filegrc 0.15.0 → 0.15.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "filegrc",
-  "version": "0.15.0",
+  "version": "0.15.1",
   "description": "Zero-dependency Git-native GRC engine",
   "license": "MIT",
   "repository": {

package/src/audit-preparation.js

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
 import { modelSupports } from "../model/index.js";
 import { applicabilityReviewIsCurrent } from "./applicability-scope.js";
+import { selectDefaultAudit } from "./audit-selection.js";
 import { openPlaceholderCount, substantiveMarkdown } from "./content-readiness.js";
 import {
   coverageContains,
@@ -63,20 +64,21 @@ export async function assessAuditPreparation(input, options = {}) {
   const records = loaded.resources;
   const byId = new Map(records.map((record) => [record.id, record]));
   const audits = records.filter((record) => record.type === "audit");
+  const calendarAsOf = options.asOf || currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const audit = options.auditId
     ? audits.find((record) => record.id === options.auditId)
     : options.selectDefault === false
       ? null
-      : audits.find((record) => !["complete", "closed", "canceled"].includes(record.status)) || audits[0];
+      : selectDefaultAudit(audits, calendarAsOf);
   if (options.auditId && !audit) throw new Error(`Audit "${options.auditId}" was not found.`);
 
-  const calendarAsOf = options.asOf || currentCalendarDate(loaded.workspace?.timezone || "UTC");
   const formalPeriodEnd = audit?.auditKind === "soc-2-type-2" ? coverageEnd(audit.coverage) : null;
   const readinessAsOf = formalPeriodEnd && formalPeriodEnd < calendarAsOf ? formalPeriodEnd : calendarAsOf;
   const programReadiness = options.programReadiness || await assessProgramReadiness(loaded, {
     asOf: readinessAsOf,
     generatedAt: options.generatedAt,
-    programId: audit?.programId || options.programId
+    programId: audit?.programId || options.programId,
+    auditId: audit?.id
   });
   const documentActivations = audit && modelSupports(loaded.model, "governed-document-activation")
     ? await auditDocumentActivationAssessments(loaded, audit, byId, calendarAsOf)
@@ -746,6 +748,12 @@ function canonicalScopeValue(value) {
 function programFoundationStage(programReadiness, workspace, audit) {
   const needsOperatingPeriod = audit?.auditKind === "soc-2-type-2";
   const ready = needsOperatingPeriod ? programReadiness.operating : programReadiness.evidenceReady;
+  const setupRemaining = programReadiness.setupProgress?.remaining
+    ?? (programReadiness.progress?.mode === "setup-progress" ? programReadiness.progress.remaining : 0);
+  const activeWindow = programReadiness.progress?.mode === "operating-window";
+  const activeWindowLabel = programReadiness.progress?.source === "audit"
+    ? "audit window"
+    : "candidate operating period";
   return stage("program", "Program Readiness", "The management program can be prepared and operated without an audit record or CPA firm.", [
     item(
       "evidence-ready",
@@ -755,9 +763,13 @@ function programFoundationStage(programReadiness, workspace, audit) {
         ? needsOperatingPeriod
           ? `${programReadiness.target.label} is operating for the selected engagement.`
           : `${programReadiness.target.label} is evidence-ready.`
+        : needsOperatingPeriod && activeWindow
+          ? setupRemaining
+            ? `The ${activeWindowLabel} is active, but ${setupRemaining} required setup ${setupRemaining === 1 ? "action remains" : "actions remain"} across scope, policies, controls, and evidence preparation.`
+            : `The ${activeWindowLabel} is active, but current operating work needs attention before treating the engagement as management-ready.`
         : needsOperatingPeriod && programReadiness.evidenceReady
           ? "Start the candidate period and finish the current operating-readiness work before treating a Type 2 engagement as management-ready."
-          : `${programReadiness.counts.action} program-readiness actions remain across scope, policies, controls, and evidence preparation.`,
+          : `${setupRemaining} required setup ${setupRemaining === 1 ? "action remains" : "actions remain"} across scope, policies, controls, and evidence preparation.`,
       workspace || { type: "workspace" }
     )
   ]);

package/src/audit-selection.js

@@ -0,0 +1,33 @@
+export function selectDefaultAudit(audits = [], asOf = "") {
+  const terminal = new Set(["complete", "closed", "canceled", "delivered"]);
+  const coverageStart = (audit) => audit?.coverage?.startsOn
+    || audit?.coverage?.periodStart
+    || audit?.coverage?.on
+    || "";
+  const statusOrder = new Map([
+    ["planned", 0],
+    ["in-progress", 1],
+    ["fieldwork", 2],
+    ["report-draft", 3],
+    ["issued", 4],
+    ["delivered", 5],
+    ["complete", 6]
+  ]);
+  const open = audits.filter((audit) => !terminal.has(audit.status));
+  const candidates = [...(open.length ? open : audits)];
+  candidates.sort((left, right) => {
+    const leftStart = coverageStart(left);
+    const rightStart = coverageStart(right);
+    const leftStarted = Boolean(leftStart && (!asOf || leftStart <= asOf));
+    const rightStarted = Boolean(rightStart && (!asOf || rightStart <= asOf));
+    return Number(rightStarted) - Number(leftStarted)
+      || (leftStarted && rightStarted
+        ? rightStart.localeCompare(leftStart)
+        : leftStart && rightStart
+          ? leftStart.localeCompare(rightStart)
+          : Number(Boolean(rightStart)) - Number(Boolean(leftStart)))
+      || (statusOrder.get(right.status) ?? -1) - (statusOrder.get(left.status) ?? -1)
+      || String(left.id || "").localeCompare(String(right.id || ""));
+  });
+  return candidates[0] || null;
+}

package/src/cli.js

@@ -447,16 +447,17 @@ export async function runCli(argv = process.argv.slice(2)) {
     const loaded = await loadWorkspace(root);
     const result = await assessProgramReadiness(loaded, { asOf: flags["as-of"], programId: flags.program });
     const output = flags.summary ? summarizeProgramReadiness(result) : result;
+    const headlineStatus = result.progress.status || result.status;
     if (flags.json) console.log(JSON.stringify(output, null, 2));
     else if (flags.summary) {
-      console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
+      console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
       for (const stage of output.stages) {
-        console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} actions`);
+        console.log(`${stage.status.toUpperCase()}\t${stage.title}\t${stage.counts.action} checks need action`);
       }
       if (output.firstAction) console.log(`Next: ${output.firstAction.title}\t${output.firstAction.message}`);
     }
     else {
-      console.log(`${result.status.toUpperCase()}: ${result.progress.complete} of ${result.progress.total} program items complete`);
+      console.log(`${headlineStatus.toUpperCase()}: ${result.progress.label} ${result.progress.percent}%. ${result.progress.detail}`);
       console.log(
         `${result.target.label}`
         + (result.target.candidateCoverage?.kind === "range"
@@ -2036,6 +2037,8 @@ function summarizeProgramReadiness(result) {
     suggestedCandidatePeriodStart: result.suggestedCandidatePeriodStart,
     target: result.target,
     progress: result.progress,
+    setupProgress: result.setupProgress,
+    checkProgress: result.checkProgress,
     counts: result.counts,
     scopeCounts: Object.fromEntries(
       Object.entries(result.scope).map(([name, ids]) => [name.replace(/Ids$/, ""), ids.length])

package/src/index.js

@@ -86,7 +86,7 @@ export {
   scaffoldExternalReviewerGovernance,
   setupExternalReviewerGovernance
 } from "./external-reviewer.js";
-export { assessEvidenceMap, assessProgramReadiness } from "./program-readiness.js";
+export { assessEvidenceMap, assessProgramReadiness, calculateProgramProgress } from "./program-readiness.js";
 export {
   approveReportingRouteSet,
   assessReportingRoutePeriod,

package/src/program-readiness.js

@@ -32,6 +32,94 @@ import { assessSourceCoverageReadiness } from "./source-coverage.js";
 import { currentCalendarDate, timestampFromLocalDateTime } from "./time.js";
 import { loadWorkspace } from "./workspace.js";
 
+export function calculateProgramProgress({
+  stages = [],
+  target = {},
+  evidenceReady = false,
+  operating = false,
+  asOf,
+  window = null
+} = {}) {
+  const typeTwo = target.goal === "soc-2-type-2";
+  const trackedWindow = normalizeProgressWindow(window || target.candidateCoverage, window ? "audit" : "candidate");
+  const windowStarted = Boolean(
+    typeTwo
+    && trackedWindow
+    && asOf
+    && trackedWindow.start <= asOf
+  );
+  const setupProgress = calculateSetupActionProgress(stages, target, Boolean(trackedWindow));
+  if (windowStarted) {
+    const totalDays = calendarDayDistance(trackedWindow.start, trackedWindow.end) + 1;
+    const elapsedDays = Math.min(
+      totalDays,
+      Math.max(0, calendarDayDistance(trackedWindow.start, asOf) + 1)
+    );
+    const percent = totalDays ? Math.round((elapsedDays / totalDays) * 100) : 0;
+    const complete = elapsedDays >= totalDays;
+    const healthy = Boolean(operating);
+    return {
+      mode: "operating-window",
+      label: trackedWindow.source === "audit" ? "Audit window" : "Operating window",
+      status: healthy ? complete ? "Window complete" : "Operating" : "Needs attention",
+      complete: elapsedDays,
+      total: totalDays,
+      remaining: Math.max(0, totalDays - elapsedDays),
+      percent,
+      unit: "day",
+      start: trackedWindow.start,
+      end: trackedWindow.end,
+      source: trackedWindow.source,
+      detail: complete
+        ? `${totalDays} of ${totalDays} days elapsed.`
+        : `Day ${elapsedDays} of ${totalDays}; ${Math.max(0, totalDays - elapsedDays)} days remain.`,
+      operating
+    };
+  }
+
+  return {
+    mode: "setup-progress",
+    label: "Program setup",
+    status: !setupProgress.remaining
+      ? evidenceReady && typeTwo && trackedWindow?.start > asOf
+        ? "Scheduled"
+        : evidenceReady ? "Evidence ready" : "Ready"
+      : evidenceReady && typeTwo ? "Ready to start" : "Needs work",
+    ...setupProgress,
+    unit: "action",
+    detail: setupProgress.remaining
+      ? `${setupProgress.complete} of ${setupProgress.total} required actions complete.`
+      : `All ${setupProgress.total} required actions are complete.`,
+    operating
+  };
+}
+
+function calculateSetupActionProgress(stages, target, windowMilestoneComplete) {
+  const units = new Map();
+  for (const currentStage of stages.filter(({ id }) => id !== "operation")) {
+    for (const current of currentStage.items || []) {
+      if (["info", "later"].includes(current.status) || current.progressUnit === false) continue;
+      const key = `${currentStage.id}:${current.progressUnitId || current.id}`;
+      const existing = units.get(key);
+      if (!existing || existing.status === "complete" && current.status !== "complete") {
+        units.set(key, current);
+      }
+    }
+  }
+
+  const setupUnits = [...units.values()];
+  const complete = setupUnits.filter(({ status }) => status === "complete").length;
+  const total = setupUnits.length + (target.goal === "soc-2-type-2" ? 1 : 0);
+  const completed = complete + (windowMilestoneComplete ? 1 : 0);
+  const remaining = Math.max(0, total - completed);
+  return {
+    complete: completed,
+    total,
+    remaining,
+    percent: total ? Math.round((completed / total) * 100) : 0
+  };
+}
+
 export async function assessProgramReadiness(input, options = {}) {
   const loaded = input?.resources && input?.model && input?.entries
     ? input
@@ -41,6 +129,15 @@ export async function assessProgramReadiness(input, options = {}) {
   const workspace = loaded.workspace || records.find((record) => record.type === "workspace");
   const program = resolveProgram(loaded, options.programId);
   const asOf = options.asOf || currentCalendarDate(workspace?.timezone || "UTC");
+  const requestedAudit = options.auditId
+    ? records.find((record) => record.type === "audit" && record.id === options.auditId)
+    : null;
+  const auditWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? requestedAudit.coverage
+    : selectedAuditWindow(records, program, asOf);
+  const progressWindow = requestedAudit?.auditKind === "soc-2-type-2"
+    ? normalizeProgressWindow(auditWindow, "audit")
+    : selectedProgressWindow(program?.candidateCoverage, auditWindow, asOf);
   const scope = programScope(program, records, byId, loaded.model, loaded);
   const collectionReviews = assessCollectionReviews(loaded, { programId: program.id });
   const markdown = new Map();
@@ -123,26 +220,54 @@ export async function assessProgramReadiness(input, options = {}) {
   const evidenceReady = evidenceGateStages.every((current) => current.counts.action === 0);
   const stages = [
     ...evidenceGateStages,
-    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model)
+    await operationStage(loaded, program, scope, records, byId, asOf, evidenceReady, loaded.model, progressWindow)
   ];
   finalizeStage(stages.at(-1));
-  const candidateStarted = Boolean(
+  const periodStarted = Boolean(
     program?.assuranceGoal === "soc-2-type-2"
-    && program.candidateCoverage?.kind === "range"
-    && coverageStart(program.candidateCoverage) <= asOf
+    && progressWindow?.start <= asOf
   );
   const obligations = planObligations(records, { programId: program.id, asOf, through: asOf, model: loaded.model });
   const policyLibrary = await assessPolicyLibraryUpgrades(loaded);
-  const operating = evidenceReady && candidateStarted && stages.at(-1).counts.action === 0;
+  const operating = Boolean(
+    evidenceReady
+    && periodStarted
+    && stages.at(-1).counts.action === 0
+  );
   const canStartCandidatePeriod = Boolean(
     evidenceReady
     && program?.assuranceGoal === "soc-2-type-2"
     && !program.candidateCoverage
+    && !periodStarted
   );
   const items = stages.flatMap((current) => current.items);
   const managedItems = items.filter((current) => !["info", "later"].includes(current.status));
   const complete = managedItems.filter((current) => current.status === "complete").length;
   const firstAction = items.find((current) => current.status === "action") || null;
+  const target = {
+    programId: program?.id || null,
+    goal: program?.assuranceGoal || "none",
+    label: assuranceGoalLabel(program?.assuranceGoal),
+    candidateCoverage: program?.candidateCoverage || null
+  };
+  const checkProgress = {
+    complete,
+    total: managedItems.length,
+    percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
+  };
+  const progress = calculateProgramProgress({
+    stages,
+    target,
+    evidenceReady,
+    operating,
+    asOf,
+    window: progressWindow
+  });
+  const setupProgress = calculateSetupActionProgress(
+    stages,
+    target,
+    Boolean(progressWindow)
+  );
 
   return {
     program,
@@ -150,12 +275,7 @@ export async function assessProgramReadiness(input, options = {}) {
     dataModelVersion: String(loaded.model.modelVersion),
     generatedAt: options.generatedAt || new Date().toISOString(),
     asOf,
-    target: {
-      programId: program?.id || null,
-      goal: program?.assuranceGoal || "none",
-      label: assuranceGoalLabel(program?.assuranceGoal),
-      candidateCoverage: program?.candidateCoverage || null
-    },
+    target,
     status: operating ? "operating" : evidenceReady ? "evidence-ready" : "needs-work",
     evidenceReady,
     operating,
@@ -168,11 +288,9 @@ export async function assessProgramReadiness(input, options = {}) {
       ...policyLibrary.proposals,
       ...legacyPolicyLibraryProposals(records)
     ],
-    progress: {
-      complete,
-      total: managedItems.length,
-      percent: managedItems.length ? Math.round((complete / managedItems.length) * 100) : 0
-    },
+    progress,
+    setupProgress,
+    checkProgress,
     counts: countStatuses(items),
     firstAction,
     scope: {
@@ -724,6 +842,7 @@ async function policiesStage(scope, records, byId, readMarkdown, model) {
           : "Appoint a reviewer who is separate from the policy owner. The reviewer may be another person in the organization or an external person, and is separate from the CPA firm that may later perform the audit.",
       appointedReviewer || (reviewerNeedsAssignment ? governedRecords[0] : { type: "person" }),
       {
+        progressUnit: false,
         commands: [
           "npx filegrc list appointment --workflow --json",
           "npx filegrc guide appointment --json",
@@ -1468,7 +1587,7 @@ async function evidenceSourcesStage(scope, byId, model, readMarkdown) {
   return stage("sources", "Control Evidence Sources", `Complete the authoritative ${modelSupports(model, "component-sources") ? "Components" : "Systems"} for every selected control family before marking the Controls implemented.`, items);
 }
 
-async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model) {
+async function operationStage(loaded, workspace, scope, records, byId, asOf, evidenceReady, model, progressWindow = null) {
   const goal = workspace?.assuranceGoal || "none";
   if (!evidenceReady) {
     return stage("operation", "Operate the Program", "Run the controls and preserve dated evidence after the Evidence Ready gate passes.", [
@@ -1500,12 +1619,9 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
   }
 
   const obligations = planObligations(records, { programId: workspace.id, asOf, through: asOf, model });
-  const start = workspace.candidateCoverage?.kind === "range"
-    ? coverageStart(workspace.candidateCoverage)
-    : null;
-  const end = workspace.candidateCoverage?.kind === "range"
-    ? coverageEnd(workspace.candidateCoverage)
-    : null;
+  const start = progressWindow?.start || null;
+  const end = progressWindow?.end || null;
+  const formalWindow = progressWindow?.source === "audit";
   const startStatus = !start ? "action" : start <= asOf ? "complete" : "later";
   const sourceCoverage = await assessSourceCoverageReadiness(loaded, scope.controls.map(({ id }) => id), workspace);
   const incompleteSourceCoverage = sourceCoverage.filter(({ complete }) => !complete);
@@ -1517,16 +1633,20 @@ async function operationStage(loaded, workspace, scope, records, byId, asOf, evi
       !start
         ? "Set the management candidate period start when the Evidence Ready gate passes. Do not backdate it."
         : start <= asOf
-          ? `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
+          ? formalWindow
+            ? `The auditor-agreed Type 2 period began on ${start}. Keep evidence collection and operating work current through the period.`
+            : `Management began the candidate Type 2 evidence period on ${start}. This is not the auditor-agreed report period.`
           : `Evidence collection is scheduled to begin on ${start}.`,
       workspace
     ),
     item(
       "candidate-period-end",
       end ? "complete" : start ? "later" : "info",
-      "Plan the candidate period end",
+      formalWindow ? "Confirm the auditor-agreed period end" : "Plan the candidate period end",
       end
-        ? `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
+        ? formalWindow
+          ? `Auditor-agreed period: ${start || "start not set"} through ${end}.`
+          : `Management candidate period: ${start || "start not set"} through ${end}. The CPA firm may agree to different dates.`
         : "Add the management target end when useful. Starting reliable evidence collection is the immediate milestone.",
       workspace
     ),
@@ -1784,6 +1904,61 @@ function countStatuses(items) {
   return counts;
 }
 
+export function selectedAuditWindow(records, program, asOf) {
+  if (program?.assuranceGoal !== "soc-2-type-2") return null;
+  const candidates = records.filter((record) => (
+    record.type === "audit"
+    && record.auditKind === "soc-2-type-2"
+    && (!record.programId || record.programId === program.id)
+    && !["canceled", "closed", "complete", "delivered"].includes(record.status)
+    && normalizeProgressWindow(record.coverage)
+    && coverageStart(record.coverage) <= asOf
+  ));
+  const statusOrder = new Map([
+    ["planned", 0],
+    ["in-progress", 1],
+    ["fieldwork", 2],
+    ["report-draft", 3],
+    ["issued", 4]
+  ]);
+  candidates.sort((left, right) => (
+    coverageStart(right.coverage).localeCompare(coverageStart(left.coverage))
+    || (statusOrder.get(right.status) ?? -1) - (statusOrder.get(left.status) ?? -1)
+    || coverageEnd(right.coverage).localeCompare(coverageEnd(left.coverage))
+    || left.id.localeCompare(right.id)
+  ));
+  return candidates[0]?.coverage || null;
+}
+
+export function selectedProgressWindow(candidateCoverage, auditCoverage, asOf) {
+  const candidates = [
+    normalizeProgressWindow(candidateCoverage, "candidate"),
+    normalizeProgressWindow(auditCoverage, "audit")
+  ].filter((window) => window && (!asOf || window.start <= asOf));
+  candidates.sort((left, right) => (
+    right.start.localeCompare(left.start)
+    || Number(right.source === "audit") - Number(left.source === "audit")
+    || right.end.localeCompare(left.end)
+  ));
+  if (candidates.length) return candidates[0];
+  return normalizeProgressWindow(candidateCoverage, "candidate")
+    || normalizeProgressWindow(auditCoverage, "audit");
+}
+
+function normalizeProgressWindow(coverage, source = "candidate") {
+  const start = coverage?.start || coverageStart(coverage);
+  const end = coverage?.end || coverageEnd(coverage);
+  if (!start || !end || end < start) return null;
+  return { start, end, source: coverage?.source || source };
+}
+
+function calendarDayDistance(start, end) {
+  const startTime = Date.parse(`${start}T00:00:00Z`);
+  const endTime = Date.parse(`${end}T00:00:00Z`);
+  if (!Number.isFinite(startTime) || !Number.isFinite(endTime)) return 0;
+  return Math.round((endTime - startTime) / 86_400_000);
+}
+
 function shiftYear(value, offset) {
   const date = new Date(`${value}T00:00:00Z`);
   date.setUTCFullYear(date.getUTCFullYear() + offset);

package/src/retention.js

@@ -32,22 +32,42 @@ export async function assessRetentionReadiness(loaded, program, options = {}) {
       ]
     }
   ));
-  items.push(...uses.map((use) => {
-    const matches = usableRules.filter((rule) => ruleCoversUse(rule, use, program));
+  const usesByInformationType = new Map();
+  for (const use of uses) {
+    const grouped = usesByInformationType.get(use.informationTypeId) || [];
+    grouped.push(use);
+    usesByInformationType.set(use.informationTypeId, grouped);
+  }
+  items.push(...[...usesByInformationType].map(([informationTypeId, informationTypeUses]) => {
+    const uncoveredUses = informationTypeUses.filter((use) => (
+      !usableRules.some((rule) => ruleCoversUse(rule, use, program))
+    ));
+    const matches = usableRules.filter((rule) => (
+      informationTypeUses.some((use) => ruleCoversUse(rule, use, program))
+    ));
+    const informationTypeTitle = byId.get(informationTypeId)?.title || informationTypeId;
+    const affectedTitles = uncoveredUses.map(({ resource }) => resource.title);
+    const affectedSummary = affectedTitles.length > 3
+      ? `${affectedTitles.slice(0, 3).join(", ")}, and ${affectedTitles.length - 3} more`
+      : affectedTitles.join(", ");
     return readinessItem(
-      `retention-use-${use.resource.id}-${use.informationTypeId}`,
-      matches.length ? "complete" : "action",
-      `Decide retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`,
-      matches.length
-        ? `${use.resource.title} is covered by ${matches.map(({ title }) => title).join(", ")}.`
-        : `${use.resource.title} uses this Information Type, but no active, current retention schedule item covers both the type and scope. Management must choose the cutoff, period, and disposition.`,
-      use.resource,
+      `retention-use-${informationTypeId}`,
+      uncoveredUses.length ? "action" : "complete",
+      `Decide retention for ${informationTypeTitle}`,
+      uncoveredUses.length
+        ? `${affectedTitles.length} in-scope ${affectedTitles.length === 1 ? "resource uses" : "resources use"} this Information Type without an active, current retention decision, including ${affectedSummary}. Management must choose the cutoff, period, disposition, and whether one program-wide rule or separate scoped rules apply.`
+        : `All ${informationTypeUses.length} in-scope ${informationTypeUses.length === 1 ? "use is" : "uses are"} covered by ${matches.map(({ title }) => title).join(", ")}.`,
+      { type: "retention-schedule-item" },
       {
-        informationTypeId: use.informationTypeId,
+        informationTypeId,
+        affectedResourceIds: uncoveredUses.map(({ resource }) => resource.id),
+        retentionScopeResourceIds: uncoveredUses.length === informationTypeUses.length
+          ? [program.id]
+          : uncoveredUses.map(({ resource }) => resource.id),
         retentionScheduleItemIds: matches.map(({ id }) => id),
         commands: [
           "npx filegrc guide retention-schedule-item --json",
-          `npx filegrc scaffold retention-schedule-item --title ${shellArgument(`Retention for ${byId.get(use.informationTypeId)?.title || use.informationTypeId}`)}`
+          `npx filegrc scaffold retention-schedule-item --title ${shellArgument(`Retention for ${informationTypeTitle}`)}`
         ]
       }
     );

package/src/web.js

@@ -1,4 +1,5 @@
 import { createResourceId } from "./id.js";
+import { selectDefaultAudit } from "./audit-selection.js";
 import { MODEL_CAPABILITY_VERSIONS } from "../model/index.js";
 import {
   calendarOccurrence,
@@ -14,12 +15,20 @@ import { formatCalendarDate, formatLocalDateTime } from "./time.js";
 
 export function dashboardProgramReadiness(programReadiness = {}) {
   const progress = programReadiness.progress || {};
-  const lifecycle = programReadiness.operating
-    ? { status: "Operating", tone: "good" }
-    : programReadiness.evidenceReady
-      ? { status: "Evidence ready", tone: "good" }
-      : { status: "Needs work", tone: "warn" };
+  const lifecycle = progress.mode === "operating-window"
+    ? {
+        status: progress.status || (programReadiness.operating ? "Operating" : "Needs attention"),
+        tone: programReadiness.operating ? "good" : "warn"
+      }
+    : programReadiness.operating
+      ? { status: "Operating", tone: "good" }
+      : programReadiness.evidenceReady
+        ? { status: progress.status || "Evidence ready", tone: "good" }
+        : { status: progress.status || "Needs work", tone: "warn" };
   return {
+    mode: progress.mode || "setup-progress",
+    label: progress.label || "Program setup",
+    detail: progress.detail || `${progress.complete ?? 0} of ${progress.total ?? 0} required actions complete.`,
     percent: progress.percent ?? 0,
     complete: progress.complete ?? 0,
     total: progress.total ?? 0,
@@ -27,6 +36,23 @@ export function dashboardProgramReadiness(programReadiness = {}) {
   };
 }
 
+export function workflowHrefBelongsToPage(destination = {}, href = "") {
+  const route = String(href).split("?")[0];
+  if (!route) return false;
+  if (destination.href === "#/policies") {
+    return ["policy", "document", "training"].some((type) => route.startsWith(`#/resource/${type}/`));
+  }
+  if (destination.type) {
+    return route === `#/resources/${destination.type}` || route.startsWith(`#/resource/${destination.type}/`);
+  }
+  return route === String(destination.href || "").split("?")[0];
+}
+
+export function pageActionIdentity(href = "", fallback = "") {
+  const route = String(href).split("?")[0];
+  return route.startsWith("#/resource/") ? route : fallback || href;
+}
+
 export function renderIndex(state = null) {
   const snapshot = state
     ? `<script id="filegrc-data" type="application/json">${safeJson(state)}</script>`
@@ -71,6 +97,9 @@ let READINESS_STAGES = SHARED_PROGRAM_STAGES.map((stage) => ({
 }));
 const RESOURCE_GUIDE_INSTRUCTIONS = ${JSON.stringify(RESOURCE_INSTRUCTIONS)};
 const dashboardProgramReadiness = ${dashboardProgramReadiness.toString()};
+const workflowHrefBelongsToPage = ${workflowHrefBelongsToPage.toString()};
+const pageActionIdentity = ${pageActionIdentity.toString()};
+const selectDefaultAudit = ${selectDefaultAudit.toString()};
 const STAGE_PAGE_SUMMARIES = ${JSON.stringify({
   ...RESOURCE_PAGE_SUMMARIES,
   "utility:evidence-sources": "Check that each Control has an authoritative, retrievable evidence source.",
@@ -93,6 +122,7 @@ let onboardingPendingDraft = false;
 const resourceDetailRequests = new Map();
 const stateSectionRequests = new Map();
 let resourceGuideCleanup = null;
+let recordOverflowCleanup = null;
 let repositorySyncPollTimer = null;
 let repositorySyncPollInFlight = false;
 let mutationStateRefreshInFlight = false;
@@ -165,6 +195,8 @@ function handleRouteChange() {
 function render() {
   resourceGuideCleanup?.();
   resourceGuideCleanup = null;
+  recordOverflowCleanup?.();
+  recordOverflowCleanup = null;
   const previousNavigation = root.querySelector(".sidebar-nav");
   if (previousNavigation) navigationScrollTop = previousNavigation.scrollTop;
   const route = parseRoute();
@@ -460,8 +492,16 @@ function topbarProgramReadiness() {
     return '<a class="topbar-readiness' + (loading ? ' is-loading' : '') + '" href="#/"' + (loading ? ' aria-busy="true"' : '') + '><span class="topbar-readiness-copy"><span>Program readiness</span><strong>' + label + '</strong></span><span class="progress" aria-hidden="true"><span style="width:0%"></span></span></a>';
   }
   const progress = dashboardProgramReadiness(state.programReadiness);
-  const detail = progress.complete + " of " + progress.total + " readiness items complete";
-  return '<a class="topbar-readiness" href="' + nextProgramStageHref() + '" aria-label="' + esc("Program readiness: " + progress.percent + "%. " + detail + ". " + progress.status + ".") + '"><span class="topbar-readiness-copy"><span>Program readiness</span><strong>' + progress.percent + '%</strong></span><span class="progress" aria-hidden="true"><span style="width:' + progress.percent + '%"></span></span></a>';
+  const setupRemaining = state.programReadiness.setupProgress?.remaining || 0;
+  const setupRegression = progress.mode === "operating-window" && setupRemaining > 0;
+  const href = progress.mode === "operating-window" && !setupRegression ? "#/stage/run" : nextProgramStageHref();
+  const label = setupRegression
+    ? progress.label + " · " + setupRemaining + " setup " + (setupRemaining === 1 ? "action" : "actions")
+    : progress.label;
+  const detail = setupRegression
+    ? progress.detail + " " + setupRemaining + " required setup " + (setupRemaining === 1 ? "action also needs" : "actions also need") + " attention."
+    : progress.detail;
+  return '<a class="topbar-readiness" href="' + href + '" aria-label="' + esc(label + ": " + progress.percent + "%. " + detail + " " + progress.status + ".") + '"><span class="topbar-readiness-copy"><span>' + esc(label) + '</span><strong>' + progress.percent + '%</strong></span><span class="progress" aria-hidden="true"><span style="width:' + progress.percent + '%"></span></span></a>';
 }
 
 function repositoryStatusTone(status) {
@@ -649,7 +689,7 @@ function renderRetentionSchedulePage(main, params = new URLSearchParams()) {
     const seed = {
       ...(params.get("title") ? { title: params.get("title") } : {}),
       ...(params.get("informationTypeId") ? { informationTypeIds: [params.get("informationTypeId")] } : {}),
-      ...(params.get("scopeResourceId") ? { scopeResourceIds: [params.get("scopeResourceId")] } : {}),
+      ...(params.getAll("scopeResourceId").length ? { scopeResourceIds: params.getAll("scopeResourceId") } : {}),
       ...(params.get("scheduleDocumentId") ? { scheduleDocumentId: params.get("scheduleDocumentId") } : {})
     };
     history.replaceState(null, "", "#/retention-schedule");
@@ -704,18 +744,9 @@ function wireRetentionScheduleTable(total) {
 }
 
 function renderRetentionScheduleIssues() {
-  const items = retentionReviewItems("policies", false);
-  const plannedRows = resourcesOfType("retention-schedule-item")
-    .filter(({ record }) => record.status === "planned")
-    .map(({ record }) => ({
-      id: "planned-" + record.id,
-      title: "Complete or retire " + record.title,
-      message: "Planned rows are excluded from the approved schedule. Finish this decision or retire the row before schedule approval.",
-      href: '#/resource/retention-schedule-item/' + encodeURIComponent(record.id) + '?stage=policies'
-    }));
-  const actions = [...plannedRows, ...items.filter((item) => (
-    item.status === "action" && item.id !== "collection-review-retention-schedule-item"
-  ))];
+  const actions = retentionSchedulePageItems().filter((item) => (
+    item.id !== "collection-review-retention-schedule-item"
+  ));
   if (!actions.length) return "";
   return '<section class="retention-issues"><div class="section-head"><div><p class="kicker">Before approval</p><h2>Items to resolve</h2></div></div><div class="retention-issue-list">' + actions.map((item) => {
     const href = item.href || (item.id?.startsWith("retention-use-")
@@ -888,7 +919,7 @@ function renderDocumentActivationAssessments() {
 
 function renderAuditDocumentActivationAssessments() {
   const audits = resourcesOfType("audit").map(({ record }) => record);
-  const audit = audits.find(({ status }) => !["complete", "closed", "canceled"].includes(status)) || audits[0];
+  const audit = selectDefaultAudit(audits, state.programReadiness?.asOf || currentDate());
   const preparation = audit ? state.auditPreparations?.[audit.id] : null;
   const assessments = preparation?.documentActivations || [];
   if (!audit || !assessments.length) return "";
@@ -1276,8 +1307,7 @@ function recordWorkflowItems(type, id) {
   const activeStates = new Set(["blocked", "due", "open", "overdue", "ready", "scheduled", "upcoming", "waiting-external"]);
   return [
     ...(state.workflow?.findings || []),
-    ...(state.workflow?.workItems || []),
-    ...programReadinessWorkflowItems()
+    ...(state.workflow?.workItems || [])
   ].filter((item) => (
     activeStates.has(item.state)
     && (
@@ -1499,7 +1529,10 @@ function workflowItemHref(item) {
 function retentionScheduleItemHref(item) {
   const params = new URLSearchParams({ new: "1" });
   if (item.informationTypeId) params.set("informationTypeId", item.informationTypeId);
-  if (item.resourceId || item.subject?.id) params.set("scopeResourceId", item.resourceId || item.subject.id);
+  for (const id of item.retentionScopeResourceIds || []) params.append("scopeResourceId", id);
+  if (!params.has("scopeResourceId") && (item.resourceId || item.subject?.id)) {
+    params.set("scopeResourceId", item.resourceId || item.subject.id);
+  }
   const informationTypeTitle = String(item.title || "").replace(/^Decide retention for\s+/i, "").trim();
   if (informationTypeTitle && informationTypeTitle !== item.title) params.set("title", "Retention for " + informationTypeTitle);
   const scheduleDocuments = resourcesOfType("document").filter(({ record }) => (
@@ -1611,16 +1644,50 @@ function isRetentionScheduleWorkflowItem(item) {
   });
 }
 
-function programReadinessWorkflowItems() {
-  if (state.sections?.workflow === "complete") return [];
-  return retentionReviewItems()
-    .filter((item) => item.status === "action")
-    .map((item) => ({
-      ...item,
-      key: "program-readiness." + item.id,
+function retentionSchedulePageItems() {
+  const plannedRows = resourcesOfType("retention-schedule-item")
+    .filter(({ record }) => record.status === "planned")
+    .map(({ record }) => ({
+      id: "planned-" + record.id,
+      key: "planned-" + record.id,
+      status: "action",
       state: "ready",
-      subject: item.resourceId && item.resourceType ? { type: item.resourceType, id: item.resourceId } : { type: item.resourceType || "unknown" }
+      title: "Complete or retire " + record.title,
+      message: "Planned rows are excluded from the approved schedule. Finish this decision or retire the row before schedule approval.",
+      resourceType: record.type,
+      resourceId: record.id,
+      href: '#/resource/retention-schedule-item/' + encodeURIComponent(record.id) + '?stage=policies'
     }));
+  return distinctPageActionItems([
+    ...plannedRows,
+    ...retentionReviewItems("policies", false)
+      .filter(({ status }) => status === "action")
+      .map((item) => ({
+        ...item,
+        key: item.id,
+        state: "ready",
+        href: item.id === "collection-review-retention-schedule-item"
+          ? "#/retention-schedule"
+          : item.id?.startsWith("retention-use-")
+            ? retentionScheduleItemHref(item)
+            : item.resourceId && item.resourceType
+              ? '#/resource/' + encodeURIComponent(item.resourceType) + '/' + encodeURIComponent(item.resourceId)
+              : workflowItemHref(item) || "#/retention-schedule",
+        subject: item.resourceId && item.resourceType
+          ? { type: item.resourceType, id: item.resourceId }
+          : item.subject
+      }))
+  ]);
+}
+
+function distinctPageActionItems(items) {
+  const distinct = new Map();
+  for (const item of items) {
+    const href = item.href || workflowItemHref(item);
+    const key = pageActionIdentity(href, item.key || item.id);
+    if (!distinct.has(key)) distinct.set(key, item);
+  }
+  return [...distinct.values()];
 }
 
 function evidenceSourceCheckLabel(name) {
@@ -1660,11 +1727,11 @@ function stagePageCard(stage, destination, index) {
   const stepLabel = "Step " + stage.number + "." + String.fromCharCode(97 + index);
   const derived = derivedStagePageState(stage, destination);
   const complete = derived.complete;
-  const items = stagePageItems(stage, destination);
+  const items = stagePageActionItems(stage, destination);
   const completionState = '<span class="stage-page-completion-state ' + (complete ? "complete" : "") + '">' + esc(derived.label) + '</span>';
   const taskPreview = items.length
     ? '<div class="stage-page-tasks">' + items.slice(0, 3).map((item) => {
-        const href = destination.utility === "evidence-sources" ? destination.href : workflowItemHref(item) || destination.href;
+        const href = destination.utility === "evidence-sources" ? destination.href : item.href || workflowItemHref(item) || destination.href;
         return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
       }).join("") + (items.length > 3 ? '<small class="stage-page-tasks-more">+' + (items.length - 3) + ' more on this page</small>' : "") + '</div>'
     : "";
@@ -1699,6 +1766,11 @@ function stageProgress(stage) {
   return progressFromCounts(complete, applicable.length, "page");
 }
 
+function stagePageActionItems(stage, destination) {
+  const deferredStates = new Set(["later", "scheduled", "upcoming", "waiting-external"]);
+  return stagePageItems(stage, destination).filter(({ state }) => !deferredStates.has(state));
+}
+
 function derivedStagePageState(stage, destination) {
   if (
     stage.id === "audit"
@@ -1716,15 +1788,14 @@ function derivedStagePageState(stage, destination) {
       : { complete: evidenceItems.length > 0, label: evidenceItems.length ? "Ready" : "Not configured", countsTowardProgress: evidenceItems.length > 0 };
   }
   if (destination.utility === "retention-schedule") {
-    const assessment = state.collectionReviews?.["retention-schedule-item"];
-    const incomplete = retentionReviewItems("policies", false).filter(({ status }) => status !== "complete").length;
-    return assessment?.status === "current" && !incomplete
+    const incomplete = retentionSchedulePageItems().length;
+    return !incomplete
       ? { complete: true, label: "Approved" }
       : { complete: false, label: incomplete ? incomplete + " " + pluralize("item", incomplete) + " need work" : "Approval needed" };
   }
   const items = stagePageItems(stage, destination);
   const deferredStates = new Set(["later", "scheduled", "upcoming", "waiting-external"]);
-  const blocking = items.filter(({ state }) => !deferredStates.has(state));
+  const blocking = stagePageActionItems(stage, destination);
   if (blocking.length) {
     return { complete: false, label: blocking.length + " " + pluralize("item", blocking.length) + (blocking.length === 1 ? " needs work" : " need work") };
   }
@@ -1749,8 +1820,7 @@ function stagePageItems(stage, destination) {
   const activeStates = new Set(["blocked", "due", "later", "open", "overdue", "ready", "scheduled", "upcoming", "waiting-external"]);
   const items = [
     ...(state.workflow?.findings || []),
-    ...(state.workflow?.workItems || []),
-    ...programReadinessWorkflowItems()
+    ...(state.workflow?.workItems || [])
   ].filter((item) => (
     activeStates.has(item.state)
     && (
@@ -1766,18 +1836,9 @@ function stagePageItems(stage, destination) {
       .map((item) => ({ ...item, key: item.id, state: item.status, subject: { type: "source-coverage" } }));
   }
   if (destination.utility === "retention-schedule") {
-    return retentionReviewItems("policies", false)
-      .filter(({ status }) => status !== "complete")
-      .map((item) => ({ ...item, key: item.id, state: item.status, subject: item.resourceId && item.resourceType ? { type: item.resourceType, id: item.resourceId } : { type: item.resourceType || "retention-schedule-item" } }));
-  }
-  if (stage.id === "policies" && destination.href === "#/policies") {
-    return items.filter((item) => !isRetentionScheduleWorkflowItem(item)).sort((left, right) => (
-      workflowItemStatePriority(left) - workflowItemStatePriority(right)
-      || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
-      || left.key.localeCompare(right.key)
-    ));
+    return retentionSchedulePageItems();
   }
-  return items.filter((item) => {
+  return distinctPageActionItems(items.filter((item) => {
     if (destination.type === "program" && item.key === "program.scope.criteria") return false;
     if (
       destination.type === "requirement"
@@ -1789,22 +1850,10 @@ function stagePageItems(stage, destination) {
       && ["source-coverage", "system"].includes(item.subject?.type)
       && item.key?.startsWith("evidence-source.")
     ) return false;
-    if (
-      stage.id === "policies"
-      && destination.type === "policy"
-      && item.code === "governance.appointment.independent-policy-reviewer"
-    ) return true;
-    if (
-      destination.type
-      && (item.subject?.type === destination.type || item.source?.type === destination.type)
-    ) return true;
     const href = workflowItemHref(item);
-    if (!href) return false;
-    const destinationHref = destination.href.split("?")[0];
-    return href === destinationHref
-      || href.startsWith(destinationHref + "?")
-      || Boolean(destination.type && href.startsWith("#/resource/" + destination.type + "/"));
-  }).sort((left, right) => (
+    return workflowHrefBelongsToPage(destination, href)
+      && !(destination.href === "#/policies" && isRetentionScheduleWorkflowItem(item));
+  })).sort((left, right) => (
     workflowItemStatePriority(left) - workflowItemStatePriority(right)
     || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
     || left.key.localeCompare(right.key)
@@ -1820,7 +1869,7 @@ function operationProgress() {
   const goal = program?.target?.goal || activeProgram().assuranceGoal || "none";
   const asOf = program?.asOf || currentDate();
   const candidateStarted = goal === "soc-2-type-2"
-    ? Boolean(program?.target?.candidateCoverage?.kind === "range" && program.target.candidateCoverage.startsOn <= asOf)
+    ? Boolean(program?.progress?.mode === "operating-window")
     : goal === "soc-2-type-1"
       ? Boolean(program?.target?.candidateCoverage?.kind === "as-of")
       : Boolean(program?.evidenceReady);
@@ -3092,7 +3141,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const seed = type === "retention-schedule-item" ? {
       ...(params.get("title") ? { title: params.get("title") } : {}),
       ...(params.get("informationTypeId") ? { informationTypeIds: [params.get("informationTypeId")] } : {}),
-      ...(params.get("scopeResourceId") ? { scopeResourceIds: [params.get("scopeResourceId")] } : {}),
+      ...(params.getAll("scopeResourceId").length ? { scopeResourceIds: params.getAll("scopeResourceId") } : {}),
       ...(params.get("scheduleDocumentId") ? { scheduleDocumentId: params.get("scheduleDocumentId") } : {})
     } : type === "document" ? {
       ...(params.get("title") ? { title: params.get("title") } : {}),
@@ -3155,12 +3204,11 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   const narrative = recordNarrative(entry.record, fields);
   const narrativeNames = new Set(narrative.map(([name]) => name));
   const visible = Object.entries(entry.record).filter(([name]) => (
-    !["id", "type", "title"].includes(name)
+    !["id", "type", "title", "extensions"].includes(name)
     && !fields[name]?.content
     && !narrativeNames.has(name)
   ));
   const content = Object.entries(entry.content);
-  const sourceMetadata = '<div><dt>Source file</dt><dd><code>' + esc(entry.relativePath) + '</code></dd></div><div><dt>Workspace revision</dt><dd>' + (state.git.available ? '<code>' + esc(state.git.shortCommit) + '</code>' : "Unavailable until the workspace is committed.") + '</dd></div>';
   const narrativeContent = narrative.length
     ? '<div class="content-label"><span>Record</span></div><div class="record-prose">' + narrative.map(([name, value]) => '<section><h3>' + esc(titleCase(fields[name]?.label || humanize(name))) + '</h3><p>' + esc(value) + '</p></section>').join("") + '</div>'
     : "";
@@ -3213,26 +3261,41 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
     ? '<section class="panel detail-main">' + narrativeContent + markdownContent + addRecordContent + '</section>'
     : "";
   const attachmentPanel = type === "evidence" ? evidenceAttachmentPanel(entry) : "";
-  const historyPanel = entry.history?.length
-    ? '<section class="panel detail-history-panel"><div class="panel-head"><h3>File History</h3></div><div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div></section>'
+  const recordFieldsPanel = visible.length
+    ? '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>'
     : "";
-  const participationPanel = entry.historyLoaded === false
-    ? '<section class="panel detail-support-panel" role="status" aria-live="polite" aria-busy="true"><div class="panel-head"><h3>Participation</h3></div><p class="muted is-loading">' + loadingIndicator("Loading participation and file history…") + '</p></section>'
-    : entry.historyError
-      ? '<section class="panel detail-support-panel" role="status" aria-live="polite"><div class="panel-head"><h3>Participation</h3></div><p class="muted">Participation and file history are unavailable. Reload the record to try again.</p></section>'
-      : personParticipation(entry);
   const supportPanels = renderDetailSupport({
     hasRecordBody,
     workflowPanel: workflowGuidance({ type, id, title: "Next steps", workflow: entry.workflow }) || recordCompletionState(entry.record),
-    metadataPanel: '<section class="panel detail-support-panel detail-metadata-panel"><div class="panel-head"><h3>Record details</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>',
-    attachmentPanel,
-    participationPanel,
-    connectionsPanel: resourceConnections(entry),
-    historyPanel
+    metadataPanel: recordFieldsPanel,
+    attachmentPanel
   });
-  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' + (!definition.singleton ? '<button class="button danger" id="delete-resource">Delete</button>' : "") : "") + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain + supportPanels + '</div></div>';
+  const mayDelete = !state.readOnly && !routeSetLocked && !definition.singleton;
+  const recordMenu = '<details class="record-overflow"><summary aria-label="More record actions" title="More record actions"><svg viewBox="0 0 18 4" aria-hidden="true"><circle cx="2" cy="2" r="2"></circle><circle cx="9" cy="2" r="2"></circle><circle cx="16" cy="2" r="2"></circle></svg></summary><div class="record-overflow-menu" aria-label="Record actions"><button type="button" data-record-modal="info">Record info</button><button type="button" data-record-modal="connections">Connections</button><button type="button" data-record-modal="history"' + (entry.historyLoaded === false ? ' disabled' : '') + '>File history' + (entry.historyLoaded === false ? ' (loading)' : '') + '</button>' + (mayDelete ? '<div class="record-overflow-separator"></div><button class="danger-text" type="button" data-delete-resource>Delete record</button>' : '') + '</div></details>';
+  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="' + collectionHref + '">' + esc(collectionLabel) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + reportingRouteSetActions + auditCycleAction + auditPopulationCorrectionAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly && !routeSetLocked ? '<button class="button" id="edit-resource">Edit</button>' : "") + recordMenu + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain + supportPanels + '</div></div>';
   main.querySelectorAll("[data-completion-requirements]").forEach((button) => button.addEventListener("click", () => openCompletionRequirementsDialog(button.dataset.completionRequirements)));
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
+  main.querySelectorAll("[data-record-modal]").forEach((button) => button.addEventListener("click", () => {
+    button.closest("details")?.removeAttribute("open");
+    openRecordUtilityDialog(entry, button.dataset.recordModal);
+  }));
+  const overflowMenu = main.querySelector(".record-overflow");
+  const stopOutsideDismissal = () => document.removeEventListener("click", dismissOnOutsideClick);
+  const dismissOnOutsideClick = (event) => {
+    if (overflowMenu.contains(event.target)) return;
+    overflowMenu.removeAttribute("open");
+    stopOutsideDismissal();
+  };
+  overflowMenu?.addEventListener("toggle", () => {
+    stopOutsideDismissal();
+    if (overflowMenu.open) queueMicrotask(() => document.addEventListener("click", dismissOnOutsideClick));
+  });
+  overflowMenu?.addEventListener("keydown", (event) => {
+    if (event.key !== "Escape" || !overflowMenu.open) return;
+    overflowMenu.removeAttribute("open");
+    overflowMenu.querySelector("summary")?.focus();
+  });
+  recordOverflowCleanup = stopOutsideDismissal;
   main.querySelector("[data-external-reviewer-governance]")?.addEventListener("click", openExternalReviewerGovernanceDialog);
   main.querySelector("[data-next-audit-cycle]")?.addEventListener("click", () => openNextAuditCycleDialog(entry.record));
   main.querySelector("[data-correct-audit-population]")?.addEventListener("click", async () => {
@@ -3343,7 +3406,8 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   }));
   main.querySelector("#add-record-content")?.addEventListener("click", () => openEditor(type, entry, { addRecordContent: true }));
   main.querySelectorAll("[data-edit-content]").forEach((button) => button.addEventListener("click", () => openContentEditor(entry, button.dataset.editContent)));
-  main.querySelector("#delete-resource")?.addEventListener("click", async () => {
+  main.querySelector("[data-delete-resource]")?.addEventListener("click", async () => {
+    main.querySelector(".record-overflow")?.removeAttribute("open");
     const repositoryPrefetch = prefetchRepositoryForReview();
     if (!await confirmAction({
       kicker: "Delete record",
@@ -3369,17 +3433,50 @@ function renderDetail(main, type, id, params = new URLSearchParams()) {
   }
 }
 
-function renderDetailSupport({ hasRecordBody, workflowPanel, metadataPanel, attachmentPanel, participationPanel, connectionsPanel, historyPanel }) {
-  const panels = workflowPanel + metadataPanel + attachmentPanel + participationPanel + connectionsPanel + historyPanel;
+function renderDetailSupport({ hasRecordBody, workflowPanel, metadataPanel, attachmentPanel }) {
+  const panels = workflowPanel + metadataPanel + attachmentPanel;
   if (hasRecordBody) return '<aside>' + panels + '</aside>';
   const stacks = [
     { name: "guidance", content: workflowPanel },
-    { name: "record", content: metadataPanel + attachmentPanel + historyPanel },
-    { name: "relationships", content: participationPanel + connectionsPanel }
+    { name: "record", content: metadataPanel + attachmentPanel }
   ].filter(({ content }) => content);
   return '<aside class="detail-support-columns">' + stacks.map(({ name, content }) => '<div class="detail-support-stack ' + name + '">' + content + '</div>').join("") + '</aside>';
 }
 
+function openRecordUtilityDialog(entry, view) {
+  const dialog = document.createElement("dialog");
+  dialog.className = "alert-dialog record-utility-dialog";
+  const definitions = {
+    info: {
+      kicker: "Record info",
+      title: entry.record.title,
+      body: '<dl class="metadata record-info"><div><dt>Record ID</dt><dd><code>' + esc(entry.record.id) + '</code></dd></div><div><dt>Type</dt><dd>' + esc(state.model.resources[entry.record.type].title) + '</dd></div><div><dt>Source file</dt><dd><code>' + esc(entry.relativePath) + '</code></dd></div><div><dt>Workspace revision</dt><dd>' + (state.git.available ? '<code>' + esc(state.git.shortCommit) + '</code>' : "Unavailable until the workspace is committed.") + '</dd></div>' + (entry.record.extensions ? '<div><dt>Extensions</dt><dd>' + formatValue(entry.record.extensions, "extensions", entry.record.type) + '</dd></div>' : '') + '</dl><details class="record-json"><summary>View raw JSON</summary><pre class="compact-json">' + esc(JSON.stringify(entry.record, null, 2)) + '</pre></details>'
+    },
+    connections: {
+      kicker: "Connections",
+      title: entry.record.title,
+      body: (personParticipation(entry, true) + resourceConnections(entry, true)) || '<p class="muted">This record has no connected records.</p>'
+    },
+    history: {
+      kicker: "File history",
+      title: entry.record.title,
+      body: entry.historyError
+        ? '<p class="muted">File history is unavailable. Reload the record to try again.</p>'
+        : entry.history?.length
+          ? '<div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div>'
+          : '<p class="muted">No committed history is available for this record.</p>'
+    }
+  };
+  const definition = definitions[view];
+  if (!definition) return;
+  dialog.setAttribute("aria-labelledby", "record-utility-title");
+  dialog.innerHTML = '<div class="dialog-head"><div><p class="kicker">' + esc(definition.kicker) + '</p><h2 id="record-utility-title">' + esc(titleCase(definition.title)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><div class="record-utility-body">' + definition.body + '</div><div class="dialog-actions"><button type="button" class="button primary">Close</button></div>';
+  document.body.append(dialog);
+  dialog.querySelectorAll("button").forEach((button) => button.addEventListener("click", () => dialog.close()));
+  dialog.addEventListener("close", () => dialog.remove(), { once: true });
+  dialog.showModal();
+}
+
 function evidenceAttachmentPanel(entry) {
   const attachments = (entry.record.filePaths || []).map((path) => ({
     path,
@@ -3563,7 +3660,7 @@ function recordContentDefinition(type) {
   };
 }
 
-function personParticipation(entry) {
+function personParticipation(entry, expanded = false) {
   if (entry.record.type !== "person") return "";
   const personId = entry.record.id;
   const appointments = resourcesOfType("appointment")
@@ -3603,8 +3700,8 @@ function personParticipation(entry) {
   const count = affiliations.length + assignments.length;
   if (!count) return "";
   return '<section class="panel connections-panel"><div class="panel-head"><h3>Participation</h3><span>' + count + '</span></div>'
-    + personParticipationGroup("Appointments and teams", affiliations, 8, "more appointments or teams")
-    + personParticipationGroup("Assigned records", assignments, 10, "more assigned records")
+    + personParticipationGroup("Appointments and teams", affiliations, expanded ? affiliations.length : 8, "more appointments or teams")
+    + personParticipationGroup("Assigned records", assignments, expanded ? assignments.length : 10, "more assigned records")
     + '</section>';
 }
 
@@ -3617,7 +3714,7 @@ function personParticipationGroup(title, rows, limit, moreLabel) {
     + '</div>';
 }
 
-function resourceConnections(entry) {
+function resourceConnections(entry, expanded = false) {
   const relatedPeopleOnly = entry.record.type === "person";
   const connections = new Map();
   const entriesById = new Map(state.resources.map((item) => [item.record.id, item]));
@@ -3652,7 +3749,7 @@ function resourceConnections(entry) {
     return firstType - secondType || first.entry.record.title.localeCompare(second.entry.record.title);
   });
   if (!sorted.length) return "";
-  const visible = sorted.slice(0, 14);
+  const visible = expanded ? sorted : sorted.slice(0, 14);
   return '<section class="panel connections-panel"><div class="panel-head"><h3>' + (relatedPeopleOnly ? "Related people" : "Connections") + '</h3><span>' + sorted.length + '</span></div><div class="connections">' + visible.map(({ entry: connected, reasons }) => '<a href="#/resource/' + encodeURIComponent(connected.record.type) + '/' + encodeURIComponent(connected.record.id) + '"><strong>' + esc(connected.record.title) + '</strong><small>' + esc([...reasons].join(" · ")) + '</small></a>').join("") + '</div>' + (sorted.length > visible.length ? '<p class="connections-more">' + (sorted.length - visible.length) + ' more connections are available through the linked records.</p>' : "") + '</section>';
 }
 
@@ -6385,7 +6482,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .reconciliation-panel>p{margin:0 0 12px;color:var(--muted);font-size:12px;line-height:1.5}.reconciliation-candidates{display:grid;gap:9px}.reconciliation-candidate{display:grid;grid-template-columns:minmax(0,1fr) minmax(280px,.8fr);gap:16px;padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.reconciliation-candidate strong{margin-left:8px;font-size:13.2px}.reconciliation-candidate p{margin:7px 0;color:var(--muted);font-size:12px;line-height:1.5}.reconciliation-candidate small{display:block;overflow-wrap:anywhere;color:var(--muted);font-size:9.6px}.reconciliation-actions{display:grid;gap:8px;justify-items:end;align-content:center}.reconciliation-actions>code{max-width:100%;overflow-wrap:anywhere;color:var(--muted);font-size:9.6px;text-align:right}
 .onboarding-save-status{color:var(--muted);font-size:10.8px;line-height:1.35}.onboarding-save-status:empty{display:none}.onboarding-save-status:not(:empty){order:-1;flex-basis:100%;margin-bottom:4px}.onboarding-retry-sync{margin-top:9px}.detail-loading{color:var(--muted)}
 .save-status{min-height:16px;color:var(--muted);font-size:10.8px;line-height:1.35}
-.page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}
+.page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center;justify-content:flex-end;flex-wrap:wrap}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}.record-overflow{position:relative;flex:0 0 auto;margin-left:auto}.record-overflow>summary{display:grid;place-items:center;width:38px;height:38px;border:1px solid var(--line);border-radius:7px;background:var(--panel);color:var(--ink);cursor:pointer;list-style:none}.record-overflow>summary::-webkit-details-marker{display:none}.record-overflow>summary svg{display:block;width:18px;height:4px;fill:currentColor}.record-overflow>summary:hover,.record-overflow[open]>summary{border-color:var(--accent-light);background:var(--accent-soft);color:var(--accent)}.record-overflow-menu{position:absolute;z-index:12;top:calc(100% + 6px);right:0;display:grid;width:190px;padding:6px;border:1px solid var(--line);border-radius:9px;background:var(--panel);box-shadow:0 14px 36px rgba(0,0,53,.16)}.record-overflow-menu button{width:100%;border:0;border-radius:6px;padding:9px 10px;background:none;color:var(--ink);font-size:13.2px;text-align:left;cursor:pointer}.record-overflow-menu button:hover{background:var(--surface-soft)}.record-overflow-menu button:disabled{cursor:wait;color:var(--muted)}.record-overflow-menu .danger-text{color:var(--red)}.record-overflow-separator{height:1px;margin:5px 4px;background:var(--line)}.record-utility-dialog{width:min(680px,calc(100vw - 30px));max-height:min(760px,calc(100vh - 30px));overflow:auto}.record-utility-body{display:grid;gap:12px;margin:19px 0}.record-utility-body>.panel{box-shadow:none}.record-info>div:first-child{border-top:0}.record-json{border-top:1px solid var(--line);padding-top:13px}.record-json summary{color:var(--accent);font-size:13.2px;font-weight:750;cursor:pointer}.record-json pre{max-height:360px;overflow:auto;margin:12px 0 0}.record-utility-dialog .history{max-height:none}
 .not-found{max-width:620px;padding:28px}.not-found h2{font-family:Georgia,serif;font-size:37.2px;font-weight:500;margin:7px 0}.not-found>p:not(.kicker){margin:0;color:var(--muted);font-size:15.6px}.not-found .page-actions{justify-content:flex-start;margin-top:22px}
 .button.danger-action{background:var(--red);border-color:var(--red);color:#fff}
 @media(max-width:1200px){.readiness-flow{grid-template-columns:repeat(3,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr 1fr}.audit-engagement .button{grid-column:1/-1;justify-self:start}}
@@ -6396,13 +6493,12 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .detail-grid aside .panel{width:100%;max-height:min(520px,65vh);overflow:auto;overscroll-behavior:contain;scrollbar-gutter:stable}.detail-grid aside .workflow-guidance,.detail-grid aside .resource-review-criteria{margin:0}.detail-grid aside .resource-review-criteria{padding:21px}.detail-grid aside .detail-workflow-panel{max-height:min(440px,60vh)}.detail-grid aside .detail-review-panel{max-height:min(300px,50vh)}.detail-grid aside .workflow-findings,.detail-grid aside .resource-review-criteria ul{grid-template-columns:1fr}.detail-support-stack{display:grid;min-width:0;gap:14px;align-content:start}
 @media(max-width:760px){.detail-grid aside{order:-1}}
 @media(max-width:760px){.reconciliation-candidate{grid-template-columns:1fr}.reconciliation-actions{justify-items:start}.reconciliation-actions>code{text-align:left}}
-@media(max-width:760px){.detail-grid-structured .detail-support-columns{display:flex;flex-direction:column}.detail-grid-structured .detail-support-stack{display:contents}.detail-grid-structured .detail-history-panel{order:1}}
+@media(max-width:760px){.detail-grid-structured .detail-support-columns{display:flex;flex-direction:column}.detail-grid-structured .detail-support-stack{display:contents}}
 @media(max-width:760px){.guide-review ul,.resource-review-criteria ul{grid-template-columns:1fr}.collection-review-head,.collection-review-foot{align-items:stretch;flex-direction:column}.record-workflow-action{min-width:0}}
 @media(max-width:760px){.policy-content-table>.section-head{display:block}.policy-content-tools{justify-content:flex-start;margin-top:15px}.policy-content-tools>label:first-child{flex:1 1 100%;width:100%}.policy-content-tools input[type="search"]{width:100%;min-width:0}}
 @media(max-width:520px){.onboarding-form,.onboarding-sections,.setup-steps{grid-template-columns:1fr}.onboarding-form label.wide{grid-column:auto}.onboarding-actions{flex-wrap:wrap}.onboarding-skip{width:100%;order:3;margin:3px 0 0}.readiness-flow{grid-template-columns:1fr}.obligation-card-foot{align-items:flex-start;flex-direction:column}.obligation-action{align-self:flex-start}}
 @media(min-width:761px){.detail-grid{grid-template-columns:minmax(270px,1fr) minmax(0,2fr)}.detail-grid aside{grid-column:1;grid-row:1}.detail-main{grid-column:2;grid-row:1}}
 @media(min-width:761px){.detail-grid.detail-grid-structured{grid-template-columns:1fr}.detail-grid-structured aside{grid-column:1;grid-row:1}.detail-grid-structured .detail-support-columns{grid-template-columns:repeat(2,minmax(0,1fr))}}
-@media(min-width:1300px){.detail-grid-structured .detail-support-columns{grid-template-columns:repeat(3,minmax(0,1fr))}}
 @media(max-width:760px){.sidebar{visibility:hidden;transition:transform .2s,visibility 0s .2s}.sidebar.shown{visibility:visible;transition-delay:0s}.nav-close{display:grid;place-items:center;position:absolute;top:25px;right:18px;width:34px;height:34px;border:1px solid #5966a4;border-radius:50%;background:#11174a;color:#eef1ff;font-size:24px;cursor:pointer}.nav-scrim{display:block;position:fixed;inset:0;border:0;background:rgba(0,0,24,.38);opacity:0;pointer-events:none;transition:opacity .2s;z-index:15}.sidebar.shown+.nav-scrim{opacity:1;pointer-events:auto}.pagination{justify-content:space-between;gap:8px}.page-status{min-width:0}}
 @media(max-width:760px){.topbar{height:56px}.topbar>div:first-of-type{display:none}.topbar-readiness{flex:0 1 220px;min-width:120px}.nav-close{font-size:0}.nav-close:before,.nav-close:after{content:"";position:absolute;width:13px;height:2px;border-radius:2px;background:currentColor;transform:rotate(45deg)}.nav-close:after{transform:rotate(-45deg)}}
 

package/src/workflow.js

@@ -1125,6 +1125,8 @@ function normalizeFinding(code, item, context) {
     ...(item.createResourceType ? { createResourceType: item.createResourceType } : {}),
     ...(item.sourceResourceIds ? { sourceResourceIds: item.sourceResourceIds } : {}),
     ...(item.informationTypeId ? { informationTypeId: item.informationTypeId } : {}),
+    ...(item.affectedResourceIds ? { affectedResourceIds: item.affectedResourceIds } : {}),
+    ...(item.retentionScopeResourceIds ? { retentionScopeResourceIds: item.retentionScopeResourceIds } : {}),
     ...(item.retentionScheduleItemIds ? { retentionScheduleItemIds: item.retentionScheduleItemIds } : {}),
     ...(item.staleResourceIds ? { staleResourceIds: item.staleResourceIds } : {}),
     ...(subject ? { subject } : {}),