filegrc 0.4.0 → 0.5.0

package/src/web.js

@@ -8,7 +8,7 @@ import {
   utcCalendarDate,
   validCalendarRecurrence
 } from "./recurrence.js";
-import { PROGRAM_PATH, RESOURCE_INSTRUCTIONS } from "./program-path.js";
+import { PROGRAM_PATH, RESOURCE_INSTRUCTIONS, RESOURCE_PAGE_SUMMARIES } from "./program-path.js";
 import { formatCalendarDate, formatLocalDateTime } from "./time.js";
 
 export function renderIndex(state = null) {
@@ -50,9 +50,10 @@ const READINESS_STAGES = SHARED_PROGRAM_STAGES.map((stage) => ({
   ...stage,
   number: String(stage.number)
 }));
+const RESOURCE_GUIDE_INSTRUCTIONS = ${JSON.stringify(RESOURCE_INSTRUCTIONS)};
 const STAGE_PAGE_SUMMARIES = ${JSON.stringify({
-  ...RESOURCE_INSTRUCTIONS,
-  "utility:audit-packet": "Review filegrc Evidence and External Evidence for the formal period, complete engagement preparation, and build the indexed audit packet."
+  ...RESOURCE_PAGE_SUMMARIES,
+  "utility:audit-packet": "Review fieldwork readiness and build the indexed evidence packet."
 })};
 const RECORD_TEXT_FIELDS = new Set(["description", "statement", "activity", "purpose", "scope", "objective", "applicabilityRationale", "summary", "rationale", "businessPurpose", "changeSummary", "decisionSummary", "decisionRationale", "recommendation", "remediationPlan", "auditorNotes", "notPerformedReason"]);
 const FINDING_SOURCE_TYPES = new Set(["control-test", "policy-review", "meeting", "risk", "risk-assessment", "vendor-review", "access-review", "incident", "exercise", "backup-test", "penetration-test", "audit"]);
@@ -253,7 +254,7 @@ function renderHome(main) {
     : "";
   main.innerHTML = '<div class="page home-page"><section class="hero overview-hero"><div><p class="kicker">Current program state</p><h2>' + esc(titleCase(state.workspace.title)) + '</h2><p>' + esc(state.workspace.description || "Governance, risk, controls, evidence, and audit work maintained as plain files in Git.") + '</p></div></section>' + setupBanner + readinessOverview() +
     '<div class="overview-grid"><section class="panel obligation-panel"><div class="panel-head"><div><p class="kicker">Policy obligations</p><h3>' + obligationHeading + '</h3></div><a href="#/stage/run">Open board</a></div>' + obligationPreview(previewObligations) + '</section>' +
-    '<section class="panel event-reminder-panel"><div class="panel-head"><div><p class="kicker">Event reminders</p><h3>Did Something Change?</h3></div><a href="#/stage/run?section=events">' + (acceptedEventTriggers.length ? "Trigger work" : "Review proposals") + '</a></div>' + eventReminderPreview(state.obligations.triggers.slice(0, 4)) + '</section>' +
+    '<section class="panel event-reminder-panel"><div class="panel-head"><div><p class="kicker">Event reminders</p><h3>Did Something Change?</h3></div><a href="#/stage/run?section=events">' + (acceptedEventTriggers.length ? "Trigger work" : "Review proposals") + '</a></div>' + eventReminderPreview(orderedPolicyEventTriggers(state.obligations.triggers).slice(0, 4)) + '</section>' +
     auditPanel + '</div></div>';
   main.querySelector("#resume-setup")?.addEventListener("click", requestOnboarding);
 }
@@ -273,29 +274,29 @@ function initialSetupBanner() {
     ? "Choose the program goal."
     : "Confirm the saved program goal: " + goalLabels[goal] + ".";
   const completion = system.status === "planned"
-    ? "Complete setup to activate the planned service and continue to Step 1."
-    : "Complete setup to close onboarding and continue to Step 1.";
-  return '<section class="setup-banner"><div><p class="kicker">Setup draft saved</p><h3>Review and complete initial setup</h3><p>' + esc(system.title) + ' already has a saved service boundary.</p></div><ol><li>Review the saved service boundary.</li><li>' + esc(goalStep) + '</li><li>' + esc(completion) + '</li><li><button class="text-button" type="button" id="resume-setup">Resume setup</button></li></ol></section>';
+    ? "Confirm the service scope to activate the planned service and continue to Step 1."
+    : "Confirm the service scope to close onboarding and continue to Step 1.";
+  return '<section class="setup-banner"><div><p class="kicker">Setup draft saved</p><h3>Review the initial service scope</h3><p>' + esc(system.title) + ' already has a saved service boundary.</p></div><ol><li>Review the saved service boundary.</li><li>' + esc(goalStep) + '</li><li>' + esc(completion) + '</li><li><button class="text-button" type="button" id="resume-setup">Resume setup</button></li></ol></section>';
 }
 
 function readinessOverview() {
   const progress = programPathProgress();
   const nextHref = nextProgramStageHref();
-  const programStage = (id, body, href) => {
+  const programStage = (id, href) => {
     const stage = READINESS_STAGES.find((candidate) => candidate.id === id);
     const current = stageProgress(stage);
     const remaining = current.total - current.complete;
-    const status = !remaining ? "Review complete" : current.complete ? remaining + " pages to review" : "Review not marked";
-    return [stage.title, body, href, status, !remaining ? "good" : current.complete ? "warn" : "neutral"];
+    const status = !remaining ? "Ready" : current.complete ? remaining + " pages need work" : "Needs work";
+    return [stage.title, stage.summary, href, status, !remaining ? "good" : current.complete ? "warn" : "neutral"];
   };
   const stages = [
-    programStage("scope", "Confirm program ownership, criteria, and commitments, then describe the service, supporting systems, and dependencies.", "#/stage/scope"),
-    programStage("policies", "Tailor the policy set, obtain independent management approval, and establish effective dates.", "#/stage/policies"),
-    programStage("controls", "Finish the internal control set and every authoritative evidence source, then record any complementary controls.", "#/stage/controls"),
-    programStage("run", "Begin the candidate period, maintain risk assessments, work the filegrc queue, run the remaining controls, and retain dated evidence.", "#/stage/run"),
-    programStage("audit", "Engage the CPA firm, confirm the formal period, complete fieldwork, and generate the final evidence packet.", "#/stage/audit")
+    programStage("scope", "#/stage/scope"),
+    programStage("policies", "#/stage/policies"),
+    programStage("controls", "#/stage/controls"),
+    programStage("run", "#/stage/run"),
+    programStage("audit", "#/stage/audit")
   ];
-  return '<section class="readiness-map"><div class="readiness-map-head"><div><p class="kicker">SOC 2 program path</p><h3>Prepare, Operate, Then Audit</h3></div><div class="readiness-progress-summary"><div><span>Page Review Progress</span><strong>' + progress.percent + '%</strong><div class="progress"><span style="width:' + progress.percent + '%"></span></div><small>' + esc(progress.complete + " of " + progress.total + " program pages marked reviewed") + '</small></div><a class="button primary" href="' + nextHref + '">Continue</a></div></div><div class="readiness-flow">' + stages.map(([title, body, href, status, tone], index) => '<a href="' + href + '"><span>' + (index + 1) + '</span><strong>' + esc(title) + '</strong><small>' + esc(body) + '</small><b class="readiness-state ' + esc(tone) + '">' + esc(status) + '</b></a>').join("") + '</div></section>';
+  return '<section class="readiness-map"><div class="readiness-map-head"><div><p class="kicker">SOC 2 program path</p><h3>Prepare, Operate, Then Audit</h3></div><div class="readiness-progress-summary"><div><span>Program readiness</span><strong>' + progress.percent + '%</strong><div class="progress"><span style="width:' + progress.percent + '%"></span></div><small>' + esc(progress.complete + " of " + progress.total + " program pages " + (progress.complete === 1 ? "is" : "are") + " ready") + '</small></div><a class="button primary" href="' + nextHref + '">Continue</a></div></div><div class="readiness-flow">' + stages.map(([title, body, href, status, tone], index) => '<a href="' + href + '"><span>' + (index + 1) + '</span><strong>' + esc(title) + '</strong><small>' + esc(body) + '</small><b class="readiness-state ' + esc(tone) + '">' + esc(status) + '</b></a>').join("") + '</div></section>';
 }
 
 function nextProgramStageHref() {
@@ -317,6 +318,249 @@ function renderStageOverview(main, stageId, params = new URLSearchParams()) {
     renderStagePageIndex(stage) + (stage.id === "controls" ? renderEvidenceReadiness() : "") + '</div>';
 }
 
+function workflowGuidance(options = {}) {
+  const workflow = state.workflow;
+  if (!workflow) return "";
+  const matches = (item) => {
+    if (options.stageId && item.stage !== options.stageId) return false;
+    if (options.type && item.subject?.type !== options.type && item.source?.type !== options.type) return false;
+    if (options.id && item.subject?.id !== options.id && item.source?.id !== options.id) return false;
+    return true;
+  };
+  const activeStates = new Set(["blocked", "due", "open", "overdue", "ready", "scheduled", "upcoming", "waiting-external"]);
+  const findings = workflow.findings.filter(matches);
+  const workItems = workflow.workItems.filter((item) => matches(item) && activeStates.has(item.state));
+  const items = [...findings, ...workItems].sort((left, right) => (
+    workflowItemStatePriority(left) - workflowItemStatePriority(right)
+    || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
+    || left.key.localeCompare(right.key)
+  ));
+  if (!items.length) return "";
+  const blocking = items.filter((item) => ["blocked", "due", "open", "overdue", "ready"].includes(item.state));
+  const status = blocking.length
+    ? blocking.length + " " + pluralize("item", blocking.length) + (blocking.length === 1 ? " needs work" : " need work")
+    : items.length + " scheduled or external";
+  const visible = items.slice(0, 6);
+  const rows = visible.map((item) => {
+    const href = workflowItemHref(item);
+    const body = '<span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message || workflowItemDetail(item)) + '</small></span>';
+    return href ? '<a href="' + href + '">' + body + '</a>' : '<div>' + body + '</div>';
+  }).join("");
+  return '<section class="workflow-guidance panel"><div class="panel-head"><div><p class="kicker">To-do</p><h3>' + esc(options.title || "Checklist") + '</h3><p>' + esc(status) + '</p></div><span class="badge ' + (blocking.length ? "warn" : "good") + '">' + (blocking.length ? "Needs work" : "Current") + '</span></div><div class="workflow-findings">' + rows + '</div>' + (items.length > visible.length ? '<p class="workflow-guidance-more">Showing ' + visible.length + ' of ' + items.length + ' items. Use <code>filegrc workflow --json</code> for the complete reproducible result.</p>' : "") + '</section>';
+}
+
+function collectionReviewPanel(type) {
+  const assessment = state.collectionReviews?.[type];
+  if (!assessment) return "";
+  const configuration = assessment.configuration;
+  const current = assessment.status === "current";
+  const reviewerNames = (assessment.review?.reviewedByIds || [])
+    .map((id) => state.resources.find(({ record }) => record.id === id)?.record.title || id);
+  const reviewSummary = current
+    ? '<p class="collection-review-result"><strong>' + esc(properCase(assessment.review.decision)) + '</strong><span>Reviewed ' + esc(formatCalendarDate(assessment.review.reviewedOn)) + (reviewerNames.length ? " by " + esc(reviewerNames.join(", ")) : "") + '.</span></p>'
+    : '<p class="collection-review-result"><strong>' + (assessment.status === "stale" ? "Review again" : "Review required") + '</strong><span>' + esc(assessment.message) + '</span></p>';
+  return '<section class="collection-review-panel panel ' + (current ? "current" : "required") + '"><div class="collection-review-head"><div><p class="kicker">Scope confirmation</p><h3>' + esc(configuration.title) + '</h3><p>' + esc(configuration.description) + '</p></div><span class="badge ' + (current ? "good" : "warn") + '">' + (current ? "Reviewed" : assessment.status === "stale" ? "Stale" : "Review required") + '</span></div>' +
+    '<details ' + (current ? "" : "open") + '><summary>What to review</summary><ul>' + configuration.reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></details>' +
+    '<div class="collection-review-foot">' + reviewSummary + (!state.readOnly ? '<button class="button ' + (current ? "" : "primary") + '" type="button" data-review-collection="' + esc(type) + '">' + (current ? "Review again" : "Review and confirm") + '</button>' : "") + '</div></section>';
+}
+
+function resourceReviewCriteria(type) {
+  const reviewPoints = state.model.resources[type]?.guidance?.reviewPoints || [];
+  if (!reviewPoints.length) return "";
+  return '<section class="resource-review-criteria"><strong>What the reviewer should check</strong><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>';
+}
+
+function recordWorkflowItems(type, id) {
+  const activeStates = new Set(["blocked", "due", "open", "overdue", "ready", "scheduled", "upcoming", "waiting-external"]);
+  return [
+    ...(state.workflow?.findings || []),
+    ...(state.workflow?.workItems || [])
+  ].filter((item) => (
+    activeStates.has(item.state)
+    && (
+      item.subject?.type === type && item.subject?.id === id
+      || item.source?.type === type && item.source?.id === id
+    )
+  )).sort((left, right) => (
+    workflowItemStatePriority(left) - workflowItemStatePriority(right)
+    || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
+    || left.key.localeCompare(right.key)
+  ));
+}
+
+function recordWorkflowCell(type, entry) {
+  const items = recordWorkflowItems(type, entry.record.id);
+  if (!items.length) return '<span class="record-workflow-clear">No calculated action</span>';
+  const item = items[0];
+  const href = workflowItemHref(item) || "#/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(entry.record.id);
+  return '<a class="record-workflow-action" href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(item.message || workflowItemDetail(item)) + (items.length > 1 ? " +" + (items.length - 1) + " more" : "") + '</small></span></a>';
+}
+
+function openCollectionReviewDialog(type) {
+  const assessment = state.collectionReviews?.[type];
+  if (!assessment) return;
+  const configuration = assessment.configuration;
+  const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
+  const systems = resourcesOfType("system").filter(({ record }) => record.status === "active");
+  const allowedDecisions = configuration.decisions || ["complete"];
+  const defaultDecision = assessment.review?.decision
+    || (!assessment.recordCount && allowedDecisions.includes("zero-population") ? "zero-population" : allowedDecisions[0]);
+  const decisions = allowedDecisions.map((decision) => (
+    '<option value="' + esc(decision) + '" ' + (defaultDecision === decision ? "selected" : "") + '>' + esc(properCase(decision)) + '</option>'
+  )).join("");
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog collection-review-dialog";
+  dialog.setAttribute("aria-labelledby", "collection-review-dialog-title");
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Scope confirmation</p><h2 id="collection-review-dialog-title">Confirm ' + esc(configuration.title.toLowerCase()) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>' + esc(configuration.description) + '</p><section class="event-dialog-steps collection-review-checks"><strong>Before confirming</strong><ul>' + configuration.reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section><div class="form-grid"><label><span>Conclusion</span><select name="decision" required>' + decisions + '</select></label><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + ((assessment.review?.reviewedByIds || []).includes(record.id) ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(assessment.review?.reviewedOn || currentDate()) + '"></label><label data-authoritative-system><span>Authoritative System</span><select name="authoritativeSystemId"><option value="">Select</option>' + systems.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (assessment.review?.authoritativeSystemId === record.id ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label class="full"><span>Review notes</span><textarea name="rationale" rows="3" required placeholder="Note what you confirmed and any scope decision that needs context.">' + esc(assessment.review?.rationale || "") + '</textarea></label></div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-collection-review>Preview confirmation</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  const form = dialog.querySelector("form");
+  const systemField = dialog.querySelector("[data-authoritative-system]");
+  const syncDecision = () => {
+    const external = form.elements.decision.value === "externally-managed";
+    systemField.hidden = !external;
+    form.elements.authoritativeSystemId.required = external;
+  };
+  syncDecision();
+  dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
+  dialog.querySelector('[data-event="cancel"]').addEventListener("click", () => dialog.close());
+  dialog.addEventListener("close", () => dialog.remove());
+  let previewedPayload = null;
+  form.addEventListener("input", () => {
+    previewedPayload = null;
+    syncDecision();
+    dialog.querySelector(".workflow-preview").innerHTML = "";
+    dialog.querySelector("[data-preview-collection-review]").textContent = "Preview confirmation";
+  });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+    const error = dialog.querySelector(".dialog-error");
+    error.textContent = "";
+    const payload = {
+      resourceType: type,
+      decision: form.elements.decision.value,
+      rationale: form.elements.rationale.value.trim(),
+      reviewedByIds: [form.elements.reviewerId.value],
+      reviewedOn: form.elements.reviewedOn.value,
+      authoritativeSystemId: form.elements.authoritativeSystemId.value || undefined,
+      expectedRevision: assessment.reviewRevision || undefined
+    };
+    form.querySelectorAll("button,input,select,textarea").forEach((control) => { control.disabled = true; });
+    try {
+      if (!previewedPayload) {
+        const response = await localFetch("/api/collection-review/preview", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        const preview = await response.json();
+        previewedPayload = payload;
+        dialog.querySelector(".workflow-preview").innerHTML = '<strong>Review before saving</strong><p>Save this confirmation for ' + preview.assessment.recordCount + ' current ' + esc(pluralize("record", preview.assessment.recordCount)) + '. If the collection or material scope changes, FileGRC will ask for another review.</p>';
+        dialog.querySelector("[data-preview-collection-review]").textContent = "Confirm and save";
+      } else {
+        const response = await localFetch("/api/collection-review", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ ...previewedPayload, confirmed: true })
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        applyMutationState(await response.json());
+        dialog.close();
+        render();
+      }
+    } catch (requestError) {
+      error.textContent = requestError.message;
+    } finally {
+      form.querySelectorAll("button,input,select,textarea").forEach((control) => { control.disabled = false; });
+    }
+  });
+}
+
+function workflowItemHref(item) {
+  const source = item.source?.id && item.source?.type && item.source.type !== "unknown"
+    ? item.source
+    : null;
+  if (source && ["assigned-work", "obligation-occurrence"].includes(item.kind)) {
+    return "#/stage/run?work=" + encodeURIComponent(source.type + ":" + source.id);
+  }
+  const commands = [
+    ...(item.actions || []).map((action) => action.command),
+    item.nextAction?.command
+  ].filter(Boolean);
+  const applicabilityCommand = commands.find((command) => command.includes(" review-applicability "));
+  const applicabilityType = applicabilityCommand?.match(/--type\s+([a-z0-9-]+)/)?.[1];
+  if (applicabilityType && state.model.resources[applicabilityType]) {
+    return "#/resources/" + encodeURIComponent(applicabilityType) + "?review=1";
+  }
+  const collectionReviewCommand = commands.find((command) => command.includes(" review-collection "));
+  const collectionReviewType = collectionReviewCommand?.match(/review-collection\s+([a-z0-9-]+)/)?.[1];
+  if (collectionReviewType && state.model.collectionReviews?.[collectionReviewType]) {
+    return "#/resources/" + encodeURIComponent(collectionReviewType) + "?review-collection=1";
+  }
+  if (commands.some((command) => command.includes(" external-reviewer-setup"))) {
+    const reviewer = resourcesOfType("appointment")
+      .find(({ record }) => record.appointmentKind === "independent-policy-reviewer");
+    if (reviewer) return "#/resource/appointment/" + encodeURIComponent(reviewer.record.id);
+  }
+  if (commands.some((command) => command.includes(" evidence-map"))) return "#/stage/controls";
+  const reference = item.subject?.id && item.subject?.type
+    ? item.subject
+    : source;
+  if (reference && reference.type !== "unknown") {
+    return "#/resource/" + encodeURIComponent(reference.type) + "/" + encodeURIComponent(reference.id);
+  }
+  const missingType = item.subject?.type && state.model.resources[item.subject.type]
+    ? item.subject.type
+    : null;
+  if (missingType) {
+    return "#/resources/" + encodeURIComponent(missingType) + (state.readOnly ? "" : "?new=1");
+  }
+  if (item.auditId) return "#/audit-packet?auditId=" + encodeURIComponent(item.auditId);
+  const stage = {
+    scope: "scope",
+    policies: "policies",
+    controls: "controls",
+    operate: "run",
+    operation: "run",
+    audit: "audit",
+    setup: "audit",
+    fieldwork: "audit",
+    deliver: "audit",
+    auditor: "audit"
+  }[item.stage];
+  return stage ? "#/stage/" + stage : "";
+}
+
+function workflowItemDetail(item) {
+  if (item.dueOn) return "Due " + item.dueOn;
+  if (item.availableOn) return "Available " + item.availableOn;
+  return item.nextAction?.command || "Review the related source facts.";
+}
+
+function workflowItemPriority(item) {
+  if (item.state === "overdue") return 0;
+  if (["due", "open", "ready"].includes(item.state)) return 20;
+  if (item.state === "blocked") return 30;
+  if (item.severity === "error") return 10;
+  if (item.state === "waiting-external") return 40;
+  return 50;
+}
+
+function workflowItemStatePriority(item) {
+  return {
+    overdue: 0,
+    due: 10,
+    open: 20,
+    ready: 30,
+    blocked: 40,
+    upcoming: 50,
+    scheduled: 60,
+    "waiting-external": 70
+  }[item.state] ?? 80;
+}
+
 function renderEvidenceReadiness() {
   const items = state.programReadiness?.stages
     ?.find((stage) => stage.id === "controls")
@@ -350,7 +594,7 @@ function renderEvidenceReadiness() {
       '<div class="evidence-map-links"><div><small>Controls</small><div class="evidence-map-references">' + (item.controlIds || []).map((id) => formatReference(id)).join("") + '</div></div><div><small>Authoritative sources</small><div class="evidence-map-sources">' + sourceAction + '</div></div></div><p class="evidence-map-status">' + esc(item.message) + '</p></article>';
   }).join("");
   const empty = '<section class="evidence-map-empty"><p class="kicker">Evidence readiness</p><h3>Select the program controls first</h3><p>Control implementation checks are generated from the selected Controls and their authoritative evidence sources.</p><a class="button primary" href="#/resources/control">Review Controls</a></section>';
-  return '<section class="evidence-map"><div class="evidence-map-head"><div><p class="kicker">Control implementation</p><h2>' + completeCount + ' of ' + items.length + ' evidence ' + (items.length === 1 ? "family" : "families") + ' ready</h2><p>Before marking Controls implemented, connect them to the Systems where their evidence originates. Each source must be active, have the required source role and current access owners, and include repeatable retrieval instructions in Record Markdown.</p></div><div class="evidence-map-actions"><a class="button" href="#/resources/system">Review Systems</a><a class="button primary" href="#/resources/control">Review Controls</a></div></div>' + (cards || empty) + '</section>';
+  return '<section class="evidence-map"><div class="evidence-map-head"><div><p class="kicker">Control implementation</p><h2>' + completeCount + ' of ' + items.length + ' evidence ' + (items.length === 1 ? "family" : "families") + ' ready</h2><p>Connect each Control to the Systems that produce its evidence. The cards below show what each source still needs.</p></div><div class="evidence-map-actions"><a class="button" href="#/resources/system">Review Systems</a><a class="button primary" href="#/resources/control">Review Controls</a></div></div>' + (cards || empty) + '</section>';
 }
 
 function evidenceSourceCheckLabel(name) {
@@ -374,15 +618,6 @@ function stagePageDestinations(stage) {
     .map((destination) => ({ ...destination, section })));
 }
 
-function stagePageId(stage, destination) {
-  return stage.id + ":" + (destination.type || "utility:" + destination.utility);
-}
-
-function stagePageComplete(pageId) {
-  const completedPageIds = rendererSettingsEntry()?.record.completedStagePageIds || [];
-  return completedPageIds.includes(pageId);
-}
-
 function stagePageSummary(destination) {
   const summaryKey = destination.type || "utility:" + destination.utility;
   const section = destination.section || (destination.type
@@ -392,24 +627,117 @@ function stagePageSummary(destination) {
 }
 
 function stagePageCard(stage, destination, index) {
-  const details = destination.type ? resourceRollup(destination.type) : utilityRollup(destination.utility);
   const summary = stagePageSummary(destination);
   const stepLabel = "Step " + stage.number + "." + String.fromCharCode(97 + index);
-  const pageId = stagePageId(stage, destination);
-  const complete = stagePageComplete(pageId);
-  const completionControl = state.readOnly
-    ? '<span class="stage-page-completion-state ' + (complete ? "complete" : "") + '">' + (complete ? "Complete" : "Not marked complete") + '</span>'
-    : '<button class="button stage-page-completion ' + (complete ? "complete" : "") + '" type="button" data-stage-page-completion="' + esc(pageId) + '" data-complete="' + complete + '">' + (complete ? "Mark incomplete" : "Mark complete") + '</button>';
-  return '<article class="stage-page-card ' + (complete ? "complete" : "") + '"><a class="stage-page-card-link" href="' + destination.href + '" aria-label="Open ' + esc(destination.label) + '"></a><div class="stage-page-card-head"><div><small>' + esc(stepLabel) + '</small><h3>' + esc(destination.label) + '</h3></div><span class="stage-page-rollup"><strong>' + esc(details.value) + '</strong><small>' + esc(details.label) + '</small></span></div><p>' + esc(summary) + '</p><div class="stage-page-card-foot"><span class="stage-page-open" aria-hidden="true">Open ›</span>' + completionControl + '</div></article>';
+  const derived = derivedStagePageState(stage, destination);
+  const complete = derived.complete;
+  const items = stagePageItems(stage, destination);
+  const completionState = '<span class="stage-page-completion-state ' + (complete ? "complete" : "") + '">' + esc(derived.label) + '</span>';
+  const taskPreview = items.length
+    ? '<div class="stage-page-tasks">' + items.slice(0, 3).map((item) => {
+        const href = workflowItemHref(item) || destination.href;
+        return '<a href="' + href + '"><span class="workflow-finding-status ' + esc(item.state) + '">' + esc(properCase(item.state)) + '</span><span><strong>' + esc(item.title) + '</strong><small>' + esc(stagePageItemDetail(item)) + '</small></span></a>';
+      }).join("") + (items.length > 3 ? '<small class="stage-page-tasks-more">+' + (items.length - 3) + ' more on this page</small>' : "") + '</div>'
+    : "";
+  return '<article class="stage-page-card ' + (complete ? "complete" : "") + '"><a class="stage-page-card-link" href="' + destination.href + '" aria-label="Open ' + esc(destination.label) + '"></a><div class="stage-page-card-head"><div><small>' + esc(stepLabel) + '</small><h3>' + esc(destination.label) + '</h3></div>' + completionState + '</div><p>' + esc(summary) + '</p>' + taskPreview + '<div class="stage-page-card-foot"><span class="stage-page-open" aria-hidden="true">Open ›</span></div></article>';
+}
+
+function stagePageItemDetail(item) {
+  const controlChecks = item.subject?.type === "control"
+    ? String(item.message || "").match(/^Complete (\d+) checks before implementation:/)
+    : null;
+  if (controlChecks) return controlChecks[1] + " implementation checks remain. Open the Control to review them.";
+  return item.message || workflowItemDetail(item);
 }
 
 function stageProgress(stage) {
   if (stage.id === "run") return operationProgress();
   const pages = stagePageDestinations(stage);
-  const complete = pages.filter((destination) => stagePageComplete(stagePageId(stage, destination))).length;
+  if (stage.id === "audit" && state.workflow?.assessments?.auditReadiness?.status === "not-started") {
+    return {
+      percent: 0,
+      complete: 0,
+      total: pages.length,
+      status: "Not started",
+      tone: "neutral",
+      detail: "Create an Audit only after a real engagement or customer deadline exists."
+    };
+  }
+  const complete = pages.filter((destination) => derivedStagePageState(stage, destination).complete).length;
   return progressFromCounts(complete, pages.length, "page");
 }
 
+function derivedStagePageState(stage, destination) {
+  if (
+    stage.id === "audit"
+    && state.workflow?.assessments?.auditReadiness?.status === "not-started"
+    && (destination.type === "audit" || destination.utility === "audit-packet")
+  ) {
+    return { complete: false, label: "No engagement" };
+  }
+  const blocking = stagePageItems(stage, destination);
+  if (blocking.length) {
+    return { complete: false, label: blocking.length + " " + pluralize("item", blocking.length) + (blocking.length === 1 ? " needs work" : " need work") };
+  }
+  if (destination.type && resourcesOfType(destination.type).length === 0) {
+    const collectionReview = state.collectionReviews?.[destination.type];
+    if (collectionReview) {
+      return collectionReview.status === "current"
+        ? { complete: true, label: "Reviewed" }
+        : { complete: false, label: "Review scope" };
+    }
+    return { complete: true, label: "Conditional" };
+  }
+  return { complete: true, label: "Ready" };
+}
+
+function stagePageItems(stage, destination) {
+  const activeStates = new Set(["blocked", "due", "open", "overdue", "ready"]);
+  const items = [
+    ...(state.workflow?.findings || []),
+    ...(state.workflow?.workItems || [])
+  ].filter((item) => (
+    activeStates.has(item.state)
+    && (
+      item.stage === stage.id
+      || stage.id === "scope"
+        && destination.type === "appointment"
+        && item.code === "governance.appointment.independent-policy-reviewer"
+    )
+  ));
+  return items.filter((item) => {
+    if (
+      destination.type === "requirement"
+      && item.subject?.type === "requirement"
+      && item.fieldPath === "applicabilityReview"
+    ) return false;
+    if (
+      stage.id === "controls"
+      && ["source-coverage", "system"].includes(item.subject?.type)
+      && item.key?.startsWith("evidence-source.")
+    ) return false;
+    if (
+      stage.id === "policies"
+      && destination.type === "policy"
+      && item.code === "governance.appointment.independent-policy-reviewer"
+    ) return true;
+    if (
+      destination.type
+      && (item.subject?.type === destination.type || item.source?.type === destination.type)
+    ) return true;
+    const href = workflowItemHref(item);
+    if (!href) return false;
+    const destinationHref = destination.href.split("?")[0];
+    return href === destinationHref
+      || href.startsWith(destinationHref + "?")
+      || Boolean(destination.type && href.startsWith("#/resource/" + destination.type + "/"));
+  }).sort((left, right) => (
+    workflowItemStatePriority(left) - workflowItemStatePriority(right)
+    || (left.priority ?? workflowItemPriority(left)) - (right.priority ?? workflowItemPriority(right))
+    || left.key.localeCompare(right.key)
+  ));
+}
+
 function operationProgress() {
   const program = state.programReadiness;
   const goal = program?.target?.goal || state.workspace.assuranceGoal || "none";
@@ -420,7 +748,8 @@ function operationProgress() {
       ? Boolean(program?.target?.candidateCoverage?.kind === "as-of")
       : Boolean(program?.evidenceReady);
   const overdue = state.obligations.counts.overdue || 0;
-  const complete = Boolean(program?.evidenceReady && candidateStarted && overdue === 0);
+  const blocked = state.obligations.counts.blocked || 0;
+  const complete = Boolean(program?.evidenceReady && candidateStarted && overdue === 0 && blocked === 0);
   if (complete) {
     return {
       percent: 100,
@@ -428,7 +757,7 @@ function operationProgress() {
       total: 1,
       status: "Operating",
       tone: "good",
-      detail: "Evidence collection is running and the Work Queue has no overdue work."
+      detail: "Evidence collection is running and the Work Queue has no overdue or blocked work."
     };
   }
   if (overdue) {
@@ -441,6 +770,16 @@ function operationProgress() {
       detail: overdue + " overdue Work Queue " + pluralize("item", overdue) + " must be resolved."
     };
   }
+  if (blocked) {
+    return {
+      percent: 0,
+      complete: 0,
+      total: 1,
+      status: "Blocked",
+      tone: "bad",
+      detail: blocked + " blocked Work Queue " + pluralize("item", blocked) + " must be resolved."
+    };
+  }
   if (program?.evidenceReady && goal === "soc-2-type-2" && !candidateStarted) {
     return {
       percent: 0,
@@ -473,10 +812,10 @@ function programPathProgress() {
 function progressFromCounts(complete, total, noun) {
   if (!total) return { percent: 0, complete: 0, total: 0, status: "Nothing to review", tone: "neutral", detail: "No " + pluralize(noun, 2) + " are configured yet." };
   const percent = Math.round((complete / total) * 100);
-  const detail = complete + " of " + total + " " + pluralize(noun, total) + " marked reviewed. This tracks page review, while readiness checks the records themselves.";
-  if (complete === total) return { percent: 100, complete, total, status: "Review complete", tone: "good", detail };
-  if (!complete) return { percent: 0, complete, total, status: "No pages marked", tone: "warn", detail };
-  return { percent, complete, total, status: "Review in progress", tone: "warn", detail };
+  const detail = complete + " of " + total + " " + pluralize(noun, total) + (complete === 1 ? " is" : " are") + " ready.";
+  if (complete === total) return { percent: 100, complete, total, status: "Ready", tone: "good", detail };
+  if (!complete) return { percent: 0, complete, total, status: "Needs work", tone: "warn", detail };
+  return { percent, complete, total, status: "In progress", tone: "warn", detail };
 }
 
 function stageProgressCard(progress) {
@@ -495,30 +834,6 @@ function sectionDestinations(section) {
   return destinations;
 }
 
-function resourceRollup(type) {
-  const records = resourcesOfType(type).map(({ record }) => record);
-  if (!records.length) return { value: "0", label: "No records yet" };
-  const statuses = new Map();
-  records.forEach((record) => {
-    const status = displayStatus(record);
-    if (status) statuses.set(status, (statuses.get(status) || 0) + 1);
-  });
-  const statusText = [...statuses.entries()].sort((a, b) => b[1] - a[1]).slice(0, 2).map(([status, count]) => count + " " + humanize(status).toLowerCase()).join(" · ");
-  return { value: String(records.length), label: statusText || pluralize("record", records.length) };
-}
-
-function utilityRollup(utility) {
-  if (utility === "obligation-board") {
-    const open = state.obligations.items.filter((item) => item.status !== "complete");
-    return { value: String(open.length), label: open.length ? "Open work items" : "No work due" };
-  }
-  if (utility === "audit-packet") {
-    const audits = resourcesOfType("audit");
-    return { value: String(audits.length), label: audits.length ? pluralize("engagement", audits.length) : "No engagement yet" };
-  }
-  return { value: "0", label: "Not started" };
-}
-
 function auditEngagementPrompt(audit = null) {
   const hasAuditor = audit?.auditorVendorId;
   if (hasAuditor) return "";
@@ -536,7 +851,7 @@ function renderExternalEvidenceSection() {
   const createButton = state.readOnly
     ? ""
     : '<button class="button primary" type="button" data-new-external-evidence>New external evidence</button>';
-  return '<section class="workflow-section external-evidence-section"><div class="section-head"><div><p class="kicker">Fixed artifacts and approved references</p><h2>External Evidence</h2><p>Create a record when a real export, report, screenshot, signed file, or approved external reference exists. Select its authoritative source System, link the Controls and operating record it supports, then record collection and verification facts.</p></div><div class="page-actions">' +
+  return '<section class="workflow-section external-evidence-section"><div class="section-head"><div><p class="kicker">Fixed artifacts and approved references</p><h2>External Evidence</h2><p>Add fixed artifacts only when they exist. Link each one to its source System and the work it supports.</p></div><div class="page-actions">' +
     createButton + '<a class="button" href="#/resources/evidence">View all</a></div></div><div class="external-evidence-list">' +
     (recent || empty("No External Evidence has been collected yet. Create it during operation only when a real artifact or approved external reference exists.")) +
     '</div></section>';
@@ -545,34 +860,42 @@ function renderExternalEvidenceSection() {
 function renderObligations(main, params = new URLSearchParams()) {
   const stage = READINESS_STAGES.find((candidate) => candidate.id === "run");
   const plan = state.obligations;
-  const controls = resourcesOfType("control");
-  const linkedControlIds = new Set(resourcesOfType("obligation").flatMap(({ record }) => record.controlIds || []));
-  const scheduledControls = controls.filter(({ record }) => linkedControlIds.has(record.id)).length;
-  const assignedFollowUp = plan.standaloneItems.length;
   const visibleCardLimit = 6;
-  const sections = ["proposed", "upcoming", "due", "overdue"].map((status) => {
-    const items = plan.items.filter((item) => item.status === status);
+  const sections = ["proposed", "upcoming", "blocked", "due", "overdue"].map((status) => {
+    const items = obligationBoardItems(plan.items, status);
     const cards = items.map((item, index) => obligationCard(item, index >= visibleCardLimit)).join("");
     const more = items.length > visibleCardLimit
       ? '<button class="button obligation-more" type="button" data-expand-obligations="' + status + '" data-total="' + items.length + '" aria-expanded="false">Show ' + (items.length - visibleCardLimit) + ' more</button>'
       : "";
     return '<section class="obligation-column" data-obligation-column="' + status + '"><div class="obligation-column-head"><span class="badge status-' + status + '">' + esc(properCase(status)) + '</span><strong>' + items.length + '</strong></div><div class="obligation-cards">' + (items.length ? cards : empty("Nothing " + status + ".")) + '</div>' + more + '</section>';
   }).join("");
-  const triggers = plan.triggers.map((trigger, index) => policyEventTrigger(trigger, index)).join("");
+  const eventTriggerLimit = 6;
+  const orderedTriggers = orderedPolicyEventTriggers(plan.triggers);
+  const triggers = orderedTriggers.map((trigger, index) => policyEventTrigger(trigger, index, index >= eventTriggerLimit)).join("");
+  const eventMore = orderedTriggers.length > eventTriggerLimit
+    ? '<button class="button policy-event-more" type="button" data-expand-policy-events aria-expanded="false">Show ' + (orderedTriggers.length - eventTriggerLimit) + ' more events</button>'
+    : "";
   const feedback = policyEventFeedback
     ? '<section class="policy-event-feedback" role="status" aria-live="polite"><span class="status-dot good"></span><div><strong>Work added to the Work Queue</strong><p>' + esc(policyEventFeedback.name + " created " + policyEventFeedback.taskCount + " " + pluralize("task", policyEventFeedback.taskCount) + ".") + '</p></div><button class="button" type="button" data-view-added-work>View Work Queue</button><button class="icon-button" type="button" data-dismiss-policy-event-feedback aria-label="Dismiss confirmation">×</button></section>'
     : "";
   main.innerHTML = '<div class="page obligation-board-page stage-overview-page"><nav class="breadcrumbs"><a href="#/">Overview</a><span>/</span><span>' + esc(stage.title) + '</span></nav>' +
     '<section class="stage-overview-hero"><div><p class="kicker">Step ' + esc(stage.number) + ' of 5</p><h2>' + esc(stage.title) + '</h2><p>' + esc(stage.summary) + '</p></div>' + stageProgressCard(stageProgress(stage)) + '</section>' +
     feedback +
-    '<section class="workflow-section event-reminders"><div class="section-head"><div><p class="kicker">Changes that create work</p><h2>Policy Events</h2><p>Trigger the matching workflow when an event occurs. filegrc adds every required action to the Work Queue with its owner and deadline.</p></div></div><div class="policy-event-list">' + (triggers || empty("No event-driven obligations are configured.")) + '</div></section>' +
-    '<section class="workflow-section work-queue-section"><div class="section-head"><div><p class="kicker">Recurring, event, and assigned work</p><h2>Work Queue</h2><p>This board schedules work linked to ' + scheduledControls + ' of ' + controls.length + ' controls and includes ' + assignedFollowUp + ' open ' + pluralize("Action Item", assignedFollowUp) + '. Triggered Policy Event actions appear here as individual tasks in Upcoming, Due, or Overdue. Other controls operate continuously or per transaction in their source systems and are documented through evidence records. Starter work remains a proposal until its governing policies are effective and at least one linked control is implemented.</p></div><div class="page-actions">' + (!state.readOnly ? '<button class="button" type="button" data-new-action-item>New task</button>' : "") + '<a class="button" href="#/resources/obligation">Edit schedules</a></div></div>' +
+    '<section class="workflow-section event-reminders"><div class="section-head"><div><p class="kicker">Changes that create work</p><h2>Policy Events</h2><p>Trigger the matching workflow when an event occurs. filegrc adds every required action to the Work Queue with its owner and deadline.</p></div></div><div class="policy-event-list">' + (triggers || empty("No event-driven obligations are configured.")) + '</div>' + eventMore + '</section>' +
+    '<section class="workflow-section work-queue-section"><div class="section-head"><div><p class="kicker">Recurring, event, and assigned work</p><h2>Work Queue</h2><p>Complete scheduled work and assigned follow-up here. Each card shows its due window, source, and next action.</p></div><div class="page-actions">' + (!state.readOnly ? '<button class="button" type="button" data-new-action-item>New task</button>' : "") + '<a class="button" href="#/resources/obligation">Edit schedules</a></div></div>' +
     '<div class="obligation-board">' + sections + '</div>' +
     '</section>' + renderExternalEvidenceSection() + '</div>';
   main.querySelectorAll("[data-start-event]").forEach((button) => button.addEventListener("click", () => {
     const trigger = plan.triggers.find((item) => item.eventType === button.dataset.startEvent);
     if (trigger) openObligationEventDialog(trigger);
   }));
+  main.querySelector("[data-expand-policy-events]")?.addEventListener("click", (event) => {
+    const button = event.currentTarget;
+    const expanded = button.getAttribute("aria-expanded") === "true";
+    main.querySelectorAll(".policy-event-row[data-collapsed]").forEach((row) => { row.hidden = expanded; });
+    button.setAttribute("aria-expanded", String(!expanded));
+    button.textContent = expanded ? "Show " + (orderedTriggers.length - eventTriggerLimit) + " more events" : "Show fewer events";
+  });
   main.querySelector("[data-view-added-work]")?.addEventListener("click", () => main.querySelector(".work-queue-section")?.scrollIntoView({ behavior: "smooth", block: "start" }));
   main.querySelector("[data-dismiss-policy-event-feedback]")?.addEventListener("click", (event) => {
     policyEventFeedback = null;
@@ -591,6 +914,10 @@ function renderObligations(main, params = new URLSearchParams()) {
     const item = plan.items.find((candidate) => candidate.key === button.dataset.recordObligation);
     if (item) openObligationCompletion(item);
   }));
+  main.querySelectorAll("[data-complete-action]").forEach((button) => button.addEventListener("click", () => {
+    const item = plan.items.find((candidate) => candidate.key === button.dataset.completeAction);
+    if (item) openActionCompletion(item);
+  }));
   main.querySelector("[data-new-action-item]")?.addEventListener("click", () => openEditor("action-item", null, {
     description: "Create a task only when follow-up from another record needs its own assignee, deadline, and completion proof. Point it to that source record; it will remain in Work Queue until done or canceled."
   }));
@@ -601,9 +928,52 @@ function renderObligations(main, params = new URLSearchParams()) {
       if (requestedEvent) main.querySelector('[data-start-event="' + CSS.escape(requestedEvent) + '"]')?.click();
     });
   }
+  const requestedWork = params.get("work");
+  if (requestedWork) {
+    queueMicrotask(() => {
+      const card = [...main.querySelectorAll("[data-work-source]")]
+        .find((candidate) => candidate.dataset.workSource === requestedWork);
+      if (!card) return;
+      card.hidden = false;
+      card.classList.add("workflow-target");
+      card.scrollIntoView({ block: "center" });
+    });
+  }
 }
 
-function policyEventTrigger(trigger, index) {
+function obligationBoardItems(items, status) {
+  const matching = items.filter((item) => item.status === status);
+  if (status !== "proposed") return matching;
+  const seen = new Set();
+  return matching.filter((item) => {
+    const source = item.actionItemId ? "action:" + item.actionItemId : "obligation:" + item.obligationId;
+    if (seen.has(source)) return false;
+    seen.add(source);
+    return true;
+  });
+}
+
+function policyEventDisplayRank(eventType) {
+  const featured = [
+    "person-started",
+    "person-role-changed",
+    "person-ended",
+    "material-incident",
+    "system-material-change",
+    "vendor-activated"
+  ];
+  const index = featured.indexOf(eventType);
+  return index === -1 ? featured.length : index;
+}
+
+function orderedPolicyEventTriggers(triggers) {
+  return [...triggers].sort((left, right) => (
+    policyEventDisplayRank(left.eventType) - policyEventDisplayRank(right.eventType)
+    || policyEventName(left.eventType).localeCompare(policyEventName(right.eventType))
+  ));
+}
+
+function policyEventTrigger(trigger, index, collapsed = false) {
   const tooltipId = "policy-event-tooltip-" + index;
   const proposed = trigger.programStatus === "proposed";
   const unavailable = state.readOnly || proposed;
@@ -612,7 +982,7 @@ function policyEventTrigger(trigger, index) {
     : state.readOnly
       ? "Open this workspace in writable mode to trigger the workflow."
       : trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " will be added to the Work Queue.";
-  return '<article class="policy-event-row"><div class="policy-event-name"><div class="policy-event-title"><strong>' + esc(policyEventName(trigger.eventType)) + '</strong><span class="policy-event-guide"><button class="guide-trigger policy-event-guide-trigger" type="button" aria-label="Show ' + esc(policyEventName(trigger.eventType)) + ' workflow steps" aria-describedby="' + tooltipId + '"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button><div class="policy-event-tooltip" id="' + tooltipId + '" role="tooltip"><strong>' + esc(proposed ? "Proposed workflow" : "Adds " + trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " to the Work Queue") + '</strong><ol>' + trigger.steps.map((step) => '<li><span>' + esc(step.title) + '</span><small>' + esc(eventStepSummary(step)) + '</small></li>').join("") + '</ol></div></span></div><small>' + esc(availability) + '</small></div><button class="button primary" type="button" data-start-event="' + esc(trigger.eventType) + '"' + (unavailable ? " disabled" : "") + '>Trigger Work</button></article>';
+  return '<article class="policy-event-row"' + (collapsed ? " data-collapsed hidden" : "") + '><div class="policy-event-name"><div class="policy-event-title"><strong>' + esc(policyEventName(trigger.eventType)) + '</strong><span class="policy-event-guide"><button class="guide-trigger policy-event-guide-trigger" type="button" aria-label="Show ' + esc(policyEventName(trigger.eventType)) + ' workflow steps" aria-describedby="' + tooltipId + '"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button><div class="policy-event-tooltip" id="' + tooltipId + '" role="tooltip"><strong>' + esc(proposed ? "Proposed workflow" : "Adds " + trigger.steps.length + " " + pluralize("task", trigger.steps.length) + " to the Work Queue") + '</strong><ol>' + trigger.steps.map((step) => '<li><span>' + esc(step.title) + '</span><small>' + esc(eventStepSummary(step)) + '</small></li>').join("") + '</ol></div></span></div><small>' + esc(availability) + '</small></div><button class="button primary" type="button" data-start-event="' + esc(trigger.eventType) + '"' + (unavailable ? " disabled" : "") + '>Trigger Work</button></article>';
 }
 
 function policyEventName(eventType) {
@@ -639,16 +1009,54 @@ function defaultClassificationId() {
 function obligationCard(item, collapsed = false) {
   const type = item.actionItemId ? "action-item" : "obligation";
   const id = item.actionItemId || item.obligationId;
-  const completion = !item.actionItemId ? obligationCompletionPlan(item) : null;
+  const completion = item.actionItemId ? actionCompletionPlan(item) : obligationCompletionPlan(item);
   const canAct = completion?.blocked === "Assign current owner"
     || !["upcoming", "proposed"].includes(item.status);
   const action = !state.readOnly && canAct && completion
     ? completion.blocked
       ? '<a class="obligation-action blocked" href="' + completion.href + '">' + esc(completion.blocked) + '</a>'
-      : '<button class="obligation-action" type="button" data-record-obligation="' + esc(item.key) + '">Record work</button>'
+      : item.actionItemId
+        ? '<button class="obligation-action" type="button" data-complete-action="' + esc(item.key) + '">Complete task</button>'
+        : '<button class="obligation-action" type="button" data-record-obligation="' + esc(item.key) + '">Record work</button>'
     : "";
   const kind = item.kind === "event" ? "Policy Event Task" : item.kind === "action" ? "Assigned Follow-up" : properCase(item.activityType || "Recurring");
-  return '<article class="obligation-card status-' + esc(item.status) + '"' + (collapsed ? ' data-collapsed hidden' : "") + '><div class="obligation-card-head"><span>' + esc(kind) + '</span><strong>' + esc(timingText(item)) + '</strong></div><h3><a href="#/resource/' + type + '/' + encodeURIComponent(id) + '">' + esc(titleCase(item.title)) + '</a></h3><p>' + esc(windowText(item)) + '</p><div class="obligation-card-foot"><div class="obligation-links">' + (item.policyIds || []).map(formatReference).join("") + '</div>' + action + '</div></article>';
+  return '<article class="obligation-card status-' + esc(item.status) + '" data-work-source="' + esc(type + ":" + id) + '"' + (collapsed ? ' data-collapsed hidden' : "") + '><div class="obligation-card-head"><span>' + esc(kind) + '</span><strong>' + esc(timingText(item)) + '</strong></div><h3><a href="#/resource/' + type + '/' + encodeURIComponent(id) + '">' + esc(titleCase(item.title)) + '</a></h3><p>' + esc(windowText(item)) + '</p><div class="obligation-card-foot"><div class="obligation-links">' + (item.policyIds || []).map(formatReference).join("") + '</div>' + action + '</div></article>';
+}
+
+function actionCompletionPlan(item) {
+  const action = state.resources.find(({ record }) => (
+    record.type === "action-item" && record.id === item.actionItemId
+  ));
+  if (!action) return null;
+  if (action.record.status === "blocked") {
+    return {
+      blocked: "Resolve blockers",
+      href: "#/resource/action-item/" + encodeURIComponent(action.record.id)
+    };
+  }
+  if (!action.record.obligationId) {
+    return {
+      blocked: "Open task",
+      href: "#/resource/action-item/" + encodeURIComponent(action.record.id)
+    };
+  }
+  const obligation = state.resources.find(({ record }) => (
+    record.type === "obligation" && record.id === action.record.obligationId
+  ));
+  if (!obligation) {
+    return {
+      blocked: "Repair obligation link",
+      href: "#/resource/action-item/" + encodeURIComponent(action.record.id)
+    };
+  }
+  const type = state.model.obligationActivities?.[obligation.record.activityType]?.completionType;
+  if (!type) {
+    return {
+      blocked: "Review completion type",
+      href: "#/resource/obligation/" + encodeURIComponent(obligation.record.id)
+    };
+  }
+  return { type, action, obligation };
 }
 
 function obligationCompletionPlan(item) {
@@ -668,6 +1076,21 @@ function obligationCompletionPlan(item) {
   return { type };
 }
 
+function openActionCompletion(item) {
+  const completion = actionCompletionPlan(item);
+  if (!completion || completion.blocked) return;
+  openEditor(completion.type, null, {
+    seed: obligationCompletionSeed(completion.type, item, completion.obligation.record),
+    actionCompletion: {
+      actionItemId: completion.action.record.id,
+      revision: completion.action.revision,
+      completedOn: currentDate()
+    },
+    description: "Record the work that completed this assigned task. Saving creates and links the required operating record, then marks the Action Item done in the same validated write.",
+    saveLabel: "Save and complete task"
+  });
+}
+
 function openObligationCompletion(item) {
   const obligation = state.resources.find(({ record }) => record.type === "obligation" && record.id === item.obligationId);
   if (!obligation) return showError("The obligation template could not be found.");
@@ -688,6 +1111,11 @@ function obligationCompletionSeed(type, item, obligation) {
   const date = currentDate();
   const timestamp = new Date().toISOString();
   const responsiblePeople = currentPeopleForParties(item.ownerIds || []);
+  const independentPeople = resourcesOfType("person")
+    .map(({ record }) => record)
+    .filter((record) => record.status === "active" && !responsiblePeople.includes(record.id))
+    .map(({ id }) => id);
+  const reviewerPeople = independentPeople.length ? [independentPeople[0]] : [];
   const inScopeSystems = resourcesOfType("system").filter(({ record }) => (state.workspace.systemIds || []).includes(record.id) && record.status !== "retired").map(({ record }) => record.id);
   const activeVendors = resourcesOfType("vendor").filter(({ record }) => record.status !== "terminated").map(({ record }) => record.id);
   const title = item.title + " · " + formatCalendarDate(item.dueWindowStart);
@@ -697,35 +1125,54 @@ function obligationCompletionSeed(type, item, obligation) {
     return { ...common, status: "complete", teamId: team.id, chairIds: currentPeopleForParties(team.chairIds || []), scheduledFor: date, startedAt: timestamp, endedAt: timestamp, attendeeIds: responsiblePeople };
   }
   if (type === "policy-review") {
-    return { ...common, status: "complete", scopeResourceIds: obligation.scopeResourceIds || [], reviewerIds: responsiblePeople, completedOn: date, outcome: "passed", changesRequired: false, coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
+    return { ...common, status: "complete", scopeResourceIds: obligation.scopeResourceIds || [], reviewerIds: reviewerPeople, completedOn: date, outcome: "passed", changesRequired: false, evidenceIds: [], coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   if (type === "risk-assessment") {
-    return { ...common, status: "complete", completedOn: date, assessmentKind: "enterprise-risk", scope: "In-scope SOC 2 systems and dependencies", assessorIds: responsiblePeople, reviewerIds: responsiblePeople, methodology: state.workspace.riskMethodology?.method || "Documented risk methodology", summary: "Assessment completed; link the supporting evidence and resulting risks.", approvedOn: date };
+    return { ...common, status: "complete", completedOn: date, assessmentKind: "enterprise-risk", scope: "In-scope SOC 2 systems and dependencies", assessorIds: responsiblePeople, reviewerIds: reviewerPeople, methodology: state.workspace.riskMethodology?.method || "Documented risk methodology", summary: "Assessment completed; link the supporting evidence and resulting risks.", evidenceIds: [], approvedOn: date };
   }
   if (type === "attestation") {
-    return { ...common, status: "completed", subjectResourceIds: [obligation.templateResourceId, ...(obligation.scopeResourceIds || [])].filter(Boolean), personId: responsiblePeople[0], attestationKind: item.activityType || "completion", assignedOn: item.dueWindowStart, dueOn: item.dueWindowEnd, completedOn: date, attestationMethod: "git-approval" };
+    return { ...common, status: "completed", subjectResourceIds: [...new Set([obligation.templateResourceId, ...(obligation.scopeResourceIds || [])].filter(Boolean))], personId: responsiblePeople[0], attestationKind: item.activityType || "completion", assignedOn: item.dueWindowStart, dueOn: item.dueWindowEnd, completedOn: date, attestationMethod: "git-approval" };
   }
   if (type === "access-review") {
-    return { ...common, status: "complete", completedOn: date, reviewerIds: responsiblePeople, systemIds: inScopeSystems, scope: "Privileged, production, and important-system access", outcome: "passed", approvedByIds: responsiblePeople, approvedOn: date, coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
+    return { ...common, status: "complete", completedOn: date, reviewerIds: responsiblePeople, systemIds: inScopeSystems, scope: "Privileged, production, and important-system access", outcome: "passed", evidenceIds: [], approvedByIds: reviewerPeople, approvedOn: date, coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   if (type === "vulnerability-scan") {
-    return { ...common, status: "complete", scanKind: "vulnerability", scope: "In-scope systems", operatorIds: responsiblePeople, scheduledFor: date, completedAt: timestamp, systemIds: inScopeSystems, resultSummary: "Document the scan result and link findings or evidence." };
+    return { ...common, status: "complete", scanKind: "vulnerability", scope: "In-scope systems", operatorIds: responsiblePeople, scheduledFor: date, completedAt: timestamp, systemIds: inScopeSystems, resultSummary: "Document the scan result and link findings or evidence.", evidenceIds: [], reviewerIds: reviewerPeople, reviewedOn: date };
   }
   if (type === "penetration-test") {
-    return { ...common, status: "complete", testKind: "independent", scope: "In-scope systems and service boundary", coverage: rangeCoverage(date, date), ownerIds: responsiblePeople, outcome: "passed", systemIds: inScopeSystems, completedOn: date, reviewerIds: responsiblePeople, reviewedOn: date };
+    return { ...common, status: "complete", testKind: "independent", scope: "In-scope systems and service boundary", coverage: rangeCoverage(date, date), ownerIds: responsiblePeople, outcome: "passed", evidenceIds: [], systemIds: inScopeSystems, completedOn: date, reviewerIds: reviewerPeople, reviewedOn: date };
   }
   if (type === "control-test") {
-    return { ...common, status: "complete", controlId: obligation.controlIds?.[0] || "", testKinds: [item.activityType || "control-operation"], performedBy: "management", testerIds: responsiblePeople, reviewerIds: responsiblePeople, completedOn: date, reviewedOn: date, outcome: "passed", coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
+    return { ...common, status: "complete", controlId: obligation.controlIds?.[0] || "", testKinds: [item.activityType || "control-operation"], performedBy: "management", testerIds: responsiblePeople, reviewerIds: reviewerPeople, completedOn: date, reviewedOn: date, outcome: "passed", evidenceIds: [], coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
+  }
+  if (type === "control-activity") {
+    return {
+      ...common,
+      status: "complete",
+      profileId: item.completionProfile || item.activityType,
+      obligationId: item.obligationId,
+      controlIds: item.controlIds || obligation.controlIds || [],
+      scopeResourceIds: (item.subjectResourceIds || item.scopeResourceIds || obligation.scopeResourceIds || []).length
+        ? (item.subjectResourceIds || item.scopeResourceIds || obligation.scopeResourceIds)
+        : [state.workspace.id],
+      performerIds: responsiblePeople,
+      completedAt: timestamp,
+      method: "",
+      result: "",
+      reviewerIds: reviewerPeople,
+      reviewedOn: date,
+      ownerIds: item.ownerIds || obligation.ownerIds || []
+    };
   }
   if (type === "exercise") {
-    return { ...common, status: "complete", exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response", scheduledFor: date, facilitatorIds: responsiblePeople, objective: item.title, outcome: "passed", systemIds: inScopeSystems, completedAt: timestamp };
+    return { ...common, status: "complete", exerciseKind: item.title.toLowerCase().includes("continuity") ? "business-continuity" : "incident-response", scheduledFor: date, facilitatorIds: responsiblePeople, objective: item.title, outcome: "passed", evidenceIds: [], systemIds: inScopeSystems, completedAt: timestamp };
   }
   if (type === "backup-test") {
-    return { ...common, status: "complete", systemIds: inScopeSystems, scheduledFor: date, operatorIds: responsiblePeople, reviewerIds: responsiblePeople, outcome: "passed", completedAt: timestamp };
+    return { ...common, status: "complete", systemIds: inScopeSystems, scheduledFor: date, operatorIds: responsiblePeople, reviewerIds: reviewerPeople, outcome: "passed", evidenceIds: [], completedAt: timestamp };
   }
   if (type === "vendor-review") {
     const eventVendorId = (item.subjectResourceIds || []).find((id) => state.resources.some(({ record }) => record.id === id && record.type === "vendor"));
-    return { ...common, status: "complete", vendorId: eventVendorId || activeVendors[0] || "", reviewerIds: responsiblePeople, completedOn: date, decision: "approved", coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
+    return { ...common, status: "complete", vendorId: eventVendorId || activeVendors[0] || "", reviewerIds: responsiblePeople, completedOn: date, decision: "approved", evidenceIds: [], coverage: rangeCoverage(item.dueWindowStart, item.dueWindowEnd) };
   }
   return {
     ...common,
@@ -749,17 +1196,29 @@ function openObligationEventDialog(trigger) {
   const eventField = needsTimestamp
     ? '<label><span>Event time <small>your local time</small></span><input name="occurredAt" type="datetime-local" required value="' + esc(currentLocalDateTime()) + '"></label>'
     : '<label><span>Event date</span><input name="occurredOn" type="date" required value="' + esc(currentDate()) + '"></label>';
+  const riskField = trigger.eventType === "person-ended"
+    ? '<label><span>Departure risk</span><select name="riskLevel" required><option value="normal">Normal</option><option value="high">High or involuntary</option></select></label>'
+    : "";
   const dialog = document.createElement("dialog");
   dialog.className = "commit-dialog event-dialog";
   dialog.setAttribute("aria-labelledby", "event-dialog-title");
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Policy event</p><h2 id="event-dialog-title">' + esc(policyEventName(trigger.eventType)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>This creates one event record and adds ' + trigger.steps.length + ' linked tasks to the Work Queue.</p>' + eventField +
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Policy event</p><h2 id="event-dialog-title">' + esc(policyEventName(trigger.eventType)) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>This creates one event record and adds the matching linked tasks to the Work Queue.</p>' + eventField + riskField +
     (subjects.length ? '<label><span>Subject <small>required</small></span><select name="subject" required><option value="">Select</option>' + subjects.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + ' · ' + esc(state.model.resources[record.type].title) + '</option>').join("") + '</select></label>' : "") +
-    '<label><span>Workflow name <small>optional</small></span><input name="title" maxlength="200" placeholder="' + esc(policyEventName(trigger.eventType)) + '"></label><div class="event-dialog-steps">' + trigger.steps.map((step) => '<div><strong>' + esc(step.title) + '</strong><small>' + esc(eventStepSummary(step)) + '</small></div>').join("") + '</div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary">Add Tasks to Work Queue</button></div></form>';
+    '<label><span>Workflow name <small>optional</small></span><input name="title" maxlength="200" placeholder="' + esc(policyEventName(trigger.eventType)) + '"></label><div class="event-dialog-steps">' + trigger.steps.map((step) => '<div data-risk-levels="' + esc((step.eventRiskLevels || []).join(",")) + '" ' + ((step.eventRiskLevels || []).length ? "hidden" : "") + '><strong>' + esc(step.title) + '</strong><small>' + esc(eventStepSummary(step)) + '</small></div>').join("") + '</div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary">Add Tasks to Work Queue</button></div></form>';
   document.body.append(dialog);
   dialog.showModal();
   dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
   dialog.querySelector('[data-event="cancel"]').addEventListener("click", () => dialog.close());
   dialog.addEventListener("close", () => dialog.remove());
+  const syncRiskSteps = () => {
+    const selectedRisk = dialog.querySelector('[name="riskLevel"]')?.value || "";
+    dialog.querySelectorAll("[data-risk-levels]").forEach((step) => {
+      const levels = step.dataset.riskLevels.split(",").filter(Boolean);
+      step.hidden = levels.length > 0 && !levels.includes(selectedRisk);
+    });
+  };
+  dialog.querySelector('[name="riskLevel"]')?.addEventListener("change", syncRiskSteps);
+  syncRiskSteps();
   dialog.querySelector("form").addEventListener("submit", async (event) => {
     event.preventDefault();
     const form = event.currentTarget;
@@ -773,6 +1232,7 @@ function openObligationEventDialog(trigger) {
           eventType: trigger.eventType,
           occurredOn: form.elements.occurredOn?.value || undefined,
           occurredAt: form.elements.occurredAt?.value ? new Date(form.elements.occurredAt.value).toISOString() : undefined,
+          riskLevel: form.elements.riskLevel?.value || undefined,
           subjectResourceIds: form.elements.subject?.value ? [form.elements.subject.value] : [],
           title: form.elements.title.value
         })
@@ -795,6 +1255,220 @@ function openObligationEventDialog(trigger) {
   dialog.querySelector('input[name="occurredOn"], input[name="occurredAt"]').focus();
 }
 
+function openExternalReviewerGovernanceDialog() {
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog";
+  dialog.setAttribute("aria-labelledby", "external-reviewer-dialog-title");
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Independent review</p><h2 id="external-reviewer-dialog-title">Set up an external reviewer</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>Use this flow when no suitable internal reviewer is available. It adds the external reviewer, activates the Independent Policy Reviewer and Oversight Chair Appointments, adds the reviewer to the oversight team, and routes draft policy approvals to that person.</p><div class="form-grid"><label><span>Reviewer name</span><input name="reviewerName" required maxlength="200"></label><label><span>Email <small>optional</small></span><input name="email" type="email"></label><label><span>Organization <small>optional</small></span><input name="organization" maxlength="200"></label><label><span>Organizational job title</span><input name="jobTitle" required maxlength="200" placeholder="Principal Consultant"></label><label><span>Appointment starts</span><input name="startsOn" type="date" required value="' + esc(currentDate()) + '"></label><label class="full"><span>Why this reviewer is independent</span><textarea name="independenceRationale" required rows="4" placeholder="Describe their separation from policy ownership and control operation."></textarea></label></div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-governance>Preview bundle</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  const form = dialog.querySelector("form");
+  const close = () => dialog.close();
+  dialog.querySelector(".icon-button").addEventListener("click", close);
+  dialog.querySelector('[data-event="cancel"]').addEventListener("click", close);
+  dialog.addEventListener("close", () => dialog.remove());
+  let previewedPayload = null;
+  form.addEventListener("input", () => {
+    previewedPayload = null;
+    dialog.querySelector(".workflow-preview").innerHTML = "";
+    dialog.querySelector("[data-preview-governance]").textContent = "Preview bundle";
+  });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+    const payload = Object.fromEntries(new FormData(form).entries());
+    const error = dialog.querySelector(".dialog-error");
+    error.textContent = "";
+    form.querySelectorAll("button,input,textarea").forEach((control) => { control.disabled = true; });
+    try {
+      if (!previewedPayload) {
+        const response = await localFetch("/api/external-reviewer-governance/preview", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        const preview = await response.json();
+        previewedPayload = payload;
+        dialog.querySelector(".workflow-preview").innerHTML = '<strong>Review this bundle</strong><p>Create ' + preview.changes.create.length + ' records and update ' + preview.changes.update.length + '. No approval or historical date is inferred beyond the facts entered above.</p>';
+        dialog.querySelector("[data-preview-governance]").textContent = "Confirm and apply";
+      } else {
+        const response = await localFetch("/api/external-reviewer-governance", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ ...previewedPayload, confirmed: true })
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        applyMutationState(await response.json());
+        dialog.close();
+        render();
+      }
+    } catch (requestError) {
+      error.textContent = requestError.message;
+    } finally {
+      form.querySelectorAll("button,input,textarea").forEach((control) => { control.disabled = false; });
+    }
+  });
+  form.elements.reviewerName.focus();
+}
+
+function openNextAuditCycleDialog(prior) {
+  const priorEnd = coverageEnd(prior.coverage) || currentDate();
+  const start = dateAfter(priorEnd);
+  const end = start.slice(0, 4) + "-12-31";
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog event-dialog";
+  dialog.setAttribute("aria-labelledby", "audit-cycle-dialog-title");
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Audit lifecycle</p><h2 id="audit-cycle-dialog-title">' + (prior.auditKind === "soc-2-type-1" ? "Start the Type 2 operating period" : "Start the next audit cycle") + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>Carry forward the approved scope and control selections as a new planning record. FileGRC leaves report, evidence, delivery, and closure facts behind and requires review of every later change.</p><div class="form-grid"><label><span>Period start</span><input name="startsOn" type="date" required value="' + esc(start) + '"></label><label><span>Period end</span><input name="endsOn" type="date" required value="' + esc(end) + '"></label><label class="full"><span>Audit name <small>optional</small></span><input name="title" maxlength="200" placeholder="Next SOC 2 Type 2 audit"></label></div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-cycle>Preview carry-forward</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  const form = dialog.querySelector("form");
+  dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
+  dialog.querySelector('[data-event="cancel"]').addEventListener("click", () => dialog.close());
+  dialog.addEventListener("close", () => dialog.remove());
+  let previewedPayload = null;
+  form.addEventListener("input", () => {
+    previewedPayload = null;
+    dialog.querySelector(".workflow-preview").innerHTML = "";
+    dialog.querySelector("[data-preview-cycle]").textContent = "Preview carry-forward";
+  });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+    const payload = {
+      ...Object.fromEntries(new FormData(form).entries()),
+      priorAuditId: prior.id
+    };
+    const error = dialog.querySelector(".dialog-error");
+    error.textContent = "";
+    form.querySelectorAll("button,input").forEach((control) => { control.disabled = true; });
+    try {
+      if (!previewedPayload) {
+        const response = await localFetch("/api/audit-cycle/preview", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        const preview = await response.json();
+        previewedPayload = payload;
+        dialog.querySelector(".workflow-preview").innerHTML = '<strong>Review the carried-forward scope</strong><p>' + preview.audit.controlIds.length + ' controls, ' + preview.audit.systemIds.length + ' systems, and ' + preview.audit.requirementIds.length + ' requirements will start in Planning. The new record still requires scope, continuity, and source review.</p>';
+        dialog.querySelector("[data-preview-cycle]").textContent = "Confirm and create";
+      } else {
+        const response = await localFetch("/api/audit-cycle", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ ...previewedPayload, confirmed: true })
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        const result = await response.json();
+        applyMutationState(result);
+        dialog.close();
+        history.replaceState(null, "", "#/resources/audit/" + encodeURIComponent(result.audit.id));
+        render();
+      }
+    } catch (requestError) {
+      error.textContent = requestError.message;
+    } finally {
+      form.querySelectorAll("button,input").forEach((control) => { control.disabled = false; });
+    }
+  });
+}
+
+function openApplicabilityReviewDialog(type, entries) {
+  const definition = state.model.resources[type];
+  const reviewPoints = definition?.guidance?.reviewPoints || [];
+  const people = resourcesOfType("person").filter(({ record }) => record.status === "active");
+  const pending = entries.filter(({ record }) => (
+    !record.applicabilityReview
+    || type === "requirement" && record.applicability === "undetermined"
+  ));
+  const dialog = document.createElement("dialog");
+  dialog.className = "commit-dialog applicability-dialog";
+  dialog.setAttribute("aria-labelledby", "applicability-dialog-title");
+  const options = type === "requirement"
+    ? '<option value="applicable">Applicable</option><option value="not-applicable">Not applicable</option>'
+    : '<option value="applicable">Applicable</option><option value="not-applicable">Not applicable</option><option value="externally-managed">Externally managed</option><option value="zero-population">Zero population</option>';
+  const rows = pending.map((entry) => '<div class="applicability-row" data-review-id="' + esc(entry.record.id) + '"><div><strong>' + esc(entry.record.title) + '</strong><small>' + esc(entry.record.code || entry.record.id) + '</small></div><select name="decision"><option value="">Review later</option>' + options + '</select><input name="rationale" placeholder="Decision rationale"></div>').join("");
+  const reviewChecks = reviewPoints.length
+    ? '<section class="collection-review-checks"><strong>Before deciding</strong><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></section>'
+    : "";
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">Batch review</p><h2 id="applicability-dialog-title">Review ' + esc(definition.pluralTitle) + '</h2></div><button type="button" class="icon-button" aria-label="Close">×</button></div><p>Record only decisions reviewed against the current service scope. Leave an item at Review later when management has not decided it.</p>' + reviewChecks + '<div class="form-grid review-context"><label><span>Reviewer</span><select name="reviewerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '">' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Reviewed on</span><input name="reviewedOn" type="date" required value="' + esc(currentDate()) + '"></label></div><div class="applicability-rows">' + (rows || empty("Every record already has a reviewed applicability decision.")) + '</div><div class="workflow-preview" role="status"></div><div class="dialog-error" role="alert"></div><div class="dialog-actions"><button type="button" class="button" data-event="cancel">Cancel</button><button type="submit" class="button primary" data-preview-review ' + (pending.length ? "" : "disabled") + '>Preview decisions</button></div></form>';
+  document.body.append(dialog);
+  dialog.showModal();
+  const form = dialog.querySelector("form");
+  dialog.querySelector(".icon-button").addEventListener("click", () => dialog.close());
+  dialog.querySelector('[data-event="cancel"]').addEventListener("click", () => dialog.close());
+  dialog.addEventListener("close", () => dialog.remove());
+  let previewedPayload = null;
+  form.addEventListener("input", () => {
+    previewedPayload = null;
+    dialog.querySelector(".workflow-preview").innerHTML = "";
+    dialog.querySelector("[data-preview-review]").textContent = "Preview decisions";
+  });
+  form.addEventListener("submit", async (event) => {
+    event.preventDefault();
+    if (!form.reportValidity()) return;
+    const error = dialog.querySelector(".dialog-error");
+    error.textContent = "";
+    let missingRationale = false;
+    const decisions = [...dialog.querySelectorAll("[data-review-id]")].flatMap((row) => {
+      const decision = row.querySelector('[name="decision"]').value;
+      if (!decision) return [];
+      const rationale = row.querySelector('[name="rationale"]').value.trim();
+      if (!rationale) missingRationale = true;
+      return [{
+        id: row.dataset.reviewId,
+        decision,
+        rationale
+      }];
+    });
+    if (missingRationale) {
+      error.textContent = "Add a rationale for every selected decision.";
+      return;
+    }
+    if (!decisions.length) {
+      error.textContent = "Select at least one decision.";
+      return;
+    }
+    const payload = {
+      decisions,
+      reviewedByIds: [form.elements.reviewerId.value],
+      reviewedOn: form.elements.reviewedOn.value,
+      expectedRevisions: Object.fromEntries(entries.map((entry) => [entry.record.id, entry.revision]))
+    };
+    form.querySelectorAll("button,input,select").forEach((control) => { control.disabled = true; });
+    try {
+      if (!previewedPayload) {
+        const response = await localFetch("/api/applicability-review/preview", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify(payload)
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        const preview = await response.json();
+        previewedPayload = payload;
+        dialog.querySelector(".workflow-preview").innerHTML = '<strong>Review before saving</strong><p>' + preview.reviewedIds.length + ' decisions will be saved with the reviewer, review date, and current scope recorded automatically.</p>';
+        dialog.querySelector("[data-preview-review]").textContent = "Confirm and save";
+      } else {
+        const response = await localFetch("/api/applicability-review", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ ...previewedPayload, confirmed: true })
+        });
+        if (!response.ok) throw new Error(await responseMessage(response));
+        applyMutationState(await response.json());
+        dialog.close();
+        render();
+      }
+    } catch (requestError) {
+      error.textContent = requestError.message;
+    } finally {
+      form.querySelectorAll("button,input,select").forEach((control) => { control.disabled = false; });
+    }
+  });
+}
+
 function renderAuditPacket(main, params = new URLSearchParams()) {
   const audits = resourcesOfType("audit");
   const evidence = resourcesOfType("evidence");
@@ -803,7 +1477,10 @@ function renderAuditPacket(main, params = new URLSearchParams()) {
     .flatMap((family) => family.operationRecordTypes || []));
   const filegrcRecords = state.resources.filter(({ record }) => filegrcRecordTypes.has(record.type));
   const requestedAudit = params.get("auditId");
-  const selected = audits.find(({ record }) => record.id === requestedAudit)?.record || audits.find(({ record }) => record.status !== "complete")?.record || null;
+  const requestedEntry = audits.find(({ record }) => record.id === requestedAudit);
+  const openEntry = audits.find(({ record }) => record.status !== "complete");
+  const soleEntry = audits.length === 1 ? audits[0] : null;
+  const selected = (requestedEntry || openEntry || soleEntry)?.record || null;
   const today = currentDate();
   const start = coverageStart(selected?.coverage) || today.slice(0, 4) + "-01-01";
   const end = coverageEnd(selected?.coverage) || today;
@@ -815,13 +1492,13 @@ function renderAuditPacket(main, params = new URLSearchParams()) {
     ["Engagement", selected ? selected.title : "No audit record", "#/resources/audit", selected ? "good" : "warn"],
     ["filegrc Evidence", filegrcRecords.length + " operating " + pluralize("record", filegrcRecords.length), "#/stage/run", "neutral"],
     ["External Evidence", evidence.length + " " + pluralize("record", evidence.length), "#/resources/evidence", evidence.length ? "good" : "neutral"],
-    ["Policy work", state.obligations.counts.overdue ? state.obligations.counts.overdue + " overdue" : state.obligations.counts.due ? state.obligations.counts.due + " due" : state.obligations.counts.proposed ? state.obligations.counts.proposed + " proposals" : "No work due", "#/stage/run", state.obligations.counts.overdue ? "bad" : state.obligations.counts.due ? "warn" : state.obligations.counts.proposed ? "neutral" : "good"]
+    ["Policy work", state.obligations.counts.overdue ? state.obligations.counts.overdue + " overdue" : state.obligations.counts.blocked ? state.obligations.counts.blocked + " blocked" : state.obligations.counts.due ? state.obligations.counts.due + " due" : state.obligations.counts.proposed ? state.obligations.counts.proposed + " proposals" : "No work due", "#/stage/run", state.obligations.counts.overdue || state.obligations.counts.blocked ? "bad" : state.obligations.counts.due ? "warn" : state.obligations.counts.proposed ? "neutral" : "good"]
   ];
-  const evidencePaths = '<section class="panel audit-evidence-paths"><div class="panel-head"><div><p class="kicker">Evidence workflow</p><h3>Review both evidence paths</h3><p>Use the formal audit date or period. Each selected control may need one or both paths.</p></div></div><div class="audit-evidence-path-grid"><a href="#/stage/run"><span class="step-label">filegrc Evidence</span><h4>Review operating records</h4><p>Complete the applicable Step 4 records, link them to their Controls, and record results in their fields or Markdown. Link any external artifact needed to support the result. The packet includes the records, Markdown, Git history, and linked artifacts.</p></a><a href="#/resources/evidence"><span class="step-label">External Evidence</span><h4>Review imported or referenced proof</h4><p>Verify the source System, audit date or period, Control links, collector, verifier, and fixed attachment or approved external reference. The packet includes the records, retained files, delivery index, and checksums.</p></a></div></section>';
+  const evidencePaths = '<section class="panel audit-evidence-paths"><div class="panel-head"><div><p class="kicker">Evidence workflow</p><h3>Review both evidence paths</h3><p>Use the formal audit date or period. Each selected control may need one or both paths.</p></div></div><div class="audit-evidence-path-grid"><a href="#/stage/run"><span class="step-label">filegrc Evidence</span><h4>Review operating records</h4><p>Confirm the applicable Step 4 records are complete and linked to their Controls.</p></a><a href="#/resources/evidence"><span class="step-label">External Evidence</span><h4>Review imported or referenced proof</h4><p>Confirm each artifact is fixed, verified, and linked to its source System and Controls.</p></a></div></section>';
   const dateFields = typeOne
     ? '<label><span>As-of date</span><input type="date" name="start" required value="' + esc(start) + '"></label>'
     : '<label><span>Period start</span><input type="date" name="start" required value="' + esc(start) + '"></label><label><span>Period end</span><input type="date" name="end" required value="' + esc(end) + '"></label>';
-  main.innerHTML = '<div class="page audit-packet-page"><div class="page-intro"><div><p class="kicker">Audit evidence and packet</p><h2>Prepare Fieldwork</h2><p>Confirm the firm-agreed date or period, review filegrc Evidence and External Evidence, complete management documents and Type 2 populations, then build the indexed packet. filegrc compiles both evidence paths with their links, control matrix, history, attachments, indexes, and checksums.</p></div></div><section class="packet-preflight" aria-label="Packet readiness">' + preflight.map(([label, value, href, tone]) => '<a href="' + href + '"><span class="status-dot ' + tone + '"></span><span><small>' + esc(label) + '</small><strong>' + esc(value) + '</strong></span></a>').join("") + '</section>' + evidencePaths + renderAuditPreparation(preparation) + '<section class="panel packet-builder"><div class="panel-head"><div><p class="kicker">Evidence delivery</p><h3>' + (typeOne ? "Build the As-of Packet" : "Build the Period Packet") + '</h3></div></div><form id="packet-form">' + dateFields + '<label><span>Audit <small>required for delivery</small></span><select name="auditId"><option value="">Draft Without Audit Scope</option>' + audits.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === selected?.id ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><button class="button primary" type="submit" ' + (state.readOnly ? "disabled" : "") + '>' + (draft ? "Generate draft" : "Generate packet") + '</button></form><p class="packet-note">' + (state.readOnly ? "Packet generation requires the local writable renderer or the CLI." : draft ? "Drafts expose coverage gaps now. Commit a clean revision and select an audit record before delivery." : "The packet is derived under .filegrc/ and bound to the selected audit and current Git revision. filegrc checks preparation and integrity; the engagement team determines evidence sufficiency.") + '</p><div class="dialog-error" role="alert"></div></section><div id="packet-results"></div></div>';
+  main.innerHTML = '<div class="page audit-packet-page"><div class="page-intro"><div><p class="kicker">Audit evidence and packet</p><h2>Prepare Fieldwork</h2><p>Review fieldwork readiness, then build the evidence packet for the agreed audit date or period.</p></div></div><section class="packet-preflight" aria-label="Packet readiness">' + preflight.map(([label, value, href, tone]) => '<a href="' + href + '"><span class="status-dot ' + tone + '"></span><span><small>' + esc(label) + '</small><strong>' + esc(value) + '</strong></span></a>').join("") + '</section>' + evidencePaths + renderAuditPreparation(preparation) + '<section class="panel packet-builder"><div class="panel-head"><div><p class="kicker">Evidence delivery</p><h3>' + (typeOne ? "Build the As-of Packet" : "Build the Period Packet") + '</h3></div></div><form id="packet-form">' + dateFields + '<label><span>Audit <small>required for delivery</small></span><select name="auditId"><option value="">Draft Without Audit Scope</option>' + audits.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === selected?.id ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><button class="button primary" type="submit" ' + (state.readOnly ? "disabled" : "") + '>' + (draft ? "Generate draft" : "Generate packet") + '</button></form><p class="packet-note">' + (state.readOnly ? "Packet generation requires the local writable renderer or the CLI." : draft ? "Drafts expose coverage gaps now. Commit a clean revision and select an audit record before delivery." : "The packet is derived under .filegrc/ and bound to the selected audit and current Git revision. filegrc checks preparation and integrity; the engagement team determines evidence sufficiency.") + '</p><div class="dialog-error" role="alert"></div></section><div id="packet-results"></div></div>';
   main.querySelector('select[name="auditId"]').addEventListener("change", (event) => {
     const next = event.currentTarget.value;
     location.hash = "#/audit-packet" + (next ? "?auditId=" + encodeURIComponent(next) : "");
@@ -925,7 +1602,7 @@ function renderPacketResults(container, result) {
 }
 
 function obligationPreview(items) {
-  return items.length ? '<div class="obligation-preview">' + items.map((item) => '<a href="#/stage/run"><span class="status-dot ' + (item.status === "overdue" ? "bad" : item.status === "due" ? "warn" : "neutral") + '"></span><span><strong>' + esc(item.title) + '</strong><small>' + esc(timingText(item)) + '</small></span></a>').join("") + '</div>' : empty("No open obligations.");
+  return items.length ? '<div class="obligation-preview">' + items.map((item) => '<a href="#/stage/run"><span class="status-dot ' + (["blocked", "overdue"].includes(item.status) ? "bad" : item.status === "due" ? "warn" : "neutral") + '"></span><span><strong>' + esc(item.title) + '</strong><small>' + esc(timingText(item)) + '</small></span></a>').join("") + '</div>' : empty("No open obligations.");
 }
 
 function distinctObligationPreviews(items, limit) {
@@ -961,6 +1638,7 @@ function windowText(item) {
 function timingText(item) {
   if (item.canceledAction) return "Action canceled; resolve or cancel the event";
   if (item.missingCompletion) return "Link required completion proof";
+  if (item.status === "blocked") return item.blockingReason || "Blocked";
   if (item.status === "proposed") return "Starter proposal";
   if (item.status === "overdue" && Number.isInteger(item.hoursOverdue)) {
     return item.hoursOverdue === 0 ? "Overdue less than 1 hour" : item.hoursOverdue + " hour" + (item.hoursOverdue === 1 ? "" : "s") + " overdue";
@@ -1015,11 +1693,21 @@ function renderList(main, type, params = new URLSearchParams()) {
     return { name, label: field.label || humanize(name), values };
   }).filter(({ values }) => values.length > 1);
   const createButton = !state.readOnly && !definition.singleton ? '<button class="button primary" id="new-resource">New ' + esc(definition.title.toLowerCase()) + '</button>' : "";
+  const hasPendingApplicability = entries.some(({ record }) => (
+    !record.applicabilityReview
+    || type === "requirement" && record.applicability === "undetermined"
+  ));
+  const applicabilityButton = !state.readOnly
+    && ["requirement", "control", "commitment", "complementary-control"].includes(type)
+    && hasPendingApplicability
+    ? '<button class="button" id="review-applicability">Review applicability</button>'
+    : "";
   const guideTrigger = '<button class="guide-trigger" id="resource-guide-trigger" type="button" aria-label="About ' + esc(definition.pluralTitle) + '" aria-haspopup="dialog" aria-controls="resource-guide" aria-expanded="false"><svg viewBox="0 0 20 20" aria-hidden="true"><circle cx="10" cy="10" r="8"></circle><path d="M7.8 7.5a2.4 2.4 0 1 1 3.25 2.25c-.7.31-1.05.72-1.05 1.5v.25M10 14.5v.1"></path></svg></button>';
   const listTools = '<div class="list-tools list-header-tools"><label><span class="sr-only">Filter list</span><input id="list-search" type="search" placeholder="Filter ' + esc(definition.pluralTitle.toLowerCase()) + '"></label>' +
-    filters.map(({ name, label, values }) => '<select class="field-filter" data-field="' + esc(name) + '" aria-label="Filter by ' + esc(label.toLowerCase()) + '"><option value="">Any ' + esc(properCase(label)) + '</option>' + values.map((value) => '<option value="' + esc(value) + '">' + esc(filterOptionLabel(value)) + '</option>').join("") + '</select>').join("") + '<span id="result-count" aria-live="polite">' + entries.length + ' records</span>' + createButton + '</div>';
+    filters.map(({ name, label, values }) => '<select class="field-filter" data-field="' + esc(name) + '" aria-label="Filter by ' + esc(label.toLowerCase()) + '"><option value="">Any ' + esc(properCase(label)) + '</option>' + values.map((value) => '<option value="' + esc(value) + '">' + esc(filterOptionLabel(value)) + '</option>').join("") + '</select>').join("") + '<span id="result-count" aria-live="polite">' + entries.length + ' records</span>' + applicabilityButton + createButton + '</div>';
   main.innerHTML = '<div class="page"><div class="page-intro"><div><p class="kicker">' + esc(listStage?.title || groupTitle(definition.group)) + '</p><div class="page-title-line"><h2>' + esc(titleCase(definition.pluralTitle)) + '</h2>' + guideTrigger + '</div></div>' + listTools + '</div>' + resourceGuide(type) +
-    '<section class="record-table-wrap"><table class="record-table"><thead><tr><th>' + esc(fieldLabel(type, "title")) + '</th>' + fields.map((name) => '<th>' + esc(fieldLabel(type, name)) + '</th>').join("") + '<th>Git file</th></tr></thead><tbody id="record-rows"></tbody></table></section>' +
+    collectionReviewPanel(type) +
+    '<section class="record-table-wrap"><table class="record-table"><thead><tr><th>' + esc(fieldLabel(type, "title")) + '</th>' + fields.map((name) => '<th>' + esc(fieldLabel(type, name)) + '</th>').join("") + '<th>Next action</th><th>Git file</th></tr></thead><tbody id="record-rows"></tbody></table></section>' +
     '<nav class="pagination list-pagination" aria-label="' + esc(definition.pluralTitle) + ' pages" hidden><button class="button" type="button" data-page="previous">Previous</button><span class="page-status" aria-live="polite"></span><button class="button" type="button" data-page="next">Next</button></nav></div>';
   resourceGuideCleanup = setupResourceGuide(main);
   const pagination = main.querySelector(".list-pagination");
@@ -1035,7 +1723,7 @@ function renderList(main, type, params = new URLSearchParams()) {
     const start = (pageNumber - 1) * LIST_PAGE_SIZE;
     const visible = filtered.slice(start, start + LIST_PAGE_SIZE);
     main.querySelector("#result-count").textContent = filtered.length + (filtered.length === 1 ? " record" : " records");
-    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type)) + '</td>').join("") + '<td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 2) + '">' + empty("No records match this filter.") + '</td></tr>';
+    main.querySelector("#record-rows").innerHTML = filtered.length ? visible.map((entry) => '<tr><td data-label="' + esc(fieldLabel(type, "title")) + '" data-primary-field><a class="record-title" href="#/resource/' + encodeURIComponent(type) + '/' + encodeURIComponent(entry.record.id) + '">' + esc(entry.record.title) + '</a></td>' + fields.map((name) => '<td data-label="' + esc(fieldLabel(type, name)) + '">' + (name === "$operationTracking" ? controlOperationTracking(entry.record) : name === "$workQueueStatus" ? obligationWorkQueueStatus(entry.record) : formatValue(name === "status" ? displayStatus(entry.record) : entry.record[name], name, type)) + '</td>').join("") + '<td data-label="Next action">' + recordWorkflowCell(type, entry) + '</td><td data-label="Git file"><code>' + esc(entry.relativePath.replace(/^data\//, "")) + '</code></td></tr>').join("") : '<tr><td colspan="' + (fields.length + 3) + '">' + empty(entries.length ? "No records match this filter." : state.collectionReviews?.[type] ? "No records exist. Use the scope confirmation above to record an allowed zero population or add the records management identified." : definition.guidance?.emptyState || "No records exist. Use the page guidance to decide whether a record is required, then add only real program facts.") + '</td></tr>';
     pagination.hidden = totalPages === 1;
     previous.disabled = pageNumber === 1;
     next.disabled = pageNumber === totalPages;
@@ -1075,7 +1763,15 @@ function renderList(main, type, params = new URLSearchParams()) {
   renderRows();
   syncRoute();
   main.querySelector("#new-resource")?.addEventListener("click", () => openEditor(type));
+  main.querySelector("#review-applicability")?.addEventListener("click", () => openApplicabilityReviewDialog(type, entries));
+  main.querySelector("[data-review-collection]")?.addEventListener("click", () => openCollectionReviewDialog(type));
   if (params.get("new") === "1" && !state.readOnly && !definition.singleton) queueMicrotask(() => openEditor(type));
+  if (params.get("review") === "1" && !state.readOnly) {
+    queueMicrotask(() => main.querySelector("#review-applicability")?.click());
+  }
+  if (params.get("review-collection") === "1" && !state.readOnly) {
+    queueMicrotask(() => main.querySelector("[data-review-collection]")?.click());
+  }
 }
 
 function renderDetail(main, type, id) {
@@ -1113,12 +1809,33 @@ function renderDetail(main, type, id) {
     ? ""
     : (FINDING_SOURCE_TYPES.has(type) ? '<button class="button" type="button" data-record-finding>Record finding</button>' : "")
       + (ACTION_ITEM_SOURCE_TYPES.has(type) ? '<button class="button" type="button" data-add-action-item>Add task</button>' : "");
+  const lifecycleActions = state.readOnly
+    ? ""
+    : type === "action-item" && !["done", "canceled"].includes(entry.record.status) && entry.record.obligationId
+      ? '<button class="button primary" type="button" data-complete-action-detail>Complete task</button>'
+      : type === "obligation-event" && entry.record.status !== "complete"
+        ? '<button class="button primary" type="button" data-complete-event>Complete event</button>'
+        : "";
+  const governanceActions = !state.readOnly
+    && type === "appointment"
+    && entry.record.appointmentKind === "independent-policy-reviewer"
+    && entry.record.status === "planned"
+    ? '<button class="button" type="button" data-external-reviewer-governance>Use external reviewer</button>'
+    : "";
+  const auditCycleAction = !state.readOnly
+    && type === "audit"
+    && entry.record.status === "complete"
+    ? '<button class="button primary" type="button" data-next-audit-cycle>' + (entry.record.auditKind === "soc-2-type-1" ? "Start Type 2 period" : "Start next cycle") + '</button>'
+    : "";
   const detailMain = hasRecordBody
     ? '<section class="panel detail-main">' + narrativeContent + markdownContent + addRecordContent + '</section>'
     : "";
-  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + issueActions + addRecordContentAction + (!state.readOnly ? '<button class="button" id="edit-resource">Edit</button>' + (!definition.singleton ? '<button class="button danger" id="delete-resource">Delete</button>' : "") : "") + '</div></div><div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain +
-    '<aside><section class="panel"><div class="panel-head"><h3>Metadata</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>' + personParticipation(entry) + resourceConnections(entry) + '<section class="panel"><div class="panel-head"><h3>File History</h3></div>' + (entry.history?.length ? '<div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div>' : empty("No committed history for this file.")) + '</section></aside></div></div>';
+  const attachmentPanel = type === "evidence" ? evidenceAttachmentPanel(entry) : "";
+  main.innerHTML = '<div class="page"><div class="detail-head"><div><div class="breadcrumbs header-breadcrumbs"><a href="#/resources/' + encodeURIComponent(type) + '">' + esc(titleCase(definition.pluralTitle)) + '</a><span>/</span><span>' + esc(entry.record.title) + '</span></div><h2>' + esc(titleCase(entry.record.title)) + '</h2></div><div class="actions">' + auditCycleAction + (type === "audit" ? '<a class="button primary" href="#/audit-packet?auditId=' + encodeURIComponent(entry.record.id) + '">Audit Evidence &amp; Packet</a>' : "") + governanceActions + lifecycleActions + issueActions + addRecordContentAction + (!state.readOnly ? '<button class="button" id="edit-resource">Edit</button>' + (!definition.singleton ? '<button class="button danger" id="delete-resource">Delete</button>' : "") : "") + '</div></div>' + workflowGuidance({ type, id, title: "Finalization checklist" }) + resourceReviewCriteria(type) + '<div class="detail-grid ' + (hasRecordBody ? "" : "detail-grid-structured") + '">' + detailMain +
+    '<aside><section class="panel"><div class="panel-head"><h3>Metadata</h3></div><dl class="metadata">' + sourceMetadata + visible.map(([name, value]) => '<div><dt>' + esc(fields[name]?.label || humanize(name)) + '</dt><dd>' + formatValue(name === "status" ? displayStatus(entry.record) : value, name, type) + '</dd></div>').join("") + '</dl></section>' + attachmentPanel + personParticipation(entry) + resourceConnections(entry) + '<section class="panel"><div class="panel-head"><h3>File History</h3></div>' + (entry.history?.length ? '<div class="history">' + entry.history.map((commit) => '<div><code>' + esc(commit.shortCommit) + '</code><span><strong>' + esc(commit.subject) + '</strong><small>' + esc(commit.author) + ' · ' + esc(formatLocalDateTime(commit.timestamp)) + '</small></span></div>').join("") + '</div>' : empty("No committed history for this file.")) + '</section></aside></div></div>';
   main.querySelector("#edit-resource")?.addEventListener("click", () => openEditor(type, entry));
+  main.querySelector("[data-external-reviewer-governance]")?.addEventListener("click", openExternalReviewerGovernanceDialog);
+  main.querySelector("[data-next-audit-cycle]")?.addEventListener("click", () => openNextAuditCycleDialog(entry.record));
   main.querySelector("[data-record-finding]")?.addEventListener("click", () => openEditor("finding", null, {
     seed: issueSeed("finding", entry.record),
     description: "Record only a confirmed gap that needs separate remediation tracking. Keep the report details in this source record’s Markdown."
@@ -1127,6 +1844,68 @@ function renderDetail(main, type, id) {
     seed: issueSeed("action-item", entry.record),
     description: "Create a separate task only when this follow-up needs its own assignee, deadline, and completion proof. It will appear in Work Queue."
   }));
+  main.querySelector("[data-complete-action-detail]")?.addEventListener("click", () => {
+    const item = state.obligations.items.find(({ actionItemId }) => actionItemId === entry.record.id);
+    if (item) openActionCompletion(item);
+    else showError("This Action Item is not available in the current Work Queue calculation.");
+  });
+  main.querySelector("[data-complete-event]")?.addEventListener("click", async () => {
+    try {
+      const response = await localFetch("/api/obligation-event-completions", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+          eventId: entry.record.id,
+          completedOn: currentDate(),
+          revision: entry.revision
+        })
+      });
+      if (!response.ok) throw new Error(await responseMessage(response));
+      applyMutationState(await response.json());
+      render();
+    } catch (error) {
+      showError(error.message);
+    }
+  });
+  main.querySelector("[data-attach-evidence]")?.addEventListener("click", () => {
+    main.querySelector("[data-evidence-file]")?.click();
+  });
+  main.querySelector("[data-evidence-file]")?.addEventListener("change", async (event) => {
+    const file = event.currentTarget.files?.[0];
+    if (!file) return;
+    if (!confirm('Attach "' + file.name + '" to this Evidence record? Confirm that its classification, retention, and repository access are appropriate.')) {
+      event.currentTarget.value = "";
+      return;
+    }
+    try {
+      const response = await localFetch(
+        "/api/evidence-attachments/" + encodeURIComponent(entry.record.id) + "/" + encodeURIComponent(file.name)
+          + "?revision=" + encodeURIComponent(entry.revision),
+        { method: "POST", body: file }
+      );
+      if (!response.ok) throw new Error(await responseMessage(response));
+      applyMutationState(await response.json());
+      render();
+    } catch (error) {
+      showError(error.message);
+    }
+  });
+  main.querySelectorAll("[data-detach-evidence]").forEach((button) => button.addEventListener("click", async () => {
+    const attachment = button.dataset.detachEvidence;
+    if (!confirm('Remove "' + attachment + '" from this Evidence record and delete its local file?')) return;
+    try {
+      const response = await localFetch(
+        "/api/evidence-attachments/" + encodeURIComponent(entry.record.id) + "/" + encodeURIComponent(attachment)
+          + "?revision=" + encodeURIComponent(entry.revision),
+        { method: "DELETE" }
+      );
+      if (!response.ok) throw new Error(await responseMessage(response));
+      applyMutationState(await response.json());
+      render();
+    } catch (error) {
+      showError(error.message);
+    }
+  }));
   main.querySelector("#add-record-content")?.addEventListener("click", () => openEditor(type, entry, { addRecordContent: true }));
   main.querySelectorAll("[data-edit-content]").forEach((button) => button.addEventListener("click", () => openContentEditor(entry, button.dataset.editContent)));
   main.querySelector("#delete-resource")?.addEventListener("click", async () => {
@@ -1142,6 +1921,23 @@ function renderDetail(main, type, id) {
   });
 }
 
+function evidenceAttachmentPanel(entry) {
+  const attachments = (entry.record.filePaths || []).map((path) => ({
+    path,
+    name: path.split("/").at(-1)
+  }));
+  const rows = attachments.length
+    ? attachments.map(({ path, name }) => (
+        '<li><span><strong>' + esc(name) + '</strong><small>' + esc(path) + '</small></span>'
+        + (!state.readOnly ? '<button class="text-button danger-text" type="button" data-detach-evidence="' + esc(name) + '">Remove</button>' : "")
+        + '</li>'
+      )).join("")
+    : '<li class="attachment-empty">No local attachments. An approved external reference may be used when the source cannot be stored here.</li>';
+  return '<section class="panel evidence-attachments"><div class="panel-head"><div><h3>Attachments</h3><p>Fixed source files retained with this Evidence record.</p></div>'
+    + (!state.readOnly ? '<button class="button" type="button" data-attach-evidence>Attach file</button><input type="file" data-evidence-file hidden>' : "")
+    + '</div><ul>' + rows + '</ul></section>';
+}
+
 async function loadResourceDetail(type, id) {
   const key = type + "\0" + id;
   if (resourceDetailRequests.has(key)) return resourceDetailRequests.get(key);
@@ -1479,14 +2275,18 @@ function resourceGuide(type) {
   const definition = state.model.resources[type];
   const guidance = definition?.guidance;
   if (!definition || !guidance) return "";
-  const instructions = stagePageSummary({ type });
+  const instructions = RESOURCE_GUIDE_INSTRUCTIONS[type] || definition.description;
   const sources = (guidance.sourceResourceIds || [])
     .map((id) => state.resources.find(({ record }) => record.id === id))
     .filter(Boolean);
   const sourceLinks = sources.length
     ? '<div class="guide-links">' + sources.map(({ record }) => '<a href="#/resource/' + encodeURIComponent(record.type) + '/' + encodeURIComponent(record.id) + '">' + esc(record.title) + '</a>').join("") + '</div>'
     : "";
-  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use ' + esc(definition.pluralTitle) + '" hidden><div><span>Instructions</span><p>' + esc(instructions) + '</p></div><div><span>Use</span><p>' + esc(definition.description) + '</p></div><div><span>Policy basis</span><p>' + esc(guidance.policyBasis) + '</p>' + sourceLinks + '</div></section>';
+  const reviewPoints = guidance.reviewPoints || [];
+  const reviewGuide = reviewPoints.length
+    ? '<div class="guide-review"><span>When reviewing</span><ul>' + reviewPoints.map((point) => '<li>' + esc(point) + '</li>').join("") + '</ul></div>'
+    : "";
+  return '<section class="page-guide resource-guide-popover" id="resource-guide" role="dialog" aria-label="How to use ' + esc(definition.pluralTitle) + '" hidden><div><span>Instructions</span><p>' + esc(instructions) + '</p></div><div><span>Use</span><p>' + esc(definition.description) + '</p></div><div><span>Policy basis</span><p>' + esc(guidance.policyBasis) + '</p>' + sourceLinks + '</div>' + reviewGuide + '</section>';
 }
 
 function setupResourceGuide(main) {
@@ -1629,91 +2429,62 @@ function onboardingSteps() {
     points: [
       "Use the UI, an editor, the CLI, or an agent; every path changes the same files.",
       "JSON holds structured records. Markdown holds policies, plans, minutes, and other long-form work.",
-      "In trunk mode, each browser save fast-forwards, validates, creates one focused local commit, then pushes it in the background. The workspace stays read-only until sync finishes.",
-      "Record status represents approval. Draft, proposed, approved, and retired records all stay on the authoritative branch.",
-      "Agents and terminal users continue to manage Git explicitly.",
-      "The dashboard derives program status from the current repository state."
+      "Record status represents approval. In trunk mode, the browser validates, commits, and pushes each save; agents and terminal users manage Git explicitly."
     ]
   };
   const path = {
     target: ".readiness-map",
     kicker: "Program model",
     title: "Follow the audit chain",
-    body: "The shortest dependable path is to define scope, approve policies, implement controls, prepare the evidence process, and operate the program before audit fieldwork begins.",
+    body: "Follow the five program steps in order. Each step reveals the records and decisions needed next.",
     points: [
-      "Scope starts with people, dated appointments, oversight teams, applicable criteria, commitments, material vendors, and in-scope systems.",
-      "Program operation includes current risk assessments and risks, which may add or change controls as conditions change.",
-      "Evidence preparation means cataloging authoritative systems, documenting extraction, and testing captures before the candidate period.",
-      "The CPA firm, formal report period, fieldwork, and final report are the last stage. Engage earlier only when timing or scope needs outside input."
+      "Define the people, criteria, service, Systems, and providers in scope.",
+      "Approve the policies, implement the controls, then operate them and retain dated proof.",
+      "Create the audit engagement when a CPA firm is involved or a real customer deadline requires it."
     ]
   };
-  const obligations = {
+  const operation = {
     target: ".obligation-panel",
-    kicker: "Obligations",
-    title: "Work the policy queue",
-    body: "Recurring policy work appears as upcoming, due, or overdue. Each item shows the full allowed completion range, the first overdue date, and a live countdown to that cutoff.",
-    points: [
-      "Quarterly means any date in that cycle is valid unless the policy sets a narrower window.",
-      "Link a dated completion record and its evidence to satisfy one occurrence.",
-      "The UI and filegrc CLI use the same calculation."
-    ]
-  };
-  const events = {
-    target: ".event-reminder-panel",
-    kicker: "Triggered work",
-    title: "Complete a checklist when key events occur",
-    body: "Use an event reminder for a new worker, job or responsibility change, departure, personal device, vendor change or incident, material system or data-use change, or security incident. One action item is created for every policy requirement, with its own owner, evidence, due range, and cutoff.",
+    kicker: "Program operation",
+    title: "Work the queue and trigger policy events",
+    body: "Recurring work and assigned follow-up appear in the Work Queue with owners, allowed completion dates, and overdue cutoffs. When a listed event happens, start its Policy Event to create the applicable tasks and deadlines.",
     points: [
-      "The checklist stays open until every action is done and has the requested completion record or evidence.",
-      "Hour-based rules keep the event time and exact cutoff; day-based rules keep the policy date range.",
-      "Every action has a policy-based cutoff or a reasonable default deadline for the event.",
-      "Agents start the identical workflow with the filegrc CLI."
+      "Complete each occurrence with the requested dated operating record and supporting evidence.",
+      "Start Policy Events only after the real event occurs. FileGRC creates one owned Action Item for each applicable policy step.",
+      "The browser and CLI use the same schedules, event rules, and completion checks."
     ]
   };
-  const reportTypes = {
+  const auditPath = {
     target: null,
-    kicker: "SOC 2 report types",
-    title: "Choose the report goal",
+    kicker: "Report goal and audit",
+    title: "Choose the report goal and plan fieldwork",
     body: [
       "SOC 2 is an independent CPA report on controls relevant to the selected Trust Services Criteria.",
-      "Most customer requests focus on Security. Add Availability, Processing Integrity, Confidentiality, or Privacy only when the service and customer need call for them."
+      "Most customer requests focus on Security. Add another category only when the service and customer need call for it. Choose a management goal now, then create an Audit record only after a real CPA engagement or customer deadline exists."
     ],
     sections: [
       {
         title: "Type 1",
-        body: "A CPA evaluates whether the controls are suitably designed and implemented at a point in time. Type 1 is optional before Type 2, but it can help with an urgent customer request."
+        body: "The CPA evaluates control design and implementation at a point in time. Type 1 is optional before Type 2."
       },
       {
         title: "Type 2",
-        body: "A CPA evaluates whether the controls operated consistently throughout an agreed review period, often six months. Dated evidence must cover that period."
+        body: "The CPA evaluates operation across an agreed period. Dated evidence and complete populations must cover that period."
       }
     ],
-    afterSections: "Most evidence comes from production, identity, monitoring, and business systems. filegrc records where it comes from and how it was collected."
-  };
-  const audit = {
-    target: ".audit-panel",
-    kicker: "Final stage",
-    title: "Engage the firm and prepare fieldwork",
-    body: "Once the program is ready and evidence collection is running, record the CPA firm and the agreed scope and period. Then reconcile populations, answer requests, and generate the delivery packet.",
-    points: [
-      "The audit record holds the firm-agreed date or period; the workspace keeps management's earlier candidate dates.",
-      "Audit Readiness identifies missing management documents, populations, exact-period evidence, and request work.",
-      "The CPA firm selects samples, tests controls, evaluates exceptions, and issues the report."
-    ]
+    afterSections: "FileGRC prepares the records and packet. The CPA firm selects samples, tests controls, evaluates exceptions, and issues the report."
   };
   const setup = {
     target: null,
     kicker: "Initial scope",
     title: "Describe the service you plan to audit",
-    body: "This records the management goal and creates the first in-scope system. It does not create an audit engagement. Next, finish Step 1 by adding the real reviewers and operators, finishing the oversight team, and confirming the criteria, commitments, vendors, and systems."
+    body: "Create the first in-scope System and record management’s goal. Step 1 will guide the rest of the scope."
   };
   return [
     files,
     path,
-    obligations,
-    events,
-    reportTypes,
-    audit,
+    operation,
+    auditPath,
     setup
   ];
 }
@@ -1734,7 +2505,7 @@ function renderOnboardingStep() {
     ? onboardingSetupForm()
     : description + explanation + afterSections;
   const finalActions = onboardingStep === steps.length - 1
-    ? '<span class="onboarding-save-status" role="status" aria-live="polite"></span><button class="button" type="button" data-onboarding="draft">Save draft</button><button class="button primary" type="button" data-onboarding="next">Complete setup</button>'
+    ? '<span class="onboarding-save-status" role="status" aria-live="polite"></span><button class="button" type="button" data-onboarding="draft">Save as planned</button><button class="button primary" type="button" data-onboarding="next">Confirm service scope</button>'
     : '<button class="button primary" type="button" data-onboarding="next">Next</button>';
   onboardingDialog.innerHTML = '<div class="onboarding-progress" style="--onboarding-step-count:' + steps.length + '" aria-label="Onboarding step ' + (onboardingStep + 1) + ' of ' + steps.length + '">' + progress + '</div><div class="onboarding-scroll"><div class="onboarding-head"><p class="kicker">' + esc(step.kicker) + ' · ' + (onboardingStep + 1) + ' of ' + steps.length + '</p><h2 id="onboarding-title">' + esc(titleCase(step.title)) + '</h2></div>' + body + '<div class="dialog-error" role="alert"></div></div><div class="dialog-actions onboarding-actions"><button class="button text-button onboarding-skip" type="button" data-onboarding="skip">Skip onboarding</button>' + (onboardingStep ? '<button class="button" type="button" data-onboarding="back">Back</button>' : "") + finalActions + '</div>';
   onboardingDialog.querySelector('[data-onboarding="skip"]').addEventListener("click", cancelOnboarding);
@@ -1774,17 +2545,12 @@ function onboardingSetupForm() {
   if (onboardingDraft.classificationId && !classifications.includes(onboardingDraft.classificationId)) {
     classifications.push(onboardingDraft.classificationId);
   }
-  const currentSystem = onboardingDraft.systemId ? state.resources.find(({ record }) => record.id === onboardingDraft.systemId)?.record : null;
-  const existing = [
-    currentSystem ? "Updates system " + currentSystem.title + "." : "Creates a new in-scope system.",
-    "Records a management program goal without creating an audit engagement."
-  ].filter(Boolean).join(" ");
   const gitStatus = state.repository?.mode === "trunk"
     ? '<div class="onboarding-git-status ' + (state.repository.status === "synced" ? "" : "warning") + '"><span class="status-dot ' + repositoryStatusTone(state.repository.status) + '"></span><span><strong>' + esc(state.repository.label) + '</strong><small>' + esc(state.repository.status === "synced" ? "Completing onboarding will save its related workspace, system, and renderer changes in one local commit, then push it in the background." : state.repository.message) + '</small></span></div>'
     : state.git.available && state.git.branch
       ? '<div class="onboarding-git-status"><span class="status-dot good"></span><span><strong>Manual repository mode</strong><small>Setup changes will stay local until you commit and synchronize them.</small></span></div>'
       : '<div class="onboarding-git-status warning"><span class="status-dot warn"></span><span><strong>Git setup needed</strong><small>Manual-mode writes still work, but Git history is unavailable until the repository is configured.</small></span></div>';
-  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="classificationId" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.classificationId ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">' + esc(existing) + ' Save draft marks the service Planned and selects it in Workspace program scope. It is ready for scope review, but it is not approved or active. ' + (state.repository?.mode === "trunk" ? "The browser saves and synchronizes the related files together." : "Manual mode leaves the files for you to commit.") + ' Complete the remaining Step 1 pages next.</p>';
+  return '<p class="onboarding-body">' + esc(onboardingSteps().at(-1).body) + '</p>' + gitStatus + '<form id="onboarding-setup" class="onboarding-form"><label class="wide"><span>Service name</span><input name="serviceName" required maxlength="200" value="' + esc(onboardingDraft.serviceName) + '" placeholder="Customer-facing application"></label><label class="wide"><span>Scope description</span><textarea name="scope" required maxlength="2000" placeholder="What the service does and which production boundary is in scope">' + esc(onboardingDraft.scope) + '</textarea></label><label><span>Accountable owner</span><select name="ownerId" required><option value="">Select</option>' + people.map(({ record }) => '<option value="' + esc(record.id) + '" ' + (record.id === onboardingDraft.ownerId ? "selected" : "") + '>' + esc(record.title) + '</option>').join("") + '</select></label><label><span>Business criticality</span><select name="criticality" required>' + ["low", "medium", "high", "critical"].map((value) => '<option value="' + value + '" ' + (value === onboardingDraft.criticality ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Highest data classification</span><select name="classificationId" required>' + classifications.map((value) => '<option value="' + esc(value) + '" ' + (value === onboardingDraft.classificationId ? "selected" : "") + '>' + esc(properCase(value)) + '</option>').join("") + '</select></label><label><span>Internet exposed</span><select name="internetExposed" required><option value="true" ' + (onboardingDraft.internetExposed === "true" ? "selected" : "") + '>Yes</option><option value="false" ' + (onboardingDraft.internetExposed === "false" ? "selected" : "") + '>No</option></select></label><label class="wide"><span>Program goal</span><select name="programGoal" required><option value="none" ' + (onboardingDraft.programGoal === "none" ? "selected" : "") + '>No Assurance Goal Yet</option><option value="readiness" ' + (onboardingDraft.programGoal === "readiness" ? "selected" : "") + '>Program Readiness</option><option value="type-1" ' + (onboardingDraft.programGoal === "type-1" ? "selected" : "") + '>SOC 2 Type 1</option><option value="type-2" ' + (onboardingDraft.programGoal === "type-2" ? "selected" : "") + '>SOC 2 Type 2</option></select><small>This records management intent only. It does not create an engagement or establish the formal report period.</small></label></form><p class="onboarding-write-note">Save as planned keeps the System planned. Confirm service scope makes it active. Both add it to the Workspace scope.</p>';
 }
 
 function captureOnboardingForm() {
@@ -1904,22 +2670,6 @@ async function writeRendererSettingsResource(record, entry) {
   return response.json();
 }
 
-async function toggleStagePageCompletion(button) {
-  const entry = rendererSettingsEntry();
-  if (!entry) throw new Error("Renderer settings are unavailable.");
-  const completed = new Set(entry.record.completedStagePageIds || []);
-  const pageId = button.dataset.stagePageCompletion;
-  if (button.dataset.complete === "true") {
-    completed.delete(pageId);
-  } else {
-    completed.add(pageId);
-  }
-  applyMutationState(await writeRendererSettingsResource({
-    ...entry.record,
-    completedStagePageIds: [...completed].sort()
-  }, entry));
-}
-
 function setOnboardingBusy(busy, label = "") {
   if (!onboardingDialog) return;
   clearTimeout(onboardingStillWorkingTimer);
@@ -2081,7 +2831,7 @@ function openEditor(type, entry = null, options = {}) {
   const editorDescription = options.description
     || implementationEditorDescription(type)
     || "Fill the core fields below. Git will record the author, time, reason, and diff when you commit this file.";
-  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + (entry ? "Edit record" : options.obligationCompletion ? "Record obligation work" : "Create record") + '</p><h2 id="resource-editor-title">' + esc(titleCase(entry?.record.title || record.title || definition.title)) + '</h2></div><button type="button" class="icon-button" data-editor-dismiss aria-label="Close">×</button></div><p>' + esc(editorDescription) + '</p><div class="form-grid">' + names.map((name) => editorField(type, name, fields[name], record[name], required.has(name) || conditionMatches(record, fields[name].requiredWhen), Boolean(entry), oneOf.has(name), activeOneOf.has(name))).join("") + '</div>' +
+  dialog.innerHTML = '<form><div class="dialog-head"><div><p class="kicker">' + (entry ? "Edit record" : options.actionCompletion ? "Complete assigned work" : options.obligationCompletion ? "Record obligation work" : "Create record") + '</p><h2 id="resource-editor-title">' + esc(titleCase(entry?.record.title || record.title || definition.title)) + '</h2></div><button type="button" class="icon-button" data-editor-dismiss aria-label="Close">×</button></div><p>' + esc(editorDescription) + '</p>' + resourceReviewCriteria(type) + '<div class="form-grid">' + names.map((name) => editorField(type, name, fields[name], record[name], required.has(name) || conditionMatches(record, fields[name].requiredWhen), Boolean(entry), oneOf.has(name), activeOneOf.has(name))).join("") + '</div>' +
     activeMarkdown.map((markdown) => {
       const generated = !entry?.content?.[markdown.name];
       const source = entry?.content?.[markdown.name]?.source
@@ -2151,7 +2901,9 @@ function openEditor(type, entry = null, options = {}) {
       }
       const url = entry
         ? "/api/resource/" + encodeURIComponent(type) + "/" + encodeURIComponent(entry.record.id)
-        : options.obligationCompletion ? "/api/obligation-completions" : "/api/resources";
+        : options.actionCompletion
+          ? "/api/action-completions"
+          : options.obligationCompletion ? "/api/obligation-completions" : "/api/resources";
       const contentRevisions = Object.fromEntries([
         ...activeMarkdown.map(({ name }) => [entry?.content?.[name]?.path, entry?.content?.[name]?.revision]),
         [recordContentItem?.path, recordContentItem?.revision]
@@ -2163,9 +2915,11 @@ function openEditor(type, entry = null, options = {}) {
         body: JSON.stringify({
           record: updated,
           content,
-          revision: entry?.revision || options.obligationCompletion?.revision,
+          revision: entry?.revision || options.actionCompletion?.revision || options.obligationCompletion?.revision,
           contentRevisions,
-          obligationId: options.obligationCompletion?.obligationId
+          obligationId: options.obligationCompletion?.obligationId,
+          actionItemId: options.actionCompletion?.actionItemId,
+          completedOn: options.actionCompletion?.completedOn
         })
       });
       if (!response.ok) throw new Error(await responseMessage(response));
@@ -2506,21 +3260,6 @@ function openContentEditor(entry, name) {
 }
 
 function bindCommon() {
-  root.querySelectorAll("[data-stage-page-completion]").forEach((button) => button.addEventListener("click", async (event) => {
-    event.preventDefault();
-    event.stopPropagation();
-    const label = button.textContent;
-    button.disabled = true;
-    button.textContent = "Saving…";
-    try {
-      await toggleStagePageCompletion(button);
-      render();
-    } catch (error) {
-      button.disabled = false;
-      button.textContent = label;
-      button.title = error.message;
-    }
-  }));
   root.querySelectorAll(".nav-toggle, .nav-subgroup-toggle").forEach((button) => button.addEventListener("click", () => {
     const group = button.closest(".nav-group");
     const open = group.classList.toggle("open");
@@ -2656,6 +3395,11 @@ function currentDate() {
     return new Date().toISOString().slice(0, 10);
   }
 }
+function dateAfter(value) {
+  const date = new Date(value + "T00:00:00Z");
+  date.setUTCDate(date.getUTCDate() + 1);
+  return date.toISOString().slice(0, 10);
+}
 function currentLocalDateTime() {
   const now = new Date();
   const local = new Date(now.getTime() - now.getTimezoneOffset() * 60000);
@@ -3026,7 +3770,9 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .nav-stage>.nav-items>a.nav-direct{display:grid;grid-template-columns:minmax(0,1fr) var(--nav-control-width);gap:6px;align-items:center;width:100%;padding:6px 6px 6px 7px;font-size:13.2px}
 .nav-heading-row{display:grid;grid-template-columns:minmax(0,1fr) 24px;gap:2px;align-items:stretch}.nav-heading-row>.nav-heading{display:grid;grid-template-columns:24px minmax(0,1fr);gap:6px;align-items:center;width:100%;padding:7px 6px;border-radius:7px;color:#d5d9ed;text-align:left;text-transform:none;letter-spacing:0;text-decoration:none}.nav-heading-row>.nav-heading:hover,.nav-heading-row>.nav-heading.current{background:rgba(255,255,255,.1);color:#fff}.nav-toggle{display:grid;place-items:center;width:24px;height:auto;min-height:100%;padding:0;border:0;border-radius:6px;background:none;color:#aeb6d8;cursor:pointer}.nav-toggle:hover{background:rgba(255,255,255,.1);color:#fff}.nav-chevron{display:block;width:12px;height:12px;place-self:center;fill:none;stroke:currentColor;stroke-width:1.5;stroke-linecap:round;stroke-linejoin:round;transition:transform .15s}.nav-subheading-row{display:grid;grid-template-columns:minmax(0,1fr) 22px;gap:2px;align-items:center;width:100%;padding:0;border:0;border-radius:6px;background:none;color:#919bc4;cursor:pointer}.nav-subheading-row:hover{background:rgba(255,255,255,.1);color:#fff}.nav-subheading-row>.nav-subheading{display:flex;align-items:center;min-width:0;padding:7px;color:inherit;text-align:left;text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780}.nav-group.open>.nav-heading-row .nav-chevron,.nav-group.open>.nav-subheading-row .nav-chevron{transform:rotate(90deg)}
 .stage-overview-hero{display:grid;grid-template-columns:minmax(0,1fr) 300px;gap:28px;align-items:center;padding:26px 28px;background:var(--panel);border:1px solid var(--line);border-radius:12px;box-shadow:var(--shadow)}.stage-overview-hero h2,.group-overview-head h2{font:500 37.2px Georgia,serif;margin:7px 0}.stage-overview-hero>div>p:not(.kicker),.group-overview-head>div>p:not(.kicker){max-width:760px;color:var(--muted);font-size:14.4px;line-height:1.55;margin:0}.stage-progress-card{padding:15px 17px;background:var(--paper);border:1px solid var(--line);border-radius:9px}.stage-progress-card>div:first-child{display:flex;align-items:center;justify-content:space-between;margin-bottom:11px}.stage-progress-card>div:first-child>strong{font:500 33.6px Georgia,serif}.stage-progress-card p{color:var(--muted);font-size:10.8px;line-height:1.45;margin:9px 0 0}.badge.neutral{background:#e5e8f2;color:#555e73}.stage-overview-layout{display:grid;grid-template-columns:320px minmax(0,1fr);gap:15px;margin-top:15px;align-items:start}.stage-plan ol,.group-plan ol{display:grid;gap:12px;padding-left:20px;margin:0}.stage-plan li,.group-plan li{padding-left:4px;color:var(--ink);font-size:13.2px;line-height:1.5}.stage-groups{min-width:0}.stage-groups>.section-head{margin:4px 0 13px}.stage-group-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-group-card{position:relative;display:block;min-height:138px;padding:18px 38px 17px 18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.stage-group-card:hover{border-color:var(--accent-light)}.stage-group-card h3{font-size:15.6px;margin:0 0 7px}.stage-group-card p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.stage-group-card small{display:block;color:var(--accent);font-size:9.6px;font-weight:700;margin-top:12px}.stage-group-arrow{position:absolute;right:16px;top:16px;color:var(--accent);font-size:24px}.group-overview-head{display:flex;justify-content:space-between;align-items:end;gap:25px;margin-bottom:15px}.stage-status-link{display:grid;grid-template-columns:auto auto;align-items:center;gap:4px 12px;min-width:155px;padding:12px 14px;background:var(--panel);border:1px solid var(--line);border-radius:9px;text-decoration:none}.stage-status-link>strong{font:500 28.8px Georgia,serif;text-align:right}.stage-status-link>small{grid-column:1/-1;color:var(--muted);font-size:9.6px;text-align:right}.relationship-note{display:grid;grid-template-columns:250px minmax(0,1fr);gap:20px;align-items:center;margin-bottom:15px;padding:17px 20px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.relationship-note h3{font-size:15.6px;margin:5px 0 0}.relationship-note>p{color:var(--muted);font-size:12px;line-height:1.55;margin:0}.relationship-note code{font-size:10.8px}.group-plan{margin-bottom:24px}.group-related-links{display:flex;align-items:center;gap:8px;margin-top:18px;padding-top:14px;border-top:1px solid var(--line)}.group-related-links>span{color:var(--muted);font-size:10.8px;margin-right:auto}.group-destinations>.section-head{margin-bottom:12px}.group-destination-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:11px}.group-destination-card{display:grid;grid-template-columns:minmax(0,1fr) 100px;gap:16px;min-height:150px;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;text-decoration:none;box-shadow:0 2px 8px rgba(21,40,33,.025)}.group-destination-card:hover{border-color:var(--accent-light)}.group-destination-card h3{font-size:15.6px;margin:5px 0 7px}.group-destination-card p:not(.kicker){color:var(--muted);font-size:10.8px;line-height:1.5;margin:0}.destination-rollup{align-self:center;text-align:right}.destination-rollup strong,.destination-rollup small{display:block}.destination-rollup strong{font:500 32.4px Georgia,serif}.destination-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:3px}
-.context-workflow{display:flex;align-items:center;justify-content:space-between;gap:24px;margin:-8px 0 18px;padding:17px 19px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.context-workflow h3{font-size:16px;margin:4px 0 5px}.context-workflow p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.5;margin:0;max-width:850px}.context-workflow .button{white-space:nowrap}.evidence-map{display:grid;gap:12px;margin-top:18px}.evidence-map-head{display:flex;align-items:center;justify-content:space-between;gap:24px;padding:20px 22px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:11px}.evidence-map-head>div:first-child{max-width:760px}.evidence-map-head h2{font:500 24px Georgia,serif;margin:5px 0 7px}.evidence-map-head p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.55;margin:0}.evidence-map-actions{display:flex;gap:8px}.evidence-map-card{padding:18px 20px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.evidence-map-card.complete{border-color:#b9dac6}.evidence-map-card-head{display:flex;align-items:start;justify-content:space-between;gap:20px}.evidence-map-card-head h3{font-size:16px;margin:7px 0 0}.evidence-map-card-head>small{color:var(--muted);font-size:10px;text-align:right}.evidence-map-card>p{color:var(--muted);font-size:12px;line-height:1.55;margin:12px 0}.evidence-map-expectation{display:grid;grid-template-columns:120px minmax(0,1fr);gap:12px;padding:8px 0;border-top:1px solid var(--line);font-size:11px;line-height:1.5}.evidence-map-expectation strong{color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.06em}.evidence-map-expectation code{background:var(--paper);border-radius:4px;padding:2px 5px}.evidence-map-links{display:grid;grid-template-columns:minmax(220px,1fr) minmax(280px,1.2fr);gap:20px;margin-top:13px;padding-top:13px;border-top:1px solid var(--line)}.evidence-map-links>div>small{display:block;color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}.evidence-map-references,.evidence-map-sources{display:flex;flex-wrap:wrap;gap:5px}.evidence-map-source{display:flex;align-items:center;gap:7px;padding:7px 9px;background:var(--paper);border:1px solid var(--line);border-radius:7px;font-size:11px;text-decoration:none}.evidence-map-source.complete{border-color:#b9dac6;background:#edf7f1}.evidence-map-source small{color:var(--muted);font-size:9px}.evidence-map-status{padding:9px 11px;background:var(--paper);border-radius:7px}.evidence-map-empty{padding:24px;background:var(--panel);border:1px solid var(--line);border-radius:10px}.evidence-map-empty h3{margin:6px 0}.evidence-map-empty p:not(.kicker){color:var(--muted);font-size:12px;margin:0 0 14px}.stage-pages{margin-top:24px}.stage-page-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-page-card{position:relative;display:flex;flex-direction:column;min-width:0;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025);transition:border-color .15s,box-shadow .15s}.stage-page-card:hover{border-color:var(--accent-light);box-shadow:0 5px 16px rgba(21,40,33,.07)}.stage-page-card.complete{border-color:#b9dac6}.stage-page-card-link{position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-card-link:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{display:flex;align-items:center;justify-content:space-between;gap:18px}.stage-page-card-head h3{font-size:15.6px;line-height:1.35;margin:4px 0 0}.stage-page-card-head>div>small{display:block;color:var(--accent);font-size:9.6px;font-weight:700}.stage-page-card>p{color:var(--muted);font-size:12px;line-height:1.5;margin:13px 0 0}.stage-page-rollup{display:flex;flex:0 0 104px;flex-direction:column;justify-content:center;text-align:right}.stage-page-rollup strong,.stage-page-rollup small{display:block}.stage-page-rollup strong{font:500 24px Georgia,serif}.stage-page-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:2px}.stage-page-card-foot{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:auto;padding-top:15px}.stage-page-completion{position:relative;z-index:2;color:var(--accent)}.stage-page-completion.complete{color:#176143;border-color:#b9dac6;background:#edf7f1}.stage-page-completion-state{color:var(--muted);font-size:10.8px}.stage-page-completion-state.complete{color:#176143;font-weight:700}.stage-page-open{color:var(--accent);font-size:12px;font-weight:700}.work-queue-section{margin-top:28px}.work-queue-section>.section-head{align-items:end}
+.collection-review-panel{margin:16px 0 22px}.collection-review-panel.required{border-color:#d8bd78}.collection-review-panel.current{border-color:#b9dac6}.collection-review-head{display:flex;align-items:flex-start;justify-content:space-between;gap:24px}.collection-review-head h3{margin:4px 0 6px}.collection-review-head p:not(.kicker){max-width:900px;margin:0;color:var(--muted);font-size:11px;line-height:1.5}.collection-review-panel details{margin-top:13px;padding:10px 12px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-panel summary{cursor:pointer;font-size:11px;font-weight:750}.collection-review-panel ul,.collection-review-checks ul{margin:9px 0 0;padding-left:20px;color:var(--muted);font-size:10.4px;line-height:1.55}.collection-review-foot{display:flex;align-items:center;justify-content:space-between;gap:20px;margin-top:13px}.collection-review-result{display:flex;align-items:baseline;gap:8px;margin:0}.collection-review-result strong{font-size:11px}.collection-review-result span{color:var(--muted);font-size:10.4px}.collection-review-checks{margin:13px 0;padding:11px 13px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.collection-review-checks>strong{font-size:11px}.event-dialog-steps.collection-review-checks{margin:15px 0 0;padding:10px;border:0}.collection-review-dialog textarea{box-sizing:border-box;width:100%;resize:vertical}.resource-review-criteria{margin:16px 0 22px;padding:13px 15px;border:1px solid var(--line);border-radius:8px;background:var(--panel)}.resource-review-criteria>strong{font-size:11px}.resource-review-criteria ul{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:5px 28px;margin:9px 0 0;padding-left:20px;color:var(--muted);font-size:10.4px;line-height:1.5}.commit-dialog .resource-review-criteria{margin:12px 0;background:var(--surface-soft)}.record-workflow-action{display:grid;grid-template-columns:auto minmax(140px,1fr);gap:7px;align-items:start;min-width:240px;text-decoration:none}.record-workflow-action strong,.record-workflow-action small{display:block}.record-workflow-action strong{font-size:10.4px}.record-workflow-action small{margin-top:2px;color:var(--muted);font-size:9.2px;line-height:1.35}.record-workflow-clear{color:var(--muted);font-size:10px;white-space:nowrap}.workflow-guidance{margin:16px 0 22px}.workflow-guidance .panel-head{align-items:flex-start;margin-bottom:12px}.workflow-guidance .panel-head h3{margin:4px 0}.workflow-guidance .panel-head p:not(.kicker){margin:4px 0 0;color:var(--muted);font-size:11px}.workflow-findings{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:7px}.workflow-findings>a,.workflow-findings>div{display:grid;grid-template-columns:auto minmax(0,1fr);gap:9px;align-items:start;padding:10px 11px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft);text-decoration:none}.workflow-findings strong,.workflow-findings small{display:block}.workflow-findings strong{font-size:11px}.workflow-findings small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.workflow-finding-status{min-width:62px;padding:3px 5px;border-radius:99px;background:var(--accent-soft);color:var(--accent);font-size:8.4px;font-weight:750;text-align:center;text-transform:uppercase;letter-spacing:.04em}.workflow-finding-status.overdue,.workflow-finding-status.blocked{background:#f5ded9;color:#8d352c}.workflow-finding-status.ready,.workflow-finding-status.due,.workflow-finding-status.open{background:#f7e9cf;color:#855717}.workflow-finding-status.complete{background:#ddefe5;color:#176143}.workflow-guidance-more{margin:10px 0 0;color:var(--muted);font-size:9.6px}.context-workflow{display:flex;align-items:center;justify-content:space-between;gap:24px;margin:-8px 0 18px;padding:17px 19px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:10px}.context-workflow h3{font-size:16px;margin:4px 0 5px}.context-workflow p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.5;margin:0;max-width:850px}.context-workflow .button{white-space:nowrap}.evidence-map{display:grid;gap:12px;margin-top:18px}.evidence-map-head{display:flex;align-items:center;justify-content:space-between;gap:24px;padding:20px 22px;background:var(--accent-soft);border:1px solid #cbd3ff;border-radius:11px}.evidence-map-head>div:first-child{max-width:760px}.evidence-map-head h2{font:500 24px Georgia,serif;margin:5px 0 7px}.evidence-map-head p:not(.kicker){color:var(--muted);font-size:12px;line-height:1.55;margin:0}.evidence-map-actions{display:flex;gap:8px}.evidence-map-card{padding:18px 20px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.evidence-map-card.complete{border-color:#b9dac6}.evidence-map-card-head{display:flex;align-items:start;justify-content:space-between;gap:20px}.evidence-map-card-head h3{font-size:16px;margin:7px 0 0}.evidence-map-card-head>small{color:var(--muted);font-size:10px;text-align:right}.evidence-map-card>p{color:var(--muted);font-size:12px;line-height:1.55;margin:12px 0}.evidence-map-expectation{display:grid;grid-template-columns:120px minmax(0,1fr);gap:12px;padding:8px 0;border-top:1px solid var(--line);font-size:11px;line-height:1.5}.evidence-map-expectation strong{color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.06em}.evidence-map-expectation code{background:var(--paper);border-radius:4px;padding:2px 5px}.evidence-map-links{display:grid;grid-template-columns:minmax(220px,1fr) minmax(280px,1.2fr);gap:20px;margin-top:13px;padding-top:13px;border-top:1px solid var(--line)}.evidence-map-links>div>small{display:block;color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.06em;margin-bottom:7px}.evidence-map-references,.evidence-map-sources{display:flex;flex-wrap:wrap;gap:5px}.evidence-map-source{display:flex;align-items:center;gap:7px;padding:7px 9px;background:var(--paper);border:1px solid var(--line);border-radius:7px;font-size:11px;text-decoration:none}.evidence-map-source.complete{border-color:#b9dac6;background:#edf7f1}.evidence-map-source small{color:var(--muted);font-size:9px}.evidence-map-status{padding:9px 11px;background:var(--paper);border-radius:7px}.evidence-map-empty{padding:24px;background:var(--panel);border:1px solid var(--line);border-radius:10px}.evidence-map-empty h3{margin:6px 0}.evidence-map-empty p:not(.kicker){color:var(--muted);font-size:12px;margin:0 0 14px}.stage-pages{margin-top:24px}.stage-page-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:10px}.stage-page-card{position:relative;display:flex;flex-direction:column;min-width:0;padding:18px;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025);transition:border-color .15s,box-shadow .15s}.stage-page-card:hover{border-color:var(--accent-light);box-shadow:0 5px 16px rgba(21,40,33,.07)}.stage-page-card.complete{border-color:#b9dac6}.stage-page-card-link{position:absolute;inset:0;z-index:1;border-radius:10px}.stage-page-card-link:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{display:flex;align-items:center;justify-content:space-between;gap:18px}.stage-page-card-head h3{font-size:15.6px;line-height:1.35;margin:4px 0 0}.stage-page-card-head>div>small{display:block;color:var(--accent);font-size:9.6px;font-weight:700}.stage-page-card>p{color:var(--muted);font-size:12px;line-height:1.5;margin:13px 0 0}.stage-page-tasks{position:relative;z-index:2;display:grid;gap:6px;margin-top:13px}.stage-page-tasks>a{display:grid;grid-template-columns:auto minmax(0,1fr);gap:8px;align-items:start;padding:9px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft);text-decoration:none}.stage-page-tasks>a:hover{border-color:var(--accent-light)}.stage-page-tasks strong,.stage-page-tasks small{display:block}.stage-page-tasks strong{font-size:10.8px}.stage-page-tasks small{margin-top:2px;color:var(--muted);font-size:9.4px;line-height:1.35}.stage-page-tasks-more{color:var(--muted);font-size:9.4px}.stage-page-rollup{display:flex;flex:0 0 104px;flex-direction:column;justify-content:center;text-align:right}.stage-page-rollup strong,.stage-page-rollup small{display:block}.stage-page-rollup strong{font:500 24px Georgia,serif}.stage-page-rollup small{color:var(--muted);font-size:9.6px;line-height:1.35;margin-top:2px}.stage-page-card-foot{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:auto;padding-top:15px}.stage-page-completion-state{color:var(--muted);font-size:10.8px}.stage-page-completion-state.complete{color:#176143;font-weight:700}.stage-page-open{color:var(--accent);font-size:12px;font-weight:700}.work-queue-section{margin-top:28px}.work-queue-section>.section-head{align-items:end}
+.workflow-findings>a:hover{border-color:var(--accent-light);box-shadow:0 3px 9px rgba(21,40,33,.05)}.workflow-findings>a:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.stage-page-card-head{align-items:flex-start}.stage-page-completion-state{flex:0 0 auto;max-width:150px;padding:5px 8px;border-radius:99px;background:#f7e9cf;color:#855717;font-size:9.6px;font-weight:750;line-height:1.25;text-align:right}.stage-page-completion-state.complete{background:#ddefe5;color:#176143}.obligation-card.workflow-target{outline:2px solid var(--focus);outline-offset:3px}.obligation-card-foot{flex-wrap:wrap}.obligation-card-foot .obligation-links{flex:1 1 120px}
+.evidence-attachments .panel-head{align-items:flex-start}.evidence-attachments .panel-head h3{margin:0}.evidence-attachments .panel-head p{margin:4px 0 0;color:var(--muted);font-size:10px}.evidence-attachments ul{list-style:none;margin:0;padding:0}.evidence-attachments li{display:flex;align-items:center;justify-content:space-between;gap:10px;padding:9px 0;border-top:1px solid var(--line)}.evidence-attachments li:first-child{border-top:0}.evidence-attachments strong,.evidence-attachments small{display:block}.evidence-attachments strong{font-size:11px}.evidence-attachments small{margin-top:2px;color:var(--muted);font-size:9px;overflow-wrap:anywhere}.evidence-attachments .attachment-empty{display:block;color:var(--muted);font-size:10px;line-height:1.45}.danger-text{color:var(--red)}
 .button{text-decoration:none}
 .external-evidence-section{margin-top:28px}.external-evidence-list{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px}.external-evidence-list>.empty{grid-column:1/-1}.external-evidence-list>a{display:flex;align-items:center;justify-content:space-between;gap:14px;padding:13px 15px;background:var(--panel);border:1px solid var(--line);border-radius:8px;text-decoration:none}.external-evidence-list>a:hover{border-color:var(--accent-light)}.external-evidence-list>a>span:first-child{min-width:0}.external-evidence-list strong,.external-evidence-list small{display:block}.external-evidence-list strong{font-size:12px;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.external-evidence-list small{color:var(--muted);font-size:9.6px;margin-top:4px}
 .home-page{padding-top:16px;padding-bottom:16px}.overview-hero{min-height:72px;padding:10px 20px;align-items:center}.overview-hero h2{font-size:26.4px;margin:3px 0 2px}.overview-hero p:not(.kicker){font-size:12px}.home-page .readiness-map{padding:12px 15px}.home-page .readiness-map-head{margin-bottom:8px}.home-page .readiness-flow a{padding:7px}
@@ -3038,7 +3784,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 .record-content-action{display:flex;justify-content:flex-start;margin-top:20px}.record-content-details{border-top:1px solid var(--line);margin-top:18px;padding-top:13px}.record-content-details summary{cursor:pointer;color:var(--accent);font-size:13.2px;font-weight:750}.record-content-details>p{color:var(--muted);font-size:12px}.record-content-editor>span small{color:var(--muted);font-size:10.8px;font-weight:500}
 .program-setup{grid-template-columns:minmax(250px,.75fr) minmax(440px,1.4fr)}.setup-steps{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:7px}.setup-steps a{display:grid;grid-template-columns:24px minmax(0,1fr);gap:9px;align-items:start;padding:10px;border:1px solid var(--line);border-radius:8px;background:var(--panel);color:var(--ink);text-decoration:none}.setup-steps a:hover{border-color:var(--accent-light)}.setup-steps a>span:first-child{display:grid;place-items:center;width:24px;height:24px;border-radius:50%;background:var(--accent-soft);color:var(--accent);font-size:12px}.setup-steps a.done>span:first-child{background:#dcefe4;color:#125733}.setup-steps strong,.setup-steps small{display:block}.setup-steps strong{font-size:12px}.setup-steps small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4;font-weight:500}
 .readiness-map{margin:14px 0;background:var(--panel);border:1px solid var(--line);border-radius:11px;padding:20px 22px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.readiness-map-head{display:grid;grid-template-columns:minmax(220px,1fr) minmax(320px,420px);gap:28px;align-items:center;margin-bottom:17px}.readiness-map-head h3{font-size:18px;margin:5px 0 0}.readiness-progress-summary{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:8px 14px;align-items:center}.readiness-progress-summary>div{display:grid;grid-template-columns:minmax(0,1fr) auto;gap:3px 12px;align-items:baseline}.readiness-progress-summary>div>span{color:var(--muted);font-size:9.6px;font-weight:700;text-transform:uppercase;letter-spacing:.08em}.readiness-progress-summary>div>strong{font-size:9.6px;font-weight:700;line-height:1.2}.readiness-progress-summary .progress,.readiness-progress-summary small{grid-column:1/-1}.readiness-progress-summary small{color:var(--muted);font-size:9.6px}.readiness-progress-summary>.button{white-space:nowrap}.readiness-flow{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:7px}.readiness-flow a{display:grid;grid-template-columns:23px minmax(0,1fr);column-gap:8px;align-content:start;min-width:0;padding:11px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);text-decoration:none}.readiness-flow a:hover{border-color:var(--accent-light);background:var(--accent-soft)}.readiness-flow a>span{grid-row:1/4;display:grid;place-items:center;width:23px;height:23px;border-radius:50%;background:var(--primary-gradient);color:#fff;font-size:9.6px;font-weight:800}.readiness-flow strong{font-size:12px;line-height:1.25}.readiness-flow small{grid-column:2;color:var(--muted);font-size:9.6px;line-height:1.4;margin-top:3px}.readiness-state{grid-column:2;justify-self:start;margin-top:8px;padding:3px 6px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:8.4px;line-height:1.2}.readiness-state.good{background:#dcefe4;color:#125733}.readiness-state.warn{background:#f6e8c9;color:#79500f}.readiness-state.bad{background:#f7dfdc;color:#873027}.audit-engagement{display:grid;grid-template-columns:minmax(210px,1fr) minmax(260px,1.25fr) auto;gap:20px;align-items:center;padding:14px 15px;border-radius:8px;background:var(--surface-soft)}.audit-engagement strong{font-size:13.2px}.audit-engagement p,.audit-engagement li{color:var(--muted);font-size:10.8px;line-height:1.5}.audit-engagement p{margin:5px 0 0}.audit-engagement ul{margin:0;padding-left:18px}.audit-engagement .button{white-space:nowrap;text-decoration:none}.resource-directory{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:10px}.resource-directory>section{min-width:0;padding:12px;border-radius:8px;background:var(--surface-soft)}.resource-directory h4{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.resource-directory a{display:flex;justify-content:space-between;gap:10px;padding:5px 0;border-top:1px solid var(--line);font-size:10.8px;text-decoration:none}.resource-directory a:first-of-type{border-top:0}.resource-directory a:hover span{color:var(--accent)}.resource-directory a strong{color:var(--muted);font-size:9.6px}.record-prose{max-width:790px}.record-prose section{padding:0 0 20px}.record-prose section+section{padding-top:20px;border-top:1px solid var(--line)}.record-prose h3{margin:0 0 7px;color:var(--muted);font-size:10.8px;text-transform:uppercase;letter-spacing:.08em}.record-prose p{margin:0;font-size:16.8px;line-height:1.65;white-space:pre-wrap}.connections-panel .panel-head>span{display:grid;place-items:center;min-width:22px;height:22px;border-radius:99px;background:var(--surface-muted);color:var(--muted);font-size:9.6px}.connections{display:grid}.connections a{display:block;padding:9px 0;border-top:1px solid var(--line);text-decoration:none}.connections a:first-child{padding-top:0;border-top:0}.connections strong,.connections small{display:block}.connections strong{font-size:12px}.connections small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.connections a:hover strong{color:var(--accent)}.connections-more{margin:9px 0 0;color:var(--muted);font-size:9.6px;line-height:1.4}.external-source{display:flex;align-items:flex-start;justify-content:space-between;gap:8px;color:var(--accent);text-decoration:none}.external-source span,.external-source strong,.external-source small{display:block}.external-source strong{font-size:12px;line-height:1.35}.external-source small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.35;overflow-wrap:anywhere}.external-source b{font-size:13.2px}.external-source:hover strong{text-decoration:underline}
-.page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
+.page-title-line{display:flex;align-items:center;gap:8px}.guide-trigger{display:grid;place-items:center;width:24px;height:24px;flex:0 0 auto;padding:0;border:1px solid var(--line);border-radius:50%;background:var(--panel);color:var(--muted);cursor:pointer}.guide-trigger svg{width:16px;height:16px;fill:none;stroke:currentColor;stroke-width:1.7;stroke-linecap:round}.guide-trigger:hover{border-color:var(--accent-light);color:var(--accent)}.guide-trigger:focus-visible{outline:2px solid var(--focus);outline-offset:2px}.page-guide{display:grid;grid-template-columns:1.05fr 1.25fr 1fr;gap:0;margin:0;background:var(--panel);border:1px solid var(--line);border-radius:10px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.resource-guide-popover{position:fixed;z-index:40;overflow:auto;box-shadow:0 18px 50px rgba(0,0,24,.24)}.resource-guide-popover[hidden]{display:none}.page-guide>div{padding:14px 16px;border-left:1px solid var(--line);min-width:0}.page-guide>div:first-child{border-left:0}.page-guide>div>span{display:block;color:var(--accent);text-transform:uppercase;letter-spacing:.09em;font-size:9.6px;font-weight:780;margin-bottom:6px}.page-guide p{color:var(--muted);font-size:12px;line-height:1.5;margin:0}.page-guide>.guide-review{grid-column:1/-1;border-top:1px solid var(--line);border-left:0}.guide-review ul{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:5px 28px;margin:0;padding-left:18px;color:var(--muted);font-size:11px;line-height:1.45}.guide-links{display:flex;flex-wrap:wrap;gap:5px;margin-top:8px}.guide-links a{color:var(--accent);background:var(--accent-soft);border-radius:99px;padding:4px 7px;text-decoration:none;font-size:9.6px;font-weight:700}
 .operation-tracking{display:grid;gap:2px;min-width:0;text-decoration:none}.operation-tracking strong,.operation-tracking small{display:block;overflow-wrap:anywhere}.operation-tracking small{color:var(--muted);line-height:1.35}.operation-tracking.running strong{color:#176143}.operation-tracking.waiting strong,.operation-tracking.mixed strong{color:var(--amber)}.operation-tracking.paused strong{color:var(--red)}a.operation-tracking:hover strong{text-decoration:underline}
 .page-actions{display:flex;align-items:center;justify-content:flex-end;gap:7px;flex-wrap:wrap}.repository-sync-status{min-height:18px;margin:7px 0 0;color:var(--muted);font-size:13.2px}.repository-sync-status.error{color:var(--red)}.repository-sync-alert{display:flex;align-items:flex-start;gap:9px;padding:10px 22px;border-bottom:1px solid #e9c888;background:#fff8e8;color:var(--ink);font-size:12px;line-height:1.45}.repository-sync-alert.syncing{border-color:var(--line);background:var(--surface-soft)}.repository-sync-alert .status-dot{flex:0 0 auto;margin-top:4px}.repository-sync-alert a{margin-left:auto;white-space:nowrap}.repository-state-banner,.repository-override{display:flex;align-items:flex-start;gap:13px;margin-bottom:14px}.repository-state-banner>.status-dot,.repository-override>.status-dot{margin-top:5px}.repository-state-banner h3{margin:3px 0 5px}.repository-state-banner p:last-child,.repository-override p{margin:0;color:var(--muted);line-height:1.5}.repository-override{padding:14px 17px;border:1px solid #e9c888;border-radius:9px;background:#fff8e8;font-size:13.2px}.repository-override strong{display:block;margin-bottom:4px}.onboarding-dialog{width:min(470px,calc(100vw - 30px));max-height:calc(100vh - 32px);margin:0;border:1px solid var(--line);border-radius:13px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 28px 90px rgba(0,0,24,.38);overflow:hidden}.onboarding-dialog[open]{display:flex;flex-direction:column}.onboarding-dialog::backdrop{background:transparent;backdrop-filter:none}.onboarding-shade{position:fixed;inset:0;z-index:60;pointer-events:none}.onboarding-shade span{position:absolute;background:rgba(0,0,24,.58)}.onboarding-progress{display:grid;flex:0 0 auto;grid-template-columns:repeat(var(--onboarding-step-count),1fr);gap:5px;padding:18px 24px 0}.onboarding-progress span{height:3px;border-radius:3px;background:var(--surface-muted)}.onboarding-progress span.active{background:var(--accent-light)}.onboarding-scroll{min-height:0;overflow-y:auto}.onboarding-head{padding:22px 25px 0}.onboarding-head h2{font-family:Georgia,serif;font-size:30px;font-weight:500;letter-spacing:-.015em;margin:8px 0 0}.onboarding-body{color:var(--muted);font-size:14.4px;line-height:1.6;margin:13px 25px 0}.onboarding-body+.onboarding-body{margin-top:8px}.onboarding-points{display:grid;gap:9px;margin:18px 25px 4px;padding-left:19px}.onboarding-points li{font-size:13.2px;line-height:1.5;padding-left:3px}.onboarding-sections{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin:16px 25px 4px}.onboarding-sections section{padding:13px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft)}.onboarding-sections strong{font-size:13.2px}.onboarding-sections p{margin:6px 0 0;color:var(--muted);font-size:12px;line-height:1.5}.onboarding-actions{flex:0 0 auto;flex-wrap:wrap;padding:12px 25px 23px;border-top:1px solid var(--line);background:var(--panel)}.onboarding-skip{margin-right:auto;color:var(--muted);text-transform:none;letter-spacing:0;font-size:13.2px}.onboarding-form{display:grid;grid-template-columns:1fr 1fr;gap:13px;margin:18px 25px 0}.onboarding-form label{display:block;min-width:0}.onboarding-form label.wide{grid-column:1/-1}.onboarding-form label>span{display:block;color:var(--ink);font-size:12px;font-weight:720;margin-bottom:6px}.onboarding-form input,.onboarding-form select,.onboarding-form textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.onboarding-form textarea{min-height:78px;resize:vertical}.onboarding-form small{display:block;color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:5px}.onboarding-write-note{color:var(--muted);font-size:10.8px;line-height:1.5;margin:12px 25px 16px}.onboarding-scroll>.dialog-error{margin:8px 25px 0}.onboarding-focus{outline:4px solid var(--accent-light)!important;outline-offset:5px;scroll-margin-top:102px}
 .onboarding-save-status{color:var(--muted);font-size:10.8px;line-height:1.35}.onboarding-save-status:empty{display:none}.onboarding-save-status:not(:empty){order:-1;flex-basis:100%;margin-bottom:4px}.onboarding-retry-sync{margin-top:9px}.detail-loading{color:var(--muted)}
@@ -3048,6 +3794,7 @@ html,body{height:100%;overflow:hidden}.shell{grid-template-columns:248px minmax(
 @media(max-width:1100px){.search{display:none}.topbar-status{margin-left:auto}.metrics{grid-template-columns:repeat(2,1fr)}.dashboard-grid,.organization-grid{grid-template-columns:repeat(2,1fr)}.catalog{grid-template-columns:repeat(3,1fr)}.span-2{grid-column:span 2}.resource-directory{grid-template-columns:repeat(2,minmax(0,1fr))}}
 @media(max-width:760px){.shell{display:block}.sidebar{transform:translateX(-100%);transition:.2s;box-shadow:8px 0 30px rgba(0,0,0,.2)}.sidebar.shown{transform:translateX(0)}.workspace{min-width:0}.mobile-nav{display:block;border:0;background:none;font-size:24px}.topbar{height:72px;padding:0 16px}.topbar>div:first-of-type{min-width:0}.topbar-status{display:none}.search{display:flex;max-width:none}.search kbd,.topbar .eyebrow{display:none}.page{padding:20px 15px 60px}.hero{display:block;padding:23px}.hero-meta{margin-top:22px;flex-wrap:wrap}.metrics,.dashboard-grid,.organization-grid{grid-template-columns:1fr}.span-2{grid-column:auto}.catalog{grid-template-columns:repeat(2,1fr)}.detail-grid{grid-template-columns:1fr}.page-intro,.detail-head{display:block}.page-intro>.button,.actions{margin-top:15px}.page-intro>.list-header-tools{justify-content:flex-start;margin:15px 0 0}.list-header-tools label{max-width:none}.record-table{min-width:720px}.readiness-map{padding:17px}.readiness-map-head{grid-template-columns:1fr;gap:8px}.readiness-flow{grid-template-columns:repeat(2,minmax(0,1fr))}.audit-engagement{grid-template-columns:1fr}.audit-engagement .button{grid-column:auto}.resource-directory{grid-template-columns:1fr}}
 @media(max-width:760px){.setup-banner,.page-guide,.stage-overview-hero,.relationship-note,.group-destination-card,.stage-page-grid,.evidence-map-expectation,.evidence-map-links,.external-evidence-list{grid-template-columns:1fr}.context-workflow,.evidence-map-head{align-items:stretch;flex-direction:column}.evidence-map-actions{flex-wrap:wrap}.page-guide>div{border-left:0;border-top:1px solid var(--line)}.page-guide>div:first-child{border-top:0}.group-overview-head{display:block}.stage-progress-card,.stage-status-link{margin-top:15px}.destination-rollup{text-align:left}.form-grid{grid-template-columns:1fr}.record-table{min-width:0}.record-table thead{display:none}.record-table,.record-table tbody,.record-table tr{display:block}.record-table tr{padding:8px 12px;border-bottom:1px solid var(--line)}.record-table tr:last-child{border-bottom:0}.record-table td:not([data-label]){display:block}.record-table td[data-label]{display:grid;grid-template-columns:105px minmax(0,1fr);gap:10px;border:0;padding:7px 0;align-items:start}.record-table td[data-label]::before{content:attr(data-label);color:#75817b;text-transform:uppercase;letter-spacing:.07em;font-size:9.6px;font-weight:700}.record-table td[data-primary-field]{display:block;padding:8px 0 10px}.record-table td[data-primary-field]::before{display:none}.content-label{align-items:flex-start}.editor form{padding:18px}.diagnostics>div{grid-template-columns:58px minmax(0,1fr)}.diagnostics p{grid-column:1/-1}.changes code{overflow-wrap:anywhere}.onboarding-dialog{max-height:56vh}}
+@media(max-width:760px){.guide-review ul,.resource-review-criteria ul{grid-template-columns:1fr}.collection-review-head,.collection-review-foot{align-items:stretch;flex-direction:column}.record-workflow-action{min-width:0}}
 @media(max-width:520px){.onboarding-form,.onboarding-sections,.setup-steps{grid-template-columns:1fr}.onboarding-form label.wide{grid-column:auto}.onboarding-actions{flex-wrap:wrap}.onboarding-skip{width:100%;order:3;margin:3px 0 0}.readiness-flow{grid-template-columns:1fr}.obligation-card-foot{align-items:flex-start;flex-direction:column}.obligation-action{align-self:flex-start}}
 @media(min-width:761px){.detail-grid{grid-template-columns:minmax(270px,1fr) minmax(0,2fr)}.detail-grid aside{grid-column:1;grid-row:1}.detail-main{grid-column:2;grid-row:1}}
 @media(min-width:761px){.detail-grid.detail-grid-structured{grid-template-columns:1fr}.detail-grid-structured aside{grid-column:1;grid-row:1;grid-template-columns:repeat(auto-fit,minmax(320px,1fr))}.detail-grid-structured aside>.panel{align-self:start}}
@@ -3121,11 +3868,12 @@ dialog::backdrop{background:rgba(0,0,24,.62)}
 .commit-files code{font-size:10.8px;overflow-wrap:anywhere}
 .onboarding-progress{grid-template-columns:repeat(var(--onboarding-step-count),1fr)}
 .onboarding-git-status{display:flex;align-items:flex-start;gap:9px;margin:14px 25px 0;padding:10px 12px;border:1px solid var(--line);border-radius:7px;background:var(--surface-soft)}.onboarding-git-status .status-dot{margin-top:4px}.onboarding-git-status strong,.onboarding-git-status small{display:block}.onboarding-git-status strong{font-size:12px}.onboarding-git-status small{color:var(--muted);font-size:10.8px;line-height:1.45;margin-top:3px}.onboarding-git-status code{font-size:10.8px}
-.badge.status-overdue{background:#f7dfdc;color:#873027}.badge.status-due{background:#f6e8c9;color:#79500f}.badge.status-upcoming,.badge.status-proposed{background:var(--accent-soft);color:var(--accent)}.badge.status-complete{background:#dcefe4;color:#125733}
+.badge.status-overdue,.badge.status-blocked{background:#f7dfdc;color:#873027}.badge.status-due{background:#f6e8c9;color:#79500f}.badge.status-upcoming,.badge.status-proposed{background:var(--accent-soft);color:var(--accent)}.badge.status-complete{background:#dcefe4;color:#125733}
 .obligation-preview,.event-reminder-preview{display:grid;gap:8px}.obligation-preview a{display:flex;align-items:flex-start;gap:9px;text-decoration:none;padding:7px 0;border-top:1px solid var(--line)}.obligation-preview a:first-child{border-top:0;padding-top:0}.obligation-preview strong,.obligation-preview small,.event-reminder-preview strong,.event-reminder-preview small{display:block}.obligation-preview strong,.event-reminder-preview strong{font-size:12px}.obligation-preview small,.event-reminder-preview small{font-size:10.8px;color:var(--muted);margin-top:2px}.event-reminder-preview{grid-template-columns:repeat(2,minmax(0,1fr))}.event-reminder-preview a{padding:10px;border-radius:7px;background:var(--surface-soft);text-decoration:none}
-.obligation-board{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:14px;align-items:start}.obligation-column{min-width:0}.obligation-column-head{display:flex;align-items:center;justify-content:space-between;margin:5px 1px 10px}.obligation-column-head>strong{font:500 26.4px Georgia,serif}.obligation-cards{display:grid;gap:9px}.obligation-card{background:var(--panel);border:1px solid var(--line);border-left:4px solid var(--accent-light);border-radius:9px;padding:14px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.obligation-card.status-overdue{border-left-color:var(--red)}.obligation-card.status-due{border-left-color:#d89021}.obligation-card-head{display:flex;justify-content:space-between;gap:8px;text-transform:uppercase;letter-spacing:.06em;font-size:9.6px;color:var(--muted)}.obligation-card-head strong{color:var(--ink);text-align:right}.obligation-card h3{font-size:14.4px;margin:9px 0 7px}.obligation-card h3 a{text-decoration:none}.obligation-card p{font-size:10.8px;line-height:1.5;color:var(--muted);margin:0}.obligation-links{margin-top:10px}.workflow-section{margin-top:30px}.section-head{display:flex;justify-content:space-between;margin-bottom:13px}.section-head h2{font:500 28.8px Georgia,serif;margin:6px 0}.section-head p:not(.kicker){font-size:13.2px;color:var(--muted);margin:0;max-width:720px}.policy-event-feedback{display:grid;grid-template-columns:auto minmax(0,1fr) auto auto;gap:10px;align-items:center;margin-top:14px;padding:12px 14px;border:1px solid #9ccfb2;border-radius:8px;background:#e7f5ec}.policy-event-feedback .status-dot{align-self:start;margin-top:4px}.policy-event-feedback strong,.policy-event-feedback p{display:block}.policy-event-feedback strong{font-size:12px}.policy-event-feedback p{margin:3px 0 0;color:#315d44;font-size:10.8px}.policy-event-feedback .icon-button{width:30px;height:30px}.policy-event-list{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}.policy-event-row{position:relative;display:flex;align-items:center;justify-content:space-between;gap:10px;min-width:0;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:var(--panel)}.policy-event-name{min-width:0}.policy-event-title{display:flex;align-items:center;gap:6px;min-width:0}.policy-event-title>strong{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.policy-event-guide{display:inline-flex;flex:0 0 auto}.policy-event-guide .guide-trigger{width:20px;height:20px}.policy-event-guide .guide-trigger svg{width:14px;height:14px}.policy-event-name strong,.policy-event-name>small{display:block}.policy-event-name strong{font-size:12px}.policy-event-name>small{margin-top:2px;color:var(--muted);font-size:9.6px;line-height:1.35;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.policy-event-row>.button{flex:none;padding:7px 9px;font-size:10.8px}.policy-event-tooltip{position:absolute;z-index:8;top:calc(100% + 7px);left:0;width:min(420px,calc(100vw - 48px));padding:12px 14px;border:1px solid var(--line);border-radius:8px;background:var(--panel);box-shadow:var(--shadow);opacity:0;visibility:hidden;transform:translateY(-3px);transition:opacity .12s,transform .12s,visibility 0s .12s;pointer-events:none}.policy-event-row:nth-child(3n) .policy-event-tooltip{right:0;left:auto}.policy-event-row:hover,.policy-event-row:focus-within{z-index:9}.policy-event-guide:hover .policy-event-tooltip,.policy-event-guide:focus-within .policy-event-tooltip{opacity:1;visibility:visible;transform:none;transition-delay:0s}.policy-event-tooltip>strong{font-size:12px}.policy-event-tooltip ol{display:grid;gap:7px;margin:9px 0 0;padding-left:20px}.policy-event-tooltip li span,.policy-event-tooltip li small{display:block}.policy-event-tooltip li span{font-size:10.8px}.policy-event-tooltip li small{margin-top:2px;color:var(--muted);font-size:9.6px;line-height:1.4}
+.obligation-board{display:grid;grid-template-columns:repeat(auto-fit,minmax(210px,1fr));gap:14px;align-items:start}.obligation-column{min-width:0}.obligation-column-head{display:flex;align-items:center;justify-content:space-between;margin:5px 1px 10px}.obligation-column-head>strong{font:500 26.4px Georgia,serif}.obligation-cards{display:grid;gap:9px}.obligation-card{background:var(--panel);border:1px solid var(--line);border-left:4px solid var(--accent-light);border-radius:9px;padding:14px;box-shadow:0 2px 8px rgba(21,40,33,.025)}.obligation-card.status-overdue,.obligation-card.status-blocked{border-left-color:var(--red)}.obligation-card.status-due{border-left-color:#d89021}.obligation-card-head{display:flex;justify-content:space-between;gap:8px;text-transform:uppercase;letter-spacing:.06em;font-size:9.6px;color:var(--muted)}.obligation-card-head strong{color:var(--ink);text-align:right}.obligation-card h3{font-size:14.4px;margin:9px 0 7px}.obligation-card h3 a{text-decoration:none}.obligation-card p{font-size:10.8px;line-height:1.5;color:var(--muted);margin:0}.obligation-links{margin-top:10px}.workflow-section{margin-top:30px}.section-head{display:flex;justify-content:space-between;margin-bottom:13px}.section-head h2{font:500 28.8px Georgia,serif;margin:6px 0}.section-head p:not(.kicker){font-size:13.2px;color:var(--muted);margin:0;max-width:720px}.policy-event-feedback{display:grid;grid-template-columns:auto minmax(0,1fr) auto auto;gap:10px;align-items:center;margin-top:14px;padding:12px 14px;border:1px solid #9ccfb2;border-radius:8px;background:#e7f5ec}.policy-event-feedback .status-dot{align-self:start;margin-top:4px}.policy-event-feedback strong,.policy-event-feedback p{display:block}.policy-event-feedback strong{font-size:12px}.policy-event-feedback p{margin:3px 0 0;color:#315d44;font-size:10.8px}.policy-event-feedback .icon-button{width:30px;height:30px}.policy-event-list{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:8px}.policy-event-more{margin-top:10px}.policy-event-row{position:relative;display:flex;align-items:center;justify-content:space-between;gap:10px;min-width:0;padding:9px 10px;border:1px solid var(--line);border-radius:8px;background:var(--panel)}.policy-event-row[hidden]{display:none}.policy-event-name{min-width:0}.policy-event-title{display:flex;align-items:center;gap:6px;min-width:0}.policy-event-title>strong{min-width:0;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.policy-event-guide{display:inline-flex;flex:0 0 auto}.policy-event-guide .guide-trigger{width:20px;height:20px}.policy-event-guide .guide-trigger svg{width:14px;height:14px}.policy-event-name strong,.policy-event-name>small{display:block}.policy-event-name strong{font-size:12px}.policy-event-name>small{margin-top:2px;color:var(--muted);font-size:9.6px;line-height:1.35;white-space:nowrap;overflow:hidden;text-overflow:ellipsis}.policy-event-row>.button{flex:none;padding:7px 9px;font-size:10.8px}.policy-event-tooltip{position:absolute;z-index:8;top:calc(100% + 7px);left:0;width:min(420px,calc(100vw - 48px));padding:12px 14px;border:1px solid var(--line);border-radius:8px;background:var(--panel);box-shadow:var(--shadow);opacity:0;visibility:hidden;transform:translateY(-3px);transition:opacity .12s,transform .12s,visibility 0s .12s;pointer-events:none}.policy-event-row:nth-child(3n) .policy-event-tooltip{right:0;left:auto}.policy-event-row:hover,.policy-event-row:focus-within{z-index:9}.policy-event-guide:hover .policy-event-tooltip,.policy-event-guide:focus-within .policy-event-tooltip{opacity:1;visibility:visible;transform:none;transition-delay:0s}.policy-event-tooltip>strong{font-size:12px}.policy-event-tooltip ol{display:grid;gap:7px;margin:9px 0 0;padding-left:20px}.policy-event-tooltip li span,.policy-event-tooltip li small{display:block}.policy-event-tooltip li span{font-size:10.8px}.policy-event-tooltip li small{margin-top:2px;color:var(--muted);font-size:9.6px;line-height:1.4}
 .obligation-card-foot{display:flex;align-items:flex-end;justify-content:space-between;gap:9px;margin-top:10px}.obligation-card-foot .obligation-links{margin-top:0;min-width:0}.obligation-action{flex:0 0 auto;border:0;border-radius:6px;background:var(--accent-soft);color:var(--accent);padding:7px 9px;font-family:inherit;font-size:10.8px;font-weight:700;line-height:1;text-decoration:none;cursor:pointer}.obligation-action:hover{filter:brightness(1.08)}.obligation-action.blocked{background:var(--surface-muted);color:var(--muted)}.obligation-more{width:100%;margin-top:9px}.workflow-section{scroll-margin-top:92px}
-.event-dialog label{display:block;margin-top:13px}.event-dialog label>span{display:block;font-size:12px;font-weight:720;margin-bottom:6px}.event-dialog input,.event-dialog select{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.event-dialog-steps{display:grid;gap:6px;margin-top:15px;padding:10px;background:var(--surface-soft);border-radius:7px}.event-dialog-steps strong,.event-dialog-steps small{display:block}.event-dialog-steps strong{font-size:12px}.event-dialog-steps small{font-size:9.6px;color:var(--muted);margin-top:2px}
+.event-dialog label{display:block;margin-top:13px}.event-dialog label[hidden]{display:none}.event-dialog label>span{display:block;font-size:12px;font-weight:720;margin-bottom:6px}.event-dialog input,.event-dialog select,.event-dialog textarea{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:14.4px}.event-dialog textarea{resize:vertical}.commit-dialog .form-grid label.full{grid-column:1/-1}.workflow-preview{margin-top:14px;padding:0 12px;border-radius:7px;background:var(--surface-soft)}.workflow-preview:not(:empty){padding-top:10px;padding-bottom:10px}.workflow-preview strong,.workflow-preview p{display:block;margin:0}.workflow-preview p{margin-top:5px;color:var(--muted);font-size:12px;line-height:1.5}.event-dialog-steps{display:grid;gap:6px;margin-top:15px;padding:10px;background:var(--surface-soft);border-radius:7px}.event-dialog-steps strong,.event-dialog-steps small{display:block}.event-dialog-steps strong{font-size:12px}.event-dialog-steps small{font-size:9.6px;color:var(--muted);margin-top:2px}
+.applicability-dialog{width:min(980px,calc(100vw - 30px));max-height:calc(100vh - 32px);border:0;border-radius:12px;padding:0;background:var(--panel);color:var(--ink);box-shadow:0 25px 80px rgba(0,0,24,.28)}.applicability-dialog form{padding:23px}.applicability-dialog form>p{color:var(--muted);font-size:13.2px}.review-context label>span{display:block;font-size:12px;font-weight:720;margin-bottom:6px}.review-context input,.review-context select,.applicability-row input,.applicability-row select{width:100%;min-height:38px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:8px 9px;font-size:13.2px}.review-context label.full{grid-column:1/-1}.applicability-rows{display:grid;gap:7px;max-height:46vh;overflow:auto;margin-top:16px;padding-right:4px}.applicability-row{display:grid;grid-template-columns:minmax(210px,1fr) 180px minmax(240px,1.3fr);gap:9px;align-items:center;padding:9px;border:1px solid var(--line);border-radius:8px}.applicability-row strong,.applicability-row small{display:block}.applicability-row small{margin-top:3px;color:var(--muted);font-size:10.8px}
 .packet-builder form{display:grid;grid-template-columns:repeat(3,minmax(0,1fr)) auto;gap:12px;align-items:end}.packet-builder label>span{display:block;font-size:10.8px;font-weight:720;margin-bottom:6px}.packet-builder input,.packet-builder select{width:100%;min-height:40px;border:1px solid var(--line);border-radius:7px;background:var(--field);color:var(--ink);padding:9px 10px;font-size:13.2px}.packet-note,.packet-output>p{font-size:12px;color:var(--muted);margin:12px 0 0}.packet-output{margin:14px 0}.packet-output h3{overflow-wrap:anywhere}.packet-gaps{display:grid}.packet-gaps>div{display:grid;grid-template-columns:58px 1fr;gap:10px;border-top:1px solid var(--line);padding:10px 0}.packet-gaps>div:first-child{border-top:0}.packet-gaps p{font-size:12px;margin:0}.packet-list{display:grid}.packet-list a{display:block;text-decoration:none;border-top:1px solid var(--line);padding:9px 0}.packet-list a:first-child{border-top:0}.packet-list strong,.packet-list small{display:block}.packet-list strong{font-size:12px}.packet-list small{font-size:9.6px;color:var(--muted);margin-top:2px}
 .packet-preflight{display:grid;grid-template-columns:repeat(5,minmax(0,1fr));gap:8px;margin-bottom:12px}.packet-preflight a{display:flex;align-items:flex-start;gap:9px;padding:10px 12px;border:1px solid var(--line);border-radius:8px;background:var(--panel);text-decoration:none}.packet-preflight .status-dot{margin-top:4px}.packet-preflight small,.packet-preflight strong{display:block}.packet-preflight small{color:var(--muted);font-size:9.6px;text-transform:uppercase;letter-spacing:.07em}.packet-preflight strong{margin-top:3px;font-size:12px}.audit-evidence-paths{margin-bottom:12px}.audit-evidence-paths .panel-head p:not(.kicker){margin:4px 0 0;color:var(--muted);font-size:10.8px}.audit-evidence-path-grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;margin-top:12px}.audit-evidence-path-grid>a{display:block;padding:14px;border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);text-decoration:none}.audit-evidence-path-grid h4{margin:7px 0 5px;font-size:13.2px}.audit-evidence-path-grid p{margin:0;color:var(--muted);font-size:10.8px;line-height:1.55}
 .audit-preparation{margin-bottom:12px}.audit-preparation .panel-head{align-items:flex-start}.audit-preparation .panel-head h3{margin:3px 0}.audit-preparation .panel-head p:not(.kicker){margin:4px 0 0;color:var(--muted);font-size:10.8px}.preparation-progress{height:5px;margin:12px 0 0;border-radius:99px;background:var(--surface-muted);overflow:hidden}.preparation-progress span{display:block;height:100%;border-radius:inherit;background:var(--primary-gradient)}.audit-preparation-note{margin:9px 0 0;color:var(--muted);font-size:10.8px;line-height:1.5}.preparation-stages{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:8px;margin-top:12px}.preparation-stage{border:1px solid var(--line);border-radius:8px;background:var(--surface-soft);overflow:hidden}.preparation-stage summary{display:flex;justify-content:space-between;gap:12px;align-items:center;padding:11px 12px;cursor:pointer;list-style:none}.preparation-stage summary::-webkit-details-marker{display:none}.preparation-stage summary span,.preparation-stage summary strong,.preparation-stage summary small{display:block}.preparation-stage summary strong{font-size:12px}.preparation-stage summary small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.4}.preparation-stage summary b{flex:none;color:var(--muted);font-size:9.6px;font-weight:650}.preparation-items{border-top:1px solid var(--line);background:var(--panel)}.preparation-items>a,.preparation-items>div{display:grid;grid-template-columns:22px minmax(0,1fr);gap:9px;padding:10px 12px;border-top:1px solid var(--line);text-decoration:none}.preparation-items>:first-child{border-top:0}.preparation-items strong,.preparation-items small{display:block}.preparation-items strong{font-size:10.8px}.preparation-items small{margin-top:3px;color:var(--muted);font-size:9.6px;line-height:1.45}.preparation-status{display:grid;place-items:center;width:20px;height:20px;border-radius:50%;background:var(--surface-muted);color:var(--muted);font-size:10.8px;font-weight:800}.preparation-status.complete{background:#dcefe4;color:#125733}.preparation-status.action{background:#f7dfdc;color:#873027}.preparation-status.later{background:#f6e8c9;color:#79500f}.preparation-status.external,.preparation-status.info{background:var(--accent-soft);color:var(--accent)}.audit-preparation-error:empty{display:none}
@@ -3135,6 +3883,7 @@ dialog::backdrop{background:rgba(0,0,24,.62)}
 @media(max-width:900px){.overview-grid{grid-template-columns:1fr}.overview-grid>.audit-panel{grid-column:auto}}
 @media(max-width:520px){.event-reminder-preview,.policy-event-list,.packet-builder form,.packet-preflight,.audit-evidence-path-grid{grid-template-columns:1fr}.policy-event-row:nth-child(n) .policy-event-tooltip{right:auto;left:0}.packet-metrics{grid-template-columns:1fr}.obligation-card-head{display:block}.obligation-card-head strong{display:block;text-align:left;margin-top:3px}}
 @media(max-width:520px){.policy-event-feedback{grid-template-columns:auto minmax(0,1fr) auto}.policy-event-feedback>.button{grid-column:2}.policy-event-feedback>.icon-button{grid-column:3;grid-row:1}}
+@media(max-width:760px){.workflow-findings{grid-template-columns:1fr}}
 
 @media(prefers-color-scheme:dark){
   :root{--ink:#f4f5ff;--muted:#b8bfd3;--line:#343d5c;--paper:#000;--panel:#141a2e;--accent:#aab7ff;--accent-soft:#252e52;--accent-light:#9aabff;--focus:#bdc7ff;--amber:#ffd08a;--red:#ffaaa0;--surface-soft:#1b2238;--surface-muted:#252d48;--field:#11172a;--field-readonly:#1c2338;--shadow:0 12px 34px rgba(0,0,0,.3)}
@@ -3146,9 +3895,19 @@ dialog::backdrop{background:rgba(0,0,24,.62)}
   .badge.status-active,.badge.status-approved,.badge.status-complete,.badge.status-passed,.badge.status-accepted{background:#173b2b;color:#a8edc4}
   .badge.status-open,.badge.status-high,.badge.status-critical,.badge.status-failed{background:#4a252a;color:#ffb5ad}
   .badge.status-draft,.badge.status-planned,.badge.status-in-progress,.badge.status-medium{background:#483714;color:#ffd991}
-  .badge.status-overdue{background:#4a252a;color:#ffb5ad}
+  .badge.status-overdue,.badge.status-blocked{background:#4a252a;color:#ffb5ad}
   .badge.status-due{background:#483714;color:#ffd991}
   .badge.status-complete{background:#173b2b;color:#a8edc4}
+  .repository-override,.repository-sync-alert{border-color:#77612f;background:#382f19}
+  .repository-override code{color:#ffe2a3}
+  .workflow-finding-status.ready,.workflow-finding-status.due,.workflow-finding-status.open,.stage-page-completion-state,.readiness-state.warn,.preparation-status.later{background:#483714;color:#ffd991}
+  .workflow-finding-status.overdue,.workflow-finding-status.blocked,.readiness-state.bad,.preparation-status.action{background:#4a252a;color:#ffb5ad}
+  .workflow-finding-status.complete,.stage-page-completion-state.complete,.readiness-state.good,.preparation-status.complete{background:#173b2b;color:#a8edc4}
+  .stage-page-card.complete,.evidence-map-card.complete{border-color:#315f48}
+  .collection-review-panel.required{border-color:#77612f}
+  .collection-review-panel.current{border-color:#315f48}
+  .evidence-map-source.complete{border-color:#315f48;background:#183426}
+  .operation-tracking.running strong{color:#a8edc4}
   .policy-event-feedback{border-color:#315f48;background:#183426}.policy-event-feedback p{color:#b7d8c3}
   .missing-options{border-color:#77612f;background:#382f19;color:#ffdc92}
   .status-dot.neutral{background:#9aabff}