@ngocsangairvds/vsaf 3.2.14 → 3.2.16

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/publishers/confluence_publisher.py

@@ -1,3048 +0,0 @@
-"""Publish audit results to Confluence using vds-cli.
-
-TSK-170B: Enhanced with publish mode (update|create-only) and attachments index.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import hashlib
-import json
-import re
-import tempfile
-import xml.etree.ElementTree as ET
-from collections.abc import Awaitable, Callable
-from dataclasses import dataclass, field
-from enum import StrEnum
-from html import escape
-from pathlib import Path
-from typing import TYPE_CHECKING, Any, TypeVar
-
-from structlog import get_logger
-
-from vds_audit_orchestrator.errors import DataSourceError
-from vds_audit_orchestrator.publishers.bitbucket_link_resolver import BitbucketLinkResolver
-from vds_audit_orchestrator.publishers.checklist_renderer import FullChecklistRenderer
-from vds_audit_orchestrator.publishers.macro_builder import ConfluenceMacroBuilder
-from vds_audit_orchestrator.publishers.markdown_converter import to_storage
-from vds_audit_orchestrator.publishers.priority_renderer import PriorityActionsRenderer
-
-if TYPE_CHECKING:
-    from vds_audit_orchestrator.clients.confluence_cli_client import ConfluenceCliClient
-    from vds_audit_orchestrator.models.checklist import AuditChecklist
-
-logger = get_logger(__name__)
-
-T = TypeVar("T")
-
-
-class PublishMode(StrEnum):
-    """TSK-170B: Publish mode for Confluence pages.
-
-    Controls behavior when a page with the same title already exists.
-    """
-
-    UPDATE = "update"  # Update existing page or create new (default)
-    CREATE_ONLY = "create-only"  # Fail if page already exists (safety mode)
-
-
-class UpdateMode(StrEnum):
-    """Upload update mode for run page refresh."""
-
-    FULL = "full"
-    INCREMENTAL = "incremental"
-
-
-class SystemDocSyncPolicy(StrEnum):
-    """Sync policy for hierarchy system-doc publishing."""
-
-    IF_CHANGED = "if-changed"
-    FORCE = "force"
-    DRY_RUN = "dry-run"
-
-
-class HierarchyTarget(StrEnum):
-    """Hierarchy target for deterministic publish placement."""
-
-    REPO = "repo"
-    PROJECT = "project"
-
-
-@dataclass(slots=True)
-class UploadResult:
-    page_id: str
-    page_url: str | None
-    attachments: list[str]
-    reused_existing_page: bool = False
-    attachments_index: list[dict[str, str]] = field(default_factory=list)  # TSK-170B
-    update_mode: str = UpdateMode.FULL.value
-    effective_update_mode: str = UpdateMode.FULL.value
-    counters: dict[str, int | str] = field(default_factory=dict)
-    fallback_reason: str | None = None
-    project_root_page_id: str | None = None
-    audit_root_page_id: str | None = None
-    repo_root_page_id: str | None = None
-    repo_run_page_id: str | None = None
-    project_analysis_root_page_id: str | None = None
-    project_aggregate_page_id: str | None = None
-    sections_rendered: list[str] = field(default_factory=list)  # TSK-940.75
-
-
-@dataclass(slots=True)
-class _IncrementalPlan:
-    rows_changed: int
-    rows_unchanged: int
-    changed_attachments: set[str]
-    unchanged_attachments: set[str]
-    template_hash: str | None
-    evidence_hash: str | None
-
-
-_SECTION_MARKERS: tuple[str, ...] = (
-    "summary",
-    "top_findings",
-    "priority_actions",
-    "checklist_core",
-    "checklist_details",
-    "readiness_executive_summary",
-    "readiness_severity_matrix",
-    "readiness_improvement_forecast",
-    "readiness_recommendations",
-)
-_SECTION_TAG_PREFIX = "VDS:SECTION"
-_SYNC_META_PREFIX = "VDS:SYNC-META"
-_VERSION_CONFLICT_MAX_RETRIES = 2
-_SECTION_FALLBACK_START_PATTERNS: dict[str, str] = {
-    "summary": r"<h2>\s*Audit Checklist Summary\s*</h2>",
-    "top_findings": r"<h2>\s*Top Findings \(Checklist\).*?</h2>",
-    "checklist_core": r"<h2>\s*Checklist Tổng hợp\s*</h2>",
-    "checklist_details": (
-        r"(?:"
-        r"<ac:structured-macro[^>]*ac:name=\"expand\"[^>]*>\s*"
-        r"<ac:parameter[^>]*ac:name=\"title\">Chi tiết lý do và minh chứng</ac:parameter>"
-        r"|"
-        r"<h2>\s*Chi tiết lý do và minh chứng\s*</h2>"
-        r")"
-    ),
-}
-_SECTION_FALLBACK_BOUNDARY_PATTERNS: dict[str, tuple[str, ...]] = {
-    "summary": (
-        _SECTION_FALLBACK_START_PATTERNS["top_findings"],
-        _SECTION_FALLBACK_START_PATTERNS["checklist_core"],
-        _SECTION_FALLBACK_START_PATTERNS["checklist_details"],
-        r"<h2>\s*Summary\s*</h2>",
-        r"<h2>\s*Provenance\s*</h2>",
-    ),
-    "top_findings": (
-        _SECTION_FALLBACK_START_PATTERNS["checklist_core"],
-        _SECTION_FALLBACK_START_PATTERNS["checklist_details"],
-        r"<h2>\s*Summary\s*</h2>",
-        r"<h2>\s*Provenance\s*</h2>",
-    ),
-    "checklist_core": (
-        _SECTION_FALLBACK_START_PATTERNS["checklist_details"],
-        r"<h[1-6]\b[^>]*>",
-        r"<h2>\s*Summary\s*</h2>",
-        r"<h2>\s*Provenance\s*</h2>",
-    ),
-    "checklist_details": (
-        r"<h[1-6]\b[^>]*>",
-        r"<h2>\s*Summary\s*</h2>",
-        r"<h2>\s*Provenance\s*</h2>",
-    ),
-}
-
-
-class ConfluencePublisher:
-    """Publish markdown reports and attachments to Confluence."""
-
-    client: ConfluenceCliClient
-    _retries: int
-    _backoff: float
-
-    def __init__(
-        self,
-        client: ConfluenceCliClient,
-        *,
-        retries: int = 2,
-        backoff: float = 1.0,
-        state_dsn: str | None = None,
-    ):
-        self.client = client
-        self._retries = retries
-        self._backoff = backoff
-        self._last_sections_rendered: list[str] = []
-        # P161-F TSK-161.24: Session-level caches to minimize Confluence API calls.
-        self._cached_space_key: str | None = None
-        self._verified_parents: set[str] = set()
-        # Phase 154: Registry integration — create sync state store when DSN available
-        if state_dsn:
-            from vds_audit_orchestrator.state.store import PostgresStateStore
-
-            self._state_store: Any | None = PostgresStateStore(state_dsn)
-        else:
-            self._state_store = None
-
-    # ------------------------------------------------------------------
-    # Phase 154: Page registry helpers
-    # ------------------------------------------------------------------
-
-    def _register_page(
-        self,
-        project_key: str,
-        repo_key: str,
-        hierarchy_role: str,
-        confluence_page_id: str,
-        confluence_page_title: str | None = None,
-        parent_page_id: str | None = None,
-        space_key: str | None = None,
-    ) -> None:
-        """Register a published page in the Postgres registry.
-
-        No-op when ``_state_store`` is None (backward-compat / test mode).
-        P161-F TSK-161.23: passes *space_key* through to the store when known.
-        """
-        if self._state_store is None:
-            return
-        # P161-F TSK-161.23: resolve space_key from session cache when not
-        # explicitly provided by the caller.
-        _effective_space_key = space_key or self._cached_space_key
-        try:
-            self._state_store.register_published_page(
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-                confluence_page_id=confluence_page_id,
-                confluence_page_title=confluence_page_title,
-                parent_page_id=parent_page_id,
-                space_key=_effective_space_key,
-            )
-        except Exception:
-            logger.warning(
-                "page_registry_register_failed",
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-                confluence_page_id=confluence_page_id,
-            )
-
-    def _lookup_page(
-        self,
-        project_key: str,
-        repo_key: str,
-        hierarchy_role: str,
-    ) -> dict[str, Any] | None:
-        """Look up a page from the Postgres registry.
-
-        Returns None when ``_state_store`` is None (backward-compat / test mode).
-        """
-        if self._state_store is None:
-            return None
-        try:
-            return self._state_store.lookup_published_page(
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-            )
-        except Exception:
-            logger.warning(
-                "page_registry_lookup_failed",
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-            )
-            return None
-
-    async def _page_exists(self, page_id: str) -> bool:
-        """Check if a Confluence page exists by ID.
-
-        P161-F TSK-161.24: Returns True immediately for already-verified parents
-        within the same publisher session (0 API calls on subsequent checks).
-
-        Uses ``_retry`` with fail-open behavior: returns False on any error
-        so the caller falls through to CQL-based resolution.
-        """
-        # Session-level verified parents cache
-        if page_id in self._verified_parents:
-            return True
-        try:
-            page = await self._retry(
-                lambda: self.client.get_content_page(page_id),
-                page_id=page_id,
-                action="page_exists_check",
-            )
-            exists = page is not None and bool(page.get("id"))
-            if exists:
-                self._verified_parents.add(page_id)
-            return exists
-        except Exception:
-            logger.warning("page_exists_check_failed", page_id=page_id)
-            return False
-
-    async def _get_page_parent_id(self, page_id: str) -> str | None:
-        """Return the immediate parent page ID from Confluence ancestors.
-
-        Phase 156: Used to verify that a page is under the expected parent
-        before deciding whether to move it.  Returns ``None`` on any failure
-        so callers fall through gracefully.
-        """
-        try:
-            page = await self._retry(
-                lambda: self.client.get_page(page_id, expand="ancestors"),
-                page_id=page_id,
-                action="get_page_ancestors",
-            )
-            if isinstance(page, dict):
-                ancestors = page.get("ancestors")
-                if isinstance(ancestors, list) and ancestors:
-                    last_ancestor = ancestors[-1]
-                    if isinstance(last_ancestor, dict) and last_ancestor.get("id"):
-                        return str(last_ancestor["id"])
-        except Exception:
-            logger.warning("get_page_parent_id_failed", page_id=page_id)
-        return None
-
-    async def _move_page_if_parent_mismatched(
-        self,
-        page_id: str,
-        expected_parent_id: str,
-    ) -> bool:
-        """Check if *page_id* lives under *expected_parent_id*; move it if not.
-
-        Phase 156: After ``update_run_page`` updates the body, this method
-        verifies the Confluence parent matches the hierarchy target and
-        reparents the page when they diverge.
-
-        Returns ``True`` when the page was actually moved, ``False`` otherwise
-        (already correct or move failed).
-        """
-        actual_parent_id = await self._get_page_parent_id(page_id)
-        if not actual_parent_id or actual_parent_id == expected_parent_id:
-            return False
-
-        logger.info(
-            "page_parent_mismatch_detected",
-            page_id=page_id,
-            actual_parent_id=actual_parent_id,
-            expected_parent_id=expected_parent_id,
-        )
-        try:
-            await self._retry(
-                lambda: self.client.move_page_to_parent(page_id, expected_parent_id),
-                page_id=page_id,
-                new_parent_id=expected_parent_id,
-                action="move_page_to_parent",
-            )
-            logger.info(
-                "page_moved_to_correct_parent",
-                page_id=page_id,
-                old_parent_id=actual_parent_id,
-                new_parent_id=expected_parent_id,
-            )
-            return True
-        except Exception:
-            logger.warning(
-                "page_move_failed",
-                page_id=page_id,
-                expected_parent_id=expected_parent_id,
-                actual_parent_id=actual_parent_id,
-            )
-            return False
-
-    def _delete_registry_entry(
-        self,
-        project_key: str,
-        repo_key: str,
-        hierarchy_role: str,
-    ) -> None:
-        """Remove a stale registry entry.
-
-        No-op when ``_state_store`` is None.
-        """
-        if self._state_store is None:
-            return
-        try:
-            self._state_store.delete_published_page(
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-            )
-        except Exception:
-            logger.warning(
-                "page_registry_delete_failed",
-                project_key=project_key,
-                repo_key=repo_key,
-                hierarchy_role=hierarchy_role,
-            )
-
-    async def _retry(
-        self,
-        fn: Callable[[], Awaitable[T]],
-        *,
-        retries: int | None = None,
-        base_delay: float | None = None,
-        max_total_api_calls: int = 3,
-        **log_ctx: Any,
-    ) -> T:
-        """Retry vds-cli backed calls (Confluence can be flaky/slow).
-
-        P161-F TSK-161.25: ``max_total_api_calls`` caps the total API calls
-        for a single logical operation to prevent retry compounding when the
-        caller already has its own retry layer.
-        """
-        retries = self._retries if retries is None else retries
-        # Cap retries so total attempts never exceed max_total_api_calls.
-        retries = min(retries, max_total_api_calls - 1)
-        base_delay = self._backoff if base_delay is None else base_delay
-        last_error: str | None = None
-        for attempt in range(retries + 1):
-            try:
-                return await fn()
-            except DataSourceError as exc:
-                last_error = str(exc)
-                # Duplicate-title errors are deterministic; retrying just burns time and
-                # makes the "search existing page" fallback slower.
-                action = str(log_ctx.get("action") or "").lower()
-                if "already exists" in (last_error or "").lower() and action in (
-                    "create_page",
-                    "create_or_update_page",
-                ):
-                    raise
-                if attempt >= retries:
-                    logger.warning("confluence_request_failed", attempt=attempt + 1, error=last_error, **log_ctx)
-                    raise
-                delay = base_delay * (2**attempt)
-                logger.warning(
-                    "confluence_request_retry",
-                    attempt=attempt + 1,
-                    retries=retries,
-                    delay_seconds=delay,
-                    error=last_error,
-                    **log_ctx,
-                )
-                await asyncio.sleep(delay)
-        raise DataSourceError(f"Confluence request failed: {last_error}", context=log_ctx)
-
-    def _is_permission_error(self, error: Exception) -> bool:
-        """Check if an error indicates a permission-denied condition.
-
-        TSK-127.4: Detect permission errors for attachment operations.
-
-        Args:
-            error: Exception to check.
-
-        Returns:
-            True if the error indicates permission was denied.
-        """
-        error_str = str(error).lower()
-        # Check for HTTP 403 status code
-        if hasattr(error, "status_code") and error.status_code == 403:
-            return True
-        # Check for common permission-denied keywords
-        permission_keywords = ("forbidden", "permission", "unauthorized", "not authorized", "access denied")
-        return any(keyword in error_str for keyword in permission_keywords)
-
-    def _build_permission_error_message(self, operation: str, page_id: str) -> str:
-        """Build a clear permission-denied error message with --page-only suggestion.
-
-        TSK-127.4: Provide actionable guidance for permission errors.
-
-        Args:
-            operation: The operation that failed (e.g., 'upload_attachment', 'list_attachments').
-            page_id: The Confluence page ID.
-
-        Returns:
-            Formatted error message with actionable guidance.
-        """
-        return (
-            f"Permission denied during {operation} on page {page_id}. "
-            f"The Confluence API returned a permission error, indicating insufficient permissions "
-            f"for attachment operations. Use --page-only to skip attachments (requires only edit permission)."
-        )
-
-    @staticmethod
-    def extract_page_id(url_or_id: str) -> str:
-        if "pageId=" in url_or_id:
-            return url_or_id.split("pageId=")[1].split("&", maxsplit=1)[0]
-        return url_or_id
-
-    async def _get_space_key(self, page_id: str) -> str:
-        # P161-F TSK-161.24: Return cached space_key if already resolved.
-        if self._cached_space_key is not None:
-            return self._cached_space_key
-        page = await self._retry(
-            lambda: self.client.get_content_page(page_id, expand="space"),
-            page_id=page_id,
-            action="get_content_page",
-        )
-        if not page:
-            raise ValueError(f"Page not found: {page_id}")
-        space = page.get("space") or {}
-        space_key = space.get("key")
-        if not space_key:
-            raise ValueError(f"Space key missing for page {page_id}")
-        self._cached_space_key = str(space_key)
-        return self._cached_space_key
-
-    async def ensure_audit_history(self, parent_id: str, *, title: str = "Audit History") -> str:
-        # Confluence enforces unique page titles per space in many installations.
-        # "Audit History" may already exist in the space, even under a different parent.
-        # Prefer the simple title under the requested parent when possible, otherwise
-        # fall back to a parent-scoped title.
-        scoped_title = f"{title} - {parent_id}"
-
-        for candidate in (title, scoped_title):
-            cql = f'parent={parent_id} and title="{candidate}" and type=page'
-            results = await self._retry(
-                lambda cql=cql: self.client.search_cql(cql, limit=1),
-                cql=cql,
-                action="search_cql",
-            )
-            if results and results[0].get("id"):
-                return str(results[0].get("id"))
-
-        space_key = await self._get_space_key(parent_id)
-        body_path = Path("/tmp/audit-history-body.html")
-        # Enhance parent page with a dynamic dashboard of child audit results
-        dashboard_html = (
-            "<p>Danh sách các báo cáo đánh giá (tự động cập nhật):</p>"
-            '<ac:structured-macro ac:name="detailssummary">'
-            '<ac:parameter ac:name="cql">parent = currentContent() and type = "page"</ac:parameter>'
-            '<ac:parameter ac:name="columns">title,Mức độ trưởng thành,Điểm tổng,Phát hiện Critical/High,✅ Đạt,❌ Không đạt</ac:parameter>'
-            '<ac:parameter ac:name="sortBy">created</ac:parameter>'
-            '<ac:parameter ac:name="reverse">true</ac:parameter>'
-            "</ac:structured-macro>"
-        )
-        body_path.write_text(dashboard_html, encoding="utf-8")
-
-        async def _search_by_title_in_space(page_title: str) -> str | None:
-            cql = f'space="{space_key}" and title="{page_title}" and type=page'
-            results = await self._retry(
-                lambda cql=cql: self.client.search_cql(cql, limit=1),
-                cql=cql,
-                action="search_cql",
-            )
-            if results and results[0].get("id"):
-                return str(results[0].get("id"))
-            return None
-
-        for candidate in (title, scoped_title):
-            try:
-                created = await self._retry(
-                    lambda candidate=candidate: self.client.create_page(
-                        space_key=space_key,
-                        title=candidate,
-                        body_file=body_path,
-                        parent_id=parent_id,
-                    ),
-                    space_key=space_key,
-                    title=candidate,
-                    parent_id=parent_id,
-                    action="create_page",
-                )
-                if created.get("id"):
-                    return str(created.get("id"))
-            except Exception as exc:
-                msg = str(exc).lower()
-                # If Confluence rejects duplicates, locate the existing page by title.
-                if "already exists" in msg:
-                    existing = await _search_by_title_in_space(candidate)
-                    if existing:
-                        return existing
-                    continue
-                # Timeouts are ambiguous: the page may have been created server-side.
-                if "timed out" in msg or "timeout" in msg:
-                    existing = await _search_by_title_in_space(candidate)
-                    if existing:
-                        return existing
-                    continue
-                raise
-
-        raise ValueError(f"Failed to ensure audit history page under parent {parent_id}")
-
-    async def _find_child_page(self, parent_id: str, title: str) -> dict | None:
-        cql = f'parent={parent_id} and title="{title}" and type=page'
-        results = await self._retry(
-            lambda cql=cql: self.client.search_cql(cql, limit=1),
-            cql=cql,
-            action="search_cql",
-        )
-        if results:
-            return results[0]
-        return None
-
-    async def _find_page_in_space(self, space_key: str, title: str) -> dict | None:
-        cql = f'space="{space_key}" and title="{title}" and type=page'
-        results = await self._retry(
-            lambda cql=cql: self.client.search_cql(cql, limit=5),
-            cql=cql,
-            action="search_cql",
-        )
-        if results:
-            return results[0]
-        return None
-
-    @staticmethod
-    def _normalize_hierarchy_key(value: str | None, *, fallback: str) -> str:
-        raw = str(value or "").strip().lower()
-        if not raw:
-            raw = fallback.strip().lower()
-        normalized = re.sub(r"[^a-z0-9]+", "-", raw).strip("-")
-        return normalized or "default"
-
-    @staticmethod
-    def _build_project_display_label(
-        project_name_hint: str | None,
-        project_storage_key: str | None,
-        fallback_key: str,
-    ) -> str:
-        """Build a human-readable project label for page titles.
-
-        When a human-readable name is available and differs from the storage key,
-        returns ``"{name} ({psk})"`` so titles include both the readable name and
-        the unique identifier.  Falls back to just the normalised key when no
-        distinct name is provided.
-
-        Examples::
-
-            _build_project_display_label("Core Payment", "88718943", "88718943")
-            # → "Core Payment (88718943)"
-
-            _build_project_display_label(None, "88718943", "88718943")
-            # → "88718943"
-
-            _build_project_display_label("wf-project", "wf-project", "wf-project")
-            # → "wf-project"  (name == key → no duplication)
-        """
-        psk = str(project_storage_key or fallback_key).strip() or fallback_key
-        name = str(project_name_hint or "").strip()
-        if name and name.lower() != psk.lower():
-            return f"{name} ({psk})"
-        return psk
-
-    async def _ensure_hierarchy_node(
-        self,
-        *,
-        parent_id: str,
-        title: str,
-        body_html: str,
-        project_key: str = "",
-        hierarchy_role: str = "",
-    ) -> str:
-        # Phase 154: Step 1 — Registry lookup (fast path)
-        if project_key and hierarchy_role:
-            entry = self._lookup_page(project_key, "", hierarchy_role)
-            if entry:
-                page_id = str(entry["confluence_page_id"])
-                if await self._page_exists(page_id):
-                    # Phase 156: Verify the registered parent matches the
-                    # expected parent.  If the hierarchy root has changed
-                    # (e.g. project re-parented), move the node and update
-                    # the registry so future lookups are consistent.
-                    registered_parent = str(entry.get("parent_page_id") or "")
-                    expected_parent = str(parent_id)
-                    if registered_parent != expected_parent:
-                        actual_parent = await self._get_page_parent_id(page_id)
-                        moved = False
-                        if actual_parent != expected_parent:
-                            moved = await self._move_page_if_parent_mismatched(page_id, parent_id)
-                        if actual_parent == expected_parent or moved:
-                            self._register_page(
-                                project_key,
-                                "",
-                                hierarchy_role,
-                                page_id,
-                                title,
-                                parent_id,
-                            )
-                    return page_id
-                # Page was deleted externally — purge stale entry and fall through
-                self._delete_registry_entry(project_key, "", hierarchy_role)
-
-        # Step 2 — CQL fallback (existing behavior)
-        existing = await self._find_child_page(parent_id, title)
-        if existing and existing.get("id"):
-            found_id = str(existing.get("id"))
-            self._register_page(project_key, "", hierarchy_role, found_id, title, parent_id)
-            return found_id
-
-        space_key = await self._get_space_key(parent_id)
-        existing_in_space = await self._find_page_in_space(space_key, title)
-        if existing_in_space and existing_in_space.get("id"):
-            found_id = str(existing_in_space.get("id"))
-            self._register_page(project_key, "", hierarchy_role, found_id, title, parent_id)
-            return found_id
-
-        # Step 3 — Create new
-        temp_path: Path | None = None
-        try:
-            with tempfile.NamedTemporaryFile(mode="w", suffix=".html", delete=False, encoding="utf-8") as handle:
-                handle.write(body_html)
-                temp_path = Path(handle.name)
-
-            created = await self._retry(
-                lambda: self.client.create_page(
-                    space_key=space_key,
-                    title=title,
-                    body_file=temp_path,
-                    parent_id=parent_id,
-                ),
-                space_key=space_key,
-                title=title,
-                parent_id=parent_id,
-                action="create_page",
-            )
-            if created.get("id"):
-                created_id = str(created.get("id"))
-                self._register_page(project_key, "", hierarchy_role, created_id, title, parent_id)
-                return created_id
-        except Exception as exc:
-            message = str(exc).lower()
-            if "already exists" in message or "timed out" in message or "timeout" in message:
-                for _attempt in range(3):
-                    existing = await self._find_child_page(parent_id, title)
-                    if existing and existing.get("id"):
-                        found_id = str(existing.get("id"))
-                        self._register_page(project_key, "", hierarchy_role, found_id, title, parent_id)
-                        return found_id
-                    existing_in_space = await self._find_page_in_space(space_key, title)
-                    if existing_in_space and existing_in_space.get("id"):
-                        found_id = str(existing_in_space.get("id"))
-                        self._register_page(project_key, "", hierarchy_role, found_id, title, parent_id)
-                        return found_id
-                    await asyncio.sleep(0.5)
-                if "already exists" in message:
-                    raise ValueError(
-                        f"Hierarchy node title conflict for '{title}' under parent '{parent_id}'."
-                    ) from exc
-            raise
-        finally:
-            if temp_path and temp_path.exists():
-                temp_path.unlink()
-
-        raise ValueError(f"Failed to ensure hierarchy node '{title}' under parent {parent_id}")
-
-    async def _resolve_publish_parent(
-        self,
-        *,
-        parent_id: str,
-        page_title: str,
-        project_storage_key: str | None,
-        repo_storage_key: str | None,
-        hierarchy_target: str | None,
-        project_name_hint: str | None = None,
-    ) -> tuple[str, dict[str, str]]:
-        resolved_target: HierarchyTarget
-        if hierarchy_target:
-            target_value = hierarchy_target.strip().lower().replace("_", "-")
-            try:
-                resolved_target = HierarchyTarget(target_value)
-            except ValueError as exc:
-                raise ValueError(
-                    f"Invalid hierarchy target: {hierarchy_target}. Use '{HierarchyTarget.REPO.value}' or "
-                    f"'{HierarchyTarget.PROJECT.value}'."
-                ) from exc
-        elif repo_storage_key:
-            resolved_target = HierarchyTarget.REPO
-        else:
-            resolved_target = HierarchyTarget.PROJECT
-
-        project_root_id = parent_id
-        project_key = self._normalize_hierarchy_key(project_storage_key, fallback=project_root_id)
-        lineage: dict[str, str] = {"project_root_page_id": project_root_id}
-
-        if resolved_target == HierarchyTarget.PROJECT:
-            display_label = self._build_project_display_label(project_name_hint, project_storage_key, project_key)
-            analysis_title = f"Project Analysis - {display_label}"
-            analysis_root_id = await self._ensure_hierarchy_node(
-                parent_id=project_root_id,
-                title=analysis_title,
-                body_html=(
-                    "<p>Deterministic project analysis root for aggregate audit reports.</p>"
-                    f"<p>project_storage_key: {escape(project_key)}</p>"
-                ),
-                project_key=project_key,
-                hierarchy_role="analysis_root",
-            )
-            lineage["project_analysis_root_page_id"] = analysis_root_id
-            lineage["project_analysis_title"] = analysis_title
-            return analysis_root_id, lineage
-
-        str(project_storage_key or project_key).strip() or project_key
-        project_page_id = str(parent_id).strip() or project_root_id
-        display_label = self._build_project_display_label(project_name_hint, project_storage_key, project_key)
-        audit_root_title = f"Project Audit - {display_label}"
-        audit_root_id = await self._ensure_hierarchy_node(
-            parent_id=project_root_id,
-            title=audit_root_title,
-            body_html=(
-                "<p>Deterministic audit root for repository reports.</p>"
-                f"<p>project_storage_key: {escape(project_key)}</p>"
-                f"<p>project_page_id: {escape(project_page_id)}</p>"
-            ),
-            project_key=project_key,
-            hierarchy_role="audit_root",
-        )
-        repo_key = self._normalize_hierarchy_key(repo_storage_key, fallback=page_title)
-        lineage["audit_root_page_id"] = audit_root_id
-        lineage["repo_root_page_id"] = audit_root_id
-        lineage["repo_root_title"] = audit_root_title
-        lineage["repo_report_title"] = page_title
-        lineage["repo_storage_key"] = repo_key
-        return audit_root_id, lineage
-
-    async def create_run_page(
-        self,
-        *,
-        parent_id: str,
-        title: str,
-        report_dir: Path,
-        markdown_path: Path,
-        thread_id: str | None = None,
-        priority_actions_limit: int = 10,
-        checklist_collapsed: bool = False,
-    ) -> str:
-        space_key = await self._get_space_key(parent_id)
-        body_html = self._build_run_body_html(
-            report_dir=report_dir,
-            markdown_path=markdown_path,
-            thread_id=thread_id,
-            priority_actions_limit=priority_actions_limit,
-            checklist_collapsed=checklist_collapsed,
-        )
-        body_path = markdown_path.with_suffix(".storage.html")
-        body_path.write_text(body_html, encoding="utf-8")
-        upserted = await self._retry(
-            lambda: self.client.create_or_update_page(
-                space_key=space_key,
-                title=title,
-                body_file=body_path,
-                parent_id=parent_id,
-            ),
-            space_key=space_key,
-            title=title,
-            parent_id=parent_id,
-            action="create_or_update_page",
-        )
-        upserted_id = upserted.get("id") if isinstance(upserted, dict) else None
-        if upserted_id is None:
-            raise ValueError(f"Confluence create_or_update_page returned no page id for title '{title}'")
-        return str(upserted_id)
-
-    async def update_run_page(
-        self,
-        *,
-        page_id: str,
-        title: str,
-        report_dir: Path,
-        markdown_path: Path,
-        thread_id: str | None = None,
-        priority_actions_limit: int = 10,
-        checklist_collapsed: bool = False,
-    ) -> str:
-        body_html = self._build_run_body_html(
-            report_dir=report_dir,
-            markdown_path=markdown_path,
-            thread_id=thread_id,
-            priority_actions_limit=priority_actions_limit,
-            checklist_collapsed=checklist_collapsed,
-        )
-        body_path = markdown_path.with_suffix(".storage.html")
-        body_path.write_text(body_html, encoding="utf-8")
-        page = await self._retry(
-            lambda: self.client.get_content_page(page_id, expand="title,version"),
-            page_id=page_id,
-            action="get_content_page",
-        )
-        version = None
-        if isinstance(page, dict):
-            current_version = page.get("version") or {}
-            if isinstance(current_version, dict):
-                number = current_version.get("number")
-                if isinstance(number, int):
-                    version = number + 1
-        resolved_title = self._resolve_update_title(page if isinstance(page, dict) else {}, title)
-        await self._retry(
-            lambda: self.client.update_page(
-                page_id,
-                title=resolved_title,
-                body_file=body_path,
-                version=version,
-            ),
-            page_id=page_id,
-            title=resolved_title,
-            version=version,
-            action="update_page",
-        )
-        return page_id
-
-    @staticmethod
-    def _section_start(key: str) -> str:
-        return f"<!-- {_SECTION_TAG_PREFIX}:{key}:START -->"
-
-    @staticmethod
-    def _section_end(key: str) -> str:
-        return f"<!-- {_SECTION_TAG_PREFIX}:{key}:END -->"
-
-    def _wrap_section(self, key: str, content: str) -> str:
-        return "\n".join([self._section_start(key), content, self._section_end(key)])
-
-    def _replace_section(self, content: str, key: str, replacement: str) -> tuple[str, bool]:
-        start = re.escape(self._section_start(key))
-        end = re.escape(self._section_end(key))
-        pattern = re.compile(f"{start}.*?{end}", flags=re.DOTALL)
-        wrapped = self._wrap_section(key, replacement)
-        updated, count = pattern.subn(lambda _match: wrapped, content, count=1)
-        if count == 0:
-            return self._replace_section_without_markers(content, key, replacement)
-        return updated, count > 0
-
-    def _replace_section_without_markers(self, content: str, key: str, replacement: str) -> tuple[str, bool]:
-        start_pattern = _SECTION_FALLBACK_START_PATTERNS.get(key)
-        if not start_pattern:
-            return content, False
-        start_match = re.search(start_pattern, content, flags=re.DOTALL | re.IGNORECASE)
-        if not start_match:
-            return self._insert_section_without_markers(content, key, replacement)
-
-        start_index = start_match.start()
-        end_index = len(content)
-        for boundary_pattern in _SECTION_FALLBACK_BOUNDARY_PATTERNS.get(key, ()):
-            boundary_match = re.search(boundary_pattern, content[start_match.end() :], flags=re.DOTALL | re.IGNORECASE)
-            if boundary_match:
-                candidate_end = start_match.end() + boundary_match.start()
-                end_index = min(end_index, candidate_end)
-        wrapped = self._wrap_section(key, replacement)
-        updated = f"{content[:start_index]}{wrapped}{content[end_index:]}"
-        return updated, True
-
-    def _insert_section_without_markers(self, content: str, key: str, replacement: str) -> tuple[str, bool]:
-        wrapped = self._wrap_section(key, replacement)
-        for boundary_pattern in _SECTION_FALLBACK_BOUNDARY_PATTERNS.get(key, ()):
-            boundary_match = re.search(boundary_pattern, content, flags=re.DOTALL | re.IGNORECASE)
-            if boundary_match:
-                index = boundary_match.start()
-                updated = f"{content[:index]}{wrapped}{content[index:]}"
-                return updated, True
-        updated = f"{content}{wrapped}"
-        return updated, True
-
-    def _append_to_section(self, content: str, key: str, new_content: str) -> tuple[str, bool]:
-        """Append *new_content* inside an existing section, before the END marker.
-
-        Returns ``(updated_body, True)`` when the section was found and
-        appended to, or ``(content, False)`` when the section does not exist.
-        """
-        end_marker = self._section_end(key)
-        end_escaped = re.escape(end_marker)
-        pattern = re.compile(f"({end_escaped})", flags=re.DOTALL)
-        # Insert new_content (with a preceding newline) just before the END marker.
-        updated, count = pattern.subn(lambda match: f"\n{new_content}\n{match.group(1)}", content, count=1)
-        return updated, count > 0
-
-    def _extract_section_content(self, body: str, key: str) -> str | None:
-        """Extract the inner content of a ``VDS:SECTION`` block.
-
-        Returns the text between the START and END markers (exclusive),
-        or ``None`` when the section is not present.
-        """
-        start = re.escape(self._section_start(key))
-        end = re.escape(self._section_end(key))
-        pattern = re.compile(f"{start}(.*?){end}", flags=re.DOTALL)
-        match = pattern.search(body)
-        if not match:
-            return None
-        return match.group(1)
-
-    async def read_section(self, page_id: str, section_key: str) -> str | None:
-        """Fetch a page and return the content of a single managed section.
-
-        Convenience wrapper around :meth:`_extract_section_content` that
-        handles the Confluence API round-trip.  Returns ``None`` when the
-        page cannot be loaded or the section is absent.
-        """
-        page = await self._retry(
-            lambda: self.client.get_content_page(page_id, expand="body.storage"),
-            page_id=page_id,
-            action="read_section",
-        )
-        if not isinstance(page, dict):
-            return None
-        body = self._extract_storage_body(page)
-        if not body:
-            return None
-        return self._extract_section_content(body, section_key)
-
-    @staticmethod
-    def _extract_storage_body(page_payload: dict[str, Any]) -> str | None:
-        body = page_payload.get("body")
-        if not isinstance(body, dict):
-            return None
-        storage = body.get("storage")
-        if not isinstance(storage, dict):
-            return None
-        value = storage.get("value")
-        if isinstance(value, str):
-            return value
-        return None
-
-    @staticmethod
-    def _extract_version(page_payload: dict[str, Any]) -> int | None:
-        version = page_payload.get("version")
-        if not isinstance(version, dict):
-            return None
-        number = version.get("number")
-        if isinstance(number, int):
-            return number + 1
-        return None
-
-    @staticmethod
-    def _extract_version_number(page_payload: dict[str, Any]) -> int | None:
-        version = page_payload.get("version")
-        if not isinstance(version, dict):
-            return None
-        number = version.get("number")
-        if isinstance(number, int):
-            return number
-        return None
-
-    @staticmethod
-    def _resolve_update_title(page_payload: dict[str, Any], desired_title: str) -> str | None:
-        """Omit the title on exact page-id updates when it is unchanged.
-
-        Some Confluence deployments can reject an update-by-id if the request
-        redundantly resubmits an unchanged title that is duplicated elsewhere.
-        When the current page already has the desired title, perform a
-        body/version-only update instead.
-        """
-        current_title = page_payload.get("title")
-        if isinstance(current_title, str) and current_title.strip() == desired_title.strip():
-            return None
-        return desired_title
-
-    @staticmethod
-    def _is_confluence_version_conflict(exc: DataSourceError) -> bool:
-        """Detect optimistic-lock conflicts returned by Confluence update APIs."""
-        context = exc.context if isinstance(exc.context, dict) else {}
-        context_blob = " ".join(str(value) for value in context.values())
-        text = f"{exc}\n{context_blob}".lower()
-        has_conflict_signal = "409" in text or "conflict" in text
-        has_version_signal = "version" in text or "optimistic" in text
-        return has_conflict_signal and has_version_signal
-
-    async def _update_page_storage_with_version_retry(
-        self,
-        *,
-        page_id: str,
-        title: str,
-        action: str,
-        failure_reason_prefix: str,
-        body_suffix: str,
-        build_body: Callable[[dict[str, Any]], tuple[str | None, str | None]],
-        max_conflict_retries: int = _VERSION_CONFLICT_MAX_RETRIES,
-    ) -> tuple[bool, str | None]:
-        """Reload page/version and retry update when Confluence reports version conflicts."""
-        max_attempts = max_conflict_retries + 1
-        for attempt in range(1, max_attempts + 1):
-            page = await self._retry(
-                lambda: self.client.get_content_page(page_id, expand="body.storage,version"),
-                page_id=page_id,
-                action="get_content_page",
-            )
-            if not isinstance(page, dict):
-                return False, f"{failure_reason_prefix}_page_load_failed"
-
-            body_html, failure_reason = build_body(page)
-            if body_html is None:
-                return False, failure_reason or f"{failure_reason_prefix}_body_build_failed"
-
-            with tempfile.NamedTemporaryFile(mode="w", suffix=body_suffix, delete=False, encoding="utf-8") as f:
-                f.write(body_html)
-                body_path = Path(f.name)
-
-            version = self._extract_version(page)
-            resolved_title = self._resolve_update_title(page, title)
-            try:
-                await self._retry(
-                    lambda _t=resolved_title, _b=body_path, _v=version: self.client.update_page(
-                        page_id,
-                        title=_t,
-                        body_file=_b,
-                        version=_v,
-                    ),
-                    page_id=page_id,
-                    title=resolved_title,
-                    version=version,
-                    action=action,
-                    retries=0,
-                )
-                return True, None
-            except DataSourceError as exc:
-                if self._is_confluence_version_conflict(exc):
-                    if attempt < max_attempts:
-                        logger.warning(
-                            "confluence_update_version_conflict_retry",
-                            page_id=page_id,
-                            action=action,
-                            attempt=attempt,
-                            max_attempts=max_attempts,
-                            error=str(exc),
-                        )
-                        continue
-                    logger.warning(
-                        "confluence_update_version_conflict_exhausted",
-                        page_id=page_id,
-                        action=action,
-                        max_attempts=max_attempts,
-                        error=str(exc),
-                    )
-                    return False, f"{failure_reason_prefix}_version_conflict_retry_exhausted"
-                raise
-            finally:
-                if body_path.exists():
-                    body_path.unlink()
-        return False, f"{failure_reason_prefix}_version_conflict_retry_exhausted"
-
-    @staticmethod
-    def _sha256_text(value: str) -> str:
-        return hashlib.sha256(value.encode("utf-8")).hexdigest()
-
-    def _extract_sync_meta_hash(self, content: str) -> str | None:
-        pattern = re.compile(
-            rf"<!--\s*{re.escape(_SYNC_META_PREFIX)}:rendered_hash=([a-fA-F0-9]{{64}})\s*-->",
-            flags=re.IGNORECASE,
-        )
-        match = pattern.search(content)
-        if not match:
-            return None
-        return match.group(1).lower()
-
-    def _build_sync_meta_comment(self, rendered_hash: str) -> str:
-        return f"<!-- {_SYNC_META_PREFIX}:rendered_hash={rendered_hash} -->"
-
-    def _extract_managed_hash(self, content: str, managed_keys: tuple[str, ...]) -> str | None:
-        chunks: list[str] = []
-        for key in managed_keys:
-            start = re.escape(self._section_start(key))
-            end = re.escape(self._section_end(key))
-            match = re.search(f"{start}.*?{end}", content, flags=re.DOTALL)
-            if not match:
-                return None
-            chunks.append(match.group(0))
-        chunks.append(self._extract_sync_meta_hash(content) or "")
-        return self._sha256_text("\n".join(chunks))
-
-    def _patch_managed_sections(
-        self,
-        *,
-        existing_body: str,
-        managed_sections: dict[str, str],
-        managed_keys: tuple[str, ...],
-        rendered_hash: str,
-        allow_backfill: bool,
-    ) -> tuple[str, bool]:
-        patched = existing_body
-        replaced = 0
-        missing: list[str] = []
-        for key in managed_keys:
-            replacement = managed_sections.get(key)
-            if replacement is None:
-                missing.append(key)
-                continue
-            patched_candidate, changed = self._replace_section(patched, key, replacement)
-            if changed:
-                patched = patched_candidate
-                replaced += 1
-            else:
-                missing.append(key)
-
-        if replaced == 0 and not allow_backfill:
-            return existing_body, False
-
-        if missing and allow_backfill:
-            appended = [patched.rstrip()]
-            for key in managed_keys:
-                if key in missing and managed_sections.get(key) is not None:
-                    appended.append(self._wrap_section(key, managed_sections[key]))
-            patched = "\n\n".join([part for part in appended if part])
-
-        sync_meta_comment = self._build_sync_meta_comment(rendered_hash)
-        existing_meta_hash = self._extract_sync_meta_hash(patched)
-        if existing_meta_hash:
-            meta_pattern = re.compile(
-                rf"<!--\s*{re.escape(_SYNC_META_PREFIX)}:rendered_hash=[a-fA-F0-9]{{64}}\s*-->",
-                flags=re.IGNORECASE,
-            )
-            patched = meta_pattern.sub(sync_meta_comment, patched, count=1)
-        else:
-            patched = f"{patched.rstrip()}\n{sync_meta_comment}\n"
-
-        return patched, True
-
-    @staticmethod
-    def _normalize_text(text: str) -> str:
-        return "\n".join(line.rstrip() for line in text.replace("\r\n", "\n").split("\n")).strip()
-
-    async def update_run_page_incremental(
-        self,
-        *,
-        page_id: str,
-        title: str,
-        report_dir: Path,
-        markdown_path: Path,
-        thread_id: str | None = None,
-        priority_actions_limit: int = 10,
-        checklist_collapsed: bool = False,
-    ) -> tuple[bool, str | None]:
-        """Patch only deterministic sections in existing storage HTML."""
-        checklist, _ = self._load_audit_checklist(report_dir)
-        skipped_sections: list[str] = []
-        section_updates: dict[str, str] = {}
-
-        summary_html = self._render_summary_html(checklist=checklist, report_dir=report_dir)
-        if summary_html:
-            section_updates["summary"] = summary_html
-
-        top_findings_html = self._render_top_findings_html(checklist=checklist, report_dir=report_dir)
-        if top_findings_html:
-            section_updates["top_findings"] = top_findings_html
-
-        if checklist:
-            resolver = self._build_bitbucket_resolver_from_report_dir(report_dir)
-            knowledge_ref_map = self._build_knowledge_ref_map_from_checklist(checklist)
-            priority_renderer = PriorityActionsRenderer(bitbucket_link_resolver=resolver)
-            priority_html = priority_renderer.render(checklist, limit=priority_actions_limit)
-            if priority_html:
-                section_updates["priority_actions"] = priority_html
-
-            checklist_renderer = FullChecklistRenderer(
-                bitbucket_link_resolver=resolver,
-                knowledge_ref_map=knowledge_ref_map or None,
-            )
-            checklist_core_html = checklist_renderer.render_core(checklist)
-            checklist_details_html = checklist_renderer.render_details(checklist, collapsed=checklist_collapsed)
-            if checklist_core_html:
-                section_updates["checklist_core"] = checklist_core_html
-            if checklist_details_html:
-                section_updates["checklist_details"] = checklist_details_html
-        else:
-            skipped_sections = ["priority_actions", "checklist_core", "checklist_details"]
-            logger.warning(
-                "incremental_patch_checklist_missing",
-                report_dir=str(report_dir),
-                skipped_sections=skipped_sections,
-                page_id=page_id,
-            )
-
-        for readiness_key, readiness_html in self._render_readiness_sections(report_dir).items():
-            if readiness_html:
-                section_updates[readiness_key] = readiness_html
-
-        def _build_incremental_body(page_payload: dict[str, Any]) -> tuple[str | None, str | None]:
-            existing_body = self._extract_storage_body(page_payload)
-            if not existing_body:
-                return None, "incremental_missing_storage_body"
-
-            if not checklist:
-                has_existing_checklist_section = any(
-                    self._extract_section_content(existing_body, key) is not None
-                    for key in ("checklist_core", "checklist_details")
-                )
-                if has_existing_checklist_section:
-                    return None, "incremental_missing_checklist_for_existing_sections"
-
-            patched = existing_body
-            patched_count = 0
-            for key in _SECTION_MARKERS:
-                replacement = section_updates.get(key)
-                if not replacement:
-                    continue
-                patched, changed = self._replace_section(patched, key, replacement)
-                if changed:
-                    patched_count += 1
-
-            if patched_count == 0:
-                return None, "incremental_unpatchable_content"
-            return patched, None
-
-        self._last_sections_rendered = [key for key in _SECTION_MARKERS if key in section_updates]
-        updated, failure_reason = await self._update_page_storage_with_version_retry(
-            page_id=page_id,
-            title=title,
-            action="update_page_incremental",
-            failure_reason_prefix="incremental",
-            body_suffix=".incremental.storage.html",
-            build_body=_build_incremental_body,
-        )
-        if updated:
-            # Keep the canonical local storage artifact in sync with the live page body so
-            # manual inspection does not lag behind successful incremental publishes.
-            body_html = self._build_run_body_html(
-                report_dir=report_dir,
-                markdown_path=markdown_path,
-                thread_id=thread_id,
-                priority_actions_limit=priority_actions_limit,
-                checklist_collapsed=checklist_collapsed,
-            )
-            markdown_path.with_suffix(".storage.html").write_text(body_html, encoding="utf-8")
-        return updated, failure_reason
-
-    def _build_run_body_html(
-        self,
-        *,
-        report_dir: Path,
-        markdown_path: Path,
-        thread_id: str | None = None,
-        priority_actions_limit: int = 10,
-        checklist_collapsed: bool = False,
-    ) -> str:
-        """Build Confluence storage HTML for the run page.
-
-        Phase 33 Structure:
-        1. Score Summary Panel (Page Properties)
-        2. Priority Actions Section
-        3. Full Checklist Table (Collapsible)
-        4. Markdown Report Content
-        5. Provenance Block
-        6. Attachments
-        """
-        try:
-            body_html = to_storage(markdown_path.read_text(encoding="utf-8"))
-        except Exception:
-            body_html = ""
-
-        parts: list[str] = []
-        sections_rendered: list[str] = []
-
-        # Phase 144Q: Targeted run banner (shown when --target was used)
-        targeted_banner = self._render_targeted_run_banner(report_dir)
-        if targeted_banner:
-            parts.append(targeted_banner)
-            sections_rendered.append("targeted_run_banner")
-
-        # Try to load AuditChecklist for rich rendering
-        checklist, _ = self._load_audit_checklist(report_dir)
-
-        # 1. Summary section
-        summary_html = self._render_summary_html(checklist=checklist, report_dir=report_dir)
-        if summary_html:
-            parts.append(self._wrap_section("summary", summary_html))
-            sections_rendered.append("summary")
-
-        # 2. Top Findings section (always attempt; falls back to workflow/xlsx sources)
-        top_findings_html = self._render_top_findings_html(checklist=checklist, report_dir=report_dir)
-        if top_findings_html:
-            parts.append(self._wrap_section("top_findings", top_findings_html))
-            sections_rendered.append("top_findings")
-
-        if checklist:
-            # AC-144Q.1.4: Build Bitbucket resolver and knowledge ref map for rich rendering
-            resolver = self._build_bitbucket_resolver_from_report_dir(report_dir)
-            knowledge_ref_map = self._build_knowledge_ref_map_from_checklist(checklist)
-
-            # 3. Priority Actions (TSK-332)
-            priority_renderer = PriorityActionsRenderer(bitbucket_link_resolver=resolver)
-            priority_html = priority_renderer.render(checklist, limit=priority_actions_limit)
-            if priority_html:
-                parts.append(self._wrap_section("priority_actions", priority_html))
-                sections_rendered.append("priority_actions")
-
-            # 4. Full Checklist (TSK-330)
-            checklist_renderer = FullChecklistRenderer(
-                bitbucket_link_resolver=resolver,
-                knowledge_ref_map=knowledge_ref_map or None,
-            )
-            checklist_core_html = checklist_renderer.render_core(checklist)
-            checklist_details_html = checklist_renderer.render_details(checklist, collapsed=checklist_collapsed)
-            if checklist_core_html:
-                parts.append(self._wrap_section("checklist_core", checklist_core_html))
-                sections_rendered.append("checklist_core")
-            if checklist_details_html:
-                parts.append(self._wrap_section("checklist_details", checklist_details_html))
-                sections_rendered.append("checklist_details")
-        else:
-            logger.warning(
-                "run_page_checklist_missing",
-                report_dir=str(report_dir),
-                skipped_sections=["priority_actions", "checklist_core", "checklist_details"],
-            )
-            # Render synthesis-based critique as fallback (Phase 109)
-            critique_html = self._render_synthesis_critique(report_dir)
-            if critique_html:
-                parts.append(self._wrap_section("synthesis_critique", critique_html))
-                sections_rendered.append("synthesis_critique")
-
-        # Optional readiness sections (Phase 85)
-        for readiness_key, readiness_html in self._render_readiness_sections(report_dir).items():
-            if readiness_html:
-                parts.append(self._wrap_section(readiness_key, readiness_html))
-                sections_rendered.append(readiness_key)
-
-        # 5. Markdown content
-        if body_html:
-            parts.append(body_html)
-            sections_rendered.append("markdown")
-
-        # 6. Provenance block
-        provenance_html = self._render_provenance_html(
-            checklist=checklist,
-            report_dir=report_dir,
-            thread_id=thread_id,
-        )
-        if provenance_html:
-            parts.append(provenance_html)
-            sections_rendered.append("provenance")
-
-        # 7. Attachments
-        parts.append(self._render_attachments_macro_html())
-
-        # TSK-940.75: Record which sections were rendered for observability.
-        self._last_sections_rendered = sections_rendered
-
-        rendered = "\n".join(parts)
-        if not self.validate_storage_format(rendered):
-            logger.warning(
-                "confluence_storage_format_validation_failed",
-                report_dir=str(report_dir),
-                markdown_path=str(markdown_path),
-            )
-        return rendered
-
-    @staticmethod
-    def validate_storage_format(html: str) -> bool:
-        """Validate Confluence storage body as parseable XHTML fragment."""
-        if not html.strip():
-            return True
-
-        wrapped = (
-            '<root xmlns:ac="http://atlassian.com/content" '
-            'xmlns:ri="http://atlassian.com/resource/identifier" '
-            'xmlns:at="http://atlassian.com/template">'
-            f"{html}"
-            "</root>"
-        )
-        try:
-            ET.fromstring(wrapped)
-            return True
-        except ET.ParseError:
-            return False
-
-    def _load_audit_checklist(self, report_dir: Path) -> tuple[AuditChecklist | None, str | None]:
-        """Load AuditChecklist from checklist artifacts (best-effort).
-
-        Preference order:
-        1) audit-checklist.json (canonical)
-        2) audit_checklist_*.json (workflow artifacts)
-        """
-        from vds_audit_orchestrator.models.checklist import AuditChecklist
-
-        checklist_json = self._newest_named(report_dir, "audit-checklist.json")
-        if not checklist_json:
-            matches = sorted(
-                report_dir.rglob("audit_checklist_*.json"),
-                key=lambda p: p.stat().st_mtime,
-                reverse=True,
-            )
-            checklist_json = matches[0] if matches else None
-        if not checklist_json:
-            logger.warning(
-                "checklist_file_not_found",
-                report_dir=str(report_dir),
-                expected_names=["audit-checklist.json", "audit_checklist_*.json"],
-                reason="no_matching_artifact",
-            )
-            return None, None
-
-        try:
-            payload = json.loads(checklist_json.read_text(encoding="utf-8"))
-            return AuditChecklist.model_validate(payload), checklist_json.name
-        except Exception as e:
-            logger.warning("checklist_load_failed", path=str(checklist_json), error=str(e))
-            return None, None
-
-    @staticmethod
-    def _build_bitbucket_resolver_from_report_dir(report_dir: Path) -> BitbucketLinkResolver | None:
-        """AC-144Q.1.4: Build a BitbucketLinkResolver from report_dir path convention.
-
-        Repo cache path convention: ~/.vds/cache/repos/<BB_PROJECT>-project/<repo>/runs/<thread_id>/
-        The project key is extracted from the '<BB_PROJECT>-project' segment immediately after
-        the 'repos' directory; the repo slug is the segment after that.
-        Falls back to workflow-summary.json 'repo_key' when the path does not follow the convention.
-        Returns None when identity cannot be determined.
-        """
-        parts = report_dir.resolve().parts
-        try:
-            repos_idx = parts.index("repos")
-        except ValueError:
-            return None
-
-        if repos_idx + 2 < len(parts):
-            project_segment = parts[repos_idx + 1]  # e.g. "PAR-project"
-            repo_slug = parts[repos_idx + 2]  # e.g. "merchant-billing"
-            if project_segment.endswith("-project"):
-                project_key = project_segment[: -len("-project")].upper()
-                if project_key and repo_slug:
-                    return BitbucketLinkResolver(project_key=project_key, repo_slug=repo_slug)
-
-        return None
-
-    @staticmethod
-    def _build_knowledge_ref_map_from_checklist(checklist: Any | None) -> dict[str, tuple[str, str]]:
-        """AC-144Q.3.1: Build a chunk_id -> (url, title) map from checklist evidence refs.
-
-        Iterates all rows' evidence_refs and collects refs that have a chunk_id and page_title,
-        using source_url as the URL.  Refs without a chunk_id are skipped.
-        Returns an empty dict when checklist is None or has no qualifying refs.
-        """
-        knowledge_ref_map: dict[str, tuple[str, str]] = {}
-        if checklist is None:
-            return knowledge_ref_map
-        rows = getattr(checklist, "rows", None) or []
-        for row in rows:
-            evidence_refs = getattr(row, "evidence_refs", None) or []
-            for ref in evidence_refs:
-                chunk_id = str(getattr(ref, "chunk_id", "") or "").strip()
-                page_title = str(getattr(ref, "page_title", "") or "").strip()
-                source_url = str(getattr(ref, "source_url", "") or "").strip()
-                if chunk_id and page_title:
-                    knowledge_ref_map[chunk_id] = (source_url, page_title)
-        return knowledge_ref_map
-
-    def _load_readiness_report(self, report_dir: Path) -> Any | None:
-        """Load readiness-report.json as ReadinessReport model when present."""
-        from vds_audit_orchestrator.models.readiness import ReadinessReport
-
-        readiness_json = self._newest_named(report_dir, "readiness-report.json")
-        if not readiness_json:
-            return None
-        try:
-            payload = json.loads(readiness_json.read_text(encoding="utf-8"))
-            return ReadinessReport.model_validate(payload)
-        except Exception as exc:
-            logger.warning("readiness_report_load_failed", path=str(readiness_json), error=str(exc))
-            return None
-
-    def _render_readiness_sections(self, report_dir: Path) -> dict[str, str]:
-        """Render readiness sections for run page extension when artifact is available."""
-        from vds_audit_orchestrator.publishers.readiness_renderer import ReadinessConfluenceRenderer
-
-        readiness_report = self._load_readiness_report(report_dir)
-        if readiness_report is None:
-            return {}
-        try:
-            return ReadinessConfluenceRenderer().render_sections(readiness_report)
-        except Exception as exc:
-            logger.warning("readiness_section_render_failed", report_dir=str(report_dir), error=str(exc))
-            return {}
-
-    @staticmethod
-    def _newest_named(report_dir: Path, name: str) -> Path | None:
-        """Find the newest file with the given name in report_dir."""
-        matches = list(report_dir.rglob(name))
-        if not matches:
-            return None
-        return max(matches, key=lambda p: p.stat().st_mtime)
-
-    def _render_targeted_run_banner(self, report_dir: Path) -> str | None:
-        """Phase 144Q: Render a banner when this is a targeted (partial) run.
-
-        Reads workflow-summary.json to detect is_targeted_run and the target_selector.
-        Returns None when no targeted run flag is present.
-        """
-        workflow_json = self._newest_named(report_dir, "workflow-summary.json")
-        if not workflow_json:
-            return None
-        try:
-            payload = json.loads(workflow_json.read_text(encoding="utf-8"))
-        except Exception:
-            return None
-        if not isinstance(payload, dict):
-            return None
-        if not payload.get("is_targeted_run"):
-            return None
-        target_selector = str(payload.get("target_selector") or "").strip()
-        if not target_selector:
-            return None
-        return "\n".join(
-            [
-                '<ac:structured-macro ac:name="info"><ac:rich-text-body>',
-                f"<p>Targeted run: rows matching selector &quot;{escape(target_selector)}&quot; only.</p>",
-                "</ac:rich-text-body></ac:structured-macro>",
-            ]
-        )
-
-    def _render_summary_html(
-        self,
-        *,
-        checklist: AuditChecklist | None,
-        report_dir: Path,
-    ) -> str | None:
-        """Render Audit Checklist Summary section (TSK-182).
-
-        Includes:
-        - Overall score (percentage and 1-5 scale)
-        - Maturity level indicator
-        - Pass/Partial/Fail/NA/Error row counts
-        - Critical findings count
-        """
-        if not checklist:
-            # Fall back to workflow-summary.json for basic stats
-            return self._render_summary_from_workflow(report_dir)
-
-        # Determine maturity level based on score
-        score = checklist.overall_score
-        if score >= 90:
-            maturity = "Exemplary"
-            maturity_color = "Green"
-            maturity_subtle = False
-        elif score >= 70:
-            maturity = "Established"
-            maturity_color = "Green"
-            maturity_subtle = True
-        elif score >= 50:
-            maturity = "Developing"
-            maturity_color = "Yellow"
-            maturity_subtle = True
-        elif score >= 30:
-            maturity = "Initial"
-            maturity_color = "Yellow"
-            maturity_subtle = True
-        else:
-            maturity = "Ad-hoc"
-            maturity_color = "Red"
-            maturity_subtle = False
-
-        critical_count = sum(
-            1 for r in checklist.rows if r.status.value == "FAIL" and (r.severity or "").lower() in ("critical", "high")
-        )
-
-        # Build Status macros
-        pass_macro = ConfluenceMacroBuilder.status_macro(str(checklist.pass_count), "Green", subtle=True)
-        partial_macro = ConfluenceMacroBuilder.status_macro(str(checklist.partial_count), "Yellow", subtle=True)
-        fail_macro = ConfluenceMacroBuilder.status_macro(str(checklist.fail_count), "Red", subtle=False)
-        na_macro = ConfluenceMacroBuilder.status_macro(str(checklist.na_count), "Grey", subtle=True)
-
-        maturity_macro = ConfluenceMacroBuilder.status_macro(maturity, maturity_color, subtle=maturity_subtle)
-
-        # Build table rows for Page Properties
-        rows = [
-            f"<tr><td><strong>Overall Score (Điểm tổng)</strong></td><td><strong>{score:.1f}%</strong> ({checklist.overall_score_1_5:.1f}/5)</td></tr>",
-            f"<tr><td><strong>Maturity Level (Mức độ trưởng thành)</strong></td><td>{maturity_macro}</td></tr>",
-            f"<tr><td><strong>Total Checks (Tổng kiểm tra)</strong></td><td>{checklist.total_rows}</td></tr>",
-            f"<tr><td>Pass (✅ Đạt)</td><td>{pass_macro}</td></tr>",
-            f"<tr><td>Partial (⚠️ Một phần)</td><td>{partial_macro}</td></tr>",
-            f"<tr><td>Fail (❌ Không đạt)</td><td>{fail_macro}</td></tr>",
-            f"<tr><td>N/A (➖ KHÔNG ÁP DỤNG)</td><td>{na_macro}</td></tr>",
-        ]
-
-        if checklist.error_count > 0:
-            error_macro = ConfluenceMacroBuilder.status_macro(str(checklist.error_count), "Red", subtle=False)
-            rows.append(f"<tr><td>🔴 Lỗi</td><td>{error_macro}</td></tr>")
-
-        if critical_count > 0:
-            crit_macro = ConfluenceMacroBuilder.status_macro(str(critical_count), "Red", subtle=False)
-            rows.append(f"<tr><td><strong>Phát hiện Critical/High</strong></td><td>{crit_macro}</td></tr>")
-
-        table_body = f"<table><tbody>{''.join(rows)}</tbody></table>"
-        return "\n".join(
-            [
-                "<h2>Audit Checklist Summary</h2>",
-                ConfluenceMacroBuilder.page_properties_macro(table_body),
-            ]
-        )
-
-    def _render_summary_from_workflow(self, report_dir: Path) -> str | None:
-        """Fallback summary rendering from workflow-summary.json.
-
-        Produces rich Confluence content with Page Properties macro, Status
-        badges, and maturity level derivation — matching the same visual
-        quality as the checklist-based path.
-        """
-        workflow_json = self._newest_named(report_dir, "workflow-summary.json")
-        if not workflow_json:
-            return None
-
-        try:
-            payload = json.loads(workflow_json.read_text(encoding="utf-8"))
-            if not isinstance(payload, dict):
-                return None
-
-            # Extract score — try top-level then synthesis fallback
-            overall_score = payload.get("overall_score") or payload.get("score")
-            synthesis = payload.get("synthesis") if isinstance(payload.get("synthesis"), dict) else {}
-            if overall_score is None:
-                overall_score = synthesis.get("score")
-            if overall_score is None:
-                return None
-
-            score = float(overall_score)
-
-            # Derive maturity level using same thresholds as checklist path
-            if score >= 90:
-                maturity, maturity_color, maturity_subtle = "Exemplary", "Green", False
-            elif score >= 70:
-                maturity, maturity_color, maturity_subtle = "Established", "Green", True
-            elif score >= 50:
-                maturity, maturity_color, maturity_subtle = "Developing", "Yellow", True
-            elif score >= 30:
-                maturity, maturity_color, maturity_subtle = "Initial", "Yellow", True
-            else:
-                maturity, maturity_color, maturity_subtle = "Ad-hoc", "Red", False
-
-            # Override with explicit maturity_level if present
-            explicit_maturity = payload.get("maturity_level")
-            if explicit_maturity:
-                maturity = str(explicit_maturity)
-
-            maturity_macro = ConfluenceMacroBuilder.status_macro(maturity, maturity_color, subtle=maturity_subtle)
-
-            # Build table rows
-            rows: list[str] = [
-                f"<tr><td><strong>Overall Score (Điểm tổng)</strong></td><td><strong>{score:.1f}%</strong></td></tr>",
-                f"<tr><td><strong>Maturity Level (Mức độ trưởng thành)</strong></td><td>{maturity_macro}</td></tr>",
-            ]
-
-            # Source indicator
-            source = payload.get("summary_score_source", "")
-            if source:
-                rows.append(f"<tr><td><strong>Score Source</strong></td><td>{escape(str(source))}</td></tr>")
-
-            # Total checks / count fields — use explicit or infer from rows_evaluated
-            total_checks = payload.get("total_checks") or payload.get("rows_evaluated")
-            if total_checks is not None:
-                rows.append(f"<tr><td><strong>Total Checks (Tổng kiểm tra)</strong></td><td>{total_checks}</td></tr>")
-
-            # Count fields with Status macros (matching checklist style)
-            count_fields = [
-                ("pass_count", "Pass (✅ Đạt)", "Green"),
-                ("partial_count", "Partial (⚠️ Một phần)", "Yellow"),
-                ("fail_count", "Fail (❌ Không đạt)", "Red"),
-                ("na_count", "N/A (➖ KHÔNG ÁP DỤNG)", "Grey"),
-                ("error_count", "🔴 Lỗi", "Red"),
-            ]
-            for key, label, color in count_fields:
-                value = payload.get(key)
-                if value is not None:
-                    subtle = color not in ("Red",)
-                    count_macro = ConfluenceMacroBuilder.status_macro(str(value), color, subtle=subtle)
-                    rows.append(f"<tr><td>{label}</td><td>{count_macro}</td></tr>")
-
-            # Synthesis-derived metadata (repository name, total findings)
-            repo_name = payload.get("repository")
-            if repo_name:
-                rows.append(f"<tr><td><strong>Repository</strong></td><td>{escape(str(repo_name))}</td></tr>")
-
-            total_findings = payload.get("total_findings") or synthesis.get("total_findings")
-            if total_findings is not None and int(total_findings) > 0:
-                findings_macro = ConfluenceMacroBuilder.status_macro(str(total_findings), "Yellow", subtle=True)
-                rows.append(f"<tr><td><strong>Total Findings</strong></td><td>{findings_macro}</td></tr>")
-
-            table_body = f"<table><tbody>{''.join(rows)}</tbody></table>"
-            return "\n".join(
-                [
-                    "<h2>Audit Checklist Summary</h2>",
-                    ConfluenceMacroBuilder.page_properties_macro(table_body),
-                ]
-            )
-        except Exception:
-            return None
-
-    def _render_synthesis_critique(self, report_dir: Path) -> str | None:
-        """Render synthesis-based critique from workflow-summary.json.
-
-        Extracts gaps and aligned_practices from the synthesis field and
-        renders them as a structured Confluence panel (Phase 109 fallback
-        when audit-checklist.json is unavailable).
-        """
-        workflow_json = self._newest_named(report_dir, "workflow-summary.json")
-        if not workflow_json:
-            return None
-
-        try:
-            payload = json.loads(workflow_json.read_text(encoding="utf-8"))
-            if not isinstance(payload, dict):
-                return None
-
-            synthesis = payload.get("synthesis") if isinstance(payload.get("synthesis"), dict) else {}
-            if not synthesis:
-                return None
-
-            gaps = synthesis.get("gaps", [])
-            aligned = synthesis.get("aligned_practices", [])
-            status = synthesis.get("status", "")
-
-            if not gaps and not aligned:
-                return None
-
-            parts: list[str] = ["<h2>Synthesis Critique (Đánh giá tổng hợp)</h2>"]
-
-            # Info macro for synthesis status
-            if status:
-                status_color = "Green" if status == "complete" else "Yellow"
-                parts.append(
-                    f"<p>Synthesis Status: {ConfluenceMacroBuilder.status_macro(status, status_color, subtle=True)}</p>"
-                )
-
-            # Gaps section
-            if gaps:
-                parts.append("<h3>Identified Gaps (Khoảng trống)</h3>")
-                parts.append(
-                    ConfluenceMacroBuilder.info_macro(
-                        title="Gaps Requiring Attention",
-                        body=self._render_synthesis_items_html(gaps, empty_label="No gaps captured."),
-                        icon="warning",
-                    )
-                )
-
-            # Aligned practices section
-            if aligned:
-                parts.append("<h3>Aligned Practices (Thực hành phù hợp)</h3>")
-                parts.append(
-                    ConfluenceMacroBuilder.info_macro(
-                        title="Aligned Practices",
-                        body=self._render_synthesis_items_html(aligned, empty_label="No aligned practices captured."),
-                        icon="check",
-                    )
-                )
-
-            return "\n".join(parts)
-        except Exception:
-            return None
-
-    def _render_synthesis_items_html(self, items: list[Any], *, empty_label: str) -> str:
-        structured_items = [item for item in items if isinstance(item, dict)]
-        if structured_items:
-            rows: list[str] = []
-            for item in structured_items:
-                check_id = escape(str(item.get("check_id") or item.get("row_id") or item.get("id") or "-"))
-                severity = self._build_severity_macro_text(str(item.get("severity") or ""))
-                finding = escape(
-                    str(
-                        item.get("finding") or item.get("title") or item.get("reason") or item.get("description") or "-"
-                    ).strip()
-                )
-                rows.append(f"<tr><td><code>{check_id}</code></td><td>{severity}</td><td>{finding}</td></tr>")
-            return (
-                "<table><thead><tr><th>Check</th><th>Severity</th><th>Finding</th></tr></thead>"
-                f"<tbody>{''.join(rows)}</tbody></table>"
-            )
-
-        text_items = [escape(str(item)) for item in items if item]
-        if text_items:
-            return "<ul>" + "".join(f"<li>{item}</li>" for item in text_items) + "</ul>"
-        return f"<p>{escape(empty_label)}</p>"
-
-    def _render_top_findings_html(
-        self,
-        *,
-        checklist: AuditChecklist | None,
-        report_dir: Path,
-        limit: int = 10,
-        bitbucket_link_resolver: Any = None,
-    ) -> str | None:
-        """Render top findings table from checklist, workflow summary, or checklist xlsx.
-
-        Args:
-            checklist: Optional audit checklist for rich rendering.
-            report_dir: Directory containing report artifacts.
-            limit: Maximum number of findings to render.
-            bitbucket_link_resolver: Optional BitbucketLinkResolver for source field links.
-        """
-        rows = self._collect_top_findings_rows(checklist=checklist, report_dir=report_dir, limit=limit)
-        if not rows:
-            return None
-
-        headers = ["Trạng thái", "Mức độ", "Phát hiện", "Tham chiếu", "Nguồn"]
-        thead = "<thead><tr>" + "".join(f"<th>{h}</th>" for h in headers) + "</tr></thead>"
-        body_rows: list[str] = []
-        for row in rows:
-            status_macro = self._build_status_macro_text(str(row.get("status", "")))
-            severity_macro = self._build_severity_macro_text(str(row.get("severity", "")))
-            finding = escape(str(row.get("finding", "")).strip())
-            reference = escape(str(row.get("reference", "")).strip())
-            raw_source = str(row.get("source", "")).strip()
-            # TSK-144Q.2: resolve source to Bitbucket URL if it doesn't start with http
-            if bitbucket_link_resolver and not raw_source.startswith("http"):
-                resolved = bitbucket_link_resolver.resolve(raw_source)
-                source = f'<a href="{escape(resolved)}">{escape(raw_source)}</a>' if resolved else escape(raw_source)
-            else:
-                source = escape(raw_source)
-            body_rows.append(
-                "<tr>"
-                f"<td>{status_macro}</td>"
-                f"<td>{severity_macro}</td>"
-                f"<td>{finding}</td>"
-                f"<td>{reference}</td>"
-                f"<td>{source}</td>"
-                "</tr>"
-            )
-
-        return (
-            "<h2>Top Findings (Checklist) / Phát hiện nổi bật (Checklist)</h2>"
-            f"<table>{thead}<tbody>{''.join(body_rows)}</tbody></table>"
-        )
-
-    def _collect_top_findings_rows(
-        self,
-        *,
-        checklist: AuditChecklist | None,
-        report_dir: Path,
-        limit: int,
-    ) -> list[dict[str, str]]:
-        rows: list[dict[str, str]] = []
-        if checklist:
-            actionable = {"FAIL", "PARTIAL", "ERROR"}
-            ranked = [r for r in checklist.rows if r.status.value in actionable]
-            ranked.sort(
-                key=lambda r: (
-                    0 if (r.severity or "").upper() == "CRITICAL" else 1 if (r.severity or "").upper() == "HIGH" else 2,
-                    r.score_percent,
-                )
-            )
-            for row in ranked[:limit]:
-                check_ref = row.check_id or row.row_id
-                evidence_ref = ""
-                if row.evidence_refs:
-                    first = row.evidence_refs[0]
-                    evidence_ref = getattr(first, "ref_value", str(first))
-                rows.append(
-                    {
-                        "status": row.status.value,
-                        "severity": row.severity or "",
-                        "finding": (row.finding or row.reason or "").strip(),
-                        "reference": evidence_ref or check_ref or "",
-                        "source": f"{check_ref or 'row'}",
-                    }
-                )
-            return rows
-
-        # Fallback: workflow-summary.json
-        workflow_json = self._newest_named(report_dir, "workflow-summary.json")
-        if workflow_json:
-            try:
-                payload = json.loads(workflow_json.read_text(encoding="utf-8"))
-                for agent_result in payload.get("agent_results", []) if isinstance(payload, dict) else []:
-                    if not isinstance(agent_result, dict):
-                        continue
-                    agent_name = str(agent_result.get("agent", "agent"))
-                    for finding in (
-                        agent_result.get("findings", []) if isinstance(agent_result.get("findings"), list) else []
-                    ):
-                        if not isinstance(finding, dict):
-                            continue
-                        finding_type = str(finding.get("type", "finding"))
-                        description = str(finding.get("description") or finding.get("title") or "").strip()
-                        location = str(finding.get("location") or finding.get("path") or "").strip()
-                        if not description:
-                            continue
-                        rows.append(
-                            {
-                                "status": "FAIL",
-                                "severity": str(finding.get("severity") or "").upper(),
-                                "finding": description,
-                                "reference": location,
-                                "source": f"{agent_name} / {finding_type} (workflow-summary.json)",
-                            }
-                        )
-                if rows:
-                    return rows[:limit]
-            except Exception:
-                logger.warning("workflow_top_findings_parse_failed", path=str(workflow_json))
-
-        # Fallback: report.md synthesized summary section
-        markdown_report = self._newest_named(report_dir, "report.md")
-        if markdown_report:
-            try:
-                markdown_text = markdown_report.read_text(encoding="utf-8")
-                rows.extend(self._extract_top_findings_from_markdown(markdown_text, limit=limit))
-                if rows:
-                    return rows[:limit]
-            except Exception:
-                logger.warning("markdown_top_findings_parse_failed", path=str(markdown_report))
-
-        # Fallback: audit-checklist.xlsx
-        checklist_xlsx = self._newest_named(report_dir, "audit-checklist.xlsx")
-        if checklist_xlsx:
-            try:
-                from openpyxl import load_workbook
-
-                workbook = load_workbook(checklist_xlsx, data_only=True, read_only=True)
-                sheet = workbook.active
-                if sheet is None:
-                    return rows[:limit]
-                header_row = next(sheet.iter_rows(min_row=1, max_row=1, values_only=True), None)
-                if header_row:
-                    header_map = {
-                        str(cell).strip().lower(): idx for idx, cell in enumerate(header_row) if cell is not None
-                    }
-                    idx_status = header_map.get("status")
-                    idx_severity = header_map.get("severity")
-                    idx_finding = header_map.get("finding")
-                    idx_location = header_map.get("location")
-                    idx_provenance = header_map.get("provenance")
-                    for row_vals in sheet.iter_rows(min_row=2, values_only=True):
-                        if idx_finding is None:
-                            break
-                        finding_val = row_vals[idx_finding] if idx_finding < len(row_vals) else None
-                        if not finding_val:
-                            continue
-                        status_val = (
-                            row_vals[idx_status] if idx_status is not None and idx_status < len(row_vals) else ""
-                        )
-                        severity_val = (
-                            row_vals[idx_severity] if idx_severity is not None and idx_severity < len(row_vals) else ""
-                        )
-                        location_val = (
-                            row_vals[idx_location] if idx_location is not None and idx_location < len(row_vals) else ""
-                        )
-                        provenance_val = (
-                            row_vals[idx_provenance]
-                            if idx_provenance is not None and idx_provenance < len(row_vals)
-                            else ""
-                        )
-                        rows.append(
-                            {
-                                "status": str(status_val or ""),
-                                "severity": str(severity_val or ""),
-                                "finding": str(finding_val),
-                                "reference": str(location_val or ""),
-                                "source": str(provenance_val or ""),
-                            }
-                        )
-                        if len(rows) >= limit:
-                            break
-                workbook.close()
-                if rows:
-                    return rows[:limit]
-            except Exception:
-                logger.warning("xlsx_top_findings_parse_failed", path=str(checklist_xlsx))
-
-        return rows
-
-    def _extract_top_findings_from_markdown(self, markdown_text: str, *, limit: int) -> list[dict[str, str]]:
-        match = re.search(r"^## Top Findings\s*$([\s\S]*?)(?=^##\s|\Z)", markdown_text, flags=re.MULTILINE)
-        if not match:
-            return []
-
-        rows: list[dict[str, str]] = []
-        for line in match.group(1).splitlines():
-            stripped = line.strip()
-            if not stripped.startswith("- "):
-                continue
-            tokens = re.findall(r"`([^`]+)`", stripped)
-            if len(tokens) < 3:
-                continue
-            check_id, status, score = tokens[:3]
-            rows.append(
-                {
-                    "status": status,
-                    "severity": "",
-                    "finding": f"{check_id} scored {score}",
-                    "reference": check_id,
-                    "source": "report.md",
-                }
-            )
-            if len(rows) >= limit:
-                break
-        return rows
-
-    def _build_status_macro_text(self, status: str) -> str:
-        token = status.strip().upper()
-        if token in {"PASS", "PASSED", "ĐẠT"}:
-            return ConfluenceMacroBuilder.status_macro("ĐẠT", "Green", subtle=True)
-        if token in {"PARTIAL", "MỘT PHẦN"}:
-            return ConfluenceMacroBuilder.status_macro("MỘT PHẦN", "Yellow", subtle=True)
-        if token in {"ERROR", "LỖI"}:
-            return ConfluenceMacroBuilder.status_macro("LỖI", "Red", subtle=False)
-        if token in {"NA", "N/A", "KHÔNG ÁP DỤNG"}:
-            return ConfluenceMacroBuilder.status_macro("KHÔNG ÁP DỤNG", "Grey", subtle=True)
-        return ConfluenceMacroBuilder.status_macro("KHÔNG ĐẠT", "Red", subtle=False)
-
-    def _build_severity_macro_text(self, severity: str) -> str:
-        token = severity.strip().upper()
-        if token == "CRITICAL":
-            return ConfluenceMacroBuilder.status_macro("CRITICAL", "Red", subtle=False)
-        if token == "HIGH":
-            return ConfluenceMacroBuilder.status_macro("HIGH", "Red", subtle=True)
-        if token == "MEDIUM":
-            return ConfluenceMacroBuilder.status_macro("MEDIUM", "Yellow", subtle=True)
-        if token == "LOW":
-            return ConfluenceMacroBuilder.status_macro("LOW", "Blue", subtle=True)
-        if token:
-            return ConfluenceMacroBuilder.status_macro(token, "Grey", subtle=True)
-        return "-"
-
-    def _render_provenance_html(
-        self,
-        *,
-        checklist: AuditChecklist | None,
-        report_dir: Path,
-        thread_id: str | None = None,
-    ) -> str | None:
-        """Render Provenance block (TSK-182).
-
-        Includes:
-        - thread-id: Workflow thread identifier
-        - template_hash: SHA256 of template content
-        - template_version: Template version string
-        - evidence_hash: SHA256 of evidence bundle
-        - evaluated_at: Timestamp of evaluation
-        - row_llm_mode: LLM mode used
-        - model: LLM model used (if applicable)
-        """
-        provenance_items: list[tuple[str, str]] = []
-
-        effective_thread_id = thread_id or self._infer_thread_id_from_report_dir(report_dir)
-        if effective_thread_id:
-            provenance_items.append(("Thread ID", effective_thread_id))
-
-        if checklist:
-            provenance_items.extend(
-                [
-                    ("Template", f"{checklist.template_name} v{checklist.template_version}"),
-                    ("Template Hash", checklist.template_hash),
-                    ("Evidence Hash", checklist.evidence_hash),
-                    ("Evaluated At", checklist.generated_at.isoformat() if checklist.generated_at else "N/A"),
-                    ("Row LLM Mode", checklist.row_llm_mode),
-                ]
-            )
-
-            # Extract model from first row with LLM provenance
-            for row in checklist.rows:
-                if row.provenance and row.provenance.model:
-                    provenance_items.append(("LLM Model", row.provenance.model))
-                    break
-        else:
-            # Try to extract from workflow-summary.json
-            workflow_json = self._newest_named(report_dir, "workflow-summary.json")
-            if workflow_json:
-                try:
-                    payload = json.loads(workflow_json.read_text(encoding="utf-8"))
-                    if isinstance(payload, dict):
-                        for key in ("template_hash", "evidence_hash", "row_llm_mode", "model"):
-                            value = payload.get(key)
-                            if value:
-                                label = key.replace("_", " ").title()
-                                provenance_items.append((label, str(value)))
-                        evaluated_at = payload.get("evaluated_at") or payload.get("generated_at")
-                        if evaluated_at:
-                            provenance_items.append(("Evaluated At", str(evaluated_at)))
-                        merge_level = payload.get("merge_level")
-                        if merge_level:
-                            provenance_items.append(("Merge Level", str(merge_level)))
-                        summary_score_source = payload.get("summary_score_source")
-                        if summary_score_source:
-                            provenance_items.append(("Summary Score Source", str(summary_score_source)))
-                        source_runs = payload.get("source_runs")
-                        if isinstance(source_runs, list):
-                            normalized_runs = [str(item).strip() for item in source_runs if str(item).strip()]
-                            if normalized_runs:
-                                provenance_items.append(("Source Runs", ", ".join(normalized_runs[:5])))
-                except Exception:
-                    pass
-
-        if not provenance_items:
-            return None
-
-        out: list[str] = [
-            "<h2>Provenance</h2>",
-            '<ac:structured-macro ac:name="info">',
-            "<ac:rich-text-body>",
-            "<table>",
-            "<tbody>",
-        ]
-
-        for label, value in provenance_items:
-            out.append(f"<tr><td><strong>{escape(label)}</strong></td><td><code>{escape(value)}</code></td></tr>")
-
-        out.extend(
-            [
-                "</tbody>",
-                "</table>",
-                "</ac:rich-text-body>",
-                "</ac:structured-macro>",
-            ]
-        )
-        return "\n".join(out)
-
-    def _infer_thread_id_from_report_dir(self, report_dir: Path) -> str | None:
-        """Infer run/thread identity from standard report directory layout."""
-        parts = report_dir.parts
-        try:
-            repos_idx = parts.index("repos")
-        except ValueError:
-            return None
-        if repos_idx >= 1:
-            candidate = parts[repos_idx - 1].strip()
-            if candidate:
-                return candidate
-        return None
-
-    def _render_attachments_macro_html(self) -> str:
-        # Storage format macro. We intentionally prefer the macro over an explicit list
-        # so the page always reflects the latest attachment state.
-        return "\n".join(
-            [
-                "<h2>Attachments</h2>",
-                '<ac:structured-macro ac:name="attachments">',
-                '<ac:parameter ac:name="old">false</ac:parameter>',
-                "</ac:structured-macro>",
-            ]
-        )
-
-    def _render_attachments_index_html(self, attachments_index: list[dict[str, str]]) -> str:
-        """TSK-170B: Render attachments index section with links to uploaded files.
-
-        Args:
-            attachments_index: List of attachment info dicts with 'name' and 'id' keys.
-
-        Returns:
-            HTML string for attachments index section.
-        """
-        if not attachments_index:
-            return ""
-
-        out = [
-            "<h2>📎 Attachments Index</h2>",
-            "<table><thead><tr><th>File</th><th>Type</th><th>Download</th></tr></thead>",
-            "<tbody>",
-        ]
-
-        for att in attachments_index:
-            name = escape(att.get("name", "Unknown"))
-            ext = Path(name).suffix.lower() if "." in name else ""
-            file_type = {
-                ".xlsx": "Excel Spreadsheet",
-                ".json": "JSON Data",
-                ".md": "Markdown",
-                ".sarif": "SARIF Report",
-                ".pdf": "PDF Document",
-            }.get(ext, "File")
-
-            # Confluence attachment link using ri:attachment
-            link = f'<ac:link><ri:attachment ri:filename="{name}"/><ac:plain-text-link-body><![CDATA[{name}]]></ac:plain-text-link-body></ac:link>'
-            out.append(f"<tr><td>{name}</td><td>{file_type}</td><td>{link}</td></tr>")
-
-        out.append("</tbody></table>")
-        return "\n".join(out)
-
-    @staticmethod
-    def _extract_hash(payload: dict[str, Any]) -> str | None:
-        for key in ("sha256", "content_hash", "hash", "file_sha256"):
-            value = payload.get(key)
-            if isinstance(value, str) and value.strip():
-                return value.strip().lower()
-        return None
-
-    def _load_incremental_plan(self, report_dir: Path) -> tuple[_IncrementalPlan | None, str | None]:
-        meta_path = self._newest_named(report_dir, "audit-checklist.meta.json")
-        delta_path = self._newest_named(report_dir, "audit-checklist.delta.json")
-        if not meta_path or not delta_path:
-            return None, "incremental_missing_meta_or_delta"
-
-        try:
-            meta_payload = json.loads(meta_path.read_text(encoding="utf-8"))
-            delta_payload = json.loads(delta_path.read_text(encoding="utf-8"))
-        except Exception:
-            return None, "incremental_artifact_parse_error"
-        if not isinstance(meta_payload, dict) or not isinstance(delta_payload, dict):
-            return None, "incremental_artifact_invalid_shape"
-
-        meta_template = meta_payload.get("template_hash")
-        delta_template = delta_payload.get("template_hash")
-        if isinstance(meta_template, str) and isinstance(delta_template, str) and meta_template != delta_template:
-            return None, "incremental_template_hash_mismatch"
-
-        meta_evidence = meta_payload.get("evidence_hash")
-        delta_evidence = delta_payload.get("evidence_hash")
-        if isinstance(meta_evidence, str) and isinstance(delta_evidence, str) and meta_evidence != delta_evidence:
-            return None, "incremental_evidence_hash_mismatch"
-
-        changed_rows_raw = delta_payload.get("rows_changed")
-        if not isinstance(changed_rows_raw, int):
-            changed_rows_raw = delta_payload.get("changed_row_count")
-        if not isinstance(changed_rows_raw, int):
-            changed_rows_raw = delta_payload.get("changed_rows")
-            if isinstance(changed_rows_raw, list):
-                changed_rows_raw = len(changed_rows_raw)
-        changed_rows = changed_rows_raw if isinstance(changed_rows_raw, int) and changed_rows_raw >= 0 else None
-        if changed_rows is None:
-            row_changes = delta_payload.get("row_changes")
-            if isinstance(row_changes, list):
-                changed_rows = len(row_changes)
-        if changed_rows is None:
-            return None, "incremental_missing_rows_changed"
-
-        unchanged_rows_raw = delta_payload.get("rows_unchanged")
-        if not isinstance(unchanged_rows_raw, int):
-            unchanged_rows_raw = meta_payload.get("rows_unchanged")
-        if not isinstance(unchanged_rows_raw, int):
-            row_count_raw = meta_payload.get("row_count")
-            if isinstance(row_count_raw, int):
-                unchanged_rows_raw = max(0, row_count_raw - changed_rows)
-        rows_unchanged = unchanged_rows_raw if isinstance(unchanged_rows_raw, int) and unchanged_rows_raw >= 0 else 0
-
-        changed_attachments: set[str] = set()
-        unchanged_attachments: set[str] = set()
-
-        changed_list = delta_payload.get("changed_attachments")
-        if isinstance(changed_list, list):
-            for item in changed_list:
-                if isinstance(item, str):
-                    changed_attachments.add(item.lower())
-                elif isinstance(item, dict):
-                    name = item.get("name") or item.get("title") or item.get("file")
-                    if isinstance(name, str) and name:
-                        changed_attachments.add(name.lower())
-
-        unchanged_list = delta_payload.get("unchanged_attachments")
-        if isinstance(unchanged_list, list):
-            for item in unchanged_list:
-                if isinstance(item, str):
-                    unchanged_attachments.add(item.lower())
-                elif isinstance(item, dict):
-                    name = item.get("name") or item.get("title") or item.get("file")
-                    if isinstance(name, str) and name:
-                        unchanged_attachments.add(name.lower())
-
-        attachments_delta = delta_payload.get("attachments")
-        if isinstance(attachments_delta, list):
-            for item in attachments_delta:
-                if not isinstance(item, dict):
-                    continue
-                name = item.get("name") or item.get("title") or item.get("file")
-                if not isinstance(name, str) or not name:
-                    continue
-                before_hash = item.get("before_hash") or item.get("old_hash")
-                after_hash = item.get("after_hash") or item.get("new_hash") or item.get("content_hash")
-                if isinstance(before_hash, str) and isinstance(after_hash, str):
-                    if before_hash.lower() == after_hash.lower():
-                        unchanged_attachments.add(name.lower())
-                    else:
-                        changed_attachments.add(name.lower())
-
-        return (
-            _IncrementalPlan(
-                rows_changed=changed_rows,
-                rows_unchanged=rows_unchanged,
-                changed_attachments=changed_attachments,
-                unchanged_attachments=unchanged_attachments,
-                template_hash=meta_template if isinstance(meta_template, str) else None,
-                evidence_hash=meta_evidence if isinstance(meta_evidence, str) else None,
-            ),
-            None,
-        )
-
-    @staticmethod
-    def _file_sha256(path: Path) -> str:
-        digest = hashlib.sha256()
-        with path.open("rb") as fh:
-            for chunk in iter(lambda: fh.read(1024 * 1024), b""):
-                digest.update(chunk)
-        return digest.hexdigest()
-
-    def _attachment_payload_hash(self, payload: dict[str, Any]) -> str | None:
-        direct = self._extract_hash(payload)
-        if direct:
-            return direct
-        metadata = payload.get("metadata")
-        if isinstance(metadata, dict):
-            nested = self._extract_hash(metadata)
-            if nested:
-                return nested
-            comment = metadata.get("comment")
-            if isinstance(comment, str):
-                match = re.search(r"sha256[:=]([a-fA-F0-9]{64})", comment)
-                if match:
-                    return match.group(1).lower()
-        return None
-
-    async def extend_run_page_readiness(
-        self,
-        *,
-        page_id: str,
-        title: str,
-        report_dir: Path,
-    ) -> bool:
-        """Append or patch readiness sections on an existing run page."""
-        readiness_sections = self._render_readiness_sections(report_dir)
-        if not readiness_sections:
-            return False
-
-        page = await self._retry(
-            lambda: self.client.get_content_page(page_id, expand="body.storage,version"),
-            page_id=page_id,
-            action="get_content_page",
-        )
-        if not isinstance(page, dict):
-            return False
-        existing_body = self._extract_storage_body(page)
-        if not isinstance(existing_body, str) or not existing_body.strip():
-            return False
-
-        patched = existing_body
-        patched_count = 0
-        for key, replacement in readiness_sections.items():
-            updated, changed = self._replace_section(patched, key, replacement)
-            if changed:
-                patched = updated
-                patched_count += 1
-                continue
-            patched = f"{patched}\n\n{self._wrap_section(key, replacement)}"
-            patched_count += 1
-
-        if patched_count <= 0:
-            return False
-
-        with tempfile.NamedTemporaryFile(
-            mode="w", suffix=".readiness.storage.html", delete=False, encoding="utf-8"
-        ) as f:
-            f.write(patched)
-            temp_path = Path(f.name)
-        try:
-            resolved_title = self._resolve_update_title(page, title)
-            await self._retry(
-                lambda: self.client.update_page(
-                    page_id,
-                    title=resolved_title,
-                    body_file=temp_path,
-                    version=self._extract_version(page),
-                ),
-                page_id=page_id,
-                title=resolved_title,
-                version=self._extract_version(page),
-                action="update_page_readiness_sections",
-            )
-        finally:
-            if temp_path.exists():
-                temp_path.unlink()
-
-        logger.info(
-            "run_page_readiness_extended",
-            page_id=page_id,
-            sections_patched=patched_count,
-            report_dir=str(report_dir),
-        )
-        return True
-
-    async def publish_project_aggregate(
-        self,
-        *,
-        report_dir: Path,
-        parent_page: str,
-        page_title: str,
-        include_attachments: bool = False,
-        project_storage_key: str | None = None,
-        hierarchy_target: str | None = None,
-        project_name_hint: str | None = None,
-    ) -> UploadResult:
-        """Publish project aggregate readiness page under deterministic project hierarchy.
-
-        TSK-940.71 (FR-282): When ``hierarchy_target="repo"``, the aggregate
-        page is placed under the shared ``Project Audit - {key}`` node
-        alongside repo pages (unified hierarchy).  The default
-        (``hierarchy_target="project"`` or ``None``) routes to the separate
-        ``Project Analysis - {key}`` branch.
-
-        ``project_name_hint`` provides the human-readable project name used to
-        generate descriptive page titles such as
-        ``"Project Analysis - Core Payment (88718943)"`` instead of
-        ``"Project Analysis - 88718943"``.
-
-        Phase 127: Default changed to skip attachments (page-only mode).
-        Use --upload-attachments flag to enable attachments.
-        """
-        if self.client.is_degraded:
-            logger.warning(
-                "confluence_upload_skipped_degraded",
-                method="publish_project_aggregate",
-                note="Confluence client is degraded — skipping upload",
-            )
-            return UploadResult(page_id="", page_url=None, attachments=[], fallback_reason="degraded")
-        from vds_audit_orchestrator.models.readiness import ProjectReadinessReport
-        from vds_audit_orchestrator.publishers.project_aggregate_renderer import ProjectAggregateRenderer
-
-        project_readiness_path = self._newest_named(report_dir, "project-readiness.json")
-        if not project_readiness_path:
-            raise ValueError(f"Missing project-readiness.json in {report_dir}")
-        payload = json.loads(project_readiness_path.read_text(encoding="utf-8"))
-        report = ProjectReadinessReport.model_validate(payload)
-        rendered_html = ProjectAggregateRenderer().render_page(report)
-        if not self.validate_storage_format(rendered_html):
-            raise ValueError("Rendered project aggregate storage HTML is invalid.")
-
-        resolved_hierarchy_target = hierarchy_target or HierarchyTarget.PROJECT.value
-        parent_id = self.extract_page_id(parent_page)
-        publish_parent_id, hierarchy_lineage = await self._resolve_publish_parent(
-            parent_id=parent_id,
-            page_title=page_title,
-            project_storage_key=project_storage_key,
-            repo_storage_key=None,
-            hierarchy_target=resolved_hierarchy_target,
-            project_name_hint=project_name_hint,
-        )
-
-        analysis_root_id = str(hierarchy_lineage.get("project_analysis_root_page_id") or "").strip() or None
-        # Match against the deterministic analysis title generated by _resolve_publish_parent
-        # (stored in lineage) so both old-format (PSK only) and new-format (name + PSK) pages
-        # are recognised as the analysis root and not re-created as a child page.
-        _deterministic_analysis_title = str(hierarchy_lineage.get("project_analysis_title") or "").strip()
-        use_analysis_root_as_target = (
-            resolved_hierarchy_target == HierarchyTarget.PROJECT.value
-            and analysis_root_id is not None
-            and bool(_deterministic_analysis_title)
-            and str(page_title).strip() == _deterministic_analysis_title
-        )
-
-        # Phase 154: Registry-first resolution for aggregate pages
-        agg_project_key = self._normalize_hierarchy_key(project_storage_key, fallback=parent_id)
-        agg_registry_hit = False
-        existing_run: dict | None = None
-        if not use_analysis_root_as_target:
-            entry = self._lookup_page(agg_project_key, "", "aggregate")
-            if entry:
-                reg_page_id = str(entry["confluence_page_id"])
-                if await self._page_exists(reg_page_id):
-                    existing_run = {"id": reg_page_id}
-                    agg_registry_hit = True
-                else:
-                    self._delete_registry_entry(agg_project_key, "", "aggregate")
-
-        if not use_analysis_root_as_target and not agg_registry_hit:
-            existing_run = await self._find_child_page(publish_parent_id, page_title)
-        reused_existing_page = bool(existing_run and existing_run.get("id")) or bool(use_analysis_root_as_target)
-        with tempfile.NamedTemporaryFile(
-            mode="w", suffix=".project-aggregate.storage.html", delete=False, encoding="utf-8"
-        ) as f:
-            f.write(rendered_html)
-            body_path = Path(f.name)
-        try:
-            if use_analysis_root_as_target and analysis_root_id is not None:
-                page_id = analysis_root_id
-                page = await self._retry(
-                    lambda: self.client.get_content_page(page_id, expand="title,version"),
-                    title=page_title,
-                    page_id=page_id,
-                    action="get_content_page",
-                )
-                resolved_title = self._resolve_update_title(page if isinstance(page, dict) else {}, page_title)
-                await self._retry(
-                    lambda: self.client.update_page(
-                        page_id,
-                        title=resolved_title,
-                        body_file=body_path,
-                        version=self._extract_version(page if isinstance(page, dict) else {}),
-                    ),
-                    page_id=page_id,
-                    title=resolved_title,
-                    action="update_project_aggregate_page",
-                )
-            elif existing_run and existing_run.get("id"):
-                page_id = str(existing_run.get("id"))
-                page = await self._retry(
-                    lambda: self.client.get_content_page(page_id, expand="title,version"),
-                    title=page_title,
-                    page_id=page_id,
-                    action="get_content_page",
-                )
-                resolved_title = self._resolve_update_title(page if isinstance(page, dict) else {}, page_title)
-                await self._retry(
-                    lambda: self.client.update_page(
-                        page_id,
-                        title=resolved_title,
-                        body_file=body_path,
-                        version=self._extract_version(page if isinstance(page, dict) else {}),
-                    ),
-                    page_id=page_id,
-                    title=resolved_title,
-                    action="update_project_aggregate_page",
-                )
-            else:
-                space_key = await self._get_space_key(publish_parent_id)
-                upserted = await self._retry(
-                    lambda: self.client.create_or_update_page(
-                        space_key=space_key,
-                        title=page_title,
-                        body_file=body_path,
-                        parent_id=publish_parent_id,
-                    ),
-                    space_key=space_key,
-                    title=page_title,
-                    parent_id=publish_parent_id,
-                    action="create_or_update_project_aggregate_page",
-                )
-                page_id_raw = upserted.get("id") if isinstance(upserted, dict) else None
-                if not page_id_raw:
-                    raise ValueError("Confluence create_or_update_page returned no page id for project aggregate page.")
-                page_id = str(page_id_raw)
-                # Register immediately so concurrent uploads find the page via
-                # registry instead of racing through CQL.  The final registration
-                # at the end is an idempotent upsert.
-                self._register_page(
-                    agg_project_key,
-                    "",
-                    "aggregate",
-                    page_id,
-                    page_title,
-                    publish_parent_id,
-                )
-        finally:
-            if body_path.exists():
-                body_path.unlink()
-
-        # Phase 156: Move aggregate page to correct parent when reused from
-        # registry under a different Confluence parent.
-        if reused_existing_page:
-            await self._move_page_if_parent_mismatched(page_id, publish_parent_id)
-
-        uploaded: list[str] = []
-        if include_attachments:
-            for path in report_dir.iterdir():
-                if not path.is_file():
-                    continue
-                if path.name.lower() not in {
-                    "project-readiness.json",
-                    "project-readiness.xlsx",
-                    "project-aggregate.json",
-                    "project-aggregate.xlsx",
-                }:
-                    continue
-                try:
-                    payload_upload = await self._retry(
-                        lambda path=path: self.client.upload_attachment(page_id=page_id, file_path=path),
-                        page_id=page_id,
-                        file_path=str(path),
-                        action="upload_attachment_project_aggregate",
-                    )
-                except DataSourceError as e:
-                    if self._is_permission_error(e):
-                        raise DataSourceError(
-                            self._build_permission_error_message("upload_attachment", page_id),
-                            context={"page_id": page_id, "file_path": str(path), "operation": "attachment_upload"},
-                        ) from e
-                    raise
-
-                attachment_id = payload_upload.get("id") if isinstance(payload_upload, dict) else None
-                if attachment_id:
-                    uploaded.append(str(attachment_id))
-
-        logger.info(
-            "project_aggregate_published",
-            page_id=page_id,
-            parent_id=publish_parent_id,
-            attachments_uploaded=len(uploaded),
-        )
-
-        # Phase 154: Register the aggregate page in the registry
-        self._register_page(
-            agg_project_key,
-            "",
-            "aggregate",
-            page_id,
-            page_title,
-            publish_parent_id,
-        )
-
-        return UploadResult(
-            page_id=page_id,
-            page_url=None,
-            attachments=uploaded,
-            reused_existing_page=reused_existing_page,
-            project_root_page_id=hierarchy_lineage.get("project_root_page_id"),
-            project_analysis_root_page_id=hierarchy_lineage.get("project_analysis_root_page_id"),
-            project_aggregate_page_id=page_id,
-        )
-
-    async def upload_results(
-        self,
-        *,
-        report_dir: Path,
-        parent_page: str,
-        page_title: str,
-        include_attachments: bool = False,
-        thread_id: str | None = None,
-        publish_mode: PublishMode = PublishMode.UPDATE,
-        update_mode: UpdateMode = UpdateMode.FULL,
-        include_attachments_index: bool = False,
-        priority_actions_limit: int = 10,
-        checklist_collapsed: bool = False,
-        project_storage_key: str | None = None,
-        repo_storage_key: str | None = None,
-        hierarchy_target: str | None = None,
-        project_name_hint: str | None = None,
-    ) -> UploadResult:
-        """Upload audit results to Confluence.
-
-        TSK-170B: Enhanced with publish_mode and attachments_index options.
-        Phase 127: Default changed to skip attachments (page-only mode).
-
-        Args:
-            report_dir: Directory containing audit reports.
-            parent_page: Confluence parent page URL or ID.
-            page_title: Title for the audit result page.
-            include_attachments: Upload report attachments. Default is False (page-only mode).
-                Use --upload-attachments flag to enable.
-            thread_id: Workflow thread ID for provenance tracking.
-            publish_mode: 'update' (default) or 'create-only' (fails if page exists).
-            update_mode: 'full' (default) or 'incremental' (delta/meta scoped updates).
-            include_attachments_index: Add attachments index section to page body.
-            project_storage_key: Canonical project key for deterministic hierarchy placement.
-            repo_storage_key: Canonical repo key for deterministic hierarchy placement.
-            hierarchy_target: Optional hierarchy target ('repo' or 'project').
-            project_name_hint: Human-readable project name used to build descriptive hierarchy
-                node titles such as ``"Project Audit - Core Payment (88718943)"``.
-
-        Returns:
-            UploadResult with page_id, attachments, and attachments_index.
-
-        Raises:
-            ValueError: If publish_mode is 'create-only' and page already exists.
-        """
-        if self.client.is_degraded:
-            logger.warning(
-                "confluence_upload_skipped_degraded",
-                method="upload_results",
-                note="Confluence client is degraded — skipping upload",
-            )
-            return UploadResult(page_id="", page_url=None, attachments=[], fallback_reason="degraded")
-        parent_id = self.extract_page_id(parent_page)
-        publish_parent_id, hierarchy_lineage = await self._resolve_publish_parent(
-            parent_id=parent_id,
-            page_title=page_title,
-            project_storage_key=project_storage_key,
-            repo_storage_key=repo_storage_key,
-            hierarchy_target=hierarchy_target,
-            project_name_hint=project_name_hint,
-        )
-        markdown_files = sorted(report_dir.rglob("*.md"), key=lambda p: p.stat().st_mtime, reverse=True)
-        if not markdown_files:
-            raise ValueError(f"No markdown report found in {report_dir}")
-        markdown_path = markdown_files[0]
-
-        repo_page_mode = bool(hierarchy_lineage.get("repo_root_page_id"))
-        deterministic_repo_title = str(hierarchy_lineage.get("repo_report_title") or "").strip() or page_title
-
-        # Phase 154: Registry-first resolution for repo_run pages
-        project_key = self._normalize_hierarchy_key(project_storage_key, fallback=parent_id)
-        repo_key = self._normalize_hierarchy_key(repo_storage_key, fallback=page_title)
-        registry_hit = False
-        existing_run: dict | None = None
-        entry = self._lookup_page(project_key, repo_key, "repo_run")
-        if entry:
-            reg_page_id = str(entry["confluence_page_id"])
-            if await self._page_exists(reg_page_id):
-                existing_run = {"id": reg_page_id}
-                registry_hit = True
-            else:
-                self._delete_registry_entry(project_key, repo_key, "repo_run")
-
-        if not registry_hit:
-            existing_run = await self._find_child_page(
-                publish_parent_id,
-                deterministic_repo_title if repo_page_mode else page_title,
-            )
-        reused_existing_page = bool(existing_run and existing_run.get("id"))
-
-        effective_update_mode = update_mode
-        fallback_reason: str | None = None
-        counters: dict[str, int | str] = {
-            "rows_changed": 0,
-            "rows_unchanged": 0,
-            "attachments_updated": 0,
-            "attachments_skipped": 0,
-            "publish_mode": publish_mode.value,
-            "update_mode": update_mode.value,
-        }
-        incremental_plan: _IncrementalPlan | None = None
-        if update_mode == UpdateMode.INCREMENTAL:
-            incremental_plan, fallback_reason = self._load_incremental_plan(report_dir)
-            if incremental_plan is None:
-                effective_update_mode = UpdateMode.FULL
-                logger.warning(
-                    "incremental_fallback_to_full",
-                    reason=fallback_reason,
-                    page_title=page_title,
-                )
-            else:
-                counters["rows_changed"] = incremental_plan.rows_changed
-                counters["rows_unchanged"] = incremental_plan.rows_unchanged
-
-        # TSK-170B: Enforce publish mode
-        if existing_run and existing_run.get("id"):
-            if publish_mode == PublishMode.CREATE_ONLY:
-                raise ValueError(
-                    f"Page '{deterministic_repo_title if repo_page_mode else page_title}' already exists "
-                    f"(ID: {existing_run.get('id')}). "
-                    f"Use --publish-mode update to overwrite, or choose a different title."
-                )
-            if effective_update_mode == UpdateMode.INCREMENTAL:
-                updated, patch_fallback_reason = await self.update_run_page_incremental(
-                    page_id=str(existing_run.get("id")),
-                    title=deterministic_repo_title if repo_page_mode else page_title,
-                    report_dir=report_dir,
-                    markdown_path=markdown_path,
-                    thread_id=thread_id,
-                    priority_actions_limit=priority_actions_limit,
-                    checklist_collapsed=checklist_collapsed,
-                )
-                if updated:
-                    run_page_id = str(existing_run.get("id"))
-                else:
-                    effective_update_mode = UpdateMode.FULL
-                    fallback_reason = patch_fallback_reason or "incremental_section_patch_failed"
-                    logger.warning(
-                        "incremental_fallback_to_full",
-                        reason=fallback_reason,
-                        page_id=str(existing_run.get("id")),
-                        page_title=deterministic_repo_title if repo_page_mode else page_title,
-                    )
-                    run_page_id = await self.update_run_page(
-                        page_id=str(existing_run.get("id")),
-                        title=deterministic_repo_title if repo_page_mode else page_title,
-                        report_dir=report_dir,
-                        markdown_path=markdown_path,
-                        thread_id=thread_id,
-                        priority_actions_limit=priority_actions_limit,
-                        checklist_collapsed=checklist_collapsed,
-                    )
-            else:
-                run_page_id = await self.update_run_page(
-                    page_id=str(existing_run.get("id")),
-                    title=deterministic_repo_title if repo_page_mode else page_title,
-                    report_dir=report_dir,
-                    markdown_path=markdown_path,
-                    thread_id=thread_id,
-                    priority_actions_limit=priority_actions_limit,
-                    checklist_collapsed=checklist_collapsed,
-                )
-        else:
-            if effective_update_mode == UpdateMode.INCREMENTAL:
-                effective_update_mode = UpdateMode.FULL
-                fallback_reason = "incremental_requires_existing_page"
-                logger.warning(
-                    "incremental_fallback_to_full",
-                    reason=fallback_reason,
-                    page_title=deterministic_repo_title if repo_page_mode else page_title,
-                )
-            run_page_id = await self.create_run_page(
-                parent_id=publish_parent_id,
-                title=deterministic_repo_title if repo_page_mode else page_title,
-                report_dir=report_dir,
-                markdown_path=markdown_path,
-                thread_id=thread_id,
-                priority_actions_limit=priority_actions_limit,
-                checklist_collapsed=checklist_collapsed,
-            )
-            # Register immediately after creation so concurrent profiles find it
-            # via registry lookup instead of hitting CQL eventual-consistency lag
-            # and attempting a duplicate create_page call.  The final registration
-            # at the end of upload_results is an idempotent upsert, so this early
-            # registration is safe.
-            self._register_page(
-                project_key,
-                repo_key,
-                "repo_run",
-                run_page_id,
-                deterministic_repo_title if repo_page_mode else page_title,
-                publish_parent_id,
-            )
-
-        # Phase 156: Move page to correct parent when registry hit found
-        # under a different Confluence parent than the resolved publish target.
-        # Only needed for reused pages — freshly created pages are already
-        # placed under publish_parent_id by create_run_page.
-        if reused_existing_page:
-            await self._move_page_if_parent_mismatched(run_page_id, publish_parent_id)
-
-        uploaded: list[str] = []
-        attachments_index: list[dict[str, str]] = []
-
-        if include_attachments:
-            try:
-                attachments = await self._retry(
-                    lambda: self.client.list_attachments(run_page_id),
-                    page_id=run_page_id,
-                    action="list_attachments",
-                )
-            except DataSourceError as e:
-                if self._is_permission_error(e):
-                    raise DataSourceError(
-                        self._build_permission_error_message("list_attachments", run_page_id),
-                        context={"page_id": run_page_id, "operation": "list_attachments"},
-                    ) from e
-                raise
-
-            attachment_map: dict[str, dict] = {}
-            for attachment in attachments:
-                if not isinstance(attachment, dict):
-                    continue
-                name = (
-                    attachment.get("title")
-                    or attachment.get("name")
-                    or attachment.get("filename")
-                    or attachment.get("fileName")
-                )
-                if isinstance(name, str):
-                    attachment_map[name.lower()] = attachment
-            for path in report_dir.rglob("*"):
-                if not path.is_file():
-                    continue
-                # Default attachment set + explicit audit-checklist.* artifacts.
-                suffix = path.suffix.lower()
-                name_lc = path.name.lower()
-                is_default = suffix in {".xlsx", ".json", ".sarif"} or name_lc.endswith(".sarif.json")
-                is_checklist = name_lc.startswith("audit-checklist.")
-                if is_default or is_checklist:
-                    existing = attachment_map.get(path.name.lower())
-                    local_hash = self._file_sha256(path)
-                    if effective_update_mode == UpdateMode.INCREMENTAL:
-                        name_lc = path.name.lower()
-                        changed_set = incremental_plan.changed_attachments if incremental_plan else set()
-                        unchanged_set = incremental_plan.unchanged_attachments if incremental_plan else set()
-                        if changed_set and name_lc not in changed_set:
-                            counters["attachments_skipped"] = int(counters["attachments_skipped"]) + 1
-                            continue
-                        if name_lc in unchanged_set:
-                            counters["attachments_skipped"] = int(counters["attachments_skipped"]) + 1
-                            continue
-                        existing_hash = self._attachment_payload_hash(existing) if isinstance(existing, dict) else None
-                        if existing_hash and existing_hash == local_hash:
-                            counters["attachments_skipped"] = int(counters["attachments_skipped"]) + 1
-                            continue
-                    try:
-                        if existing and existing.get("id"):
-                            payload = await self._retry(
-                                lambda existing=existing, path=path: self.client.update_attachment(
-                                    page_id=run_page_id,
-                                    attachment_id=str(existing.get("id")),
-                                    file_path=path,
-                                ),
-                                page_id=run_page_id,
-                                attachment_id=str(existing.get("id")),
-                                file_path=str(path),
-                                action="update_attachment",
-                            )
-                        else:
-                            payload = await self._retry(
-                                lambda path=path: self.client.upload_attachment(page_id=run_page_id, file_path=path),
-                                page_id=run_page_id,
-                                file_path=str(path),
-                                action="upload_attachment",
-                            )
-                    except DataSourceError as e:
-                        if self._is_permission_error(e):
-                            raise DataSourceError(
-                                self._build_permission_error_message("upload_attachment", run_page_id),
-                                context={
-                                    "page_id": run_page_id,
-                                    "file_path": str(path),
-                                    "operation": "attachment_upload",
-                                },
-                            ) from e
-                        raise
-                    attachment_id = None
-                    if isinstance(payload, dict):
-                        attachment_id = payload.get("id") or payload.get("attachment_id")
-                        if not attachment_id:
-                            results = payload.get("results")
-                            if isinstance(results, list) and results and isinstance(results[0], dict):
-                                attachment_id = results[0].get("id") or results[0].get("attachment_id")
-                    if attachment_id:
-                        uploaded.append(str(attachment_id))
-                        counters["attachments_updated"] = int(counters["attachments_updated"]) + 1
-                        # TSK-170B: Track for attachments index
-                        attachments_index.append({"name": path.name, "id": str(attachment_id)})
-
-        # TSK-170B: Update page with attachments index if requested
-        if include_attachments_index and attachments_index:
-            try:
-                # Get current page content and append attachments index
-                current_content = await self._retry(
-                    lambda: self.client.get_page(run_page_id, expand="body.storage"),
-                    page_id=run_page_id,
-                    action="get_page",
-                )
-                if current_content and isinstance(current_content, dict):
-                    body = current_content.get("body", {})
-                    storage = body.get("storage", {}) if isinstance(body, dict) else {}
-                    content = storage.get("value", "") if isinstance(storage, dict) else ""
-
-                    if not content.strip():
-                        logger.warning(
-                            "attachments_index_skipped_empty_body",
-                            page_id=run_page_id,
-                            reason="get_page returned empty body.storage; skipping to avoid overwriting rich content",
-                        )
-                    else:
-                        # Append attachments index section
-                        index_html = self._render_attachments_index_html(attachments_index)
-                        if index_html and index_html not in content:
-                            updated_content = content + "\n\n" + index_html
-
-                            with tempfile.NamedTemporaryFile(mode="w", suffix=".html", delete=False) as f:
-                                f.write(updated_content)
-                                temp_path = Path(f.name)
-
-                            try:
-                                resolved_title = self._resolve_update_title(
-                                    current_content if isinstance(current_content, dict) else {}, page_title
-                                )
-                                await self._retry(
-                                    lambda: self.client.update_page(
-                                        page_id=run_page_id,
-                                        title=resolved_title,
-                                        body_file=temp_path,
-                                    ),
-                                    page_id=run_page_id,
-                                    title=resolved_title,
-                                    action="update_page_with_index",
-                                )
-                            finally:
-                                if temp_path.exists():
-                                    temp_path.unlink()
-            except Exception as e:
-                # Non-critical - log but don't fail
-                logger.warning("attachments_index_update_failed", error=str(e), page_id=run_page_id)
-
-        counters["effective_update_mode"] = effective_update_mode.value
-        logger.info(
-            "upload_results_completed",
-            page_id=run_page_id,
-            publish_mode=publish_mode.value,
-            update_mode=update_mode.value,
-            effective_update_mode=effective_update_mode.value,
-            rows_changed=counters["rows_changed"],
-            rows_unchanged=counters["rows_unchanged"],
-            attachments_updated=counters["attachments_updated"],
-            attachments_skipped=counters["attachments_skipped"],
-            fallback_reason=fallback_reason,
-        )
-
-        # Phase 154: Register the repo run page in the registry
-        self._register_page(
-            project_key,
-            repo_key,
-            "repo_run",
-            run_page_id,
-            deterministic_repo_title if repo_page_mode else page_title,
-            publish_parent_id,
-        )
-
-        return UploadResult(
-            page_id=run_page_id,
-            page_url=None,
-            reused_existing_page=reused_existing_page,
-            attachments=uploaded,
-            attachments_index=attachments_index,
-            update_mode=update_mode.value,
-            effective_update_mode=effective_update_mode.value,
-            counters=counters,
-            fallback_reason=fallback_reason,
-            project_root_page_id=hierarchy_lineage.get("project_root_page_id"),
-            audit_root_page_id=hierarchy_lineage.get("audit_root_page_id"),
-            repo_root_page_id=hierarchy_lineage.get("repo_root_page_id"),
-            repo_run_page_id=run_page_id if hierarchy_lineage.get("repo_root_page_id") else None,
-            project_analysis_root_page_id=hierarchy_lineage.get("project_analysis_root_page_id"),
-            project_aggregate_page_id=run_page_id if hierarchy_lineage.get("project_analysis_root_page_id") else None,
-            sections_rendered=list(self._last_sections_rendered),
-        )