 Portfolio shape",
-  "method.rules.r1.explanation": "Quadrant placement on the Value \xD7 Delivery-Feasibility map drives the go / scale / pilot / stop decision for each initiative.",
-  "method.rules.r2.formula": "Compliance Band \u2192 Veto criterion",
-  "method.rules.r2.explanation": "Any initiative above the restricted band (Compliance & Operational Risk \u2265 61) cannot scale until explicit board-level controls are in place; it is removed from the prioritised list regardless of value or feasibility.",
-  "method.rules.r4.explanation": "If any portfolio cut (vendor, solution type, digital category, or business unit) exceeds HHI 0.25 on the normalised 0\u20131 scale, the portfolio steward must actively consider redistribution before approving new initiatives in the dominant segment.",
   "method.s1.dimensions.feasibility": "<strong>Delivery Feasibility &amp; Operability</strong> \u2014 buildability, operability and transparency.",
   "method.s1.dimensions.governance": "<strong>Compliance &amp; Operational Risk</strong> \u2014 regulatory, compliance and operational-risk load (deep dive in \xA7 3).",
-  "method.s2.b1": "<strong>0\u201320 \xB7 Low sensitivity</strong>: routine controls suffice.",
+  "method.s2.b1": "<strong>0\u201320 \xB7 Minimal oversight</strong>: routine controls suffice.",
   "method.s5.intro": "Each initiative is evaluated against the rules below and assigned to the <em>first</em> category whose rule matches, in the precedence order <strong>1 \u2192 2 \u2192 3 \u2192 4 \u2192 5 \u2192 6 \u2192 7</strong>. The list below is shown in the same order the Prioritisation page renders the groups, which is not the same as precedence \u2014 the precedence number is given on each rule. Initiatives that satisfy none of rules 1\u20136 fall into the fallback group <em>Tactical / Uncategorised</em> (precedence 7).",
   "method.s5.quickWins": "<strong>Quick Wins</strong> (precedence 1) \u2014 value \u2265 {v}, feasibility \u2265 {f}, and compliance & operational risk \u2264 {g}. High return, low risk, ready to execute.",
   "method.s5.strategicCore": "<strong>Strategic Platform Initiatives</strong> (precedence 2) \u2014 value \u2265 {v}, feasibility \u2265 {f}, and strategic \u2265 {s}. Core platform bets that are both valuable and strategically central.",
@@ -7713,7 +7850,7 @@ var EN_DIGITAL = {
   "method.s5.longTerm": "<strong>Multi-Year Programmes</strong> (precedence 4) \u2014 value \u2265 {v}, feasibility &lt; {f}, and strategic \u2265 {s} (after High Compliance Risk has already claimed initiatives above its threshold). Strategically attractive but not yet feasible \u2014 keep on the horizon.",
   "method.s5.incremental": "<strong>Continuous Improvement</strong> (precedence 5) \u2014 value &lt; {v}, feasibility \u2265 {f}, and strategic &lt; {s}. Easy to ship but limited upside; useful as fillers.",
   "method.s5.uncategorised": "<strong>Tactical / Uncategorised</strong> (precedence 7) \u2014 fallback for initiatives that don't satisfy any of rules 1\u20136. Treat as tactical until scores sharpen.",
-  "method.s5.ranking": "<strong>Ranking inside the queue.</strong> Initiatives are first grouped by the category rules above (precedence 1 \u2192 7), then within each category ordered by <strong>Value</strong> score descending, then \u2014 if Value-at-Stake weighting is enabled in Settings and the row sits in Quick Wins / Strategic Platform Initiatives \u2014 Year-3 benefit descending. Final tie-break is <strong>Strategic Impact</strong> descending, then name A\u2192Z, so the result is deterministic and reproducible.",
+  "method.s5.ranking": "<strong>Ranking inside the queue.</strong> Initiatives are first grouped by category in the order listed above (the order the Prioritisation page shows them), then within each category ordered by <strong>Value</strong> score descending, then \u2014 if Value-at-Stake weighting is enabled in Settings and the row sits in Quick Wins / Strategic Platform Initiatives \u2014 Year-3 benefit descending. Final tie-break is <strong>Strategic Impact</strong> descending, then name A\u2192Z, so the result is deterministic and reproducible.",
   "method.s10.p7": "<strong>Quick Win definition.</strong> The Quick Wins category requires fast time-to-value. Therefore a Quick Win that depends on an active non-Quick-Win upstream (Strategic Platform Initiative, Operating Model Modernisation, High Compliance Risk etc.) is automatically demoted out of Quick Wins \u2014 the upstream's pre-work makes it no longer quick. The rule is transitive: if A depends on B, and B is itself demoted, A is also demoted in the next iteration.",
   "method.audit.scope.governance": "<strong>Status</strong> and the four <strong>evaluation dimension scores</strong> (Value, Delivery Feasibility, Compliance &amp; Operational Risk, Strategic Impact) with their confidence.",
   "method.audit.scope.metadata": "<strong>All Core Metadata fields</strong> \u2014 name, business unit, owner, description, timeline, budget, vendor strategy, solution type, digital category and tags.",
@@ -7760,16 +7897,18 @@ var DE_DIGITAL = {
   "subHelp.dataAvailability": "Verf\xFCgbarkeit der Quellsysteme, Schnittstellen und Stammdaten, von denen die L\xF6sung abh\xE4ngt.",
   "subHelp.dataQuality": "Sauberkeit, Vollst\xE4ndigkeit und Aktualit\xE4t der Daten im digitalen Workflow.",
   "dim.feasibility.band1.meaning": "L\xFCcken bei Daten, L\xF6sung oder Integration machen die Umsetzung unsicher.",
-  "dim.governance.band2.meaning": "Standard-Risikokontrollen und Monitoring erforderlich.",
-  "govBand.Low.desc": "0\u201320 \xB7 Geringe Sensitivit\xE4t \u2014 Routinekontrollen; keine Eskalation erforderlich",
-  "govBand.Moderate.desc": "21\u201340 \xB7 Geringe Sensitivit\xE4t \u2014 Routinekontrollen ausreichend",
-  "govBand.Elevated.desc": "41\u201360 \xB7 \xDCberwachter Betrieb \u2014 Standard-Risikokontrollen und Monitoring erforderlich",
-  "govBand.High.desc": "61\u201380 \xB7 Eingeschr\xE4nkter Einsatz \u2014 aktive Vorstandsaufsicht, Audit-Trail und Zugriffskontrollen",
+  "dim.governance.band2.meaning": "Standardmonitoring; regelm\xE4ssige \xDCberpr\xFCfung des Betriebs.",
+  "dim.governance.band3.meaning": "Dokumentierte Verfahren, Vier-Augen-Prinzip und aktives Monitoring erforderlich.",
+  "govBand.Low.desc": "0\u201320 \xB7 Minimale Aufsicht \u2014 Routinekontrollen; keine Eskalation erforderlich",
+  "govBand.Moderate.desc": "21\u201340 \xB7 Kontrollierter Betrieb \u2014 Standardmonitoring; regelm\xE4ssige \xDCberpr\xFCfung",
+  "govBand.Elevated.desc": "41\u201360 \xB7 Beaufsichtigter Betrieb erforderlich \u2014 dokumentierte Verfahren, Vier-Augen-Prinzip, aktives Monitoring",
+  "govBand.High.desc": "61\u201380 \xB7 Eingeschr\xE4nkter Rollout \u2014 aktive Vorstandsaufsicht, Audit-Trail und Zugriffskontrollen",
   "govBand.Critical.desc": "81\u2013100 \xB7 Hohe Governance-Sensitivit\xE4t \u2014 als wesentliches Risiko behandeln; Ringfencing und kontinuierliche Aufsicht",
   "govLabel.Controlled Automation": "Kontrollierter Betrieb",
   "govLabel.Human-in-the-Loop Required": "Beaufsichtigter Betrieb erforderlich",
   "govLabel.Restricted Deployment": "Eingeschr\xE4nkter Rollout",
   "memo.governance.intro": "{count} Initiativen liegen im Band \u201EEingeschr\xE4nkter Rollout\u201C oder dar\xFCber (Governance \u2265 61/100) und ben\xF6tigen aktive Vorstandsaufsicht.",
+  "settings.guardrails.maxHighGovernanceSharePct.hint": "H\xF6chstens dieser Anteil der aktiven Initiativen darf einen Governance-Score \xFCber 60 tragen (Eingeschr\xE4nkter Rollout oder h\xF6her).",
   "subHelp.modelRobustness": "Stabilit\xE4t der L\xF6sung unter Last, bei Edge-Cases und unerwarteten Eingaben.",
   "subHelp.reproducibility": "Reife des zugrundeliegenden Cloud-/Plattform-Stacks \u2014 bew\xE4hrt und supportet (Managed Services, etablierte Regionen, SLAs) vs. experimentell oder selbstgehostet.",
   "subHelp.explainability": "Wie klar Verhalten und Ergebnisse des Systems Betreibern und Endnutzern erkl\xE4rbar sind.",
@@ -7796,7 +7935,7 @@ var DE_DIGITAL = {
   "settings.prio.longTermBets": "Mehrjahresprogramme",
   "settings.prio.incremental": "Kontinuierliche Verbesserung",
   "settings.prio.operatingModel": "Betriebsmodell-Modernisierung",
-  "settings.prio.subtitle": "Schwellenwerte, mit denen die Priorisierungsseite jede digitale Initiative einem strategischen Archetyp zuordnet. Die Regeln werden von oben nach unten gepr\xFCft, die erste \xDCbereinstimmung gewinnt. Alle Werte sind Punkte von 0\u2013100 \xFCber die vier Dimensionen: W = Wert & Skalierung, M = Umsetzbarkeit & Betreibbarkeit, C = Compliance & Betriebsrisiko, S = Strategischer Impact.",
+  "settings.prio.subtitle": "Schwellenwerte, mit denen die Priorisierungsseite jede digitale Initiative einem strategischen Archetyp zuordnet. Die Regeln stehen in F\xF6rderreihenfolge wie auf der Priorisierungsseite; jede Initiative wird der ersten Regel zugeordnet, die sie erf\xFCllt, gepr\xFCft in der Reihenfolge der Pr\xE4zedenznummer. Alle Werte sind Punkte von 0\u2013100 \xFCber die vier Dimensionen: W = Wert & Skalierung, M = Umsetzbarkeit & Betreibbarkeit, C = Compliance & Betriebsrisiko, S = Strategischer Impact.",
   "inventory.col.scores": "Punkte (W/M/C/S)",
   "concept.eyebrow": "Steuerung von KI-, Digital- und Transformationsportfolios",
   "concept.title": "Fragmentierte Digitalprojekte in ein gesteuertes Portfolio verwandeln.",
@@ -7859,10 +7998,10 @@ var DE_DIGITAL = {
   "method.s2.title": "2. Compliance- & Betriebsrisiko-Klassifikation",
   "method.s2.subtitle": "Compliance- & Betriebsrisiko-B\xE4nder und was sie f\xFCr die Kontroll-Last bedeuten.",
   "method.s2.intro": "Initiativen werden auf Basis des Compliance- & Betriebsrisiko-Werts klassifiziert:",
-  "method.s2.b2": "<strong>21\u201340 \xB7 Standard-Kontrollen</strong>: Standardmonitoring; regelm\xE4ssige \xDCberpr\xFCfung.",
-  "method.s2.b3": "<strong>41\u201360 \xB7 Erweiterte Betriebskontrollen</strong>: dokumentierte Verfahren, Vier-Augen-Prinzip, aktives Monitoring.",
+  "method.s2.b2": "<strong>21\u201340 \xB7 Kontrollierter Betrieb</strong>: Standardmonitoring; regelm\xE4ssige \xDCberpr\xFCfung.",
+  "method.s2.b3": "<strong>41\u201360 \xB7 Beaufsichtigter Betrieb erforderlich</strong>: dokumentierte Verfahren, Vier-Augen-Prinzip, aktives Monitoring.",
   "method.s2.b4": "<strong>61\u201380 \xB7 Eingeschr\xE4nkter Rollout</strong>: aktive Vorstandsaufsicht, Audit-Trail und Zugriffskontrollen.",
-  "method.s2.b5": "<strong>81\u2013100 \xB7 Vorstandspatenschaft erforderlich</strong>: als wesentliches Risiko behandeln; nur mit Ringfencing einsetzen.",
+  "method.s2.b5": "<strong>81\u2013100 \xB7 Hohe Governance-Sensitivit\xE4t</strong>: als wesentliches Risiko behandeln; nur mit Ringfencing einsetzen.",
   "method.s4.subtitle": "Wie jede Initiative auf der Business-Impact-\xD7-Liefer-Machbarkeit-Ebene positioniert wird.",
   "method.s4.intro": "Die x-Achse (<strong>Business Impact</strong>) ist der gleichgewichtete Mittelwert aus Wert & Skalierung und strategischem Impact: <code>BusinessImpact = (Wert + Strategisch) / 2</code>. Die y-Achse ist Liefer-Machbarkeit & Betreibbarkeit. Die Quadranten werden deterministisch bei 50 auf beiden Achsen geteilt:",
   "method.s4.scale": "<strong>Ausrollen</strong> \u2014 Business Impact \u2265 50 und Liefer-Machbarkeit \u2265 50. Hoher Impact, verl\xE4sslich lieferbar \u2014 bereit f\xFCr unternehmensweiten Roll-out.",
@@ -7872,7 +8011,7 @@ var DE_DIGITAL = {
   "method.s4.bubbles": "Die Blasengr\xF6sse betont zus\xE4tzlich den strategischen Impact f\xFCr sich (eine strategische Initiative erscheint also gr\xF6sser, selbst wenn ihr Wert-Score moderat ist); die Farbe spiegelt das Compliance- & Betriebsrisiko-Band wider.",
   "method.s5.governance": "<strong>Hohes Compliance- & Betriebsrisiko</strong> (Pr\xE4zedenz 3) \u2014 Compliance- & Betriebsrisiko-Wert \u2265 {g} (und die Initiative wurde nicht bereits als Quick Wins oder Strategische Kerninitiative klassifiziert). Erh\xF6hte regulatorische, Compliance- oder Betriebsrisiko-Exposition, die vor einer Skalierung adressiert werden muss.",
   "memo.assumptions.signals": "Es wurden keine externen regulatorischen, Betriebsrisiko- oder Drittparteien-Signale in diese Scores einbezogen.",
-  "method.s6.p1": 'Der <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman-Index</a> wird auf vier Schnitte angewendet: <strong>Anbieterstrategie</strong>, <strong>L\xF6sungstyp</strong>, <strong>Digital-Kategorie</strong> und <strong>Gesch\xE4ftseinheit</strong>.',
+  "method.s6.p1": 'Der <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman-Index</a> wird auf vier Schnitte der Konzentrationsseite angewendet: <strong>Anbieterstrategie</strong>, <strong>Digital-Kategorie</strong>, <strong>Gesch\xE4ftseinheit</strong> und <strong>Compliance-Band</strong>. Das Board-Pack verwendet Anbieter, Kategorie, Gesch\xE4ftseinheit und L\xF6sungstyp sowie einen gewichteten HHI.',
   "method.s6.p2": "Eine Gesch\xE4ftseinheit-\xD7-Digital-Kategorie-Heatmap auf der Konzentrations-Seite deckt dar\xFCber hinaus spezifische \xFCberexponierte Kombinationen jenseits des Aggregats auf.",
   "concept.problem.p1": "Viele Organisationen verfolgen Digital-Initiativen \xFCber eine Vielzahl von Gesch\xE4ftsprozessen hinweg. Diese Initiativen entstehen h\xE4ufig aus lokalen Experimenten in einzelnen Gesch\xE4ftseinheiten oder Technologieteams \u2013 nicht aus einem strukturierten strategischen Prozess.",
   "concept.dim.value.body": "\xD6konomischer Hebel der digitalen L\xF6sung. Anwendungsf\xE4lle mit hochfrequenten, ressourcenintensiven Aktivit\xE4ten bieten das gr\xF6sste Potenzial f\xFCr \xF6konomische Wirkung; F\xE4lle mit begrenztem Volumen oder marginalen Effizienzgewinnen rechtfertigen den organisatorischen Aufwand selten.",
@@ -7893,9 +8032,8 @@ var DE_DIGITAL = {
   "dim.valueScale.band1.meaning": "Auf ein einzelnes Team oder einen Prozess begrenzt; geringer finanzieller Effekt.",
   "dim.feasibility.band2.meaning": "Machbar, erfordert aber Investitionen in Daten, Integration oder Betreibbarkeit.",
   "dim.feasibility.band3.meaning": "Daten, Tools und Betreibbarkeit sind vorhanden, um mit Vertrauen umzusetzen.",
-  "dim.governance.band2.label": "\xDCberwachter Betrieb",
-  "dim.governance.band3.meaning": "Aktive Vorstandsaufsicht, Audit-Trail und Zugriffskontrollen f\xFCr das digitale System erforderlich.",
-  "dim.strategic.band3.meaning": "Ver\xE4ndert Betriebsmodell, Kundenerlebnis oder die Datennutzung im Unternehmen.",
+  "dim.governance.band4.meaning": "Aktive Vorstandsaufsicht, Audit-Trail und Zugriffskontrollen f\xFCr das digitale System erforderlich.",
+  "dim.strategic.band4.meaning": "Ver\xE4ndert Betriebsmodell, Kundenerlebnis oder die Datennutzung im Unternehmen.",
   "op.governance.detailLow": "Eingebettete Teams mit teilweiser Betriebsrisiko-Abdeckung reichen bei dieser Last meist aus.",
   "boardPack.col.g": "C",
   // ── Concept & Methodology page theming ────────────────────────────────
@@ -7915,14 +8053,9 @@ var DE_DIGITAL = {
   "concept.features.f24.body": "In sich geschlossene Demo-Portfolios pro Modus (KI / Digital / Innovation) laden mit realistischen Initiativen und Abh\xE4ngigkeiten \u2014 sodass neue Nutzer jede Sicht sofort erkunden k\xF6nnen, ohne Daten einzugeben.",
   "concept.features.f29.body": "Die Konsole l\xE4uft als mandantenf\xE4hige SaaS: Jede Organisation ist ein isolierter Mandant mit eigenem Portfolio und eigenen Daten. Mitglieder melden sich \xFCber eine verwaltete Authentifizierung an und erhalten rollenbasierten Zugriff \u2014 Admin, Mitglied oder Betrachter \u2014 verfeinert durch granulare Berechtigungen pro Bereich, die ein Admin in den Einstellungen vergibt und die serverseitig wie auch in der Oberfl\xE4che durchgesetzt werden. Jede governance-kritische und Kern-Metadaten-\xC4nderung wird in einem feldgenauen Audit-Trail mit handelndem Benutzer und Zeitstempel erfasst, und jede Initiative zeigt, wer sie erstellt und zuletzt bearbeitet hat. Cloud-Sync h\xE4lt das gemeinsame Portfolio im Team konsistent, w\xE4hrend der lokale Modus (ohne Konto) weiterhin f\xFCr einen einzelnen Nutzer funktioniert. Privilegierte Admin-Aktionen \u2014 Zugriffsvergaben, Rollen- und Rechte\xE4nderungen, \xC4nderungen an Einstellungen, Profilen und Initiativen \u2014 werden zus\xE4tzlich in einem Admin-Aktivit\xE4tsprotokoll auf Organisationsebene in den Einstellungen erfasst.",
   "concept.features.f30.body": "Eine regelbasierte, nach Dringlichkeit sortierte Liste der Entscheidungen, die die Portfoliodaten selbst einfordern: Stopp-/Aufschub-Kandidaten, Gate-Disziplin, Kapazit\xE4ts- und Budgetengp\xE4sse sowie Konzentration. Nutzenrealisierungs-Regeln markieren Produktionssysteme, die ihren zugesagten Nutzen verfehlen \u2014 oder nie messen. Vom Board gesetzte Leitplanken erg\xE4nzen die roten Linien: Admins definieren Richtwerte in den Einstellungen \u2014 Budgetkonzentrations-Obergrenze je Gesch\xE4ftsbereich, Wert-Untergrenze f\xFCr finanzierte Initiativen und Compliance-Last-Obergrenze \u2014 jeweils mit Live-Pr\xFCfung, und jeder Verstoss erscheint hier als Entscheidungspunkt.",
-  "method.rules.r1.formula": "Nutzen \xD7 Liefer-Machbarkeit \u2192 Portfolio-Gestalt",
-  "method.rules.r1.explanation": "Die Quadrantenposition auf der Nutzen-\xD7-Liefer-Machbarkeits-Karte bestimmt die Go-/Skalieren-/Pilot-/Stopp-Entscheidung f\xFCr jede Initiative.",
-  "method.rules.r2.formula": "Compliance-Band \u2192 Veto-Kriterium",
-  "method.rules.r2.explanation": "Jede Initiative oberhalb des Restricted-Bands (Compliance & Betriebsrisiko \u2265 61) darf nicht skaliert werden, solange keine expliziten Vorstandskontrollen vorhanden sind; sie wird unabh\xE4ngig von Nutzen oder Machbarkeit von der Priorisierungsliste entfernt.",
-  "method.rules.r4.explanation": "\xDCbersteigt ein Portfolio-Schnitt (Anbieter, L\xF6sungstyp, Digital-Kategorie oder Gesch\xE4ftseinheit) den HHI 0,25 auf der normierten 0\u20131-Skala, muss der Portfolio-Steward eine Umverteilung aktiv pr\xFCfen, bevor neue Initiativen im dominanten Segment freigegeben werden.",
   "method.s1.dimensions.feasibility": "<strong>Liefer-Machbarkeit &amp; Betreibbarkeit</strong> \u2014 Umsetzbarkeit, Betreibbarkeit und Transparenz.",
   "method.s1.dimensions.governance": "<strong>Compliance &amp; Betriebsrisiko</strong> \u2014 regulatorische, Compliance- und Betriebsrisiko-Last (Vertiefung in \xA7 3).",
-  "method.s2.b1": "<strong>0\u201320 \xB7 Geringe Sensitivit\xE4t</strong>: Routinekontrollen gen\xFCgen.",
+  "method.s2.b1": "<strong>0\u201320 \xB7 Minimale Aufsicht</strong>: Routinekontrollen gen\xFCgen.",
   "method.s5.intro": "Jede Initiative wird gegen die folgenden Regeln gepr\xFCft und der <em>ersten</em> Kategorie zugeordnet, deren Regel zutrifft \u2014 in der Pr\xE4zedenzreihenfolge <strong>1 \u2192 2 \u2192 3 \u2192 4 \u2192 5 \u2192 6 \u2192 7</strong>. Die Liste unten erscheint in derselben Reihenfolge, in der die Priorisierungsseite die Gruppen darstellt; das entspricht nicht der Pr\xE4zedenz \u2014 die Pr\xE4zedenznummer steht jeweils an der Regel. Initiativen, die keine der Regeln 1\u20136 erf\xFCllen, landen in der Auffangkategorie <em>Taktisch / nicht kategorisiert</em> (Pr\xE4zedenz 7).",
   "method.s5.quickWins": "<strong>Quick Wins</strong> (Pr\xE4zedenz 1) \u2014 Wert \u2265 {v}, Machbarkeit \u2265 {f} und Compliance & Betriebsrisiko \u2264 {g}. Hoher Nutzen, geringes Risiko, umsetzungsreif.",
   "method.s5.strategicCore": "<strong>Strategische Plattform-Initiativen</strong> (Pr\xE4zedenz 2) \u2014 Wert \u2265 {v}, Machbarkeit \u2265 {f} und Strategie \u2265 {s}. Kern-Plattform-Wetten, die zugleich wertvoll und strategisch zentral sind.",
@@ -7930,7 +8063,7 @@ var DE_DIGITAL = {
   "method.s5.longTerm": "<strong>Mehrjahresprogramme</strong> (Pr\xE4zedenz 4) \u2014 Wert \u2265 {v}, Machbarkeit &lt; {f} und Strategie \u2265 {s} (nachdem Hohes Compliance-Risiko Initiativen oberhalb seines Schwellenwerts bereits beansprucht hat). Strategisch attraktiv, aber noch nicht machbar \u2014 am Horizont halten.",
   "method.s5.incremental": "<strong>Kontinuierliche Verbesserung</strong> (Pr\xE4zedenz 5) \u2014 Wert &lt; {v}, Machbarkeit \u2265 {f} und Strategie &lt; {s}. Leicht umsetzbar, aber begrenzter Nutzen; geeignet als F\xFCllinitiativen.",
   "method.s5.uncategorised": "<strong>Taktisch / nicht kategorisiert</strong> (Pr\xE4zedenz 7) \u2014 Auffangkategorie f\xFCr Initiativen, die keine der Regeln 1\u20136 erf\xFCllen. Bis zur Sch\xE4rfung der Bewertung taktisch behandeln.",
-  "method.s5.ranking": "<strong>Reihenfolge innerhalb der Warteschlange.</strong> Initiativen werden zuerst nach den Kategorie-Regeln oben gruppiert (Pr\xE4zedenz 1 \u2192 7), dann innerhalb jeder Kategorie nach <strong>Value</strong>-Score absteigend geordnet, dann \u2014 wenn die Value-at-Stake-Gewichtung in den Einstellungen aktiv ist und die Zeile in Quick Wins / Strategische Plattform-Initiativen liegt \u2014 nach Jahr-3-Nutzen absteigend. Letzter Tiebreaker ist <strong>Strategischer Impact</strong> absteigend, danach Name A\u2192Z, damit das Ergebnis deterministisch und reproduzierbar ist.",
+  "method.s5.ranking": "<strong>Reihenfolge innerhalb der Warteschlange.</strong> Initiativen werden zuerst nach Kategorie gruppiert, in der oben aufgef\xFChrten Reihenfolge (wie auf der Priorisierungsseite), dann innerhalb jeder Kategorie nach <strong>Value</strong>-Score absteigend geordnet, dann \u2014 wenn die Value-at-Stake-Gewichtung in den Einstellungen aktiv ist und die Zeile in Quick Wins / Strategische Plattform-Initiativen liegt \u2014 nach Jahr-3-Nutzen absteigend. Letzter Tiebreaker ist <strong>Strategischer Impact</strong> absteigend, danach Name A\u2192Z, damit das Ergebnis deterministisch und reproduzierbar ist.",
   "method.s10.p7": "<strong>Quick-Win-Definition.</strong> Die Kategorie Quick Wins setzt schnelle Zeit-zum-Wert voraus. Ein Quick Win, der von einem aktiven, nicht-Quick-Win-en Vorgelagerten abh\xE4ngt (Strategische Plattform-Initiative, Betriebsmodell-Modernisierung, Hohes Compliance-Risiko etc.), wird daher automatisch aus den Quick Wins demotet \u2014 der Vorlauf macht ihn nicht mehr schnell. Die Regel ist transitiv: H\xE4ngt A von B ab und wird B demotet, wird A in der n\xE4chsten Iteration ebenfalls demotet.",
   "method.audit.scope.governance": "<strong>Status</strong> und die vier <strong>Bewertungsdimensions-Scores</strong> (Wert, Liefer-Machbarkeit, Compliance &amp; Betriebsrisiko, Strategischer Impact) mit ihrer Konfidenz.",
   "method.audit.scope.metadata": "<strong>Alle Kern-Metadatenfelder</strong> \u2014 Name, Gesch\xE4ftseinheit, Verantwortliche, Beschreibung, Zeitplan, Budget, Anbieterstrategie, L\xF6sungstyp, Digital-Kategorie und Tags.",
@@ -7982,11 +8115,17 @@ var EN_INNOVATION = {
   "subHelp.dataAvailability": "How much evidence (data, prior art, prototypes) already exists to support the idea.",
   "subHelp.dataQuality": "Strength of that evidence \u2014 rigour, sample size, independence, recency.",
   "dim.feasibility.band1.meaning": "Concept, capability or partner gaps make delivery uncertain.",
-  "govBand.Elevated.desc": "41\u201360 \xB7 Gated trial \u2014 standard stage-gate controls",
+  "govBand.Low.desc": "0\u201320 \xB7 Minimal oversight \u2014 routine stage-gate checkpoints",
+  "govBand.Moderate.desc": "21\u201340 \xB7 Monitored trial \u2014 standard stage-gate controls",
+  "govBand.Elevated.desc": "41\u201360 \xB7 Active stewardship required \u2014 stop-loss thresholds and capital limits",
+  "govBand.High.desc": "61\u201380 \xB7 Bounded pilot only \u2014 named sponsor and explicit kill criteria",
+  "govBand.Critical.desc": "81\u2013100 \xB7 Board-level sponsorship required \u2014 treat as material strategic risk",
   "govLabel.Controlled Automation": "Monitored Trial",
   "govLabel.Human-in-the-Loop Required": "Active Stewardship Required",
   "govLabel.Restricted Deployment": "Bounded Pilot Only",
   "memo.governance.intro": "{count} initiatives sit in the Bounded Pilot Only band or above (governance \u2265 61/100) and require active board-level monitoring.",
+  "settings.guardrails.maxHighGovernanceSharePct.hint": "At most this share of active initiatives may carry a governance score above 60 (Bounded Pilot Only or higher).",
+  "governance.warning.body": "{count} initiatives require board-level visibility and active risk mitigation due to scores in the Board-Level Sponsorship Required band.",
   "govLabel.High Governance Sensitivity": "Board-Level Sponsorship Required",
   "subHelp.modelRobustness": "How well the core concept holds up under stress, edge cases and pessimistic assumptions.",
   "subHelp.reproducibility": "Likelihood that observed results would repeat under independent conditions.",
@@ -8014,7 +8153,7 @@ var EN_INNOVATION = {
   "settings.prio.longTermBets": "Long Horizons (H3)",
   "settings.prio.incremental": "Incremental Refinements",
   "settings.prio.operatingModel": "New Operating Models",
-  "settings.prio.subtitle": "Thresholds used by the Prioritisation page to assign each innovation initiative to a strategic archetype. Rules are evaluated top-to-bottom and the first match wins. All values are scores out of 100 across the four dimensions: V = Value Potential, E = Validation & Evidence, U = Governance & Uncertainty, S = Strategic Impact.",
+  "settings.prio.subtitle": "Thresholds used by the Prioritisation page to assign each innovation initiative to a strategic archetype. Rules are listed in funding order, as on the Prioritisation page; each initiative is assigned by the first rule it matches, checked in the order of its precedence number. All values are scores out of 100 across the four dimensions: V = Value Potential, E = Validation & Evidence, U = Governance & Uncertainty, S = Strategic Impact.",
   "inventory.col.scores": "Scores (V/E/U/S)",
   "concept.eyebrow": "Steering of AI, digital and transformation portfolios",
   "concept.title": "Turn scattered experiments into a managed innovation portfolio.",
@@ -8082,11 +8221,11 @@ var EN_INNOVATION = {
   "method.s2.title": "2. Governance & Uncertainty Classification",
   "method.s2.subtitle": "Uncertainty bands and what they imply for stage-gate posture and stop-loss controls.",
   "method.s2.intro": "Initiatives are classified into bands based on the Governance & Uncertainty score:",
-  "method.s2.b1": "<strong>0\u201320 \xB7 Low uncertainty</strong>: routine stage-gate checkpoints; no escalation required.",
-  "method.s2.b2": "<strong>21\u201340 \xB7 Gated trial</strong>: standard stage-gate controls and progress monitoring.",
-  "method.s2.b3": "<strong>41\u201360 \xB7 Tight stage-gating</strong>: explicit stop-loss thresholds and capital limits.",
-  "method.s2.b4": "<strong>61\u201380 \xB7 Board sponsorship required</strong>: active board-level oversight, named sponsor and explicit kill criteria.",
-  "method.s2.b5": "<strong>81\u2013100 \xB7 High strategic exposure</strong>: treat as material strategic risk; pursue only with explicit ringfencing and continuous oversight.",
+  "method.s2.b1": "<strong>0\u201320 \xB7 Minimal oversight</strong>: routine stage-gate checkpoints; no escalation required.",
+  "method.s2.b2": "<strong>21\u201340 \xB7 Monitored trial</strong>: standard stage-gate controls and progress monitoring.",
+  "method.s2.b3": "<strong>41\u201360 \xB7 Active stewardship required</strong>: tight stage-gating with explicit stop-loss thresholds and capital limits.",
+  "method.s2.b4": "<strong>61\u201380 \xB7 Bounded pilot only</strong>: active board-level oversight, named sponsor and explicit kill criteria.",
+  "method.s2.b5": "<strong>81\u2013100 \xB7 Board-level sponsorship required</strong>: treat as material strategic risk; pursue only with explicit ringfencing and continuous oversight.",
   "method.s4.subtitle": "How each initiative is positioned on the Business Impact \xD7 Validation plane.",
   "method.s4.intro": "The x-axis (<strong>Business Impact</strong>) is the equal-weighted average of Value Potential and Strategic Impact: <code>BusinessImpact = (Value + Strategic) / 2</code>. The y-axis is Validation & Evidence. Quadrants are split deterministically at 50 on both axes:",
   "method.s4.scale": "<strong>Scale</strong> \u2014 Business Impact \u2265 50 and Validation \u2265 50. High impact, strong evidence \u2014 ready to scale.",
@@ -8096,7 +8235,7 @@ var EN_INNOVATION = {
   "method.s4.bubbles": "Bubble size additionally emphasises Strategic Impact on its own (so a strategic bet reads as a larger bubble even when its value score is moderate); bubble colour reflects the uncertainty band.",
   "method.s5.governance": "<strong>High-Uncertainty Bets</strong> (precedence 3) \u2014 governance & uncertainty score \u2265 {g} (and the bet was not already classified as Quick Wins or Strategic Core). Elevated strategic, market or execution uncertainty that must be de-risked through stage-gating before scaling.",
   "memo.assumptions.signals": "No external regulatory, peer-review or third-party assurance signals have been incorporated into these scores.",
-  "method.s6.p1": 'The <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman Index</a> is applied to four cuts of the portfolio: <strong>partner strategy</strong>, <strong>bet type</strong>, <strong>innovation category</strong>, and <strong>business unit</strong>.',
+  "method.s6.p1": 'The <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman Index</a> is applied to four cuts on the Concentration page: <strong>partner strategy</strong>, <strong>innovation category</strong>, <strong>business unit</strong> and <strong>uncertainty band</strong>. The board pack uses partner, category, business unit and bet type, plus a weighted HHI.',
   "method.s6.p2": "A business-unit \xD7 innovation-category cluster heatmap on the Concentration page surfaces specific over-exposed combinations beyond the aggregate.",
   "concept.problem.p1": "Many organisations are pursuing innovation bets across a wide range of horizons. These initiatives often emerge from local experimentation within business units, labs or partner ecosystems rather than from a structured strategic process.",
   "concept.dim.value.body": "Strategic and economic potential of the innovation bet. Bets that target large, growing or under-served opportunities typically offer the greatest upside; narrow-scale or marginal-efficiency bets rarely justify the organisational effort required.",
@@ -8123,7 +8262,11 @@ var EN_INNOVATION = {
   "filters.vendor.open": "Open / internal",
   "concentration.hhi.vendor": "Partner strategy",
   "concentration.vendor.title": "Partner dependency",
-  "concentration.vendor.subtitle": "Number of bets by partner strategy. Click a bar to view the list.",
+  "concentration.vendor.subtitle": "Bets split by stage, ordered by lock-in. Click a segment to view the list.",
+  "concentration.measure.count": "Bets",
+  "concentration.tooltip.count": "Bets",
+  "concentration.takeaway.count": "{name}: {value} of {total} bets ({share} %), {prod} already in production.",
+  "concentration.takeaway.noBudget": "No budget recorded for the bets in scope.",
   "concentration.obs.vendor": "High partner concentration. The portfolio is materially dependent on a narrow set of external partners; consider broadening the ecosystem to reduce systemic dependency.",
   "memo.concentration.vendor": "Partner strategy concentration: {name} accounts for {count} of {total} bets ({pct}%).",
   "memo.opmodel.vendor": "Partner strategy: {name} should be reviewed against ecosystem-resilience standards; over-reliance on a single partner increases systemic fragility.",
@@ -8146,17 +8289,13 @@ var EN_INNOVATION = {
   "dim.feasibility.band2.meaning": "Promising but requires further evidence, prototypes or partner capability.",
   "dim.feasibility.band3.label": "Ready to scale",
   "dim.feasibility.band3.meaning": "Evidence, capability and a credible path to scale are in place.",
-  "dim.governance.band1.label": "Low uncertainty",
   "dim.governance.band1.meaning": "Routine stage-gate checkpoints; no escalation required.",
-  "dim.governance.band2.label": "Gated trial",
   "dim.governance.band2.meaning": "Standard stage-gate controls and progress monitoring required.",
-  "dim.governance.band3.label": "Tight stage-gating",
-  "dim.governance.band3.meaning": "Active board-level oversight, stop-loss thresholds and capital limits required.",
-  "dim.governance.band4.label": "High strategic exposure",
-  "dim.governance.band4.meaning": "Treat as material strategic risk; pursue only with explicit ringfencing and continuous oversight.",
-  "dim.strategic.band1.label": "Incremental",
+  "dim.governance.band3.meaning": "Tight stage-gating with explicit stop-loss thresholds and capital limits required.",
+  "dim.governance.band4.meaning": "Active board-level oversight, a named sponsor and explicit kill criteria required.",
+  "dim.governance.band5.meaning": "Treat as material strategic risk; pursue only with explicit ringfencing and continuous oversight.",
   "dim.strategic.band1.meaning": "Refines an existing offering only.",
-  "dim.strategic.band3.meaning": "Opens new operating models, revenue streams or market positioning.",
+  "dim.strategic.band5.meaning": "Opens new revenue streams or a structural market position.",
   "op.governance.detailLow": "Embedded delivery teams with part-time stage-gate coverage are typically sufficient at this load.",
   "boardPack.col.f": "E",
   "boardPack.col.g": "U",
@@ -8181,11 +8320,6 @@ var EN_INNOVATION = {
   "concept.features.f24.body": "Self-contained demo portfolios per mode (AI / Digital / Innovation) load with realistic initiatives and dependencies \u2014 so new users can explore every view immediately without entering data.",
   "concept.features.f29.body": "Run the console as a multi-tenant SaaS: each organisation is an isolated tenant with its own portfolio and data. Members sign in through managed authentication and get role-based access \u2014 admin, member or viewer \u2014 refined by granular per-section permissions an admin grants from Settings, enforced on both the server and the UI. Every governance-critical and Core Metadata change is captured in a per-field audit trail with the acting user and a timestamp, and each initiative shows who created and last edited it. Cloud sync keeps the shared portfolio consistent across the team, while local (no-account) mode still works for a single user. Privileged admin actions \u2014 access grants, role and permission changes, settings, profile and initiative changes \u2014 are additionally recorded in an organisation-level admin activity log in Settings.",
   "concept.features.f30.body": "A rules-based, severity-ranked list of the decisions the portfolio's own data calls for: stop/defer candidates, gate discipline, capacity and budget shortfalls, and concentration. Benefits-realisation rules flag production systems that under-deliver \u2014 or never measure \u2014 their promised value. Board-set guardrails add the red lines: admins define policy limits in Settings \u2014 a budget-concentration cap per business unit, a value floor for funded initiatives and an uncertainty-load ceiling \u2014 each showing a live pass/fail, and every breach lands here as a decide-now item.",
-  "method.rules.r1.formula": "Value \xD7 Validation \u2192 Portfolio shape",
-  "method.rules.r1.explanation": "Quadrant placement on the Value \xD7 Validation map drives the go / scale / pilot / stop decision for each initiative.",
-  "method.rules.r2.formula": "Uncertainty Band \u2192 Veto criterion",
-  "method.rules.r2.explanation": "Any initiative above the restricted band (Governance & Uncertainty \u2265 61) cannot scale until explicit board-level controls are in place; it is removed from the prioritised list regardless of value or validation.",
-  "method.rules.r4.explanation": "If any portfolio cut (partner, solution type, innovation category, or business unit) exceeds HHI 0.25 on the normalised 0\u20131 scale, the portfolio steward must actively consider redistribution before approving new initiatives in the dominant segment.",
   "method.s1.dimensions.value": "<strong>Value Potential</strong> \u2014 economic and strategic upside.",
   "method.s1.dimensions.feasibility": "<strong>Validation &amp; Evidence</strong> \u2014 strength, rigour and repeatability of the evidence.",
   "method.s1.dimensions.governance": "<strong>Governance &amp; Uncertainty</strong> \u2014 stage-gate posture and uncertainty load (deep dive in \xA7 3).",
@@ -8196,7 +8330,7 @@ var EN_INNOVATION = {
   "method.s5.longTerm": "<strong>Long Horizons (H3)</strong> (precedence 4) \u2014 value \u2265 {v}, validation &lt; {f}, and strategic \u2265 {s} (after High-Uncertainty Bets has already claimed initiatives above its threshold). Strategically attractive but not yet validated \u2014 keep on the horizon.",
   "method.s5.incremental": "<strong>Incremental Refinements</strong> (precedence 5) \u2014 value &lt; {v}, validation \u2265 {f}, and strategic &lt; {s}. Easy to ship but limited upside; useful as fillers.",
   "method.s5.uncategorised": "<strong>Unsorted Experiments</strong> (precedence 7) \u2014 fallback for initiatives that don't satisfy any of rules 1\u20136. Treat as exploratory until scores sharpen.",
-  "method.s5.ranking": "<strong>Ranking inside the queue.</strong> Initiatives are first grouped by the category rules above (precedence 1 \u2192 7), then within each category ordered by <strong>Value Potential</strong> score descending, then \u2014 if Value-at-Stake weighting is enabled in Settings and the row sits in Easy Experiments / Scale Candidates \u2014 Year-3 benefit descending. Final tie-break is <strong>Strategic Impact</strong> descending, then name A\u2192Z, so the result is deterministic and reproducible.",
+  "method.s5.ranking": "<strong>Ranking inside the queue.</strong> Initiatives are first grouped by category in the order listed above (the order the Prioritisation page shows them), then within each category ordered by <strong>Value Potential</strong> score descending, then \u2014 if Value-at-Stake weighting is enabled in Settings and the row sits in Easy Experiments / Scale Candidates \u2014 Year-3 benefit descending. Final tie-break is <strong>Strategic Impact</strong> descending, then name A\u2192Z, so the result is deterministic and reproducible.",
   "method.s10.p7": "<strong>Easy Experiment definition.</strong> The Easy Experiments category requires fast time-to-value. Therefore an Easy Experiment that depends on an active upstream outside Easy Experiments (Scale Candidate, New Operating Models, High-Uncertainty Bets etc.) is automatically demoted out of Easy Experiments \u2014 the upstream's pre-work makes it no longer quick. The rule is transitive: if A depends on B, and B is itself demoted, A is also demoted in the next iteration.",
   "method.audit.scope.governance": "<strong>Status</strong> and the four <strong>evaluation dimension scores</strong> (Value Potential, Validation &amp; Evidence, Governance &amp; Uncertainty, Strategic Impact) with their confidence.",
   "method.audit.scope.metadata": "<strong>All Core Metadata fields</strong> \u2014 name, business unit, owner, description, timeline, budget, partner strategy, solution type, innovation category and tags.",
@@ -8248,11 +8382,17 @@ var DE_INNOVATION = {
   "subHelp.dataAvailability": "Wie viel Evidenz (Daten, Stand der Technik, Prototypen) die Idee bereits st\xFCtzt.",
   "subHelp.dataQuality": "Belastbarkeit dieser Evidenz \u2014 Rigorosit\xE4t, Stichprobengr\xF6sse, Unabh\xE4ngigkeit, Aktualit\xE4t.",
   "dim.feasibility.band1.meaning": "L\xFCcken bei Konzept, F\xE4higkeiten oder Partnern machen die Umsetzung unsicher.",
-  "govBand.Elevated.desc": "41\u201360 \xB7 Gegateter Pilot \u2014 Standard-Stage-Gate-Kontrollen",
+  "govBand.Low.desc": "0\u201320 \xB7 Minimale Aufsicht \u2014 Routine-Stage-Gate-Checkpoints",
+  "govBand.Moderate.desc": "21\u201340 \xB7 \xDCberwachte Erprobung \u2014 Standard-Stage-Gate-Kontrollen",
+  "govBand.Elevated.desc": "41\u201360 \xB7 Aktive Begleitung erforderlich \u2014 Stop-Loss-Schwellen und Kapitalgrenzen",
+  "govBand.High.desc": "61\u201380 \xB7 Nur eingegrenzter Pilot \u2014 benannter Sponsor und explizite Kill-Kriterien",
+  "govBand.Critical.desc": "81\u2013100 \xB7 Vorstandspatenschaft erforderlich \u2014 als wesentliches strategisches Risiko behandeln",
   "govLabel.Controlled Automation": "\xDCberwachte Erprobung",
   "govLabel.Human-in-the-Loop Required": "Aktive Begleitung erforderlich",
   "govLabel.Restricted Deployment": "Nur eingegrenzter Pilot",
   "memo.governance.intro": "{count} Initiativen liegen im Band \u201ENur eingegrenzter Pilot\u201C oder dar\xFCber (Governance \u2265 61/100) und ben\xF6tigen aktive Vorstandsaufsicht.",
+  "settings.guardrails.maxHighGovernanceSharePct.hint": "H\xF6chstens dieser Anteil der aktiven Initiativen darf einen Governance-Score \xFCber 60 tragen (Nur eingegrenzter Pilot oder h\xF6her).",
+  "governance.warning.body": "{count} Initiativen ben\xF6tigen aufgrund von Werten im Band \u201EVorstandspatenschaft erforderlich\u201C Vorstandsaufmerksamkeit und aktive Risikominderung.",
   "govLabel.High Governance Sensitivity": "Vorstandspatenschaft erforderlich",
   "subHelp.modelRobustness": "Wie gut das Kernkonzept Belastung, Edge-Cases und pessimistische Annahmen aush\xE4lt.",
   "subHelp.reproducibility": "Wahrscheinlichkeit, dass beobachtete Ergebnisse unter unabh\xE4ngigen Bedingungen wiederholbar sind.",
@@ -8280,7 +8420,7 @@ var DE_INNOVATION = {
   "settings.prio.longTermBets": "Lange Horizonte (H3)",
   "settings.prio.incremental": "Inkrementelle Verfeinerungen",
   "settings.prio.operatingModel": "Neue Betriebsmodelle",
-  "settings.prio.subtitle": "Schwellenwerte, mit denen die Priorisierungsseite jede Innovationsinitiative einem strategischen Archetyp zuordnet. Die Regeln werden von oben nach unten gepr\xFCft, die erste \xDCbereinstimmung gewinnt. Alle Werte sind Punkte von 0\u2013100 \xFCber die vier Dimensionen: W = Wertpotenzial, E = Validierung & Evidenz, U = Governance & Unsicherheit, S = Strategischer Impact.",
+  "settings.prio.subtitle": "Schwellenwerte, mit denen die Priorisierungsseite jede Innovationsinitiative einem strategischen Archetyp zuordnet. Die Regeln stehen in F\xF6rderreihenfolge wie auf der Priorisierungsseite; jede Initiative wird der ersten Regel zugeordnet, die sie erf\xFCllt, gepr\xFCft in der Reihenfolge der Pr\xE4zedenznummer. Alle Werte sind Punkte von 0\u2013100 \xFCber die vier Dimensionen: W = Wertpotenzial, E = Validierung & Evidenz, U = Governance & Unsicherheit, S = Strategischer Impact.",
   "inventory.col.scores": "Punkte (W/E/U/S)",
   "concept.eyebrow": "Steuerung von KI-, Digital- und Transformationsportfolios",
   "concept.title": "Verstreute Experimente in ein gesteuertes Innovationsportfolio \xFCberf\xFChren.",
@@ -8348,11 +8488,11 @@ var DE_INNOVATION = {
   "method.s2.title": "2. Governance- & Unsicherheits-Klassifikation",
   "method.s2.subtitle": "Unsicherheits-B\xE4nder und was sie f\xFCr Stage-Gate-Haltung und Stop-Loss-Kontrollen bedeuten.",
   "method.s2.intro": "Initiativen werden auf Basis des Governance- & Unsicherheits-Werts klassifiziert:",
-  "method.s2.b1": "<strong>0\u201320 \xB7 Geringe Unsicherheit</strong>: Routine-Stage-Gate-Checkpoints; keine Eskalation erforderlich.",
-  "method.s2.b2": "<strong>21\u201340 \xB7 Gated Trial</strong>: Standard-Stage-Gate-Kontrollen und Fortschrittsmonitoring.",
-  "method.s2.b3": "<strong>41\u201360 \xB7 Strenges Stage-Gating</strong>: explizite Stop-Loss-Schwellen und Kapitalgrenzen.",
-  "method.s2.b4": "<strong>61\u201380 \xB7 Vorstandspatenschaft erforderlich</strong>: aktive Vorstandsaufsicht, benannter Sponsor und explizite Kill-Kriterien.",
-  "method.s2.b5": "<strong>81\u2013100 \xB7 Hohe strategische Exposition</strong>: als wesentliches strategisches Risiko behandeln; nur mit Ringfencing und kontinuierlicher Aufsicht verfolgen.",
+  "method.s2.b1": "<strong>0\u201320 \xB7 Minimale Aufsicht</strong>: Routine-Stage-Gate-Checkpoints; keine Eskalation erforderlich.",
+  "method.s2.b2": "<strong>21\u201340 \xB7 \xDCberwachte Erprobung</strong>: Standard-Stage-Gate-Kontrollen und Fortschrittsmonitoring.",
+  "method.s2.b3": "<strong>41\u201360 \xB7 Aktive Begleitung erforderlich</strong>: strenges Stage-Gating mit expliziten Stop-Loss-Schwellen und Kapitalgrenzen.",
+  "method.s2.b4": "<strong>61\u201380 \xB7 Nur eingegrenzter Pilot</strong>: aktive Vorstandsaufsicht, benannter Sponsor und explizite Kill-Kriterien.",
+  "method.s2.b5": "<strong>81\u2013100 \xB7 Vorstandspatenschaft erforderlich</strong>: als wesentliches strategisches Risiko behandeln; nur mit Ringfencing und kontinuierlicher Aufsicht verfolgen.",
   "method.s4.subtitle": "Wie jede Initiative auf der Business-Impact-\xD7-Validierung-Ebene positioniert wird.",
   "method.s4.intro": "Die x-Achse (<strong>Business Impact</strong>) ist der gleichgewichtete Mittelwert aus Wertpotenzial und strategischem Impact: <code>BusinessImpact = (Wert + Strategisch) / 2</code>. Die y-Achse ist Validierung & Evidenz. Die Quadranten werden deterministisch bei 50 auf beiden Achsen geteilt:",
   "method.s4.scale": "<strong>Skalieren</strong> \u2014 Business Impact \u2265 50 und Validierung \u2265 50. Hoher Impact, starke Evidenz \u2014 bereit zur Skalierung.",
@@ -8362,7 +8502,7 @@ var DE_INNOVATION = {
   "method.s4.bubbles": "Die Blasengr\xF6sse betont zus\xE4tzlich den strategischen Impact f\xFCr sich (eine strategische Wette erscheint also gr\xF6sser, selbst wenn ihr Wert-Score moderat ist); die Farbe spiegelt das Unsicherheits-Band wider.",
   "method.s5.governance": "<strong>Hochunsichere Wetten</strong> (Pr\xE4zedenz 3) \u2014 Governance- & Unsicherheits-Wert \u2265 {g} (und die Wette wurde nicht bereits als Quick Wins oder Strategische Kernwette klassifiziert). Erh\xF6hte strategische, Markt- oder Ausf\xFChrungsunsicherheit, die vor einer Skalierung durch Stage-Gating reduziert werden muss.",
   "memo.assumptions.signals": "Es wurden keine externen regulatorischen, Peer-Review- oder Drittparteien-Signale in diese Scores einbezogen.",
-  "method.s6.p1": 'Der <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman-Index</a> wird auf vier Schnitte angewendet: <strong>Partnerstrategie</strong>, <strong>Wettentyp</strong>, <strong>Innovations-Kategorie</strong> und <strong>Gesch\xE4ftseinheit</strong>.',
+  "method.s6.p1": 'Der <a href="https://www.investopedia.com/terms/h/hhi.asp" target="_blank" rel="noopener noreferrer" class="text-primary underline underline-offset-2 hover:no-underline">Herfindahl\u2013Hirschman-Index</a> wird auf vier Schnitte der Konzentrationsseite angewendet: <strong>Partnerstrategie</strong>, <strong>Innovations-Kategorie</strong>, <strong>Gesch\xE4ftseinheit</strong> und <strong>Unsicherheits-Band</strong>. Das Board-Pack verwendet Partner, Kategorie, Gesch\xE4ftseinheit und Wettentyp sowie einen gewichteten HHI.',
   "method.s6.p2": "Eine Gesch\xE4ftseinheit-\xD7-Innovations-Kategorie-Heatmap auf der Konzentrations-Seite deckt dar\xFCber hinaus spezifische \xFCberexponierte Kombinationen jenseits des Aggregats auf.",
   "concept.problem.p1": "Viele Organisationen verfolgen Innovationswetten \xFCber unterschiedliche Horizonte hinweg. Diese Initiativen entstehen h\xE4ufig aus lokalen Experimenten in Gesch\xE4ftseinheiten, Labs oder Partner-\xD6kosystemen \u2013 nicht aus einem strukturierten strategischen Prozess.",
   "concept.dim.value.body": "Strategisches und \xF6konomisches Potenzial der Innovationswette. Wetten auf grosse, wachsende oder unterversorgte Chancen bieten das gr\xF6sste Upside; Wetten mit begrenztem Volumen oder marginalen Effizienzgewinnen rechtfertigen den organisatorischen Aufwand selten.",
@@ -8389,7 +8529,11 @@ var DE_INNOVATION = {
   "filters.vendor.open": "Offen / intern",
   "concentration.hhi.vendor": "Partnerstrategie",
   "concentration.vendor.title": "Partner-Abh\xE4ngigkeit",
-  "concentration.vendor.subtitle": "Anzahl Wetten nach Partnerstrategie. Auf einen Balken klicken, um die Liste anzuzeigen.",
+  "concentration.vendor.subtitle": "Wetten nach Phase aufgeteilt, nach Lock-in geordnet. Segment anklicken, um die Liste anzuzeigen.",
+  "concentration.measure.count": "Wetten",
+  "concentration.tooltip.count": "Wetten",
+  "concentration.takeaway.count": "{name}: {value} von {total} Wetten ({share} %), {prod} davon bereits in Produktion.",
+  "concentration.takeaway.noBudget": "F\xFCr die Wetten im Fokus ist kein Budget erfasst.",
   "concentration.obs.vendor": "Hohe Partnerkonzentration. Das Portfolio h\xE4ngt wesentlich von wenigen externen Partnern ab; eine Verbreiterung des \xD6kosystems reduziert die systemische Abh\xE4ngigkeit.",
   "memo.concentration.vendor": "Partnerstrategie-Konzentration: {name} steht f\xFCr {count} von {total} Wetten ({pct} %).",
   "memo.opmodel.vendor": "Partnerstrategie: {name} sollte gegen Standards der \xD6kosystem-Resilienz gepr\xFCft werden; zu starke Abh\xE4ngigkeit von einem Partner erh\xF6ht die systemische Fragilit\xE4t.",
@@ -8412,17 +8556,13 @@ var DE_INNOVATION = {
   "dim.feasibility.band2.meaning": "Vielversprechend, erfordert aber weitere Evidenz, Prototypen oder Partnerf\xE4higkeit.",
   "dim.feasibility.band3.label": "Bereit zur Skalierung",
   "dim.feasibility.band3.meaning": "Evidenz, F\xE4higkeit und ein glaubw\xFCrdiger Skalierungspfad sind vorhanden.",
-  "dim.governance.band1.label": "Geringe Unsicherheit",
   "dim.governance.band1.meaning": "Routinem\xE4ssige Stage-Gate-Checkpoints; keine Eskalation erforderlich.",
-  "dim.governance.band2.label": "Gegateter Pilot",
-  "dim.governance.band2.meaning": "Standard Stage-Gate-Kontrollen und Fortschrittsmonitoring erforderlich.",
-  "dim.governance.band3.label": "Enges Stage-Gating",
-  "dim.governance.band3.meaning": "Aktive Vorstandsaufsicht, Stop-Loss-Schwellen und Kapitallimits erforderlich.",
-  "dim.governance.band4.label": "Hohe strategische Exposition",
-  "dim.governance.band4.meaning": "Als materielles strategisches Risiko behandeln; nur mit explizitem Ringfencing und kontinuierlicher Aufsicht verfolgen.",
-  "dim.strategic.band1.label": "Inkrementell",
+  "dim.governance.band2.meaning": "Standard-Stage-Gate-Kontrollen und Fortschrittsmonitoring erforderlich.",
+  "dim.governance.band3.meaning": "Strenges Stage-Gating mit expliziten Stop-Loss-Schwellen und Kapitalgrenzen erforderlich.",
+  "dim.governance.band4.meaning": "Aktive Vorstandsaufsicht, benannter Sponsor und explizite Kill-Kriterien erforderlich.",
+  "dim.governance.band5.meaning": "Als wesentliches strategisches Risiko behandeln; nur mit explizitem Ringfencing und kontinuierlicher Aufsicht verfolgen.",
   "dim.strategic.band1.meaning": "Verfeinert nur ein bestehendes Angebot.",
-  "dim.strategic.band3.meaning": "Er\xF6ffnet neue Betriebsmodelle, Erl\xF6sstr\xF6me oder Marktpositionierungen.",
+  "dim.strategic.band5.meaning": "Er\xF6ffnet neue Erl\xF6sstr\xF6me oder eine strukturelle Marktposition.",
   "op.governance.detailLow": "Eingebettete Teams mit teilweiser Stage-Gate-Abdeckung reichen bei dieser Last meist aus.",
   "boardPack.col.f": "E",
   "boardPack.col.g": "U",
@@ -8447,11 +8587,6 @@ var DE_INNOVATION = {
   "concept.features.f24.body": "In sich geschlossene Demo-Portfolios pro Modus (KI / Digital / Innovation) laden mit realistischen Initiativen und Abh\xE4ngigkeiten \u2014 sodass neue Nutzer jede Sicht sofort erkunden k\xF6nnen, ohne Daten einzugeben.",
   "concept.features.f29.body": "Die Konsole l\xE4uft als mandantenf\xE4hige SaaS: Jede Organisation ist ein isolierter Mandant mit eigenem Portfolio und eigenen Daten. Mitglieder melden sich \xFCber eine verwaltete Authentifizierung an und erhalten rollenbasierten Zugriff \u2014 Admin, Mitglied oder Betrachter \u2014 verfeinert durch granulare Berechtigungen pro Bereich, die ein Admin in den Einstellungen vergibt und die serverseitig wie auch in der Oberfl\xE4che durchgesetzt werden. Jede governance-kritische und Kern-Metadaten-\xC4nderung wird in einem feldgenauen Audit-Trail mit handelndem Benutzer und Zeitstempel erfasst, und jede Initiative zeigt, wer sie erstellt und zuletzt bearbeitet hat. Cloud-Sync h\xE4lt das gemeinsame Portfolio im Team konsistent, w\xE4hrend der lokale Modus (ohne Konto) weiterhin f\xFCr einen einzelnen Nutzer funktioniert. Privilegierte Admin-Aktionen \u2014 Zugriffsvergaben, Rollen- und Rechte\xE4nderungen, \xC4nderungen an Einstellungen, Profilen und Initiativen \u2014 werden zus\xE4tzlich in einem Admin-Aktivit\xE4tsprotokoll auf Organisationsebene in den Einstellungen erfasst.",
   "concept.features.f30.body": "Eine regelbasierte, nach Dringlichkeit sortierte Liste der Entscheidungen, die die Portfoliodaten selbst einfordern: Stopp-/Aufschub-Kandidaten, Gate-Disziplin, Kapazit\xE4ts- und Budgetengp\xE4sse sowie Konzentration. Nutzenrealisierungs-Regeln markieren Produktionssysteme, die ihren zugesagten Nutzen verfehlen \u2014 oder nie messen. Vom Board gesetzte Leitplanken erg\xE4nzen die roten Linien: Admins definieren Richtwerte in den Einstellungen \u2014 Budgetkonzentrations-Obergrenze je Gesch\xE4ftsbereich, Wert-Untergrenze f\xFCr finanzierte Initiativen und Unsicherheitslast-Obergrenze \u2014 jeweils mit Live-Pr\xFCfung, und jeder Verstoss erscheint hier als Entscheidungspunkt.",
-  "method.rules.r1.formula": "Nutzen \xD7 Validierung \u2192 Portfolio-Gestalt",
-  "method.rules.r1.explanation": "Die Quadrantenposition auf der Nutzen-\xD7-Validierungs-Karte bestimmt die Go-/Skalieren-/Pilot-/Stopp-Entscheidung f\xFCr jede Initiative.",
-  "method.rules.r2.formula": "Unsicherheits-Band \u2192 Veto-Kriterium",
-  "method.rules.r2.explanation": "Jede Initiative oberhalb des Restricted-Bands (Governance & Unsicherheit \u2265 61) darf nicht skaliert werden, solange keine expliziten Vorstandskontrollen vorhanden sind; sie wird unabh\xE4ngig von Nutzen oder Validierung von der Priorisierungsliste entfernt.",
-  "method.rules.r4.explanation": "\xDCbersteigt ein Portfolio-Schnitt (Partner, L\xF6sungstyp, Innovations-Kategorie oder Gesch\xE4ftseinheit) den HHI 0,25 auf der normierten 0\u20131-Skala, muss der Portfolio-Steward eine Umverteilung aktiv pr\xFCfen, bevor neue Initiativen im dominanten Segment freigegeben werden.",
   "method.s1.dimensions.value": "<strong>Wertpotenzial</strong> \u2014 \xF6konomischer und strategischer Nutzen.",
   "method.s1.dimensions.feasibility": "<strong>Validierung &amp; Evidenz</strong> \u2014 St\xE4rke, Strenge und Wiederholbarkeit der Evidenz.",
   "method.s1.dimensions.governance": "<strong>Governance &amp; Unsicherheit</strong> \u2014 Stage-Gate-Haltung und Unsicherheitslast (Vertiefung in \xA7 3).",
@@ -8462,7 +8597,7 @@ var DE_INNOVATION = {
   "method.s5.longTerm": "<strong>Lange Horizonte (H3)</strong> (Pr\xE4zedenz 4) \u2014 Wert \u2265 {v}, Validierung &lt; {f} und Strategie \u2265 {s} (nachdem Hochunsichere Wetten Initiativen oberhalb ihres Schwellenwerts bereits beansprucht haben). Strategisch attraktiv, aber noch nicht validiert \u2014 am Horizont halten.",
   "method.s5.incremental": "<strong>Inkrementelle Verfeinerungen</strong> (Pr\xE4zedenz 5) \u2014 Wert &lt; {v}, Validierung \u2265 {f} und Strategie &lt; {s}. Leicht umsetzbar, aber begrenzter Nutzen; geeignet als F\xFCllinitiativen.",
   "method.s5.uncategorised": "<strong>Unsortierte Experimente</strong> (Pr\xE4zedenz 7) \u2014 Auffangkategorie f\xFCr Initiativen, die keine der Regeln 1\u20136 erf\xFCllen. Bis zur Sch\xE4rfung der Bewertung explorativ behandeln.",
-  "method.s5.ranking": "<strong>Reihenfolge innerhalb der Warteschlange.</strong> Initiativen werden zuerst nach den Kategorie-Regeln oben gruppiert (Pr\xE4zedenz 1 \u2192 7), dann innerhalb jeder Kategorie nach <strong>Wertpotenzial</strong>-Score absteigend geordnet, dann \u2014 wenn die Value-at-Stake-Gewichtung in den Einstellungen aktiv ist und die Zeile in Einfache Experimente / Skalierungs-Kandidaten liegt \u2014 nach Jahr-3-Nutzen absteigend. Letzter Tiebreaker ist <strong>Strategischer Impact</strong> absteigend, danach Name A\u2192Z, damit das Ergebnis deterministisch und reproduzierbar ist.",
+  "method.s5.ranking": "<strong>Reihenfolge innerhalb der Warteschlange.</strong> Initiativen werden zuerst nach Kategorie gruppiert, in der oben aufgef\xFChrten Reihenfolge (wie auf der Priorisierungsseite), dann innerhalb jeder Kategorie nach <strong>Wertpotenzial</strong>-Score absteigend geordnet, dann \u2014 wenn die Value-at-Stake-Gewichtung in den Einstellungen aktiv ist und die Zeile in Einfache Experimente / Skalierungs-Kandidaten liegt \u2014 nach Jahr-3-Nutzen absteigend. Letzter Tiebreaker ist <strong>Strategischer Impact</strong> absteigend, danach Name A\u2192Z, damit das Ergebnis deterministisch und reproduzierbar ist.",
   "method.s10.p7": "<strong>Definition Einfaches Experiment.</strong> Die Kategorie Einfache Experimente setzt schnelle Zeit-zum-Wert voraus. Ein Einfaches Experiment, das von einem aktiven Vorgelagerten ausserhalb der Einfachen Experimente abh\xE4ngt (Skalierungs-Kandidat, Neue Betriebsmodelle, Hochunsichere Wetten etc.), wird daher automatisch aus den Einfachen Experimenten demotet \u2014 der Vorlauf macht es nicht mehr schnell. Die Regel ist transitiv: H\xE4ngt A von B ab und wird B demotet, wird A in der n\xE4chsten Iteration ebenfalls demotet.",
   "method.audit.scope.governance": "<strong>Status</strong> und die vier <strong>Bewertungsdimensions-Scores</strong> (Wertpotenzial, Validierung &amp; Evidenz, Governance &amp; Unsicherheit, Strategischer Impact) mit ihrer Konfidenz.",
   "method.audit.scope.metadata": "<strong>Alle Kern-Metadatenfelder</strong> \u2014 Name, Gesch\xE4ftseinheit, Verantwortliche, Beschreibung, Zeitplan, Budget, Partnerstrategie, L\xF6sungstyp, Innovations-Kategorie und Tags.",
@@ -9773,8 +9908,22 @@ var OPTIONAL_SECTIONS = [
   {
     key: "milestones",
     hint: {
-      en: "[{title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 dated intermediate results (pilot live, vendor selected, go-live; at most 30, title up to 300 characters). baselineDate is the agreed plan; forecastDate today's expectation when it differs; doneDate once reached. Ask for the 3\u20135 that the steering committee watches. On an update, send every milestone the initiative keeps: the file replaces the list.",
-      de: "[{title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 datierte Zwischenergebnisse (Pilot live, Anbieter gew\xE4hlt, Go-live; h\xF6chstens 30, Titel bis 300 Zeichen). baselineDate ist der vereinbarte Plan, forecastDate die heutige Erwartung, wenn sie abweicht, doneDate sobald erreicht. Nach den 3\u20135 fragen, die der Lenkungsausschuss verfolgt. Bei einem Update alle Meilensteine senden, die bleiben sollen: die Datei ersetzt die Liste."
+      en: `[{id?, title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 dated intermediate results (pilot live, vendor selected, go-live; at most 30, title up to 300 characters). baselineDate is the agreed plan; forecastDate today's expectation when it differs; doneDate once reached. id? is a label (e.g. "m1") a follow-up's milestoneId can point at; the stored id is minted. Ask for the 3\u20135 that the steering committee watches. On an update, send every milestone the initiative keeps: the file replaces the list.`,
+      de: "[{id?, title, baselineDate, forecastDate?, doneDate?, note?}] \u2014 datierte Zwischenergebnisse (Pilot live, Anbieter gew\xE4hlt, Go-live; h\xF6chstens 30, Titel bis 300 Zeichen). baselineDate ist der vereinbarte Plan, forecastDate die heutige Erwartung, wenn sie abweicht, doneDate sobald erreicht. id? ist ein Label (z. B. \u201Em1\u201C), auf das die milestoneId einer Pendenz zeigen kann; die gespeicherte ID wird gepr\xE4gt. Nach den 3\u20135 fragen, die der Lenkungsausschuss verfolgt. Bei einem Update alle Meilensteine senden, die bleiben sollen: die Datei ersetzt die Liste."
+    }
+  },
+  {
+    key: "risks",
+    hint: {
+      en: '[{id?, title, category, probability, impact, status, residualProbability?, residualImpact?, owner?, mitigation?, raisedDate?, reviewDate?, occurredDate?, note?}] \u2014 the concrete project risks (at most 50, title up to 300 characters): category delivery | vendor | data | people | regulatory | technical | financial; probability and impact 1\u20135 as whole numbers (score = product: low 1\u20134, medium 5\u20139, high 10\u201316, critical 20\u201325); status open | mitigating | closed | occurred (occurred = an issue; give occurredDate, which a closed, resolved issue keeps); the residual pair is the expectation after mitigation (both or neither); owner is free text; mitigation is the plan, its actions are follow-ups linked by riskId; id? is a label (e.g. "r1") for that link, the stored id is minted. Ask for the 2\u20135 risks the steering committee would want named, with owner and mitigation. On an update, send every risk the initiative keeps: the file replaces the list.',
+      de: "[{id?, title, category, probability, impact, status, residualProbability?, residualImpact?, owner?, mitigation?, raisedDate?, reviewDate?, occurredDate?, note?}] \u2014 die konkreten Projektrisiken (h\xF6chstens 50, Titel bis 300 Zeichen): category delivery | vendor | data | people | regulatory | technical | financial; probability und impact 1\u20135 als ganze Zahlen (Score = Produkt: niedrig 1\u20134, mittel 5\u20139, hoch 10\u201316, kritisch 20\u201325); status open | mitigating | closed | occurred (occurred = ein Issue; occurredDate angeben, ein geschlossenes, gel\xF6stes Issue beh\xE4lt es); das Restrisiko-Paar ist die Erwartung nach der Massnahme (beide oder keines); owner ist Freitext; mitigation ist der Plan, seine Schritte sind Pendenzen mit riskId; id? ist ein Label (z. B. \u201Er1\u201C) f\xFCr diese Verkn\xFCpfung, die gespeicherte ID wird gepr\xE4gt. Nach den 2\u20135 Risiken fragen, die der Lenkungsausschuss benannt haben will, mit Owner und Massnahme. Bei einem Update alle Risiken senden, die bleiben sollen: die Datei ersetzt die Liste."
+    }
+  },
+  {
+    key: "followUps",
+    hint: {
+      en: '[{title, dueDate, assigneeName?, assigneeUserId?, doneDate?, milestoneId?, riskId?, note?}] \u2014 agreed next steps: who does what by when (at most 50, title up to 300 characters). assigneeName is a free-text name; assigneeUserId only when the user gives a member id from the app (the app clears an id that is not a member, the name stays). milestoneId / riskId point at a milestone or risk of this same spec by the id you gave it there (e.g. "m1", "r1"); the Composer mints the stored ids and keeps the link. Ask for the open actions, in particular one per severe risk. On an update, send every follow-up the initiative keeps: the file replaces the list.',
+      de: "[{title, dueDate, assigneeName?, assigneeUserId?, doneDate?, milestoneId?, riskId?, note?}] \u2014 vereinbarte n\xE4chste Schritte: wer macht was bis wann (h\xF6chstens 50, Titel bis 300 Zeichen). assigneeName ist ein Freitext-Name; assigneeUserId nur, wenn der Benutzer eine Mitglieds-ID aus der App nennt (die App l\xF6scht eine ID, die kein Mitglied ist, der Name bleibt). milestoneId / riskId zeigen auf einen Meilenstein oder ein Risiko derselben Spezifikation \xFCber die dort vergebene id (z. B. \u201Em1\u201C, \u201Er1\u201C); der Composer pr\xE4gt die gespeicherten IDs und beh\xE4lt die Verkn\xFCpfung. Nach den offenen Schritten fragen, besonders je einem pro schwerem Risiko. Bei einem Update alle Pendenzen senden, die bleiben sollen: die Datei ersetzt die Liste."
     }
   },
   {
@@ -9836,7 +9985,7 @@ function describeZodShape(schema, depth = 0) {
 }
 function buildSchemaDescriptor(sectionShapes) {
   return {
-    about: "BICon initiative composer. Collect the required fields, then rate every sub-dimension 0\u2013100 (higher = more of the named quality) and a confidence per dimension. Dimension scores are DERIVED (mean of subs) \u2014 never ask the user for them. Values are used verbatim; enum values must match exactly; unknown keys are rejected. Dates: talk dd/mm/yyyy with the user (dd/mm/yyyy, dd.mm.yyyy and yyyy-mm-dd are all accepted; stored as yyyy-mm-dd). Row ids of decision-log entries, status reports, milestones and incidents are minted by the Composer \u2014 never invent ids. To UPDATE an existing initiative pass its id as `id`; omit it for a new one.",
+    about: "BICon initiative composer. Collect the required fields, then rate every sub-dimension 0\u2013100 (higher = more of the named quality) and a confidence per dimension. Dimension scores are DERIVED (mean of subs) \u2014 never ask the user for them. Values are used verbatim; enum values must match exactly; unknown keys are rejected. Dates: talk dd/mm/yyyy with the user (dd/mm/yyyy, dd.mm.yyyy and yyyy-mm-dd are all accepted; stored as yyyy-mm-dd). Row ids of decision-log entries, status reports, milestones, risks, follow-ups and incidents are minted by the Composer \u2014 never invent ids; an id you give a milestone or risk is only a label inside the spec, for a follow-up's milestoneId / riskId. To UPDATE an existing initiative pass its id as `id`; omit it for a new one.",
     requiredFields: REQUIRED_FIELDS,
     enums: {
       status: STATUS_VALUES,
@@ -9868,7 +10017,8 @@ function buildSchemaDescriptor(sectionShapes) {
     },
     optionalSections: OPTIONAL_SECTIONS,
     // Exact shapes of the object/array sections (aiAct, economics, actuals,
-    // decisionLog, statusReports, requiredSkills, capabilityImpacts, milestones). Keys ending in "?" are
+    // decisionLog, statusReports, requiredSkills, capabilityImpacts,
+    // milestones, risks, followUps). Keys ending in "?" are
     // optional; "enum[a|b]" lists the allowed values; "<key>" marks a map.
     // Pass these sections as JSON objects/arrays. Any key not listed is
     // rejected with its path.
@@ -9964,7 +10114,7 @@ var parseIfString = (v) => typeof v === "string" ? tryParseJson(v) : v;
 function wireSection(inner, description) {
   return external_exports.preprocess(parseIfString, deepStrict(inner)).describe(description);
 }
-var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts", "milestones"];
+var SECTION_KEYS = ["aiAct", "economics", "actuals", "decisionLog", "statusReports", "requiredSkills", "capabilityImpacts", "milestones", "risks", "followUps"];
 var SECTION_SCHEMAS = Object.fromEntries(
   SECTION_KEYS.map((k) => [k, contractSection(k)])
 );
@@ -9975,7 +10125,9 @@ var SECTION_DESCRIPTIONS = {
   decisionLog: "Decision log entries \u2014 see sectionShapes.decisionLog. Entry ids are minted by the Composer \u2014 leave them out. Dates dd/mm/yyyy or yyyy-mm-dd.",
   statusReports: "Status reports \u2014 see sectionShapes.statusReports. Report ids are minted by the Composer \u2014 leave them out. Dates dd/mm/yyyy or yyyy-mm-dd.",
   capabilityImpacts: "Capability links [{capabilityId, kind: improve|new|replace|retire, maturityTo?}]. maturityTo 1\u20135 = level reached (omit = the capability's target; never for retire). capabilityId: a capability of the map, from read_portfolio_context \u2192 lists.capabilities; without the context leave the list empty.",
-  milestones: "Milestones (max 30, title \u2264300 chars): baselineDate = the plan, forecastDate = today's expectation (omit = baseline), doneDate = reached. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted. An update replaces the list: send all.",
+  milestones: `Milestones (max 30, title \u2264300 chars): baselineDate = the plan, forecastDate = today's expectation (omit = baseline), doneDate = reached. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "m1") is a label a follow-up's milestoneId can point at. An update replaces the list: send all.`,
+  risks: `Risks (max 50, title \u2264300 chars): category delivery|vendor|data|people|regulatory|technical|financial; probability and impact 1\u20135 as whole numbers (score = product); status open|mitigating|closed|occurred (occurred = an issue, with occurredDate); residualProbability + residualImpact = the expectation after mitigation (both or neither); owner (free text), mitigation (the plan), raisedDate, reviewDate, note. Dates dd/mm/yyyy or yyyy-mm-dd; ids minted \u2014 an id you give (e.g. "r1") is a label a follow-up's riskId can point at. An update replaces the list: send all.`,
+  followUps: "Follow-ups (max 50, title \u2264300 chars): who does what by when \u2014 title, dueDate, assigneeName (free text; assigneeUserId only when the user gives a member id from the app), doneDate once done, note; milestoneId / riskId = the id label of a milestone or risk in THIS spec (the Composer keeps the link when it mints the stored ids). Dates dd/mm/yyyy or yyyy-mm-dd; ids minted. An update replaces the list: send all.",
   requiredSkills: "Required skills [{skillId, fte, runFte?}] \u2014 fte is the build-phase demand, the optional runFte the run-team demand after the planned end (absent = build fte continues, 0 = no run demand). skillId must be the id of a skill that exists in the organisation. With the portfolio context the Composer validates it (read_portfolio_context \u2192 lists.skills gives id + name); without it, leave the list empty and link skills in the app."
 };
 var contextWire = () => external_exports.preprocess(parseIfString, external_exports.union([external_exports.string().regex(/^ctx_[0-9a-f]{16}$/, "a contextId looks like ctx_<16 hex>"), external_exports.object({}).passthrough()]));
@@ -10021,6 +10173,8 @@ var compactSpecSchema = external_exports.object({
   requiredSkills: wireSection(SECTION_SCHEMAS.requiredSkills, SECTION_DESCRIPTIONS.requiredSkills).optional(),
   capabilityImpacts: wireSection(SECTION_SCHEMAS.capabilityImpacts, SECTION_DESCRIPTIONS.capabilityImpacts).optional(),
   milestones: wireSection(SECTION_SCHEMAS.milestones, SECTION_DESCRIPTIONS.milestones).optional(),
+  risks: wireSection(SECTION_SCHEMAS.risks, SECTION_DESCRIPTIONS.risks).optional(),
+  followUps: wireSection(SECTION_SCHEMAS.followUps, SECTION_DESCRIPTIONS.followUps).optional(),
   aiRiskTier: external_exports.enum(AI_RISK_TIERS).optional(),
   hitlPosture: external_exports.enum(HITL_POSTURES).optional(),
   dpiaStatus: external_exports.enum(DPIA_STATUSES).optional(),
@@ -10458,15 +10612,74 @@ function assembleInitiative(input, now = /* @__PURE__ */ new Date()) {
     }
     if (m.doneDate && isCalendarDate(m.doneDate) && m.doneDate > today) warnings.push(`milestones.${i}.doneDate: ${m.doneDate} lies in the future \u2014 a done date marks a milestone already reached.`);
   }
+  const risks = spec.risks ?? [];
+  for (const [i, r] of risks.entries()) {
+    if (!r.title.trim()) errors.push(`risks.${i}.title: must not be empty (got only spaces).`);
+    for (const field of ["probability", "impact", "residualProbability", "residualImpact"]) {
+      const v = r[field];
+      if (v !== void 0 && !Number.isInteger(v)) errors.push(`risks.${i}.${field}: must be a whole number 1\u20135 (got ${v}).`);
+    }
+    if (r.residualProbability === void 0 !== (r.residualImpact === void 0)) {
+      errors.push(`risks.${i}: the residual needs both residualProbability and residualImpact \u2014 send the pair, or neither.`);
+    }
+    for (const field of ["raisedDate", "reviewDate", "occurredDate"]) {
+      const v = r[field];
+      if (v !== void 0 && !isCalendarDate(v)) errors.push(`risks.${i}.${field}: "${v}" is not a real calendar date \u2014 dd/mm/yyyy or yyyy-mm-dd`);
+    }
+    if (r.occurredDate !== void 0 && (r.status === "open" || r.status === "mitigating")) {
+      errors.push(`risks.${i}.occurredDate: an open or mitigating risk has not occurred \u2014 set status to occurred (or closed for a resolved issue), or omit the date.`);
+    }
+    if (r.status === "occurred" && r.occurredDate === void 0) {
+      warnings.push(`risks.${i}: status occurred without occurredDate \u2014 the app will show the issue without the date it occurred; send occurredDate (dd/mm/yyyy).`);
+    }
+    if (r.occurredDate && isCalendarDate(r.occurredDate) && r.occurredDate > today) warnings.push(`risks.${i}.occurredDate: ${r.occurredDate} lies in the future \u2014 an issue has already occurred.`);
+  }
+  const followUps = spec.followUps ?? [];
+  const labelCounts = (rows) => {
+    const counts = /* @__PURE__ */ new Map();
+    for (const row of rows) if (row.id !== void 0) counts.set(row.id, (counts.get(row.id) ?? 0) + 1);
+    return counts;
+  };
+  const milestoneLabels = labelCounts(milestones);
+  const riskLabels = labelCounts(risks);
+  const checkLink = (i, field, label, labels, what) => {
+    if (!label) return;
+    const n = labels.get(label) ?? 0;
+    if (n === 0) {
+      errors.push(
+        `followUps.${i}.${field}: "${label}" is not the id of a ${what} in this spec \u2014 give that ${what} an id (any label, e.g. "${field === "milestoneId" ? "m1" : "r1"}") and use it here; the Composer mints the stored ids and keeps the link. The app would clear a link it cannot resolve.`
+      );
+    } else if (n > 1) {
+      errors.push(`followUps.${i}.${field}: "${label}" is the id of ${n} ${what}s in this spec \u2014 ids must be unique for the link to resolve.`);
+    }
+  };
+  for (const [i, f] of followUps.entries()) {
+    if (!f.title.trim()) errors.push(`followUps.${i}.title: must not be empty (got only spaces).`);
+    for (const field of ["dueDate", "doneDate"]) {
+      const v = f[field];
+      if (v !== void 0 && !isCalendarDate(v)) errors.push(`followUps.${i}.${field}: "${v}" is not a real calendar date \u2014 dd/mm/yyyy or yyyy-mm-dd`);
+    }
+    if (f.doneDate && isCalendarDate(f.doneDate) && f.doneDate > today) warnings.push(`followUps.${i}.doneDate: ${f.doneDate} lies in the future \u2014 a done date marks a follow-up already done.`);
+    checkLink(i, "milestoneId", f.milestoneId, milestoneLabels, "milestone");
+    checkLink(i, "riskId", f.riskId, riskLabels, "risk");
+    if (f.assigneeUserId !== void 0 && !f.assigneeName?.trim()) {
+      warnings.push(`followUps.${i}.assigneeUserId: the Composer cannot verify workspace members, and the app clears an id that is not a member of the workspace \u2014 send assigneeName too, so the follow-up keeps its assignee either way.`);
+    }
+  }
   const norm2 = (v) => (v ?? "").trim().toLowerCase();
   const others = context?.initiatives ?? [];
   const ext = norm2(spec.externalId);
   const updates = spec.id !== void 0 || !!ext && others.filter((x) => norm2(x.externalId) === ext).length === 1 || others.some((x) => norm2(x.name) === norm2(spec.name));
-  if (updates && spec.milestones === void 0) {
-    warnings.push("milestones: none sent, and the app will offer this file as an update \u2014 it replaces the initiative's milestones, so any the app holds are removed. Send the full list to keep them.");
-  }
   if (updates) {
-    warnings.push("risks: this file cannot carry risks, and the app will offer it as an update \u2014 any risks the app holds for this initiative are removed. Re-enter them in the app after the import, or add the initiative's details there instead.");
+    for (const [key, what] of [
+      ["milestones", "milestones"],
+      ["risks", "risks"],
+      ["followUps", "follow-ups"]
+    ]) {
+      if (spec[key] === void 0) {
+        warnings.push(`${key}: none sent, and the app will offer this file as an update \u2014 it replaces the initiative's ${what}, so any the app holds are removed. Send the full list to keep them.`);
+      }
+    }
   }
   let businessUnit = spec.businessUnit;
   let aiCategory = spec.aiCategory;
@@ -10506,6 +10719,24 @@ function assembleInitiative(input, now = /* @__PURE__ */ new Date()) {
   }
   const stamp = now.toISOString();
   const aiAct = spec.aiAct;
+  const trimTitles = (rows) => rows?.map((r) => ({ ...r, title: r.title.trim() }));
+  const mintedMilestones = trimTitles(mintNestedIds(spec.milestones, stamp));
+  const mintedRisks = trimTitles(mintNestedIds(spec.risks, stamp));
+  const mintedIdByLabel = (given, minted) => new Map(
+    (given ?? []).flatMap((row, i) => {
+      const minted_ = minted?.[i]?.id;
+      return row.id !== void 0 && minted_ !== void 0 ? [[row.id, minted_]] : [];
+    })
+  );
+  const milestoneIds = mintedIdByLabel(milestones, mintedMilestones);
+  const riskIds = mintedIdByLabel(risks, mintedRisks);
+  const mintedFollowUps = trimTitles(mintNestedIds(spec.followUps, stamp))?.map(
+    ({ milestoneId, riskId, ...f }) => ({
+      ...f,
+      ...milestoneId ? { milestoneId: milestoneIds.get(milestoneId) ?? milestoneId } : {},
+      ...riskId ? { riskId: riskIds.get(riskId) ?? riskId } : {}
+    })
+  );
   const candidate = {
     ...spec,
     id: spec.id ?? randomUUID(),
@@ -10518,7 +10749,9 @@ function assembleInitiative(input, now = /* @__PURE__ */ new Date()) {
     evaluation,
     decisionLog: mintNestedIds(spec.decisionLog, stamp),
     statusReports: mintNestedIds(spec.statusReports, stamp),
-    milestones: mintNestedIds(spec.milestones, stamp)?.map((m) => ({ ...m, title: m.title.trim() })),
+    milestones: mintedMilestones,
+    risks: mintedRisks,
+    followUps: mintedFollowUps,
     aiAct: aiAct ? { ...aiAct, ...aiAct.incidents ? { incidents: mintNestedIds(aiAct.incidents, stamp, true) } : {} } : void 0,
     createdAt: stamp,
     updatedAt: stamp
@@ -10556,7 +10789,7 @@ var IMPORT_INSTRUCTIONS = [
   "2. In the BICon app (signed in to the target organisation), open Import/Export.",
   "3. If the initiative carries EU-AI-Act data, make sure the organisation's EU-AI-Act module is switched on (Settings \u203A AI Act) \u2014 the app strips AI-Act fields while it is off.",
   "4. In the 'Single initiative' card, drop the file (or Browse).",
-  "5. Review the preview \u2014 it should show 0 warnings \u2014 then choose 'Add as new' (or 'Update' when the file carries an existing initiative's id, Initiative ID or name \u2014 the app keeps that initiative's id and creation date, and REPLACES everything else with this file, decision log and status reports included) and Confirm.",
+  "5. Review the preview \u2014 it should show 0 warnings \u2014 then choose 'Add as new' (or 'Update' when the file carries an existing initiative's id, Initiative ID or name \u2014 the app keeps that initiative's id and creation date, and REPLACES everything else with this file, decision log, status reports, milestones, risks and follow-ups included) and Confirm.",
   "6. The initiative appears in the Inventory with the derived dimension scores."
 ].join("\n");
 
@@ -10588,7 +10821,7 @@ function createServer() {
     async () => text({
       capabilities: [
         "strict typed schemas: unknown keys anywhere in the spec are rejected with their exact path (never silently dropped)",
-        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts/milestones) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer",
+        "sections (aiAct/economics/actuals/decisionLog/statusReports/requiredSkills/capabilityImpacts/milestones/risks/followUps) accept a JSON object/array or the same JSON as a string; row ids are minted by the Composer, and a follow-up's milestoneId / riskId names a milestone or risk of the same spec by the id label given there",
         "dates accepted as dd/mm/yyyy, dd.mm.yyyy or yyyy-mm-dd (stored as yyyy-mm-dd)",
         "get_initiative_schema: sectionShapes, aiActVocabularies, portfolio-mode wording overlays",
         "AI-Act vocabulary and id-format enforcement with the allowed values in the error",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bicon/mcp-composer",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "description": "MCP server that helps an AI client compose a valid BICon portfolio initiative and hand it back as an import file (draft-first, no auth, no API calls).",
   "license": "UNLICENSED",
   "author": "BICon Establishment",