filegrc 0.3.3 → 0.4.0

package/src/web.js

@@ -8,7 +8,7 @@ import {
   utcCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { POLICY_EVENT_NAMES, PROGRAM_PATH, RESOURCE_INSTRUCTIONS } from "./program-path.js";
+import { PROGRAM_PATH, RESOURCE_INSTRUCTIONS } from "./program-path.js";
 import { formatCalendarDate, formatLocalDateTime } from "./time.js";
 
 export function renderIndex(state = null) {
@@ -54,29 +54,7 @@ const STAGE_PAGE_SUMMARIES = ${JSON.stringify({
   ...RESOURCE_INSTRUCTIONS,
   "utility:audit-packet": "Review filegrc Evidence and External Evidence for the formal period, complete engagement preparation, and build the indexed audit packet."
 })};
-const POLICY_EVENT_NAMES = ${JSON.stringify(POLICY_EVENT_NAMES)};
-const STAGE_PAGE_ID_ALIASES = {
-  "controls:complementary-control": ["scope:complementary-control"]
-};
-const OBLIGATION_COMPLETION_TYPES = {
-  "access-review": "access-review",
-  "backup-test": "backup-test",
-  "continuity-review": "evidence",
-  exercise: "exercise",
-  "inventory-review": "evidence",
-  "log-review": "evidence",
-  meeting: "meeting",
-  "network-review": "evidence",
-  "penetration-test": "penetration-test",
-  "performance-review": "evidence",
-  "policy-review": "policy-review",
-  "risk-assessment": "risk-assessment",
-  "security-scan": "evidence",
-  training: "attestation",
-  "vendor-review": "vendor-review",
-  "vulnerability-scan": "vulnerability-scan"
-};
-const RECORD_TEXT_FIELDS = new Set(["description", "statement", "activity", "purpose", "scope", "objective", "applicabilityRationale", "summary", "rationale", "acceptanceRationale", "businessPurpose", "changeSummary", "decisionSummary", "decisionRationale", "recommendation", "remediationPlan", "auditorNotes", "notPerformedReason"]);
+const RECORD_TEXT_FIELDS = new Set(["description", "statement", "activity", "purpose", "scope", "objective", "applicabilityRationale", "summary", "rationale", "businessPurpose", "changeSummary", "decisionSummary", "decisionRationale", "recommendation", "remediationPlan", "auditorNotes", "notPerformedReason"]);
 const FINDING_SOURCE_TYPES = new Set(["control-test", "policy-review", "meeting", "risk", "risk-assessment", "vendor-review", "access-review", "incident", "exercise", "backup-test", "penetration-test", "audit"]);
 const ACTION_ITEM_SOURCE_TYPES = new Set(["finding", "exception", "policy-review", "meeting", "risk", "risk-assessment", "vendor-review", "access-review", "vulnerability", "incident", "exercise", "backup-test", "data-request", "audit-request"]);
 const TITLE_CASE_MINOR_WORDS = new Set(["a", "an", "and", "as", "at", "but", "by", "for", "in", "nor", "of", "on", "or", "per", "the", "to", "via", "vs"]);
@@ -86,7 +64,12 @@ let onboardingShade = null;
 let onboardingStep = 0;
 let onboardingDraft = null;
 let onboardingBusy = false;
+let onboardingStillWorkingTimer = null;
+let onboardingPendingDraft = false;
+const resourceDetailRequests = new Map();
 let resourceGuideCleanup = null;
+let repositorySyncPollTimer = null;
+let repositorySyncPollInFlight = false;
 
 start().catch((error) => {
   root.innerHTML = '<main class="fatal"><h1>Could Not Load the Workspace</h1><pre></pre></main>';
@@ -100,6 +83,7 @@ async function start() {
   window.addEventListener("resize", positionCurrentOnboarding);
   window.addEventListener("scroll", positionCurrentOnboarding, true);
   render();
+  scheduleRepositorySyncPoll();
   if (!state.readOnly && rendererSettingsEntry()?.record.showOnboarding === true) {
     queueMicrotask(requestOnboarding);
   }
@@ -112,7 +96,7 @@ function render() {
   if (previousNavigation) navigationScrollTop = previousNavigation.scrollTop;
   const route = parseRoute();
   const nav = buildNavigation(route);
-  root.innerHTML = '<div class="shell">' + nav + '<div class="workspace"><header class="topbar">' + topbar(route) + '</header><main id="main"></main></div></div>';
+  root.innerHTML = '<div class="shell">' + nav + '<div class="workspace"><header class="topbar">' + topbar(route) + '</header>' + repositorySyncAlert() + '<main id="main"></main></div></div>';
   const nextNavigation = root.querySelector(".sidebar-nav");
   if (nextNavigation) nextNavigation.scrollTop = navigationScrollTop;
   const main = root.querySelector("main");
@@ -121,7 +105,7 @@ function render() {
   else if (route.name === "obligations") renderObligations(main, route.params);
   else if (route.name === "audit-packet") renderAuditPacket(main, route.params);
   else if (route.name === "list") renderList(main, route.type, route.params);
-  else if (route.name === "detail") renderDetail(main, route.type, route.id);
+  else if (route.name === "detail") renderDetail(main, route.type, route.id, route.params);
   else if (route.name === "organization") renderOrganization(main);
   else if (route.name === "repository") renderRepository(main);
   else renderNotFound(main);
@@ -141,7 +125,7 @@ function parseRoute() {
   if (parts.length === 1 && parts[0] === "obligations") return { name: "obligations", params: new URLSearchParams(query) };
   if (parts.length === 1 && parts[0] === "audit-packet") return { name: "audit-packet", params: new URLSearchParams(query) };
   if (parts.length === 2 && parts[0] === "resources" && parts[1]) return { name: "list", type: parts[1], params: new URLSearchParams(query) };
-  if (parts.length === 3 && parts[0] === "resource" && parts[1] && parts[2]) return { name: "detail", type: parts[1], id: parts[2] };
+  if (parts.length === 3 && parts[0] === "resource" && parts[1] && parts[2]) return { name: "detail", type: parts[1], id: parts[2], params: new URLSearchParams(query) };
   if (parts.length === 1 && parts[0] === "organization") return { name: "organization" };
   if (parts.length === 1 && parts[0] === "repository") return { name: "repository" };
   return { name: "missing" };
@@ -149,13 +133,15 @@ function parseRoute() {
 
 function buildNavigation(route) {
   const currentStage = readinessStageForRoute(route);
+  const contextualStageId = route.params?.get("stage");
   const stages = READINESS_STAGES.map((stage) => {
     const stagePageCurrent = (route.name === "stage" && route.stageId === stage.id)
       || (stage.id === "run" && route.name === "obligations");
     const stageOpen = navigationGroupState[stage.id] ?? currentStage?.id === stage.id;
     const sections = stage.sections.map((section) => {
       const sectionKey = stage.id + ":" + section.id;
-      const sectionCurrent = (route.type && section.types.includes(route.type))
+      const sectionCurrent = (route.type && section.types.includes(route.type) && (!contextualStageId || contextualStageId === stage.id))
+        || (section.relatedLinks || []).some((link) => route.type === link.type && contextualStageId === stage.id)
         || (section.utility === "obligation-board" && route.name === "obligations")
         || (section.utility === "audit-packet" && route.name === "audit-packet");
       const sectionOpen = navigationGroupState[sectionKey] ?? (sectionCurrent || section.defaultOpen);
@@ -164,7 +150,11 @@ function buildNavigation(route) {
         .filter(([, definition]) => definition);
       const direct = stage.sections.length === 1 || sectionDestinations(section).length === 1;
       const links = resources.map(([type, definition]) => {
-        return '<a class="' + (direct ? "nav-direct " : "") + (route.type === type ? "current" : "") + '" href="#/resources/' + encodeURIComponent(type) + '"><span>' + esc(titleCase(definition.pluralTitle)) + '</span><span class="nav-control-slot" aria-hidden="true"></span></a>';
+        const current = route.type === type && (!contextualStageId || contextualStageId === stage.id);
+        return '<a class="' + (direct ? "nav-direct " : "") + (current ? "current" : "") + '" href="#/resources/' + encodeURIComponent(type) + '"><span>' + esc(titleCase(definition.pluralTitle)) + '</span><span class="nav-control-slot" aria-hidden="true"></span></a>';
+      }).join("") + (section.relatedLinks || []).map((link) => {
+        const current = route.type === link.type && contextualStageId === stage.id;
+        return '<a class="' + (direct ? "nav-direct " : "") + (current ? "current" : "") + '" href="' + esc(link.href) + '"><span>' + esc(link.label) + '</span><span class="nav-control-slot" aria-hidden="true"></span></a>';
       }).join("") + renderSidebarUtility(section.utility, route, direct);
       if (direct) return links;
       return '<section class="nav-group nav-subgroup ' + (sectionOpen ? "open" : "") + '" data-group="' + esc(sectionKey) + '"><button class="nav-subheading-row nav-subgroup-toggle" type="button" aria-label="' + (sectionOpen ? "Collapse " : "Expand ") + esc(section.title) + '" aria-expanded="' + sectionOpen + '" aria-controls="nav-group-' + esc(sectionKey) + '"><span class="nav-subheading">' + esc(section.title) + '</span><svg class="nav-chevron" viewBox="0 0 12 12" aria-hidden="true"><path d="M4 2.5 7.5 6 4 9.5"></path></svg></button><div class="nav-items" id="nav-group-' + esc(sectionKey) + '">' + links + '</div></section>';
@@ -179,6 +169,12 @@ function buildNavigation(route) {
 
 function readinessStageForRoute(route) {
   if (route.name === "stage") return READINESS_STAGES.find((stage) => stage.id === route.stageId);
+  const contextualStageId = route.params?.get("stage");
+  const contextualStage = contextualStageId && READINESS_STAGES.find((stage) => (
+    stage.id === contextualStageId
+    && stage.sections.some((section) => (section.relatedLinks || []).some((link) => link.type === route.type))
+  ));
+  if (contextualStage) return contextualStage;
   return READINESS_STAGES.find((stage) => (
     (stage.supportingResourceTypes || []).includes(route.type)
     || stage.sections.some((section) => section.types.includes(route.type)
@@ -217,13 +213,34 @@ function topbar(route) {
           : route.name === "audit-packet"
             ? "Audit Readiness"
             : state.model.resources[route.type]?.pluralTitle || "filegrc";
-  return '<button class="mobile-nav" type="button" aria-label="Open navigation" aria-controls="sidebar-navigation" aria-expanded="false">☰</button><div><small class="eyebrow">' + esc(state.workspace.organizationName) + '</small><h1>' + esc(titleCase(title)) + '</h1></div><label class="search"><span aria-hidden="true">⌕</span><input id="global-search" type="search" placeholder="Search records" aria-label="Search records"><kbd>/</kbd></label><div class="topbar-status"><a class="validation-chip" href="#/repository"><span class="status-dot ' + (state.validation.ok ? "good" : "bad") + '"></span>' + (state.validation.ok ? "Data valid" : state.validation.counts.errors + " validation errors") + '</a><a class="repo-chip" href="#/repository"><span class="status-dot ' + (state.git.clean ? "good" : "warn") + '"></span>' + esc(state.git.available ? ((state.git.branch || "detached") + " · " + state.git.shortCommit) : "Git unavailable") + '</a></div>';
+  const repositoryLabel = state.repository?.mode === "trunk"
+    ? state.repository.label
+    : state.git.available ? ((state.git.branch || "detached") + " · " + state.git.shortCommit) : "Git unavailable";
+  const repositoryTone = state.repository?.mode === "trunk"
+    ? repositoryStatusTone(state.repository.status)
+    : state.git.clean ? "good" : "warn";
+  return '<button class="mobile-nav" type="button" aria-label="Open navigation" aria-controls="sidebar-navigation" aria-expanded="false">☰</button><div><small class="eyebrow">' + esc(state.workspace.organizationName) + '</small><h1>' + esc(titleCase(title)) + '</h1></div><label class="search"><span aria-hidden="true">⌕</span><input id="global-search" type="search" placeholder="Search records" aria-label="Search records"><kbd>/</kbd></label><div class="topbar-status"><a class="validation-chip" href="#/repository"><span class="status-dot ' + (state.validation.ok ? "good" : "bad") + '"></span>' + (state.validation.ok ? "Data valid" : state.validation.counts.errors + " validation errors") + '</a><a class="repo-chip" href="#/repository"><span class="status-dot ' + repositoryTone + '"></span>' + esc(repositoryLabel) + '</a></div>';
+}
+
+function repositoryStatusTone(status) {
+  if (status === "synced") return "good";
+  if (status === "syncing") return "neutral";
+  return "warn";
+}
+
+function repositorySyncAlert() {
+  if (state.repository?.status === "syncing") {
+    return '<div class="repository-sync-alert syncing" role="status" aria-live="polite"><span class="status-dot neutral"></span><span><strong>Saved and committed locally.</strong> Git push is continuing in the background. Other changes unlock when synchronization finishes.</span><a href="#/repository">View status</a></div>';
+  }
+  const message = state.repository?.backgroundSyncError;
+  if (!message) return "";
+  return '<div class="repository-sync-alert" role="alert"><span class="status-dot warn"></span><span><strong>Saved locally, but Git sync failed.</strong> ' + esc(message) + '</span><a href="#/repository">Review and retry</a></div>';
 }
 
 function renderHome(main) {
   const activeAudit = resourcesOfType("audit").find((item) => !["complete", "closed", "cancelled"].includes(item.record.status));
   const program = state.programReadiness;
-  const activeFirm = activeAudit && (activeAudit.record.auditorVendorId || (activeAudit.record.auditor && Object.keys(activeAudit.record.auditor).length));
+  const activeFirm = activeAudit?.record.auditorVendorId;
   const setupPending = rendererSettingsEntry()?.record.showOnboarding === true;
   const acceptedEventTriggers = state.obligations.triggers.filter(({ programStatus }) => programStatus !== "proposed");
   const openObligations = state.obligations.items.filter((item) => item.status !== "complete");
@@ -242,7 +259,7 @@ function renderHome(main) {
 }
 
 function initialSetupBanner() {
-  const system = resourcesOfType("system").find(({ record }) => record.inScope && record.status !== "retired")?.record;
+  const system = resourcesOfType("system").find(({ record }) => (state.workspace.systemIds || []).includes(record.id) && record.status !== "retired")?.record;
   if (!system) {
     return '<section class="setup-banner"><div><p class="kicker">Setup incomplete</p><h3>Define the initial service boundary</h3><p>Record the management program goal and the systems that should enter policy and control review.</p></div><ol><li>Describe the service boundary.</li><li>Choose the program goal.</li><li><button class="text-button" type="button" id="resume-setup">Resume setup</button></li></ol></section>';
   }
@@ -274,8 +291,7 @@ function readinessOverview() {
   const stages = [
     programStage("scope", "Confirm program ownership, criteria, and commitments, then describe the service, supporting systems, and dependencies.", "#/stage/scope"),
     programStage("policies", "Tailor the policy set, obtain independent management approval, and establish effective dates.", "#/stage/policies"),
-    programStage("controls", "Finish the internal control set with actual procedures, owners, scope, and evidence sources, then record any complementary controls.", "#/stage/controls"),
-    programStage("evidence", "For each control family, finish the source-system instructions and verify a real test export or capture.", "#/stage/evidence"),
+    programStage("controls", "Finish the internal control set and every authoritative evidence source, then record any complementary controls.", "#/stage/controls"),
     programStage("run", "Begin the candidate period, maintain risk assessments, work the filegrc queue, run the remaining controls, and retain dated evidence.", "#/stage/run"),
     programStage("audit", "Engage the CPA firm, confirm the formal period, complete fieldwork, and generate the final evidence packet.", "#/stage/audit")
   ];
@@ -297,8 +313,53 @@ function renderStageOverview(main, stageId, params = new URLSearchParams()) {
   if (stage.id === "run") return renderObligations(main, params);
   const progress = stageProgress(stage);
   main.innerHTML = '<div class="page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
-    '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 6</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(progress) + '</section>' +
-    renderStagePageIndex(stage) + '</div>';
+    '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(progress) + '</section>' +
+    renderStagePageIndex(stage) + (stage.id === "controls" ? renderEvidenceReadiness() : "") + '</div>';
+}
+
+function renderEvidenceReadiness() {
+  const items = state.programReadiness?.stages
+    ?.find((stage) => stage.id === "controls")
+    ?.items.filter((item) => item.id.startsWith("source-family-")) || [];
+  const completeCount = items.filter((item) => item.status === "complete").length;
+  const cards = items.map((item) => {
+    const sources = (item.sourceSystemIds || []).map((id) => {
+      const source = state.resources.find(({ record }) => record.type === "system" && record.id === id)?.record;
+      const sourceCheck = (item.sourceSystemChecks || []).find(({ sourceSystemId }) => sourceSystemId === id);
+      const complete = sourceCheck?.complete ?? (item.completeSourceSystemIds || []).includes(id);
+      const status = complete
+        ? "Ready"
+        : Object.entries(sourceCheck?.checks || {})
+            .filter(([, passed]) => !passed)
+            .map(([name]) => evidenceSourceCheckLabel(name))
+            .join(", ") || "Needs details";
+      return source
+        ? '<a class="evidence-map-source ' + (complete ? "complete" : "incomplete") + '" href="#/resource/system/' + encodeURIComponent(id) + '">' + esc(source.title) + '<small>' + esc(status) + '</small></a>'
+        : "";
+    }).join("");
+    const sourceAction = sources
+      ? sources
+      : '<a class="button" href="#/resources/system?new=1">Add source System</a>';
+    const method = item.operationRecordTypes?.length
+      ? "FileGRC records: " + item.operationRecordTypes.map(properCase).join(", ")
+      : properCase(item.evidenceForm || "External evidence");
+    return '<article class="evidence-map-card ' + esc(item.status) + '"><div class="evidence-map-card-head"><div><span class="badge ' + (item.status === "complete" ? "good" : "warn") + '">' + (item.status === "complete" ? "Mapped" : "Needs mapping") + '</span><h3>' + esc(item.title) + '</h3></div><small>' + esc(method) + '</small></div><p>' + esc(item.description || item.message) + '</p>' +
+      (item.sourceKinds?.length ? '<div class="evidence-map-expectation"><strong>Source role</strong><span>' + item.sourceKinds.map((kind) => '<code>' + esc(kind) + '</code>').join(" or ") + '</span></div>' : "") +
+      (item.evidencePrompt ? '<div class="evidence-map-expectation"><strong>Expected evidence</strong><span>' + esc(item.evidencePrompt) + '</span></div>' : "") +
+      (item.timing ? '<div class="evidence-map-expectation"><strong>When</strong><span>' + esc(item.timing) + '</span></div>' : "") +
+      '<div class="evidence-map-links"><div><small>Controls</small><div class="evidence-map-references">' + (item.controlIds || []).map((id) => formatReference(id)).join("") + '</div></div><div><small>Authoritative sources</small><div class="evidence-map-sources">' + sourceAction + '</div></div></div><p class="evidence-map-status">' + esc(item.message) + '</p></article>';
+  }).join("");
+  const empty = '<section class="evidence-map-empty"><p class="kicker">Evidence readiness</p><h3>Select the program controls first</h3><p>Control implementation checks are generated from the selected Controls and their authoritative evidence sources.</p><a class="button primary" href="#/resources/control">Review Controls</a></section>';
+  return '<section class="evidence-map"><div class="evidence-map-head"><div><p class="kicker">Control implementation</p><h2>' + completeCount + ' of ' + items.length + ' evidence ' + (items.length === 1 ? "family" : "families") + ' ready</h2><p>Before marking Controls implemented, connect them to the Systems where their evidence originates. Each source must be active, have the required source role and current access owners, and include repeatable retrieval instructions in Record Markdown.</p></div><div class="evidence-map-actions"><a class="button" href="#/resources/system">Review Systems</a><a class="button primary" href="#/resources/control">Review Controls</a></div></div>' + (cards || empty) + '</section>';
+}
+
+function evidenceSourceCheckLabel(name) {
+  return ({
+    active: "activate source",
+    sourceRole: "add source role",
+    accessOwners: "add access owner",
+    retrievalInstructions: "add retrieval instructions"
+  })[name] || humanize(name);
 }
 
 function renderStagePageIndex(stage) {
@@ -319,7 +380,7 @@ function stagePageId(stage, destination) {
 
 function stagePageComplete(pageId) {
   const completedPageIds = rendererSettingsEntry()?.record.completedStagePageIds || [];
-  return [pageId, ...(STAGE_PAGE_ID_ALIASES[pageId] || [])].some((id) => completedPageIds.includes(id));
+  return completedPageIds.includes(pageId);
 }
 
 function stagePageSummary(destination) {
@@ -354,9 +415,9 @@ function operationProgress() {
   const goal = program?.target?.goal || state.workspace.assuranceGoal || "none";
   const asOf = program?.asOf || currentDate();
   const candidateStarted = goal === "soc-2-type-2"
-    ? Boolean(program?.target?.candidatePeriodStart && program.target.candidatePeriodStart <= asOf)
+    ? Boolean(program?.target?.candidateCoverage?.kind === "range" && program.target.candidateCoverage.startsOn <= asOf)
     : goal === "soc-2-type-1"
-      ? Boolean(program?.target?.candidateTypeOneAsOf)
+      ? Boolean(program?.target?.candidateCoverage?.kind === "as-of")
       : Boolean(program?.evidenceReady);
   const overdue = state.obligations.counts.overdue || 0;
   const complete = Boolean(program?.evidenceReady && candidateStarted && overdue === 0);
@@ -439,7 +500,8 @@ function resourceRollup(type) {
   if (!records.length) return { value: "0", label: "No records yet" };
   const statuses = new Map();
   records.forEach((record) => {
-    if (record.status) statuses.set(record.status, (statuses.get(record.status) || 0) + 1);
+    const status = displayStatus(record);
+    if (status) statuses.set(status, (statuses.get(status) || 0) + 1);
   });
   const statusText = [...statuses.entries()].sort((a, b) => b[1] - a[1]).slice(0, 2).map(([status, count]) => count + " " + humanize(status).toLowerCase()).join(" · ");
   return { value: String(records.length), label: statusText || pluralize("record", records.length) };
@@ -458,12 +520,28 @@ function utilityRollup(utility) {
 }
 
 function auditEngagementPrompt(audit = null) {
-  const hasAuditor = audit?.auditorVendorId || (audit?.auditor && Object.keys(audit.auditor).length);
+  const hasAuditor = audit?.auditorVendorId;
   if (hasAuditor) return "";
   const heading = audit ? "CPA Firm Not Recorded" : "Optional: Engage a CPA Firm Early";
   return '<div class="audit-engagement"><div><strong>' + heading + '</strong><p>The program can keep operating while management selects a firm. Engage early when a customer deadline, unusual scope, or other timing risk needs CPA input.</p></div><ul><li>Share the program boundary, goal, and evidence-source plan.</li><li>Keep management candidate dates separate from the firm-agreed report period.</li><li>Create or update the audit record only for a real engagement.</li></ul>' + (!audit ? '<a class="button" href="#/resources/audit?new=1">Create engagement</a>' : "") + '</div>';
 }
 
+function renderExternalEvidenceSection() {
+  const records = resourcesOfType("evidence").map(({ record }) => record);
+  const recent = records.slice(0, 6).map((record) => (
+    '<a href="#/resource/evidence/' + encodeURIComponent(record.id) + '"><span><strong>' + esc(record.title) + '</strong><small>' +
+    esc(properCase(record.artifactKind || "Evidence")) + (record.collectedOn ? " · " + esc(formatCalendarDate(record.collectedOn)) : "") +
+    '</small></span><span class="badge status-' + esc(record.status || "draft") + '">' + esc(properCase(record.status || "draft")) + '</span></a>'
+  )).join("");
+  const createButton = state.readOnly
+    ? ""
+    : '<button class="button primary" type="button" data-new-external-evidence>New external evidence</button>';
+  return '<section class="workflow-section external-evidence-section"><div class="section-head"><div><p class="kicker">Fixed artifacts and approved references</p><h2>External Evidence</h2><p>Create a record when a real export, report, screenshot, signed file, or approved external reference exists. Select its authoritative source System, link the Controls and operating record it supports, then record collection and verification facts.</p></div><div class="page-actions">' +
+    createButton + '<a class="button" href="#/resources/evidence">View all</a></div></div><div class="external-evidence-list">' +
+    (recent || empty("No External Evidence has been collected yet. Create it during operation only when a real artifact or approved external reference exists.")) +
+    '</div></section>';
+}
+
 function renderObligations(main, params = new URLSearchParams()) {
   const stage = READINESS_STAGES.find((candidate) => candidate.id === "run");
   const plan = state.obligations;
@@ -485,12 +563,12 @@ function renderObligations(main, params = new URLSearchParams()) {
     ? '<section class="policy-event-feedback" role="status" aria-live="polite"><span class="status-dot good"></span><div><strong>Work added to the Work Queue</strong><p>' + esc(policyEventFeedback.name + " created " + policyEventFeedback.taskCount + " " + pluralize("task", policyEventFeedback.taskCount) + ".") + '</p></div><button class="button" type="button" data-view-added-work>View Work Queue</button><button class="icon-button" type="button" data-dismiss-policy-event-feedback aria-label="Dismiss confirmation">×</button></section>'
     : "";
   main.innerHTML = '<div class="page obligation-board-page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
-    '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 6</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(stageProgress(stage)) + '</section>' +
+    '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(stageProgress(stage)) + '</section>' +
     feedback +
     '<section class="workflow-section event-reminders"><div class="section-head"><div><p class="kicker">Changes that create work</p><h2>Policy Events</h2><p>Trigger the matching workflow when an event occurs. filegrc adds every required action to the Work Queue with its owner and deadline.</p></div></div><div class="policy-event-list">' + (triggers || empty("No event-driven obligations are configured.")) + '</div></section>' +
     '<section class="workflow-section work-queue-section"><div class="section-head"><div><p class="kicker">Recurring, event, and assigned work</p><h2>Work Queue</h2><p>This board schedules work linked to ' + scheduledControls + ' of ' + controls.length + ' controls and includes ' + assignedFollowUp + ' open ' + pluralize("Action Item", assignedFollowUp) + '. Triggered Policy Event actions appear here as individual tasks in Upcoming, Due, or Overdue. Other controls operate continuously or per transaction in their source systems and are documented through evidence records. Starter work remains a proposal until its governing policies are effective and at least one linked control is implemented.</p></div><div class="page-actions">' + (!state.readOnly ? '<button class="button" type="button" data-new-action-item>New task</button>' : "") + '<a class="button" href="#/resources/obligation">Edit schedules</a></div></div>' +
     '<div class="obligation-board">' + sections + '</div>' +
-    '</section></div>';
+    '</section>' + renderExternalEvidenceSection() + '</div>';
   main.querySelectorAll("[data-start-event]").forEach((button) => button.addEventListener("click", () => {
     const trigger = plan.triggers.find((item) => item.eventType === button.dataset.startEvent);
     if (trigger) openObligationEventDialog(trigger);
@@ -500,6 +578,7 @@ function renderObligations(main, params = new URLSearchParams()) {
     policyEventFeedback = null;
     event.currentTarget.closest(".policy-event-feedback")?.remove();
   });
+  main.querySelector("[data-new-external-evidence]")?.addEventListener("click", () => openEditor("evidence"));
   main.querySelectorAll("[data-expand-obligations]").forEach((button) => button.addEventListener("click", () => {
     const column = button.closest("[data-obligation-column]");
     const expanded = button.getAttribute("aria-expanded") === "true";
@@ -537,7 +616,24 @@ function policyEventTrigger(trigger, index) {
 }
 
 function policyEventName(eventType) {
-  return POLICY_EVENT_NAMES[eventType] || titleCase(humanize(eventType));
+  return state.model.policyEvents?.[eventType]?.title || titleCase(humanize(eventType));
+}
+
+function rangeCoverage(startsOn, endsOn) {
+  return { kind: "range", startsOn, endsOn };
+}
+
+function coverageStart(coverage) {
+  return coverage?.kind === "as-of" ? coverage.on : coverage?.startsOn;
+}
+
+function coverageEnd(coverage) {
+  return coverage?.kind === "as-of" ? coverage.on : coverage?.endsOn;
+}
+
+function defaultClassificationId() {
+  const definitions = state.workspace.classificationDefinitions || {};
+  return Object.hasOwn(definitions, "internal") ? "internal" : Object.keys(definitions)[0] || "";
 }
 
 function obligationCard(item, collapsed = false) {
@@ -556,11 +652,11 @@ function obligationCard(item, collapsed = false) {
 }
 
 function obligationCompletionPlan(item) {
-  const type = OBLIGATION_COMPLETION_TYPES[item.activityType] || "evidence";
+  const type = state.model.obligationActivities?.[item.activityType]?.completionType || "evidence";
   if (!currentPeopleForParties(item.ownerIds || []).length) {
     return { type, blocked: "Assign current owner", href: "#/resource/obligation/" + encodeURIComponent(item.obligationId) };
   }
-  if (["access-review", "backup-test"].includes(type) && !resourcesOfType("system").some(({ record }) => record.inScope && record.status !== "retired")) {
+  if (["access-review", "backup-test"].includes(type) && !(state.workspace.systemIds || []).some((id) => state.resources.some(({ record }) => record.id === id && record.status !== "retired"))) {
     return { type, blocked: "Add system first", href: "#/resources/system?new=1" };
   }
   if (type === "vendor-review" && !resourcesOfType("vendor").some(({ record }) => record.status !== "terminated")) {
@@ -592,63 +688,64 @@ function obligationCompletionSeed(type, item, obligation) {
   const date = currentDate();
   const timestamp = new Date().toISOString();
   const responsiblePeople = currentPeopleForParties(item.ownerIds || []);
-  const inScopeSystems = resourcesOfType("system").filter(({ record }) => record.inScope && record.status !== "retired").map(({ record }) => record.id);
+  const inScopeSystems = resourcesOfType("system").filter(({ record }) => (state.workspace.systemIds || []).includes(record.id) && record.status !== "retired").map(({ record }) => record.id);
   const activeVendors = resourcesOfType("vendor").filter(({ record }) => record.status !== "terminated").map(({ record }) => record.id);
   const title = item.title + " · " + formatCalendarDate(item.dueWindowStart);
   const common = { title };
   if (type === "meeting") {
     const team = completionTeam(item);
-    return { ...common, status: "complete", teamId: team.id, chairIds: currentPeopleForParties(team.chairIds || []), scheduledOn: date };
+    return { ...common, status: "complete", teamId: team.id, chairIds: currentPeopleForParties(team.chairIds || []), scheduledFor: date, startedAt: timestamp, endedAt: timestamp, attendeeIds: responsiblePeople };
   }
   if (type === "policy-review") {
-    return { ...common, status: "complete", scopeResourceIds: obligation.scopeResourceIds || [], reviewerIds: responsiblePeople, reviewedOn: date, outcome: "passed", changesRequired: false, periodStart: item.dueWindowStart, periodEnd: item.dueWindowEnd };
+    return { ...common, status: "complete", scopeResourceIds: obligation.scopeResourceIds || [], reviewerIds: responsiblePeople, completedOn: date, outcome: "passed", changesRequired: false, coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   if (type === "risk-assessment") {
-    return { ...common, status: "complete", assessmentDate: date, assessmentKind: "enterprise-risk", scope: "In-scope SOC 2 systems and dependencies", assessorIds: responsiblePeople, reviewerIds: responsiblePeople, methodology: state.workspace.riskMethodology?.method || "Documented risk methodology", approvedOn: date };
+    return { ...common, status: "complete", completedOn: date, assessmentKind: "enterprise-risk", scope: "In-scope SOC 2 systems and dependencies", assessorIds: responsiblePeople, reviewerIds: responsiblePeople, methodology: state.workspace.riskMethodology?.method || "Documented risk methodology", summary: "Assessment completed; link the supporting evidence and resulting risks.", approvedOn: date };
   }
   if (type === "attestation") {
     return { ...common, status: "completed", subjectResourceIds: [obligation.templateResourceId, ...(obligation.scopeResourceIds || [])].filter(Boolean), personId: responsiblePeople[0], attestationKind: item.activityType || "completion", assignedOn: item.dueWindowStart, dueOn: item.dueWindowEnd, completedOn: date, attestationMethod: "git-approval" };
   }
   if (type === "access-review") {
-    return { ...common, status: "complete", reviewDate: date, reviewerIds: responsiblePeople, systemIds: inScopeSystems, scope: "Privileged, production, and important-system access", outcome: "passed", periodStart: item.dueWindowStart, periodEnd: item.dueWindowEnd };
+    return { ...common, status: "complete", completedOn: date, reviewerIds: responsiblePeople, systemIds: inScopeSystems, scope: "Privileged, production, and important-system access", outcome: "passed", approvedByIds: responsiblePeople, approvedOn: date, coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   if (type === "vulnerability-scan") {
-    return { ...common, status: "complete", scanKind: "vulnerability", scope: "In-scope systems", operatorIds: responsiblePeople, scheduledOn: date, completedAt: timestamp, systemIds: inScopeSystems, resultSummary: "Document the scan result and link findings or evidence." };
+    return { ...common, status: "complete", scanKind: "vulnerability", scope: "In-scope systems", operatorIds: responsiblePeople, scheduledFor: date, completedAt: timestamp, systemIds: inScopeSystems, resultSummary: "Document the scan result and link findings or evidence." };
   }
   if (type === "penetration-test") {
-    return { ...common, status: "complete", testKind: "independent", scope: "In-scope systems and service boundary", periodStart: date, periodEnd: date, ownerIds: responsiblePeople, outcome: "passed", systemIds: inScopeSystems };
+    return { ...common, status: "complete", testKind: "independent", scope: "In-scope systems and service boundary", coverage: rangeCoverage(date, date), ownerIds: responsiblePeople, outcome: "passed", systemIds: inScopeSystems, completedOn: date, reviewerIds: responsiblePeople, reviewedOn: date };
+  }
+  if (type === "control-test") {
+    return { ...common, status: "complete", controlId: obligation.controlIds?.[0] || "", testKinds: [item.activityType || "control-operation"], performedBy: "management", testerIds: responsiblePeople, reviewerIds: responsiblePeople, completedOn: date, reviewedOn: date, outcome: "passed", coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   if (type === "exercise") {
-    return { ...common, status: "complete", exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response", scheduledOn: date, facilitatorIds: responsiblePeople, objective: item.title, outcome: "passed", systemIds: inScopeSystems, completedAt: timestamp };
+    return { ...common, status: "complete", exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response", scheduledFor: date, facilitatorIds: responsiblePeople, objective: item.title, outcome: "passed", systemIds: inScopeSystems, completedAt: timestamp };
   }
   if (type === "backup-test") {
-    return { ...common, status: "passed", systemIds: inScopeSystems, testDate: date, operatorIds: responsiblePeople, outcome: "passed", completedAt: timestamp };
+    return { ...common, status: "complete", systemIds: inScopeSystems, scheduledFor: date, operatorIds: responsiblePeople, reviewerIds: responsiblePeople, outcome: "passed", completedAt: timestamp };
   }
   if (type === "vendor-review") {
-    return { ...common, status: "complete", vendorIds: activeVendors, reviewerIds: responsiblePeople, reviewedOn: date, outcome: "passed", periodStart: item.dueWindowStart, periodEnd: item.dueWindowEnd };
+    const eventVendorId = (item.subjectResourceIds || []).find((id) => state.resources.some(({ record }) => record.id === id && record.type === "vendor"));
+    return { ...common, status: "complete", vendorId: eventVendorId || activeVendors[0] || "", reviewerIds: responsiblePeople, completedOn: date, decision: "approved", coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   return {
     ...common,
     status: "collected",
-    evidenceKind: item.activityType || "control-operation",
-    source: "Internal control operation",
+    artifactKind: "business-record",
+    artifactSubtype: item.activityType || "control-operation",
+    sourceKind: "authored-record",
+    sourceDescription: "Internal control operation",
     collectedOn: date,
-    classification: "Internal",
-    periodStart: item.dueWindowStart,
-    periodEnd: item.dueWindowEnd,
+    classificationId: defaultClassificationId(),
+    coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd),
     controlIds: item.controlIds || [],
     sourceResourceIds: [item.obligationId]
   };
 }
 
 function openObligationEventDialog(trigger) {
-  const subjectType = trigger.eventType.startsWith("person") || trigger.eventType.includes("person-") ? "person"
-    : trigger.eventType.startsWith("vendor") ? "vendor"
-      : trigger.eventType.startsWith("system") ? "system"
-        : trigger.eventType.includes("incident") ? "incident"
-          : null;
-  const subjects = subjectType ? resourcesOfType(subjectType) : [];
-  const needsTimestamp = trigger.steps.some((step) => Number.isInteger(step.window?.endOffsetHours));
+  const subjectTypes = (state.model.policyEvents?.[trigger.eventType]?.subjectRules || []).map(({ resourceType }) => resourceType);
+  const subjects = subjectTypes.flatMap((type) => resourcesOfType(type));
+  const needsTimestamp = trigger.steps.some((step) => step.window?.precision === "timestamp");
   const eventField = needsTimestamp
     ? '<label><span>Event time <small>your local time</small></span><input name="occurredAt" type="datetime-local" required value="' + esc(currentLocalDateTime()) + '"></label>'
     : '<label><span>Event date</span><input name="occurredOn" type="date" required value="' + esc(currentDate()) + '"></label>';
@@ -656,7 +753,7 @@ function openObligationEventDialog(trigger) {
   dialog.className = "commit-dialog event-dialog";
   dialog.setAttribute("aria-labelledby", "event-dialog-title");
   dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Policy event</p><h2 id="event-dialog-title">' + esc(policyEventName(trigger.eventType)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>This creates one event record and adds ' + trigger.steps.length + ' linked tasks to the Work Queue.</p>' + eventField +
-    (subjects.length ? '<label><span>Subject</span><select name="subject"><option value="">Select</option>' + subjects.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label>' : "") +
+    (subjects.length ? '<label><span>Subject <small>required</small></span><select name="subject" required><option value="">Select</option>' + subjects.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + ' · ' + esc(state.model.resources[record.type].title) + '</option>').join("") + '</select></label>' : "") +
     '<label><span>Workflow name <small>optional</small></span><input name="title" maxlength="200" placeholder="' + esc(policyEventName(trigger.eventType)) + '"></label><div class="event-dialog-steps">' + trigger.steps.map((step) => '<div><strong>' + esc(step.title) + '</strong><small>' + esc(eventStepSummary(step)) + '</small></div>').join("") + '</div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary">Add Tasks to Work Queue</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
@@ -686,7 +783,7 @@ function openObligationEventDialog(trigger) {
         name: policyEventName(trigger.eventType),
         taskCount: created.actions?.length || trigger.steps.length
       };
-      state = await fetchJson("/api/state");
+      applyMutationState(created);
       dialog.close();
       history.replaceState(null, "", "#/stage/run");
       render();
@@ -702,14 +799,14 @@ function renderAuditPacket(main, params = new URLSearchParams()) {
   const audits = resourcesOfType("audit");
   const evidence = resourcesOfType("evidence");
   const filegrcRecordTypes = new Set((state.model.evidenceSourceFamilies || [])
-    .filter((family) => family.collectionTestRequired === false)
+    .filter((family) => family.filegrcManaged === true)
     .flatMap((family) => family.operationRecordTypes || []));
   const filegrcRecords = state.resources.filter(({ record }) => filegrcRecordTypes.has(record.type));
   const requestedAudit = params.get("auditId");
   const selected = audits.find(({ record }) => record.id === requestedAudit)?.record || audits.find(({ record }) => record.status !== "complete")?.record || null;
   const today = currentDate();
-  const start = selected?.periodStart || selected?.typeOneAsOf || today.slice(0, 4) + "-01-01";
-  const end = selected?.periodEnd || selected?.typeOneAsOf || today;
+  const start = coverageStart(selected?.coverage) || today.slice(0, 4) + "-01-01";
+  const end = coverageEnd(selected?.coverage) || today;
   const typeOne = selected?.auditKind === "soc-2-type-1";
   const draft = !state.git.clean || !selected;
   const preparation = state.auditPreparations?.[selected?.id || "none"] || state.auditPreparations?.none;
@@ -720,7 +817,7 @@ function renderAuditPacket(main, params = new URLSearchParams()) {
     ["External Evidence", evidence.length + " " + pluralize("record", evidence.length), "#/resources/evidence", evidence.length ? "good" : "neutral"],
     ["Policy work", state.obligations.counts.overdue ? state.obligations.counts.overdue + " overdue" : state.obligations.counts.due ? state.obligations.counts.due + " due" : state.obligations.counts.proposed ? state.obligations.counts.proposed + " proposals" : "No work due", "#/stage/run", state.obligations.counts.overdue ? "bad" : state.obligations.counts.due ? "warn" : state.obligations.counts.proposed ? "neutral" : "good"]
   ];
-  const evidencePaths = '<section class="panel audit-evidence-paths"><div class="panel-head"><div><p class="kicker">Evidence workflow</p><h3>Review both evidence paths</h3><p>Use the formal audit date or period. Each selected control may need one or both paths.</p></div></div><div class="audit-evidence-path-grid"><a href="#/stage/run"><span class="step-label">filegrc Evidence</span><h4>Review operating records</h4><p>Complete the applicable Step 5 records, link them to their Controls, and record results in their fields or Markdown. Link any external artifact needed to support the result. The packet includes the records, Markdown, Git history, and linked artifacts.</p></a><a href="#/resources/evidence"><span class="step-label">External Evidence</span><h4>Review imported or referenced proof</h4><p>Verify the source System, audit date or period, Control links, collector, verifier, and fixed attachment or approved external reference. The packet includes the records, retained files, delivery index, and checksums.</p></a></div></section>';
+  const evidencePaths = '<section class="panel audit-evidence-paths"><div class="panel-head"><div><p class="kicker">Evidence workflow</p><h3>Review both evidence paths</h3><p>Use the formal audit date or period. Each selected control may need one or both paths.</p></div></div><div class="audit-evidence-path-grid"><a href="#/stage/run"><span class="step-label">filegrc Evidence</span><h4>Review operating records</h4><p>Complete the applicable Step 4 records, link them to their Controls, and record results in their fields or Markdown. Link any external artifact needed to support the result. The packet includes the records, Markdown, Git history, and linked artifacts.</p></a><a href="#/resources/evidence"><span class="step-label">External Evidence</span><h4>Review imported or referenced proof</h4><p>Verify the source System, audit date or period, Control links, collector, verifier, and fixed attachment or approved external reference. The packet includes the records, retained files, delivery index, and checksums.</p></a></div></section>';
   const dateFields = typeOne
     ? '<label><span>As-of date</span><input type="date" name="start" required value="' + esc(start) + '"></label>'
     : '<label><span>Period start</span><input type="date" name="start" required value="' + esc(start) + '"></label><label><span>Period end</span><input type="date" name="end" required value="' + esc(end) + '"></label>';
@@ -742,7 +839,7 @@ function renderAuditPacket(main, params = new URLSearchParams()) {
         body: JSON.stringify({ auditId: selected.id })
       });
       if (!response.ok) throw new Error(await responseMessage(response));
-      state = await fetchJson("/api/state");
+      applyMutationState(await response.json());
       render();
     } catch (caught) {
       error.textContent = caught.message;
@@ -824,7 +921,7 @@ function renderPacketResults(container, result) {
     metric("External Evidence", packet.summary.evidence, packet.summary.policies + " policies · " + packet.summary.controls + " controls", "neutral") +
     metric("Review items", packet.summary.gaps, packet.summary.errors + " errors · " + packet.summary.warnings + " warnings", packet.summary.errors ? "bad" : packet.summary.warnings ? "warn" : "good") +
     '</section><section class="panel packet-output"><div class="panel-head"><div><p class="kicker">' + (ready ? "filegrc management checks passed" : "Draft packet") + '</p><h3>' + esc(result.output) + '</h3></div>' + (result.packetUrl ? '<a class="button primary" href="' + esc(result.packetUrl) + '" target="_blank" rel="noreferrer">Open index</a>' : "") + '</div><p>The directory contains ' + result.files.length + ' files. ' + (ready ? "Verify the checksums, reconcile external deliveries, and let the engagement team confirm evidence sufficiency." : "Do not deliver it until every error is resolved and each warning has been reviewed.") + '</p></section>' +
-    '<div class="dashboard-grid"><section class="panel span-2"><div class="panel-head"><h3>Coverage Gaps and Warnings</h3></div>' + (packet.gaps.length ? '<div class="packet-gaps">' + packet.gaps.map((gap) => '<div><span class="badge ' + (gap.severity === "error" ? "bad" : "warn") + '">' + esc(properCase(gap.severity)) + '</span><p>' + esc(gap.message) + '</p></div>').join("") + '</div>' : empty("No packet gaps were detected.")) + '</section><section class="panel"><div class="panel-head"><h3>Included filegrc Evidence</h3></div>' + (packet.filegrcRecords.length ? '<div class="packet-list">' + packet.filegrcRecords.slice(0, 12).map((item) => '<a href="#/resource/' + encodeURIComponent(item.type) + '/' + encodeURIComponent(item.id) + '"><strong>' + esc(item.title) + '</strong><small>' + esc(properCase(item.type)) + ' · ' + esc(item.primaryDate) + '</small></a>').join("") + '</div>' : empty("No filegrc Evidence matched.")) + '</section><section class="panel"><div class="panel-head"><h3>Included External Evidence</h3></div>' + (packet.evidence.length ? '<div class="packet-list">' + packet.evidence.slice(0, 12).map((item) => '<a href="#/resource/evidence/' + encodeURIComponent(item.id) + '"><strong>' + esc(item.title) + '</strong><small>' + esc(properCase(item.status)) + ' · ' + esc(properCase(item.evidenceKind)) + '</small></a>').join("") + '</div>' : empty("No External Evidence matched.")) + '</section></div>';
+    '<div class="dashboard-grid"><section class="panel span-2"><div class="panel-head"><h3>Coverage Gaps and Warnings</h3></div>' + (packet.gaps.length ? '<div class="packet-gaps">' + packet.gaps.map((gap) => '<div><span class="badge ' + (gap.severity === "error" ? "bad" : "warn") + '">' + esc(properCase(gap.severity)) + '</span><p>' + esc(gap.message) + '</p></div>').join("") + '</div>' : empty("No packet gaps were detected.")) + '</section><section class="panel"><div class="panel-head"><h3>Included filegrc Evidence</h3></div>' + (packet.filegrcRecords.length ? '<div class="packet-list">' + packet.filegrcRecords.slice(0, 12).map((item) => '<a href="#/resource/' + encodeURIComponent(item.type) + '/' + encodeURIComponent(item.id) + '"><strong>' + esc(item.title) + '</strong><small>' + esc(properCase(item.type)) + ' · ' + esc(item.primaryDate) + '</small></a>').join("") + '</div>' : empty("No filegrc Evidence matched.")) + '</section><section class="panel"><div class="panel-head"><h3>Included External Evidence</h3></div>' + (packet.evidence.length ? '<div class="packet-list">' + packet.evidence.slice(0, 12).map((item) => '<a href="#/resource/evidence/' + encodeURIComponent(item.id) + '"><strong>' + esc(item.title) + '</strong><small>' + esc(properCase(item.status)) + ' · ' + esc(properCase(item.artifactKind)) + '</small></a>').join("") + '</div>' : empty("No External Evidence matched.")) + '</section></div>';
 }
 
 function obligationPreview(items) {
@@ -881,13 +978,11 @@ function timingText(item) {
 }
 
 function relativeEventWindow(window) {
-  if (Number.isInteger(window?.endOffsetHours)) {
-    return window.endOffsetHours === 0 ? "Due at the event time" : "Due within " + window.endOffsetHours + " hours";
-  }
-  if (Number.isInteger(window?.endOffsetDays)) {
-    return window.endOffsetDays === 0 ? "Due on the event date" : "Due within " + window.endOffsetDays + " days";
-  }
-  return "Due within 30 days";
+  if (!Number.isInteger(window?.dueAfter)) return "Deadline not configured";
+  const unit = window.precision === "timestamp" ? "hour" : "day";
+  return window.dueAfter === 0
+    ? (window.precision === "timestamp" ? "Due at the event time" : "Due on the event date")
+    : "Due within " + window.dueAfter + " " + unit + (window.dueAfter === 1 ? "" : "s");
 }
 
 function eventStepSummary(step) {
@@ -903,6 +998,7 @@ function eventStepSummary(step) {
 function renderList(main, type, params = new URLSearchParams()) {
   const definition = state.model.resources[type];
   if (!definition) return renderNotFound(main);
+  const listStage = readinessStageForType(type);
   const entries = resourcesOfType(type);
   const requestedPage = Number(params.get("page"));
   let pageNumber = Number.isInteger(requestedPage) && requestedPage > 0 ? requestedPage : 1;
@@ -922,7 +1018,7 @@ function renderList(main, type, params = new URLSearchParams()) {
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
     filters.map(({ name, label, values }) => '<select class="field-filter" data-field="' + esc(name) + '" aria-label="Filter by ' + esc(label.toLowerCase()) + '"><option value="">Any ' + esc(properCase(label)) + '</option>' + values.map((value) => '<option value="' + esc(value) + '">' + esc(filterOptionLabel(value)) + '</option>').join("") + '</select>').join("") + '<span id="result-count" aria-live="polite">' + entries.length + ' records</span>' + createButton + '</div>';
-  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(readinessStageForType(type)?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(definition.pluralTitle)) + '</h2>' + guideTrigger + '</div></div>' + listTools + '</div>' + resourceGuide(type) +
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(definition.pluralTitle)) + '</h2>' + guideTrigger + '</div></div>' + listTools + '</div>' + resourceGuide(type) +
     '<section class="record-table-wrap"><table class="record-table"><thead><tr><th>' + esc(fieldLabel(type, "title")) + '</th>' + fields.map((name) => '<th>' + esc(fieldLabel(type, name)) + '</th>').join("") + '<th>Git file</th></tr></thead><tbody id="record-rows"></tbody></table></section>' +
     '<nav class="pagination list-pagination" aria-label="' + esc(definition.pluralTitle) + ' pages" hidden><button class="button" type="button" data-page="previous">Previous</button><span class="page-status" aria-live="polite"></span><button class="button" type="button" data-page="next">Next</button></nav></div>';
   resourceGuideCleanup = setupResourceGuide(main);
@@ -939,7 +1035,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(entry.record[name], name, type)) + '</td>').join("") + '<td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 2) + '">' + empty("No records match this filter.") + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type)) + '</td>').join("") + '<td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 2) + '">' + empty("No records match this filter.") + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;
@@ -986,12 +1082,17 @@ function renderDetail(main, type, id) {
   const entry = resourcesOfType(type).find(({ record }) => record.id === id);
   const definition = state.model.resources[type];
   if (!entry || !definition) return renderNotFound(main);
+  if (entry.detailsLoaded === false) {
+    main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div></div><section class="panel detail-loading" role="status">Loading record content and file history…</section></div>';
+    loadResourceDetail(type, id);
+    return;
+  }
   const fields = { ...state.model.commonFields, ...definition.fields };
   const recordContent = recordContentDefinition(type);
   const narrative = recordNarrative(entry.record, fields);
   const narrativeNames = new Set(narrative.map(([name]) => name));
   const visible = Object.entries(entry.record).filter(([name]) => (
-    !["schemaVersion", "id", "type", "title"].includes(name)
+    !["id", "type", "title"].includes(name)
     && !fields[name]?.content
     && !narrativeNames.has(name)
   ));
@@ -1016,7 +1117,7 @@ function renderDetail(main, type, id) {
     ? '<section class="panel detail-main">' + narrativeContent + markdownContent + addRecordContent + '</section>'
     : "";
   main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + issueActions + addRecordContentAction + (!state.readOnly ? '<button class="button" id="edit-resource">Edit</button>' + (!definition.singleton ? '<button class="button danger" id="delete-resource">Delete</button>' : "") : "") + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain +
-    '<aside><section class="panel"><div class="panel-head"><h3>Metadata</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(value, name, type) + '</dd></div>').join("") + '</dl></section>' + resourceConnections(entry) + '<section class="panel"><div class="panel-head"><h3>File History</h3></div>' + (entry.history?.length ? '<div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div>' : empty("No committed history for this file.")) + '</section></aside></div></div>';
+    '<aside><section class="panel"><div class="panel-head"><h3>Metadata</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>' + personParticipation(entry) + resourceConnections(entry) + '<section class="panel"><div class="panel-head"><h3>File History</h3></div>' + (entry.history?.length ? '<div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div>' : empty("No committed history for this file.")) + '</section></aside></div></div>';
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
   main.querySelector("[data-record-finding]")?.addEventListener("click", () => openEditor("finding", null, {
     seed: issueSeed("finding", entry.record),
@@ -1033,7 +1134,7 @@ function renderDetail(main, type, id) {
     try {
       const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id) + "?revision=" + encodeURIComponent(entry.revision), { method: "DELETE" });
       if (!response.ok) return showError(await responseMessage(response));
-      state = await fetchJson("/api/state");
+      applyMutationState(await response.json());
       location.hash = "#/resources/" + encodeURIComponent(type);
     } catch (error) {
       showError(error.message);
@@ -1041,6 +1142,32 @@ function renderDetail(main, type, id) {
   });
 }
 
+async function loadResourceDetail(type, id) {
+  const key = type + "\0" + id;
+  if (resourceDetailRequests.has(key)) return resourceDetailRequests.get(key);
+  const request = (async () => {
+    try {
+      const response = await localFetch("/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(id));
+      if (!response.ok) throw new Error(await responseMessage(response));
+      const detail = await response.json();
+      const index = state.resources.findIndex(({ record }) => record.type === type && record.id === id);
+      if (index >= 0) state.resources[index] = detail;
+      const route = parseRoute();
+      if (route.name === "detail" && route.type === type && route.id === id) render();
+    } catch (error) {
+      const route = parseRoute();
+      if (route.name === "detail" && route.type === type && route.id === id) {
+        const main = root.querySelector("main");
+        if (main) main.innerHTML = '<div class="page"><section class="panel"><div class="dialog-error" role="alert">' + esc(error.message) + '</div></section></div>';
+      }
+    } finally {
+      resourceDetailRequests.delete(key);
+    }
+  })();
+  resourceDetailRequests.set(key, request);
+  return request;
+}
+
 function issueSeed(type, source) {
   const owners = source.ownerIds || source.reviewerIds || source.assessorIds || source.testerIds || [];
   if (type === "finding") {
@@ -1079,11 +1206,67 @@ function recordContentDefinition(type) {
   };
 }
 
+function personParticipation(entry) {
+  if (entry.record.type !== "person") return "";
+  const personId = entry.record.id;
+  const appointments = resourcesOfType("appointment")
+    .map(({ record }) => record)
+    .filter(({ holderId }) => holderId === personId);
+  const appointmentIds = new Set(appointments.map(({ id }) => id));
+  const affiliations = appointments.map((record) => ({
+    record,
+    detail: "Appointment · " + properCase(record.status)
+  }));
+  for (const { record } of resourcesOfType("team")) {
+    const member = (record.memberIds || []).includes(personId);
+    const chair = (record.chairIds || []).some((id) => id === personId || appointmentIds.has(id));
+    if (member || chair) affiliations.push({
+      record,
+      detail: "Team · " + (chair ? "Chair" : "Member")
+    });
+  }
+  const assignments = [];
+  for (const candidate of state.resources) {
+    if (["person", "appointment", "team"].includes(candidate.record.type)) continue;
+    const fields = { ...state.model.commonFields, ...state.model.resources[candidate.record.type].fields };
+    const reasons = [];
+    for (const [name, field] of Object.entries(fields)) {
+      if (!field.relation) continue;
+      const values = Array.isArray(candidate.record[name]) ? candidate.record[name] : [candidate.record[name]];
+      if (values.includes(personId)) reasons.push(fieldLabel(candidate.record.type, name));
+      for (const appointment of appointments) {
+        if (values.includes(appointment.id)) reasons.push(fieldLabel(candidate.record.type, name) + " via " + appointment.title);
+      }
+    }
+    if (reasons.length) assignments.push({
+      record: candidate.record,
+      detail: [...new Set(reasons)].join(" · ")
+    });
+  }
+  const count = affiliations.length + assignments.length;
+  if (!count) return "";
+  return '<section class="panel connections-panel"><div class="panel-head"><h3>Participation</h3><span>' + count + '</span></div>'
+    + personParticipationGroup("Appointments and teams", affiliations, 8, "more appointments or teams")
+    + personParticipationGroup("Assigned records", assignments, 10, "more assigned records")
+    + '</section>';
+}
+
+function personParticipationGroup(title, rows, limit, moreLabel) {
+  if (!rows.length) return "";
+  const visible = rows.slice(0, limit);
+  return '<div class="connection-group"><h4>' + esc(title) + '</h4><div class="connections">'
+    + visible.map(({ record, detail }) => '<a href="#/resource/' + encodeURIComponent(record.type) + '/' + encodeURIComponent(record.id) + '"><strong>' + esc(record.title) + '</strong><small>' + esc(detail) + '</small></a>').join("")
+    + '</div>' + (rows.length > visible.length ? '<p class="connections-more">' + (rows.length - visible.length) + ' ' + esc(moreLabel) + ' are available through connected records.</p>' : "")
+    + '</div>';
+}
+
 function resourceConnections(entry) {
+  const relatedPeopleOnly = entry.record.type === "person";
   const connections = new Map();
   const entriesById = new Map(state.resources.map((item) => [item.record.id, item]));
   const add = (connectedEntry, reason) => {
     if (!connectedEntry || connectedEntry.record.id === entry.record.id) return;
+    if (relatedPeopleOnly && connectedEntry.record.type !== "person") return;
     const existing = connections.get(connectedEntry.record.id) || { entry: connectedEntry, reasons: new Set() };
     existing.reasons.add(reason);
     connections.set(connectedEntry.record.id, existing);
@@ -1113,7 +1296,7 @@ function resourceConnections(entry) {
   });
   if (!sorted.length) return "";
   const visible = sorted.slice(0, 14);
-  return '<section class="panel connections-panel"><div class="panel-head"><h3>Connections</h3><span>' + sorted.length + '</span></div><div class="connections">' + visible.map(({ entry: connected, reasons }) => '<a href="#/resource/' + encodeURIComponent(connected.record.type) + '/' + encodeURIComponent(connected.record.id) + '"><strong>' + esc(connected.record.title) + '</strong><small>' + esc([...reasons].join(" · ")) + '</small></a>').join("") + '</div>' + (sorted.length > visible.length ? '<p class="connections-more">' + (sorted.length - visible.length) + ' more connections are available through the linked records.</p>' : "") + '</section>';
+  return '<section class="panel connections-panel"><div class="panel-head"><h3>' + (relatedPeopleOnly ? "Related people" : "Connections") + '</h3><span>' + sorted.length + '</span></div><div class="connections">' + visible.map(({ entry: connected, reasons }) => '<a href="#/resource/' + encodeURIComponent(connected.record.type) + '/' + encodeURIComponent(connected.record.id) + '"><strong>' + esc(connected.record.title) + '</strong><small>' + esc([...reasons].join(" · ")) + '</small></a>').join("") + '</div>' + (sorted.length > visible.length ? '<p class="connections-more">' + (sorted.length - visible.length) + ' more connections are available through the linked records.</p>' : "") + '</section>';
 }
 
 function navigationResourceTypes() {
@@ -1132,6 +1315,7 @@ function renderOrganization(main) {
 }
 
 function renderRepository(main) {
+  if (state.repository?.mode === "trunk") return renderTrunkRepository(main);
   const settings = rendererSettingsEntry();
   const settingsLink = settings ? '<a class="button" href="#/resource/renderer-settings/' + encodeURIComponent(settings.record.id) + '">Renderer settings</a>' : "";
   const onboardingButton = settings && !state.readOnly ? '<button class="button" type="button" id="start-onboarding">Run onboarding</button>' : "";
@@ -1177,12 +1361,41 @@ function renderRepository(main) {
   main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
 }
 
+function renderTrunkRepository(main) {
+  const repository = state.repository;
+  const settings = rendererSettingsEntry();
+  const settingsLink = settings ? '<a class="button" href="#/resource/renderer-settings/' + encodeURIComponent(settings.record.id) + '">Renderer settings</a>' : "";
+  const onboardingButton = settings && repository.writesAllowed
+    ? '<button class="button" type="button" id="start-onboarding">Run onboarding</button>'
+    : "";
+  const retryButton = repository.retrySafe
+    ? '<button class="button primary" type="button" data-git-action="retry-sync">Retry sync</button>'
+    : "";
+  const pending = repository.pendingCommitsFilegrcOnly === false
+    ? empty("Ahead commits include files outside this FileGRC workspace. Reconcile them with Git.")
+    : repository.pendingCommits?.length
+    ? '<ul class="changes">' + repository.pendingCommits.map((commit) => '<li><code>' + esc(commit.shortCommit) + '</code> ' + esc(commit.subject) + '</li>').join("") + '</ul>'
+    : empty("No FileGRC commits are waiting to be pushed.");
+  const lastSync = repository.lastSuccessfulSynchronization
+    ? formatLocalDateTime(repository.lastSuccessfulSynchronization)
+    : "No successful sync recorded by this server";
+  const override = repository.developmentOverride
+    ? '<div class="repository-override"><span class="status-dot warn"></span><div><strong>Development write override active</strong><p>Browser writes stay local. FileGRC will not fetch, commit, or push while this server uses <code>--allow-non-authoritative-writes</code>.</p></div></div>'
+    : "";
+  const validationBody = state.validation.diagnostics.length
+    ? '<div class="diagnostics">' + state.validation.diagnostics.map((item) => '<div><span class="badge ' + item.severity + '">' + esc(properCase(item.severity)) + '</span><code>' + esc(item.path) + '</code><p>' + esc(item.message) + '</p></div>').join("") + '</div>'
+    : empty("No validation problems.");
+  main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">Audit trail</p><h2>Repository State</h2><p>Browser saves use one authoritative branch. Record status represents draft, proposal, approval, and retirement; Git branches do not.</p><p class="repository-sync-status" role="status" aria-live="polite"></p></div><div class="page-actions">' + retryButton + onboardingButton + settingsLink + '<a class="button" href="#/resource/workspace/workspace">Workspace settings</a></div></div>' + override + '<section class="panel repository-state-banner"><span class="status-dot ' + repositoryStatusTone(repository.status) + '"></span><div><p class="kicker">Repository status</p><h3>' + esc(repository.label) + '</h3><p>' + esc(repository.message) + '</p></div></section><div class="dashboard-grid"><section class="panel"><div class="panel-head"><h3>Configured Repository</h3></div><dl class="metadata"><div><dt>Branch</dt><dd>' + esc(repository.authoritativeBranch) + '</dd></div><div><dt>Remote</dt><dd>' + esc(repository.remote) + '</dd></div><div><dt>Checkout</dt><dd>' + esc(state.git.branch || (state.git.available ? "Detached HEAD" : "Unavailable")) + '</dd></div><div><dt>Upstream</dt><dd>' + esc(repository.upstream || "Not configured") + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Synchronization</h3></div><dl class="metadata"><div><dt>Current commit</dt><dd><code>' + esc(repository.currentCommit || "Unavailable") + '</code></dd></div><div><dt>Upstream commit</dt><dd><code>' + esc(repository.upstreamCommit || "Unavailable") + '</code></dd></div><div><dt>Ahead</dt><dd>' + esc(repository.ahead ?? "Unknown") + '</dd></div><div><dt>Behind</dt><dd>' + esc(repository.behind ?? "Unknown") + '</dd></div><div><dt>Last sync</dt><dd>' + esc(lastSync) + '</dd></div></dl></section><section class="panel"><div class="panel-head"><h3>Safety Checks</h3></div><dl class="metadata"><div><dt>Whole worktree</dt><dd>' + (repository.wholeWorktreeClean === null ? "Unavailable" : repository.wholeWorktreeClean ? "Clean" : "Has changes") + '</dd></div><div><dt>Git operation</dt><dd>' + esc(repository.operationInProgress || "None") + '</dd></div><div><dt>Pending scope</dt><dd>' + (repository.pendingCommitsFilegrcOnly === false ? "Includes external files" : repository.pendingCommits?.length ? "FileGRC only" : "None") + '</dd></div></dl></section><section class="panel span-2"><div class="panel-head"><h3>Pending FileGRC-only Commits</h3></div>' + pending + '</section><section class="panel span-2"><div class="panel-head"><h3>Validation</h3><span class="badge ' + (state.validation.ok ? "good" : "bad") + '">' + (state.validation.ok ? "Passing" : "Needs attention") + '</span></div>' + validationBody + '</section></div></div>';
+  main.querySelectorAll("[data-git-action]").forEach((button) => button.addEventListener("click", () => runRepositoryGitAction(button.dataset.gitAction)));
+  main.querySelector("#start-onboarding")?.addEventListener("click", requestOnboarding);
+}
+
 async function runRepositoryGitAction(action) {
   const buttons = [...document.querySelectorAll("[data-git-action]")];
   const disabled = buttons.map((button) => button.disabled);
   const active = buttons.find((button) => button.dataset.gitAction === action);
   const status = document.querySelector(".repository-sync-status");
-  const label = action === "pull" ? "Pulling…" : "Pushing…";
+  const label = action === "pull" ? "Pulling…" : action === "retry-sync" ? "Syncing…" : "Pushing…";
   if (status) {
     status.textContent = "";
     status.classList.remove("error");
@@ -1193,17 +1406,19 @@ async function runRepositoryGitAction(action) {
     const response = await localFetch("/api/git/" + action, { method: "POST" });
     if (!response.ok) throw new Error(await responseMessage(response));
     const result = await response.json();
-    state = await fetchJson("/api/state");
+    applyMutationState(result);
     render();
     const currentStatus = document.querySelector(".repository-sync-status");
     if (currentStatus) currentStatus.textContent = action === "pull"
       ? result.updated
         ? "Pulled " + result.upstream + " with rebase at " + result.shortCommit + "."
         : result.branch + " is current with " + result.upstream + "."
-      : "Pushed " + result.shortCommit + " to " + result.upstream + ".";
+      : action === "retry-sync"
+        ? "Synchronized " + result.shortCommit + " with " + result.upstream + "."
+        : "Pushed " + result.shortCommit + " to " + result.upstream + ".";
   } catch (cause) {
     buttons.forEach((button, index) => { button.disabled = disabled[index]; });
-    if (active) active.textContent = action === "pull" ? "Pull with rebase" : "Push";
+    if (active) active.textContent = action === "pull" ? "Pull with rebase" : action === "retry-sync" ? "Retry sync" : "Push";
     if (status) {
       status.textContent = cause.message;
       status.classList.add("error");
@@ -1239,7 +1454,7 @@ function openCommitDialog() {
       });
       if (!response.ok) throw new Error(await responseMessage(response));
       const result = await response.json();
-      state = await fetchJson("/api/state");
+      applyMutationState(result);
       dialog.close();
       render();
       const status = document.querySelector(".repository-sync-status");
@@ -1385,12 +1600,13 @@ function requestOnboarding() {
     onboardingDialog = null;
     onboardingDraft = null;
     onboardingBusy = false;
+    onboardingPendingDraft = false;
   });
   renderOnboardingStep();
 }
 
 function initialOnboardingDraft() {
-  const systemEntry = resourcesOfType("system").find(({ record }) => record.inScope && record.status !== "retired");
+  const systemEntry = resourcesOfType("system").find(({ record }) => (state.workspace.systemIds || []).includes(record.id) && record.status !== "retired");
   const owner = resourcesOfType("person").find(({ record }) => record.status === "active")?.record;
   return {
     systemId: systemEntry?.record.id || "",
@@ -1398,7 +1614,7 @@ function initialOnboardingDraft() {
     scope: systemEntry?.record.description || "",
     ownerId: systemEntry?.record.ownerIds?.[0] || owner?.id || "",
     criticality: systemEntry?.record.criticality || "high",
-    dataClassification: systemEntry?.record.dataClassification || "Confidential",
+    classificationId: systemEntry?.record.classificationId || defaultClassificationId(),
     internetExposed: systemEntry?.record.internetExposed === false ? "false" : "true",
     programGoal: programGoalFromKind(state.workspace.assuranceGoal)
   };
@@ -1413,8 +1629,9 @@ function onboardingSteps() {
     points: [
       "Use the UI, an editor, the CLI, or an agent; every path changes the same files.",
       "JSON holds structured records. Markdown holds policies, plans, minutes, and other long-form work.",
-      "Repository pulls with rebase, then commits and pushes reviewed changes together.",
-      "Agents and terminal users run git pull --rebase, git commit, and git push directly.",
+      "In trunk mode, each browser save fast-forwards, validates, creates one focused local commit, then pushes it in the background. The workspace stays read-only until sync finishes.",
+      "Record status represents approval. Draft, proposed, approved, and retired records all stay on the authoritative branch.",
+      "Agents and terminal users continue to manage Git explicitly.",
       "The dashboard derives program status from the current repository state."
     ]
   };
@@ -1424,7 +1641,7 @@ function onboardingSteps() {
     title: "Follow the audit chain",
     body: "The shortest dependable path is to define scope, approve policies, implement controls, prepare the evidence process, and operate the program before audit fieldwork begins.",
     points: [
-      "Scope starts with the people and oversight team, applicable criteria, commitments, material vendors, and in-scope systems.",
+      "Scope starts with people, dated appointments, oversight teams, applicable criteria, commitments, material vendors, and in-scope systems.",
       "Program operation includes current risk assessments and risks, which may add or change controls as conditions change.",
       "Evidence preparation means cataloging authoritative systems, documenting extraction, and testing captures before the candidate period.",
       "The CPA firm, formal report period, fieldwork, and final report are the last stage. Engage earlier only when timing or scope needs outside input."
@@ -1445,7 +1662,7 @@ function onboardingSteps() {
     target: ".event-reminder-panel",
     kicker: "Triggered work",
     title: "Complete a checklist when key events occur",
-    body: "Use an event reminder for a new worker, role change, departure, personal device, vendor change or incident, material system or data-use change, or security incident. One action item is created for every policy requirement, with its own owner, evidence, due range, and cutoff.",
+    body: "Use an event reminder for a new worker, job or responsibility change, departure, personal device, vendor change or incident, material system or data-use change, or security incident. One action item is created for every policy requirement, with its own owner, evidence, due range, and cutoff.",
     points: [
       "The checklist stays open until every action is done and has the requested completion record or evidence.",
       "Hour-based rules keep the event time and exact cutoff; day-based rules keep the policy date range.",
@@ -1517,7 +1734,7 @@ function renderOnboardingStep() {
     ? onboardingSetupForm()
     : description + explanation + afterSections;
   const finalActions = onboardingStep === steps.length - 1
-    ? '<button class="button" type="button" data-onboarding="draft">Save draft</button><button class="button primary" type="button" data-onboarding="next">Complete setup</button>'
+    ? '<span class="onboarding-save-status" role="status" aria-live="polite"></span><button class="button" type="button" data-onboarding="draft">Save draft</button><button class="button primary" type="button" data-onboarding="next">Complete setup</button>'
     : '<button class="button primary" type="button" data-onboarding="next">Next</button>';
   onboardingDialog.innerHTML = '<div class="onboarding-progress" style="--onboarding-step-count:' + steps.length + '" aria-label="Onboarding step ' + (onboardingStep + 1) + ' of ' + steps.length + '">' + progress + '</div><div class="onboarding-scroll"><div class="onboarding-head"><p class="kicker">' + esc(step.kicker) + ' · ' + (onboardingStep + 1) + ' of ' + steps.length + '</p><h2 id="onboarding-title">' + esc(titleCase(step.title)) + '</h2></div>' + body + '<div class="dialog-error" role="alert"></div></div><div class="dialog-actions onboarding-actions"><button class="button text-button onboarding-skip" type="button" data-onboarding="skip">Skip onboarding</button>' + (onboardingStep ? '<button class="button" type="button" data-onboarding="back">Back</button>' : "") + finalActions + '</div>';
   onboardingDialog.querySelector('[data-onboarding="skip"]').addEventListener("click", cancelOnboarding);
@@ -1554,29 +1771,27 @@ function renderOnboardingStep() {
 function onboardingSetupForm() {
   const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
   const classifications = Object.keys(state.workspace.classificationDefinitions || {});
-  if (onboardingDraft.dataClassification && !classifications.includes(onboardingDraft.dataClassification)) {
-    classifications.push(onboardingDraft.dataClassification);
+  if (onboardingDraft.classificationId && !classifications.includes(onboardingDraft.classificationId)) {
+    classifications.push(onboardingDraft.classificationId);
   }
   const currentSystem = onboardingDraft.systemId ? state.resources.find(({ record }) => record.id === onboardingDraft.systemId)?.record : null;
   const existing = [
     currentSystem ? "Updates system " + currentSystem.title + "." : "Creates a new in-scope system.",
     "Records a management program goal without creating an audit engagement."
   ].filter(Boolean).join(" ");
-  const gitStatus = state.git.available && !state.git.branch
-    ? '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Detached HEAD detected</strong><small>Setup changes can be saved, but browser commits, pulls, and pushes are disabled until you check out a branch.</small></span></div>'
-    : state.git.available && state.git.remotes?.length
-    ? '<div class="onboarding-git-status"><span class="status-dot good"></span><span><strong>Git repository and remote detected</strong><small>Setup changes will appear in the workspace diff. Browser commits push to the configured remote.</small></span></div>'
-    : state.git.available
-      ? '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git remote needed</strong><small>Saving and local commits still work. Add a remote before the browser can push.</small></span></div>'
-      : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Saving still works. Run <code>git init</code> at the workspace root before your first compliance commit.</small></span></div>';
-  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="dataClassification" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.dataClassification ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and In scope. It is selected for scope review, but it is not approved or active. Saving writes JSON files but does not commit them. Complete the remaining Step 1 pages next.</p>';
+  const gitStatus = state.repository?.mode === "trunk"
+    ? '<div class="onboarding-git-status ' + (state.repository.status === "synced" ? "" : "warning") + '"><span class="status-dot ' + repositoryStatusTone(state.repository.status) + '"></span><span><strong>' + esc(state.repository.label) + '</strong><small>' + esc(state.repository.status === "synced" ? "Completing onboarding will save its related workspace, system, and renderer changes in one local commit, then push it in the background." : state.repository.message) + '</small></span></div>'
+    : state.git.available && state.git.branch
+      ? '<div class="onboarding-git-status"><span class="status-dot good"></span><span><strong>Manual repository mode</strong><small>Setup changes will stay local until you commit and synchronize them.</small></span></div>'
+      : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Manual-mode writes still work, but Git history is unavailable until the repository is configured.</small></span></div>';
+  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="classificationId" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.classificationId ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and selects it in Workspace program scope. It is ready for scope review, but it is not approved or active. ' + (state.repository?.mode === "trunk" ? "The browser saves and synchronizes the related files together." : "Manual mode leaves the files for you to commit.") + ' Complete the remaining Step 1 pages next.</p>';
 }
 
 function captureOnboardingForm() {
   const form = onboardingDialog?.querySelector("#onboarding-setup");
   if (!form) return;
   const data = new FormData(form);
-  for (const name of ["serviceName", "scope", "ownerId", "criticality", "dataClassification", "internetExposed", "programGoal"]) {
+  for (const name of ["serviceName", "scope", "ownerId", "criticality", "classificationId", "internetExposed", "programGoal"]) {
     onboardingDraft[name] = String(data.get(name) || "").trim();
   }
 }
@@ -1596,7 +1811,7 @@ async function saveOnboarding(draft = false) {
         boundary: onboardingDraft.scope,
         ownerId: onboardingDraft.ownerId,
         criticality: onboardingDraft.criticality,
-        dataClassification: onboardingDraft.dataClassification,
+        classificationId: onboardingDraft.classificationId,
         internetExposed: onboardingDraft.internetExposed === "true",
         programGoal: onboardingDraft.programGoal,
         systemId: onboardingDraft.systemId,
@@ -1604,14 +1819,55 @@ async function saveOnboarding(draft = false) {
       })
     });
     if (!response.ok) throw new Error(await responseMessage(response));
-    state = await fetchJson("/api/state");
+    const result = await response.json();
+    applyMutationState(result);
+    if (result.synchronization?.pushError) {
+      onboardingDraft.systemId = result.system?.id || onboardingDraft.systemId;
+      onboardingPendingDraft = draft;
+      setOnboardingBusy(false);
+      showOnboardingError(result.synchronization.pushError, true);
+      return;
+    }
     closeOnboarding();
     history.replaceState(null, "", draft ? "#/" : "#/stage/scope");
     render();
   } catch (error) {
     setOnboardingBusy(false);
-    const errorNode = onboardingDialog?.querySelector(".dialog-error");
-    if (errorNode) errorNode.textContent = error.message;
+    showOnboardingError(error.message);
+  }
+}
+
+function showOnboardingError(message, retrySync = false) {
+  const errorNode = onboardingDialog?.querySelector(".dialog-error");
+  if (!errorNode) return;
+  errorNode.textContent = message;
+  if (!retrySync) return;
+  onboardingDialog.querySelectorAll("button,input,select,textarea").forEach((control) => { control.disabled = true; });
+  const retry = document.createElement("button");
+  retry.type = "button";
+  retry.className = "button onboarding-retry-sync";
+  retry.textContent = "Retry sync";
+  retry.disabled = false;
+  retry.addEventListener("click", retryOnboardingSync);
+  errorNode.append(document.createElement("br"), retry);
+}
+
+async function retryOnboardingSync() {
+  if (onboardingBusy) return;
+  setOnboardingBusy(true, "Retrying sync…");
+  try {
+    const response = await localFetch("/api/git/retry-sync", { method: "POST" });
+    if (!response.ok) throw new Error(await responseMessage(response));
+    const result = await response.json();
+    if (!result.state) throw new Error("The sync response did not include the current workspace state.");
+    state = result.state;
+    const draft = onboardingPendingDraft;
+    closeOnboarding();
+    history.replaceState(null, "", draft ? "#/" : "#/stage/scope");
+    render();
+  } catch (error) {
+    setOnboardingBusy(false);
+    showOnboardingError(error.message, true);
   }
 }
 
@@ -1632,8 +1888,7 @@ async function cancelOnboarding() {
 async function persistOnboardingPreference(showOnboarding) {
   const entry = rendererSettingsEntry();
   if (!entry) throw new Error("Renderer settings are unavailable.");
-  await writeRendererSettingsResource({ ...entry.record, showOnboarding }, entry);
-  state = await fetchJson("/api/state");
+  applyMutationState(await writeRendererSettingsResource({ ...entry.record, showOnboarding }, entry));
 }
 
 async function writeRendererSettingsResource(record, entry) {
@@ -1646,6 +1901,7 @@ async function writeRendererSettingsResource(record, entry) {
     body: JSON.stringify({ record, revision: entry?.revision })
   });
   if (!response.ok) throw new Error(await responseMessage(response));
+  return response.json();
 }
 
 async function toggleStagePageCompletion(button) {
@@ -1655,25 +1911,31 @@ async function toggleStagePageCompletion(button) {
   const pageId = button.dataset.stagePageCompletion;
   if (button.dataset.complete === "true") {
     completed.delete(pageId);
-    (STAGE_PAGE_ID_ALIASES[pageId] || []).forEach((id) => completed.delete(id));
   } else {
     completed.add(pageId);
   }
-  await writeRendererSettingsResource({
+  applyMutationState(await writeRendererSettingsResource({
     ...entry.record,
     completedStagePageIds: [...completed].sort()
-  }, entry);
-  state = await fetchJson("/api/state");
+  }, entry));
 }
 
 function setOnboardingBusy(busy, label = "") {
   if (!onboardingDialog) return;
+  clearTimeout(onboardingStillWorkingTimer);
+  onboardingStillWorkingTimer = null;
   onboardingBusy = busy;
   onboardingDialog.querySelectorAll("button,input,select,textarea").forEach((control) => { control.disabled = busy; });
   const next = onboardingDialog.querySelector('[data-onboarding="next"]');
   if (next && label) next.textContent = label;
   const skip = onboardingDialog.querySelector('[data-onboarding="skip"]');
   if (skip && label && onboardingStep !== onboardingSteps().length - 1) skip.textContent = label;
+  if (busy && onboardingStep === onboardingSteps().length - 1) {
+    onboardingStillWorkingTimer = setTimeout(() => {
+      const status = onboardingDialog?.querySelector(".onboarding-save-status");
+      if (status) status.textContent = "Still working. Git sync and workspace checks can take a moment.";
+    }, 1_500);
+  }
   if (!busy) renderOnboardingStep();
 }
 
@@ -1766,6 +2028,8 @@ function clearOnboardingFocus() {
 
 function closeOnboarding() {
   if (!onboardingDialog) return;
+  clearTimeout(onboardingStillWorkingTimer);
+  onboardingStillWorkingTimer = null;
   onboardingBusy = false;
   clearOnboardingFocus();
   onboardingDialog.close();
@@ -1802,9 +2066,10 @@ function openEditor(type, entry = null, options = {}) {
     "title",
     ...required,
     ...(definition.listFields || []),
+    ...(definition.formFields || []),
     ...Object.entries(fields).filter(([, field]) => field.requiredWhen).map(([name]) => name),
     ...oneOf
-  ])].filter((name) => !["schemaVersion", "id", "type"].includes(name) && fields[name]);
+  ])].filter((name) => !["id", "type"].includes(name) && fields[name]);
   const dialog = document.createElement("dialog");
   dialog.className = "editor";
   dialog.setAttribute("aria-labelledby", "resource-editor-title");
@@ -1813,7 +2078,10 @@ function openEditor(type, entry = null, options = {}) {
   ));
   const recordContent = recordContentDefinition(type);
   const recordContentItem = recordContent ? entry?.content?.[recordContent.slot] : null;
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + (entry ? "Edit record" : options.obligationCompletion ? "Record obligation work" : "Create record") + '</p><h2 id="resource-editor-title">' + esc(titleCase(entry?.record.title || record.title || definition.title)) + '</h2></div><button type="button" class="icon-button" data-editor-dismiss aria-label="Close">×</button></div><p>' + esc(options.description || "Fill the core fields below. Git will record the author, time, reason, and diff when you commit this file.") + '</p><div class="form-grid">' + names.map((name) => editorField(type, name, fields[name], record[name], required.has(name) || conditionMatches(record, fields[name].requiredWhen), Boolean(entry), oneOf.has(name), activeOneOf.has(name))).join("") + '</div>' +
+  const editorDescription = options.description
+    || implementationEditorDescription(type)
+    || "Fill the core fields below. Git will record the author, time, reason, and diff when you commit this file.";
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + (entry ? "Edit record" : options.obligationCompletion ? "Record obligation work" : "Create record") + '</p><h2 id="resource-editor-title">' + esc(titleCase(entry?.record.title || record.title || definition.title)) + '</h2></div><button type="button" class="icon-button" data-editor-dismiss aria-label="Close">×</button></div><p>' + esc(editorDescription) + '</p><div class="form-grid">' + names.map((name) => editorField(type, name, fields[name], record[name], required.has(name) || conditionMatches(record, fields[name].requiredWhen), Boolean(entry), oneOf.has(name), activeOneOf.has(name))).join("") + '</div>' +
     activeMarkdown.map((markdown) => {
       const generated = !entry?.content?.[markdown.name];
       const source = entry?.content?.[markdown.name]?.source
@@ -1826,7 +2094,7 @@ function openEditor(type, entry = null, options = {}) {
           : "";
       return '<label class="content-editor-field" data-content-editor="' + esc(markdown.name) + '"><span>' + esc(markdown.label) + ' Markdown' + requiredMark + '</span><textarea data-markdown-slot="' + esc(markdown.name) + '" data-generated-content="' + generated + '" spellcheck="true" ' + (requiredNow ? "required" : "") + '>' + esc(source) + '</textarea></label>';
     }).join("") + renderRecordContentEditor(type, entry, options) +
-    '<details class="advanced-editor"><summary>Advanced JSON</summary><p>Use this for optional fields, extensions, or bulk edits. Changes here replace the guided fields above.</p><textarea spellcheck="false" aria-label="Advanced resource JSON">' + esc(JSON.stringify(record, null, 2)) + '</textarea></details><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-editor-dismiss>Cancel</button><button type="submit" class="button primary" id="save-record">' + esc(options.saveLabel || "Save file") + '</button></div></form>';
+    '<details class="advanced-editor"><summary>Advanced JSON</summary><p>Use this for optional fields, extensions, or bulk edits. Changes here replace the guided fields above.</p><textarea spellcheck="false" aria-label="Advanced resource JSON">' + esc(JSON.stringify(record, null, 2)) + '</textarea></details><div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button type="button" class="button" data-editor-dismiss>Cancel</button><button type="submit" class="button primary" id="save-record">' + esc(options.saveLabel || "Save file") + '</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
   dialog.addEventListener("close", () => dialog.remove());
@@ -1857,6 +2125,7 @@ function openEditor(type, entry = null, options = {}) {
   }
   dialog.querySelector("form").addEventListener("submit", async (event) => {
     event.preventDefault();
+    if (dialog.dataset.mutationBusy === "true") return;
     try {
       const advanced = dialog.dataset.jsonDirty === "true";
       if (!advanced && !dialog.querySelector("form").reportValidity()) return;
@@ -1887,6 +2156,7 @@ function openEditor(type, entry = null, options = {}) {
         ...activeMarkdown.map(({ name }) => [entry?.content?.[name]?.path, entry?.content?.[name]?.revision]),
         [recordContentItem?.path, recordContentItem?.revision]
       ].filter(([path, revision]) => path && revision));
+      setMutationBusy(dialog, true, "Saving…", options.saveLabel || "Save file");
       const response = await localFetch(url, {
         method: entry ? "PUT" : "POST",
         headers: { "content-type": "application/json" },
@@ -1899,18 +2169,29 @@ function openEditor(type, entry = null, options = {}) {
         })
       });
       if (!response.ok) throw new Error(await responseMessage(response));
-      state = await fetchJson("/api/state");
+      applyMutationState(await response.json());
       dialog.close();
       location.hash = "#/resource/" + encodeURIComponent(updated.type) + "/" + encodeURIComponent(updated.id);
       render();
     } catch (error) {
+      setMutationBusy(dialog, false, "", options.saveLabel || "Save file");
       dialog.querySelector(".dialog-error").textContent = error.message;
     }
   });
 }
 
+function implementationEditorDescription(type) {
+  if (type === "system") {
+    return "Complete the System inventory fields. If this System produces control evidence, add its evidence source roles and current access owners, then write the exact report, filters, date range, timezone, export format, and reconciliation steps in Record Markdown.";
+  }
+  if (type === "control") {
+    return "Document the actual procedure and select every authoritative System that produces evidence for this Control. Before marking it implemented, confirm each source is active, has the required evidence role and current access owners, and includes repeatable retrieval instructions in Record Markdown.";
+  }
+  return "";
+}
+
 function seedRecord(type, definition) {
-  const record = { schemaVersion: 1, id: createResourceId(type, "new", state.resources.map(({ record }) => record.id)), type, title: "" };
+  const record = { id: createResourceId(type, "new", state.resources.map(({ record }) => record.id)), type, title: "" };
   const fields = { ...state.model.commonFields, ...definition.fields };
   for (const name of definition.required || []) {
     const field = fields[name];
@@ -1985,20 +2266,29 @@ function editorField(type, name, field, value, required, editing, oneOfRequired
     : field.relation ? relationHelp(field)
     : "";
   let control;
+  if (field.managed) {
+    control = '<textarea readonly spellcheck="false" placeholder="Filled when approval is saved">' + esc(value === undefined ? "" : JSON.stringify(value, null, 2)) + '</textarea>';
+    return fieldWrap(name, "object", label, requiredMark, control, "Managed by filegrc from the exact companion Markdown revisions", false);
+  }
   if (field.relation && field.type === "array") {
     const candidates = relationCandidates(field);
     control = candidates.length
-      ? '<div class="checkbox-list">' + candidates.map(({ record }) => '<label><input type="checkbox" value="' + esc(record.id) + '" ' + ((value || []).includes(record.id) ? "checked" : "") + '><span>' + esc(record.title) + '<small>' + esc(record.id) + '</small></span></label>').join("") + '</div>'
+      ? '<div class="checkbox-list">' + candidates.map(({ record }) => '<label><input type="checkbox" value="' + esc(record.id) + '" ' + ((value || []).includes(record.id) ? "checked" : "") + '><span>' + esc(record.title) + '<small>' + esc(state.model.resources[record.type].title + " · " + record.id) + '</small></span></label>').join("") + '</div>'
       : required ? '<select><option value="">No Matching Resources Exist Yet</option></select>' : '<div class="missing-options">No matching resources exist yet.</div>';
     return fieldWrap(name, "relation-array", label, requiredMark, control, help, required);
   }
   if (field.relation) {
     const candidates = relationCandidates(field);
     control = candidates.length
-      ? '<select><option value="">Select a Resource</option>' + candidates.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (value === record.id ? "selected" : "") + '>' + esc(record.title) + ' · ' + esc(record.id) + '</option>').join("") + '</select>'
+      ? '<select><option value="">Select a Resource</option>' + candidates.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (value === record.id ? "selected" : "") + '>' + esc(record.title) + ' · ' + esc(state.model.resources[record.type].title) + ' · ' + esc(record.id) + '</option>').join("") + '</select>'
       : required ? '<select><option value="">No Matching Resources Exist Yet</option></select>' : '<div class="missing-options">No matching resources exist yet.</div>';
     return fieldWrap(name, "relation", label, requiredMark, control, help, required);
   }
+  if (name === "classificationId") {
+    const values = Object.keys(state.workspace.classificationDefinitions || {});
+    control = '<select><option value="">Select</option>' + values.map((item) => '<option value="' + esc(item) + '" ' + (value === item ? "selected" : "") + '>' + esc(properCase(item)) + '</option>').join("") + '</select>';
+    return fieldWrap(name, "string", label, requiredMark, control, "Defined by Workspace classificationDefinitions", required);
+  }
   if (field.type === "enum" || field.type === "rating" || field.type === "outcome") {
     const values = field.values || (field.type === "rating" ? state.model.primitives.rating : state.model.primitives.outcome) || [];
     control = '<select><option value="">Select</option>' + values.map((item) => '<option value="' + esc(item) + '" ' + (value === item ? "selected" : "") + '>' + esc(properCase(item)) + '</option>').join("") + '</select>';
@@ -2014,7 +2304,10 @@ function editorField(type, name, field, value, required, editing, oneOfRequired
   }
   if (field.type === "array") {
     control = '<textarea placeholder="One value per line">' + esc((value || []).join("\n")) + '</textarea>';
-    return fieldWrap(name, "array", label, requiredMark, control, "One value per line", required);
+    const arrayHelp = name === "evidenceSourceKinds"
+      ? "One role per line. Use the roles required by the Controls this System supports, such as " + evidenceSourceRoleOptions().join(", ") + "."
+      : "One value per line";
+    return fieldWrap(name, "array", label, requiredMark, control, arrayHelp, required);
   }
   if (["description", "statement", "scope", "rationale", "purpose"].some((part) => name.toLowerCase().includes(part))) {
     control = '<textarea>' + esc(value ?? "") + '</textarea>';
@@ -2028,6 +2321,10 @@ function editorField(type, name, field, value, required, editing, oneOfRequired
   return fieldWrap(name, field.type, label, requiredMark, control, help, required);
 }
 
+function evidenceSourceRoleOptions() {
+  return [...new Set((state.model.evidenceSourceFamilies || []).flatMap(({ sourceKinds }) => sourceKinds || []))].sort();
+}
+
 function fieldWrap(name, kind, label, requiredMark, control, help, required) {
   const labelId = "field-label-" + name;
   let labelledControl = control.replace(/^<([a-z]+)/, '<$1 aria-labelledby="' + esc(labelId) + '"');
@@ -2068,14 +2365,28 @@ function wireEditorRequirements(dialog, base, fields, oneOfGroups, markdownDefin
   };
   const refresh = () => {
     for (const [name, field] of Object.entries(fields)) {
-      if (!field.requiredWhen) continue;
       const group = dialog.querySelector('[data-field-group="' + CSS.escape(name) + '"]');
       if (!group) continue;
+      if (field.managed) {
+        const visible = !field.allowedWhen || conditionMatchesValues(field.allowedWhen, currentValue);
+        group.hidden = !visible;
+        refreshGroup(group, false);
+        continue;
+      }
+      if (field.allowedWhen && !conditionMatchesValues(field.allowedWhen, currentValue)) {
+        group.hidden = true;
+        refreshGroup(group, false);
+        continue;
+      }
+      if (!field.requiredWhen) {
+        group.hidden = false;
+        continue;
+      }
       const visible = !field.visibleWhen || conditionMatchesValues(field.visibleWhen, currentValue);
       const applicable = Object.entries(field.requiredWhen)
         .filter(([conditionName]) => conditionName !== "status")
         .every(([conditionName, expected]) => conditionValueMatches(currentValue(conditionName), expected));
-      group.hidden = !visible || !applicable;
+      group.hidden = !visible || (!applicable && field.showWhenInactive !== true);
       const required = visible && applicable && conditionMatchesValues(field.requiredWhen, currentValue);
       refreshGroup(group, required);
     }
@@ -2133,6 +2444,10 @@ function readGuidedRecord(dialog, base, fields) {
   const record = structuredClone(base);
   for (const group of dialog.querySelectorAll("[data-field-group]")) {
     const name = group.dataset.fieldGroup;
+    if (group.hidden) {
+      delete record[name];
+      continue;
+    }
     const kind = group.dataset.kind;
     let value;
     if (kind === "relation-array") value = [...group.querySelectorAll('input[type="checkbox"]:checked')].map((input) => input.value);
@@ -2157,7 +2472,11 @@ function relationCandidates(field) {
 }
 
 function relationHelp(field) {
-  return "References " + (field.relation.includes("*") ? "any resource" : field.relation.map((type) => state.model.resources[type]?.pluralTitle || type).join(" or "));
+  if (field.relation.includes("*")) return "References any resource";
+  const labels = field.relation.map((type) => state.model.resources[type]?.pluralTitle || type);
+  if (labels.length < 2) return "References " + labels.join("");
+  if (labels.length === 2) return "References " + labels.join(" or ");
+  return "References " + labels.slice(0, -1).join(", ") + ", or " + labels.at(-1);
 }
 
 function openContentEditor(entry, name) {
@@ -2166,18 +2485,21 @@ function openContentEditor(entry, name) {
   const dialog = document.createElement("dialog");
   dialog.className = "editor content-dialog";
   dialog.setAttribute("aria-labelledby", "content-editor-title");
-  dialog.innerHTML = '<form method="dialog"><div class="dialog-head"><div><p class="kicker">Edit Markdown</p><h2 id="content-editor-title">' + esc(titleCase(entry.record.title)) + '</h2></div><button value="cancel" class="icon-button" aria-label="Close">×</button></div><p><code>' + esc(item.path) + '</code></p><textarea class="markdown-source" spellcheck="true" aria-label="Markdown content">' + esc(item.source) + '</textarea><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button value="cancel" class="button">Cancel</button><button type="button" class="button primary" id="save-content">Save Markdown</button></div></form>';
+  dialog.innerHTML = '<form method="dialog"><div class="dialog-head"><div><p class="kicker">Edit Markdown</p><h2 id="content-editor-title">' + esc(titleCase(entry.record.title)) + '</h2></div><button value="cancel" class="icon-button" aria-label="Close">×</button></div><p><code>' + esc(item.path) + '</code></p><textarea class="markdown-source" spellcheck="true" aria-label="Markdown content">' + esc(item.source) + '</textarea><div class="dialog-error" role="alert"></div><div class="save-status" role="status" aria-live="polite"></div><div class="dialog-actions"><button value="cancel" class="button">Cancel</button><button type="button" class="button primary" id="save-content">Save Markdown</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
   dialog.addEventListener("close", () => dialog.remove());
   dialog.querySelector("#save-content").addEventListener("click", async () => {
+    if (dialog.dataset.mutationBusy === "true") return;
     try {
+      setMutationBusy(dialog, true, "Saving…", "Save Markdown");
       const response = await localFetch("/api/content", { method: "PUT", headers: { "content-type": "application/json" }, body: JSON.stringify({ path: item.path, source: dialog.querySelector(".markdown-source").value, revision: item.revision }) });
       if (!response.ok) throw new Error(await responseMessage(response));
-      state = await fetchJson("/api/state");
+      applyMutationState(await response.json());
       dialog.close();
       render();
     } catch (error) {
+      setMutationBusy(dialog, false, "", "Save Markdown");
       dialog.querySelector(".dialog-error").textContent = error.message;
     }
   });
@@ -2313,7 +2635,11 @@ function metric(label, value, note, tone) {
 }
 function countOverdue(entries) { const today = currentDate(); return entries.filter(({ record }) => dueDate(record) && dueDate(record) < today).length; }
 function dueDate(record) {
-  const explicit = record.dueOn || record.nextDueOn || record.reviewDueOn || record.expiresOn || record.acceptanceExpiresOn || record.scheduledOn;
+  const explicit = record.completionWindow?.dueOn
+    || record.completionWindow?.dueAt?.slice(0, 10)
+    || record.dueOn
+    || record.expiresOn
+    || record.scheduledFor;
   if (explicit) return explicit;
   if (record.type !== "obligation" || record.status !== "active") return null;
   const recurrence = record.recurrence?.anchorDate
@@ -2353,6 +2679,9 @@ function currentPeopleForParties(ids = [], seen = new Set()) {
     if (party?.type === "team" && party.status === "active") {
       people.push(...currentPeopleForParties([...(party.memberIds || []), ...(party.chairIds || [])], seen));
     }
+    if (party?.type === "appointment" && party.status === "active") {
+      people.push(...currentPeopleForParties([party.holderId], seen));
+    }
   }
   return [...new Set(people)];
 }
@@ -2420,6 +2749,19 @@ function fieldLabel(type, name) {
 function filterOptionLabel(value) { return state.resources.find(({ record }) => record.id === value)?.record.title || properCase(value); }
 function humanize(value) { return String(value).replace(/[-_]+/g, " ").replace(/Ids?$/, "").replace(/([a-z])([A-Z])/g, "$1 $2").replace(/^./, (letter) => letter.toUpperCase()); }
 function properCase(value) { return humanize(value).replace(/\b[a-z]/g, (letter) => letter.toUpperCase()).replace(/\bSoc 2\b/g, "SOC 2"); }
+function displayStatus(record) {
+  if (record?.type === "attestation"
+    && record.status === "pending"
+    && record.dueOn
+    && state.asOf
+    && record.dueOn < state.asOf) return "overdue";
+  if (record?.type === "evidence"
+    && ["collected", "verified"].includes(record.status)
+    && record.expiresOn
+    && state.asOf
+    && record.expiresOn < state.asOf) return "expired";
+  return record?.status;
+}
 function titleCase(value) {
   const words = String(value).split(/\s+/);
   return words.map((word, index) => {
@@ -2545,8 +2887,82 @@ ${nextCalendarOccurrence.toString()}
 ${formatCalendarDate.toString()}
 ${formatLocalDateTime.toString()}
 function empty(message) { return '<div class="empty">' + esc(message) + '</div>'; }
-function pluralize(noun, count) { return count === 1 ? noun : noun + "s"; }
+function pluralize(noun, count) {
+  if (count === 1) return noun;
+  if (/[^aeiou]y$/i.test(noun)) return noun.slice(0, -1) + "ies";
+  return noun + "s";
+}
 function renderNotFound(main) { main.innerHTML = '<div class="page">' + empty("That resource does not exist.") + '</div>'; }
+function applyMutationState(result) {
+  if (!result?.state) throw new Error("The save response did not include the current workspace state.");
+  state = result.state;
+  scheduleRepositorySyncPoll(result.synchronization);
+}
+
+function scheduleRepositorySyncPoll(synchronization = state.repository?.backgroundSynchronization) {
+  const syncing = synchronization?.status === "syncing"
+    || state.repository?.status === "syncing";
+  if (!syncing) {
+    clearTimeout(repositorySyncPollTimer);
+    repositorySyncPollTimer = null;
+    return;
+  }
+  if (repositorySyncPollTimer || repositorySyncPollInFlight) return;
+  repositorySyncPollTimer = setTimeout(pollRepositorySync, 400);
+}
+
+async function pollRepositorySync() {
+  repositorySyncPollTimer = null;
+  if (repositorySyncPollInFlight) return;
+  repositorySyncPollInFlight = true;
+  let continuePolling = false;
+  try {
+    const response = await localFetch("/api/git/sync-status");
+    if (!response.ok) throw new Error(await responseMessage(response));
+    const result = await response.json();
+    const wasSyncing = state.repository?.status === "syncing";
+    state.repository = result.repository;
+    state.git = result.git;
+    state.readOnly = result.readOnly;
+    if (result.repository?.status === "syncing") {
+      continuePolling = true;
+    } else if (wasSyncing) {
+      render();
+    }
+  } catch {
+    continuePolling = true;
+  } finally {
+    repositorySyncPollInFlight = false;
+  }
+  if (continuePolling) {
+    repositorySyncPollTimer = setTimeout(pollRepositorySync, 1_000);
+  }
+}
+
+function setMutationBusy(dialog, busy, label, idleLabel) {
+  clearTimeout(dialog._stillWorkingTimer);
+  dialog._stillWorkingTimer = null;
+  dialog.dataset.mutationBusy = busy ? "true" : "false";
+  dialog.querySelectorAll("button,input,select,textarea").forEach((control) => {
+    if (busy) {
+      control.dataset.mutationWasDisabled = control.disabled ? "true" : "false";
+      control.disabled = true;
+    } else if (control.dataset.mutationWasDisabled === "false") {
+      control.disabled = false;
+      delete control.dataset.mutationWasDisabled;
+    }
+  });
+  const button = dialog.querySelector("#save-record,#save-content");
+  if (button) button.textContent = busy ? label : idleLabel;
+  const status = dialog.querySelector(".save-status");
+  if (status) status.textContent = "";
+  if (busy) {
+    dialog._stillWorkingTimer = setTimeout(() => {
+      if (status) status.textContent = "Still working. Git sync and workspace checks can take a moment.";
+    }, 1_500);
+  }
+}
+
 function showError(message) {
   const dialog = document.createElement("dialog");
   dialog.className = "alert-dialog";
@@ -2562,10 +2978,35 @@ async function responseMessage(response) {
   try { return JSON.parse(source).error || source; } catch { return source; }
 }
 async function localFetch(url, options) {
+  const method = String(options?.method || "GET").toUpperCase();
+  const synchronizing = state?.repository?.mode === "trunk"
+    && ["POST", "PUT", "DELETE"].includes(method)
+    && url !== "/api/evidence-packet";
+  const chip = synchronizing ? document.querySelector(".repo-chip") : null;
+  const previousChip = chip?.innerHTML;
+  let repositoryRefreshed = false;
+  if (chip) chip.innerHTML = '<span class="status-dot neutral"></span>Syncing';
   try {
-    return await fetch(url, options);
+    const response = await fetch(url, options);
+    if (synchronizing && !response.ok) {
+      try {
+        const stateResponse = await fetch("/api/state");
+        if (stateResponse.ok) {
+          state = await stateResponse.json();
+          if (chip?.isConnected) {
+            chip.innerHTML = '<span class="status-dot ' + repositoryStatusTone(state.repository.status) + '"></span>' + esc(state.repository.label);
+            repositoryRefreshed = true;
+          }
+        }
+      } catch {
+        // The original response contains the useful mutation error.
+      }
+    }
+    return response;
   } catch {
     throw new Error("The filegrc server is unavailable. Restart npm run serve, or pnpm dev in the monorepo, and try again.");
+  } finally {
+    if (!repositoryRefreshed && chip?.isConnected && previousChip) chip.innerHTML = previousChip;
   }
 }
 async function fetchJson(url, options) { const response = await localFetch(url, options); if (!response.ok) throw new Error(await responseMessage(response)); return response.json(); }
@@ -2585,8 +3026,9 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .nav-stage>.nav-items>a.nav-direct{display:grid;grid-template-columns:minmax(0,1fr) var(--nav-control-width);gap:6px;align-items:center;width:100%;padding:6px 6px 6px 7px;font-size:13.2px}
 .nav-heading-row{display:grid;grid-template-columns:minmax(0,1fr) 24px;gap:2px;align-items:stretch}.nav-heading-row>.nav-heading{display:grid;grid-template-columns:24px minmax(0,1fr);gap:6px;align-items:center;width:100%;padding:7px 6px;border-radius:7px;color:#d5d9ed;text-align:left;text-transform:none;letter-spacing:0;text-decoration:none}.nav-heading-row>.nav-heading:hover,.nav-heading-row>.nav-heading.current{background:rgba(255,255,255,.1);color:#fff}.nav-toggle{display:grid;place-items:center;width:24px;height:auto;min-height:100%;padding:0;border:0;border-radius:6px;background:none;color:#aeb6d8;cursor:pointer}.nav-toggle:hover{background:rgba(255,255,255,.1);color:#fff}.nav-chevron{display:block;width:12px;height:12px;place-self:center;fill:none;stroke:currentColor;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round;transition:transform .15s}.nav-subheading-row{display:grid;grid-template-columns:minmax(0,1fr) 22px;gap:2px;align-items:center;width:100%;padding:0;border:0;border-radius:6px;background:none;color:#919bc4;cursor:pointer}.nav-subheading-row:hover{background:rgba(255,255,255,.1);color:#fff}.nav-subheading-row>.nav-subheading{display:flex;align-items:center;min-width:0;padding:7px;color:inherit;text-align:left;text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780}.nav-group.open>.nav-heading-row .nav-chevron,.nav-group.open>.nav-subheading-row .nav-chevron{transform:rotate(90deg)}
 .stage-overview-hero{display:grid;grid-template-columns:minmax(0,1fr) 300px;gap:28px;align-items:center;padding:26px 28px;background:var(--panel);border:1px solid var(--line);border-radius:12px;box-shadow:var(--shadow)}.stage-overview-hero h2,.group-overview-head h2{font:500 37.2px Georgia,serif;margin:7px 0}.stage-overview-hero>div>p:not(.kicker),.group-overview-head>div>p:not(.kicker){max-width:760px;color:var(--muted);font-size:14.4px;line-height:1.55;margin:0}.stage-progress-card{padding:15px 17px;background:var(--paper);border:1px solid var(--line);border-radius:9px}.stage-progress-card>div:first-child{display:flex;align-items:center;justify-content:space-between;margin-bottom:11px}.stage-progress-card>div:first-child>strong{font:500 33.6px Georgia,serif}.stage-progress-card p{color:var(--muted);font-size:10.8px;line-height:1.45;margin:9px 0 0}.badge.neutral{background:#e5e8f2;color:#555e73}.stage-overview-layout{display:grid;grid-template-columns:320px minmax(0,1fr);gap:15px;margin-top:15px;align-items:start}.stage-plan ol,.group-plan ol{display:grid;gap:12px;padding-left:20px;margin:0}.stage-plan li,.group-plan li{padding-left:4px;color:var(--ink);font-size:13.2px;line-height:1.5}.stage-groups{min-width:0}.stage-groups>.section-head{margin:4px 0 13px}.stage-group-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-group-card{position:relative;display:block;min-height:138px;padding:18px 38px 17px 18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.stage-group-card:hover{border-color:var(--accent-light)}.stage-group-card h3{font-size:15.6px;margin:0 0 7px}.stage-group-card p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.stage-group-card small{display:block;color:var(--accent);font-size:9.6px;font-weight:700;margin-top:12px}.stage-group-arrow{position:absolute;right:16px;top:16px;color:var(--accent);font-size:24px}.group-overview-head{display:flex;justify-content:space-between;align-items:end;gap:25px;margin-bottom:15px}.stage-status-link{display:grid;grid-template-columns:auto auto;align-items:center;gap:4px 12px;min-width:155px;padding:12px 14px;background:var(--panel);border:1px solid var(--line);border-radius:9px;text-decoration:none}.stage-status-link>strong{font:500 28.8px Georgia,serif;text-align:right}.stage-status-link>small{grid-column:1/-1;color:var(--muted);font-size:9.6px;text-align:right}.relationship-note{display:grid;grid-template-columns:250px minmax(0,1fr);gap:20px;align-items:center;margin-bottom:15px;padding:17px 20px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.relationship-note h3{font-size:15.6px;margin:5px 0 0}.relationship-note>p{color:var(--muted);font-size:12px;line-height:1.55;margin:0}.relationship-note code{font-size:10.8px}.group-plan{margin-bottom:24px}.group-related-links{display:flex;align-items:center;gap:8px;margin-top:18px;padding-top:14px;border-top:1px solid var(--line)}.group-related-links>span{color:var(--muted);font-size:10.8px;margin-right:auto}.group-destinations>.section-head{margin-bottom:12px}.group-destination-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:11px}.group-destination-card{display:grid;grid-template-columns:minmax(0,1fr) 100px;gap:16px;min-height:150px;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.group-destination-card:hover{border-color:var(--accent-light)}.group-destination-card h3{font-size:15.6px;margin:5px 0 7px}.group-destination-card p:not(.kicker){color:var(--muted);font-size:10.8px;line-height:1.5;margin:0}.destination-rollup{align-self:center;text-align:right}.destination-rollup strong,.destination-rollup small{display:block}.destination-rollup strong{font:500 32.4px Georgia,serif}.destination-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:3px}
-.stage-pages{margin-top:24px}.stage-page-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-page-card{position:relative;display:flex;flex-direction:column;min-width:0;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025);transition:border-color .15s,box-shadow .15s}.stage-page-card:hover{border-color:var(--accent-light);box-shadow:0 5px 16px rgba(21,40,33,.07)}.stage-page-card.complete{border-color:#b9dac6}.stage-page-card-link{position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-card-link:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{display:flex;align-items:center;justify-content:space-between;gap:18px}.stage-page-card-head h3{font-size:15.6px;line-height:1.35;margin:4px 0 0}.stage-page-card-head>div>small{display:block;color:var(--accent);font-size:9.6px;font-weight:700}.stage-page-card>p{color:var(--muted);font-size:12px;line-height:1.5;margin:13px 0 0}.stage-page-rollup{display:flex;flex:0 0 104px;flex-direction:column;justify-content:center;text-align:right}.stage-page-rollup strong,.stage-page-rollup small{display:block}.stage-page-rollup strong{font:500 24px Georgia,serif}.stage-page-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:2px}.stage-page-card-foot{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:auto;padding-top:15px}.stage-page-completion{position:relative;z-index:2;color:var(--accent)}.stage-page-completion.complete{color:#176143;border-color:#b9dac6;background:#edf7f1}.stage-page-completion-state{color:var(--muted);font-size:10.8px}.stage-page-completion-state.complete{color:#176143;font-weight:700}.stage-page-open{color:var(--accent);font-size:12px;font-weight:700}.work-queue-section{margin-top:28px}.work-queue-section>.section-head{align-items:end}
+.context-workflow{display:flex;align-items:center;justify-content:space-between;gap:24px;margin:-8px 0 18px;padding:17px 19px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.context-workflow h3{font-size:16px;margin:4px 0 5px}.context-workflow p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.5;margin:0;max-width:850px}.context-workflow .button{white-space:nowrap}.evidence-map{display:grid;gap:12px;margin-top:18px}.evidence-map-head{display:flex;align-items:center;justify-content:space-between;gap:24px;padding:20px 22px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:11px}.evidence-map-head>div:first-child{max-width:760px}.evidence-map-head h2{font:500 24px Georgia,serif;margin:5px 0 7px}.evidence-map-head p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.55;margin:0}.evidence-map-actions{display:flex;gap:8px}.evidence-map-card{padding:18px 20px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.evidence-map-card.complete{border-color:#b9dac6}.evidence-map-card-head{display:flex;align-items:start;justify-content:space-between;gap:20px}.evidence-map-card-head h3{font-size:16px;margin:7px 0 0}.evidence-map-card-head>small{color:var(--muted);font-size:10px;text-align:right}.evidence-map-card>p{color:var(--muted);font-size:12px;line-height:1.55;margin:12px 0}.evidence-map-expectation{display:grid;grid-template-columns:120px minmax(0,1fr);gap:12px;padding:8px 0;border-top:1px solid var(--line);font-size:11px;line-height:1.5}.evidence-map-expectation strong{color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.06em}.evidence-map-expectation code{background:var(--paper);border-radius:4px;padding:2px 5px}.evidence-map-links{display:grid;grid-template-columns:minmax(220px,1fr) minmax(280px,1.2fr);gap:20px;margin-top:13px;padding-top:13px;border-top:1px solid var(--line)}.evidence-map-links>div>small{display:block;color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}.evidence-map-references,.evidence-map-sources{display:flex;flex-wrap:wrap;gap:5px}.evidence-map-source{display:flex;align-items:center;gap:7px;padding:7px 9px;background:var(--paper);border:1px solid var(--line);border-radius:7px;font-size:11px;text-decoration:none}.evidence-map-source.complete{border-color:#b9dac6;background:#edf7f1}.evidence-map-source small{color:var(--muted);font-size:9px}.evidence-map-status{padding:9px 11px;background:var(--paper);border-radius:7px}.evidence-map-empty{padding:24px;background:var(--panel);border:1px solid var(--line);border-radius:10px}.evidence-map-empty h3{margin:6px 0}.evidence-map-empty p:not(.kicker){color:var(--muted);font-size:12px;margin:0 0 14px}.stage-pages{margin-top:24px}.stage-page-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-page-card{position:relative;display:flex;flex-direction:column;min-width:0;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025);transition:border-color .15s,box-shadow .15s}.stage-page-card:hover{border-color:var(--accent-light);box-shadow:0 5px 16px rgba(21,40,33,.07)}.stage-page-card.complete{border-color:#b9dac6}.stage-page-card-link{position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-card-link:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{display:flex;align-items:center;justify-content:space-between;gap:18px}.stage-page-card-head h3{font-size:15.6px;line-height:1.35;margin:4px 0 0}.stage-page-card-head>div>small{display:block;color:var(--accent);font-size:9.6px;font-weight:700}.stage-page-card>p{color:var(--muted);font-size:12px;line-height:1.5;margin:13px 0 0}.stage-page-rollup{display:flex;flex:0 0 104px;flex-direction:column;justify-content:center;text-align:right}.stage-page-rollup strong,.stage-page-rollup small{display:block}.stage-page-rollup strong{font:500 24px Georgia,serif}.stage-page-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:2px}.stage-page-card-foot{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:auto;padding-top:15px}.stage-page-completion{position:relative;z-index:2;color:var(--accent)}.stage-page-completion.complete{color:#176143;border-color:#b9dac6;background:#edf7f1}.stage-page-completion-state{color:var(--muted);font-size:10.8px}.stage-page-completion-state.complete{color:#176143;font-weight:700}.stage-page-open{color:var(--accent);font-size:12px;font-weight:700}.work-queue-section{margin-top:28px}.work-queue-section>.section-head{align-items:end}
 .button{text-decoration:none}
+.external-evidence-section{margin-top:28px}.external-evidence-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.external-evidence-list>.empty{grid-column:1/-1}.external-evidence-list>a{display:flex;align-items:center;justify-content:space-between;gap:14px;padding:13px 15px;background:var(--panel);border:1px solid var(--line);border-radius:8px;text-decoration:none}.external-evidence-list>a:hover{border-color:var(--accent-light)}.external-evidence-list>a>span:first-child{min-width:0}.external-evidence-list strong,.external-evidence-list small{display:block}.external-evidence-list strong{font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.external-evidence-list small{color:var(--muted);font-size:9.6px;margin-top:4px}
 .home-page{padding-top:16px;padding-bottom:16px}.overview-hero{min-height:72px;padding:10px 20px;align-items:center}.overview-hero h2{font-size:26.4px;margin:3px 0 2px}.overview-hero p:not(.kicker){font-size:12px}.home-page .readiness-map{padding:12px 15px}.home-page .readiness-map-head{margin-bottom:8px}.home-page .readiness-flow a{padding:7px}
 .overview-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px;margin-top:10px}.overview-grid>.audit-panel{grid-column:1/-1}
 .overview-grid>.panel{padding:15px}.overview-grid .panel-head{margin-bottom:10px}.overview-grid .audit-progress{gap:7px 20px}.overview-grid .progress-number strong{font-size:31.2px}.overview-grid .audit-engagement{padding:8px 11px}
@@ -2598,18 +3040,21 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .readiness-map{margin:14px 0;background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:20px 22px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.readiness-map-head{display:grid;grid-template-columns:minmax(220px,1fr) minmax(320px,420px);gap:28px;align-items:center;margin-bottom:17px}.readiness-map-head h3{font-size:18px;margin:5px 0 0}.readiness-progress-summary{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:8px 14px;align-items:center}.readiness-progress-summary>div{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:3px 12px;align-items:baseline}.readiness-progress-summary>div>span{color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}.readiness-progress-summary>div>strong{font-size:9.6px;font-weight:700;line-height:1.2}.readiness-progress-summary .progress,.readiness-progress-summary small{grid-column:1/-1}.readiness-progress-summary small{color:var(--muted);font-size:9.6px}.readiness-progress-summary>.button{white-space:nowrap}.readiness-flow{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:7px}.readiness-flow a{display:grid;grid-template-columns:23px minmax(0,1fr);column-gap:8px;align-content:start;min-width:0;padding:11px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);text-decoration:none}.readiness-flow a:hover{border-color:var(--accent-light);background:var(--accent-soft)}.readiness-flow a>span{grid-row:1/4;display:grid;place-items:center;width:23px;height:23px;border-radius:50%;background:var(--primary-gradient);color:#fff;font-size:9.6px;font-weight:800}.readiness-flow strong{font-size:12px;line-height:1.25}.readiness-flow small{grid-column:2;color:var(--muted);font-size:9.6px;line-height:1.4;margin-top:3px}.readiness-state{grid-column:2;justify-self:start;margin-top:8px;padding:3px 6px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:8.4px;line-height:1.2}.readiness-state.good{background:#dcefe4;color:#125733}.readiness-state.warn{background:#f6e8c9;color:#79500f}.readiness-state.bad{background:#f7dfdc;color:#873027}.audit-engagement{display:grid;grid-template-columns:minmax(210px,1fr) minmax(260px,1.25fr) auto;gap:20px;align-items:center;padding:14px 15px;border-radius:8px;background:var(--surface-soft)}.audit-engagement strong{font-size:13.2px}.audit-engagement p,.audit-engagement li{color:var(--muted);font-size:10.8px;line-height:1.5}.audit-engagement p{margin:5px 0 0}.audit-engagement ul{margin:0;padding-left:18px}.audit-engagement .button{white-space:nowrap;text-decoration:none}.resource-directory{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.resource-directory>section{min-width:0;padding:12px;border-radius:8px;background:var(--surface-soft)}.resource-directory h4{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.resource-directory a{display:flex;justify-content:space-between;gap:10px;padding:5px 0;border-top:1px solid var(--line);font-size:10.8px;text-decoration:none}.resource-directory a:first-of-type{border-top:0}.resource-directory a:hover span{color:var(--accent)}.resource-directory a strong{color:var(--muted);font-size:9.6px}.record-prose{max-width:790px}.record-prose section{padding:0 0 20px}.record-prose section+section{padding-top:20px;border-top:1px solid var(--line)}.record-prose h3{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.record-prose p{margin:0;font-size:16.8px;line-height:1.65;white-space:pre-wrap}.connections-panel .panel-head>span{display:grid;place-items:center;min-width:22px;height:22px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:9.6px}.connections{display:grid}.connections a{display:block;padding:9px 0;border-top:1px solid var(--line);text-decoration:none}.connections a:first-child{padding-top:0;border-top:0}.connections strong,.connections small{display:block}.connections strong{font-size:12px}.connections small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.connections a:hover strong{color:var(--accent)}.connections-more{margin:9px 0 0;color:var(--muted);font-size:9.6px;line-height:1.4}.external-source{display:flex;align-items:flex-start;justify-content:space-between;gap:8px;color:var(--accent);text-decoration:none}.external-source span,.external-source strong,.external-source small{display:block}.external-source strong{font-size:12px;line-height:1.35}.external-source small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.35;overflow-wrap:anywhere}.external-source b{font-size:13.2px}.external-source:hover strong{text-decoration:underline}
 .page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
 .operation-tracking{display:grid;gap:2px;min-width:0;text-decoration:none}.operation-tracking strong,.operation-tracking small{display:block;overflow-wrap:anywhere}.operation-tracking small{color:var(--muted);line-height:1.35}.operation-tracking.running strong{color:#176143}.operation-tracking.waiting strong,.operation-tracking.mixed strong{color:var(--amber)}.operation-tracking.paused strong{color:var(--red)}a.operation-tracking:hover strong{text-decoration:underline}
-.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
+.page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.repository-sync-alert{display:flex;align-items:flex-start;gap:9px;padding:10px 22px;border-bottom:1px solid #e9c888;background:#fff8e8;color:var(--ink);font-size:12px;line-height:1.45}.repository-sync-alert.syncing{border-color:var(--line);background:var(--surface-soft)}.repository-sync-alert .status-dot{flex:0 0 auto;margin-top:4px}.repository-sync-alert a{margin-left:auto;white-space:nowrap}.repository-state-banner,.repository-override{display:flex;align-items:flex-start;gap:13px;margin-bottom:14px}.repository-state-banner>.status-dot,.repository-override>.status-dot{margin-top:5px}.repository-state-banner h3{margin:3px 0 5px}.repository-state-banner p:last-child,.repository-override p{margin:0;color:var(--muted);line-height:1.5}.repository-override{padding:14px 17px;border:1px solid #e9c888;border-radius:9px;background:#fff8e8;font-size:13.2px}.repository-override strong{display:block;margin-bottom:4px}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;flex-wrap:wrap;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
+.onboarding-save-status{color:var(--muted);font-size:10.8px;line-height:1.35}.onboarding-save-status:empty{display:none}.onboarding-save-status:not(:empty){order:-1;flex-basis:100%;margin-bottom:4px}.onboarding-retry-sync{margin-top:9px}.detail-loading{color:var(--muted)}
+.save-status{min-height:16px;color:var(--muted);font-size:10.8px;line-height:1.35}
 .page-intro,.detail-head{align-items:center;margin-bottom:12px}.actions{align-items:center}.detail-head>div:first-child{min-width:0}.detail-head h2{margin:7px 0}.detail-head .header-breadcrumbs{margin:0;font-size:10.8px;line-height:normal;min-height:11px;align-items:center}.header-breadcrumbs span:last-child{overflow:hidden;text-overflow:ellipsis;white-space:nowrap;max-width:60ch}
 @media(max-width:1200px){.readiness-flow{grid-template-columns:repeat(3,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr 1fr}.audit-engagement .button{grid-column:1/-1;justify-self:start}}
 @media(max-width:1100px){.search{display:none}.topbar-status{margin-left:auto}.metrics{grid-template-columns:repeat(2,1fr)}.dashboard-grid,.organization-grid{grid-template-columns:repeat(2,1fr)}.catalog{grid-template-columns:repeat(3,1fr)}.span-2{grid-column:span 2}.resource-directory{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media(max-width:760px){.shell{display:block}.sidebar{transform:translateX(-100%);transition:.2s;box-shadow:8px 0 30px rgba(0,0,0,.2)}.sidebar.shown{transform:translateX(0)}.workspace{min-width:0}.mobile-nav{display:block;border:0;background:none;font-size:24px}.topbar{height:72px;padding:0 16px}.topbar>div:first-of-type{min-width:0}.topbar-status{display:none}.search{display:flex;max-width:none}.search kbd,.topbar .eyebrow{display:none}.page{padding:20px 15px 60px}.hero{display:block;padding:23px}.hero-meta{margin-top:22px;flex-wrap:wrap}.metrics,.dashboard-grid,.organization-grid{grid-template-columns:1fr}.span-2{grid-column:auto}.catalog{grid-template-columns:repeat(2,1fr)}.detail-grid{grid-template-columns:1fr}.page-intro,.detail-head{display:block}.page-intro>.button,.actions{margin-top:15px}.page-intro>.list-header-tools{justify-content:flex-start;margin:15px 0 0}.list-header-tools label{max-width:none}.record-table{min-width:720px}.readiness-map{padding:17px}.readiness-map-head{grid-template-columns:1fr;gap:8px}.readiness-flow{grid-template-columns:repeat(2,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr}.audit-engagement .button{grid-column:auto}.resource-directory{grid-template-columns:1fr}}
-@media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid{grid-template-columns:1fr}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}}
+@media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid,.evidence-map-expectation,.evidence-map-links,.external-evidence-list{grid-template-columns:1fr}.context-workflow,.evidence-map-head{align-items:stretch;flex-direction:column}.evidence-map-actions{flex-wrap:wrap}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}}
 @media(max-width:520px){.onboarding-form,.onboarding-sections,.setup-steps{grid-template-columns:1fr}.onboarding-form label.wide{grid-column:auto}.onboarding-actions{flex-wrap:wrap}.onboarding-skip{width:100%;order:3;margin:3px 0 0}.readiness-flow{grid-template-columns:1fr}.obligation-card-foot{align-items:flex-start;flex-direction:column}.obligation-action{align-self:flex-start}}
 @media(min-width:761px){.detail-grid{grid-template-columns:minmax(270px,1fr) minmax(0,2fr)}.detail-grid aside{grid-column:1;grid-row:1}.detail-main{grid-column:2;grid-row:1}}
 @media(min-width:761px){.detail-grid.detail-grid-structured{grid-template-columns:1fr}.detail-grid-structured aside{grid-column:1;grid-row:1;grid-template-columns:repeat(auto-fit,minmax(320px,1fr))}.detail-grid-structured aside>.panel{align-self:start}}
 @media(max-width:760px){.sidebar{visibility:hidden;transition:transform .2s,visibility 0s .2s}.sidebar.shown{visibility:visible;transition-delay:0s}.nav-close{display:grid;place-items:center;position:absolute;top:25px;right:18px;width:34px;height:34px;border:1px solid #5966a4;border-radius:50%;background:#11174a;color:#eef1ff;font-size:24px;cursor:pointer}.nav-scrim{display:block;position:fixed;inset:0;border:0;background:rgba(0,0,24,.38);opacity:0;pointer-events:none;transition:opacity .2s;z-index:15}.sidebar.shown+.nav-scrim{opacity:1;pointer-events:auto}.pagination{justify-content:space-between;gap:8px}.page-status{min-width:0}}
 @media(max-width:760px){.topbar{height:56px}.nav-close{font-size:0}.nav-close:before,.nav-close:after{content:"";position:absolute;width:13px;height:2px;border-radius:2px;background:currentColor;transform:rotate(45deg)}.nav-close:after{transform:rotate(-45deg)}}
 
+.connection-group+.connection-group{margin-top:15px;padding-top:13px;border-top:1px solid var(--line)}.connection-group h4{margin:0 0 8px;color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.08em}
 body,button,input,select,textarea,dialog{color:var(--ink)}
 button,input,select,textarea{accent-color:var(--accent)}
 :focus-visible{outline:3px solid var(--focus);outline-offset:2px}