Automated PR: platform-dev → dev (#300)

Automated PR created by Copilot. Commit: 4b0dc2a62e

This PR merges branch `platform-dev` into `dev`.

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #300

.github/agents/copilot-instructions.md

@@ -264,6 +264,8 @@ ## Active Technologies
 - PostgreSQL via existing `tenant_reviews`, `review_packs`, `evidence_snapshots`, findings / finding-exception truth, workspace memberships, and `audit_logs`; no new persistence planned (249-customer-review-workspace)
 - PHP 8.4 (Laravel 12) + Filament v5 + Livewire v4, existing workspace settings stack (`SettingsRegistry`, `SettingsResolver`, `SettingsWriter`), `WorkspaceEntitlementResolver`, `ReviewPackService`, system directory detail page (251-commercial-entitlements-billing-state)
 - PostgreSQL via existing `workspace_settings` rows plus existing audit log records; no new table or billing/account model (251-commercial-entitlements-billing-state)
+- PHP 8.4 (Laravel 12) + Laravel 12 + Filament v5 + Livewire v4 + Pest; existing `UiEnforcement`, `OperationUxPresenter`, `OperationRunService`, `OperationCatalog`, `SystemOperationRunLinks`, `OperationRunLinks`, `AuditRecorder`, `WorkspaceAuditLogger`, and `PlatformCapabilities` (253-remove-findings-backfill-runtime-surfaces)
+- PostgreSQL existing `findings`, `operation_runs`, `audit_logs`, and related runtime tables only; no new persistence, migration, or data backfill is planned (253-remove-findings-backfill-runtime-surfaces)
 
 - PHP 8.4.15 (feat/005-bulk-operations)
 
@@ -298,9 +300,9 @@ ## Code Style
 PHP 8.4.15: Follow standard conventions
 
 ## Recent Changes
+- 253-remove-findings-backfill-runtime-surfaces: Added PHP 8.4 (Laravel 12) + Laravel 12 + Filament v5 + Livewire v4 + Pest; existing `UiEnforcement`, `OperationUxPresenter`, `OperationRunService`, `OperationCatalog`, `SystemOperationRunLinks`, `OperationRunLinks`, `AuditRecorder`, `WorkspaceAuditLogger`, and `PlatformCapabilities`
 - 251-commercial-entitlements-billing-state: Added PHP 8.4 (Laravel 12) + Filament v5 + Livewire v4, existing workspace settings stack (`SettingsRegistry`, `SettingsResolver`, `SettingsWriter`), `WorkspaceEntitlementResolver`, `ReviewPackService`, system directory detail page
 - 249-customer-review-workspace: Added PHP 8.4, Laravel 12 + Filament v5, Livewire v4, Pest v4, existing review/evidence/review-pack/audit/RBAC support services
-- 241-support-diagnostic-pack: Added PHP 8.4 (Laravel 12) + Laravel 12 + Filament v5 + Livewire v4 + Pest; existing `OperationRunLinks`, `GovernanceRunDiagnosticSummaryBuilder`, `ProviderReasonTranslator`, `RelatedNavigationResolver`, `RedactionIntegrity`, `WorkspaceAuditLogger`
 <!-- MANUAL ADDITIONS START -->
 
 ### Pre-production compatibility check

apps/platform/app/Console/Commands/PurgeLegacyBaselineGapRuns.php

@@ -6,12 +6,14 @@
 
 use App\Models\OperationRun;
 use App\Models\Tenant;
+use App\Support\OperationCatalog;
+use App\Support\OperationRunType;
 use Illuminate\Console\Command;
 
 class PurgeLegacyBaselineGapRuns extends Command
 {
     protected $signature = 'tenantpilot:baselines:purge-legacy-gap-runs
-        {--type=* : Limit cleanup to baseline_compare and/or baseline_capture runs}
+        {--type=* : Limit cleanup to baseline.compare and/or baseline.capture runs (legacy aliases also accepted)}
         {--tenant=* : Limit cleanup to tenant ids or tenant external ids}
         {--workspace=* : Limit cleanup to workspace ids}
         {--limit=500 : Maximum candidate runs to inspect}
@@ -99,21 +101,35 @@ public function handle(): int
      */
     private function normalizedTypes(): array
     {
-        $types = array_values(array_unique(array_filter(
+        $requestedTypes = array_values(array_unique(array_filter(
             array_map(
                 static fn (mixed $type): ?string => is_string($type) && trim($type) !== '' ? trim($type) : null,
                 (array) $this->option('type'),
             ),
         )));
 
-        if ($types === []) {
-            return ['baseline_compare', 'baseline_capture'];
+        $canonicalTypes = array_values(array_unique(array_filter(array_map(
+            static fn (string $type): ?string => match ($type) {
+                OperationRunType::BaselineCompare->value, 'baseline_compare' => OperationRunType::BaselineCompare->value,
+                OperationRunType::BaselineCapture->value, 'baseline_capture' => OperationRunType::BaselineCapture->value,
+                default => null,
+            },
+            $requestedTypes,
+        ))));
+
+        if ($canonicalTypes === []) {
+            $canonicalTypes = [
+                OperationRunType::BaselineCompare->value,
+                OperationRunType::BaselineCapture->value,
+            ];
         }
 
-        return array_values(array_filter(
-            $types,
-            static fn (string $type): bool => in_array($type, ['baseline_compare', 'baseline_capture'], true),
-        ));
+        return array_values(array_unique(array_merge(
+            ...array_map(
+                static fn (string $type): array => OperationCatalog::rawValuesForCanonical($type),
+                $canonicalTypes,
+            ),
+        )));
     }
 
     /**

apps/platform/app/Console/Commands/TenantpilotBackfillFindingLifecycle.php

@@ -1,129 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Console\Commands;
-
-use App\Models\Tenant;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\OperationalControls\OperationalControlBlockedException;
-use Illuminate\Console\Command;
-use Illuminate\Validation\ValidationException;
-
-class TenantpilotBackfillFindingLifecycle extends Command
-{
-    protected $signature = 'tenantpilot:findings:backfill-lifecycle
-        {--tenant=* : Limit to tenant_id/external_id}';
-
-    protected $description = 'Queue tenant-scoped findings lifecycle backfill jobs idempotently.';
-
-    public function handle(FindingsLifecycleBackfillRunbookService $runbookService): int
-    {
-        $tenantIdentifiers = array_values(array_filter((array) $this->option('tenant')));
-
-        if ($tenantIdentifiers === []) {
-            $this->error('Provide one or more tenants via --tenant={id|external_id}.');
-
-            return self::FAILURE;
-        }
-
-        $tenants = $this->resolveTenants($tenantIdentifiers);
-
-        if ($tenants->isEmpty()) {
-            $this->info('No tenants matched the provided identifiers.');
-
-            return self::SUCCESS;
-        }
-
-        $queued = 0;
-        $skipped = 0;
-        $nothingToDo = 0;
-
-        foreach ($tenants as $tenant) {
-            if (! $tenant instanceof Tenant) {
-                continue;
-            }
-
-            try {
-                $run = $runbookService->start(
-                    scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-                    initiator: null,
-                    reason: null,
-                    source: 'cli',
-                );
-            } catch (OperationalControlBlockedException $e) {
-                $this->error(sprintf(
-                    'Backfill paused for tenant %d: %s',
-                    (int) $tenant->getKey(),
-                    $e->getMessage(),
-                ));
-
-                return self::FAILURE;
-            } catch (ValidationException $e) {
-                $errors = $e->errors();
-
-                if (isset($errors['preflight.affected_count'])) {
-                    $nothingToDo++;
-
-                    continue;
-                }
-
-                $this->error(sprintf(
-                    'Backfill blocked for tenant %d: %s',
-                    (int) $tenant->getKey(),
-                    $e->getMessage(),
-                ));
-
-                return self::FAILURE;
-            }
-
-            if (! $run->wasRecentlyCreated) {
-                $skipped++;
-
-                continue;
-            }
-
-            $queued++;
-        }
-
-        $this->info(sprintf(
-            'Queued %d backfill run(s), skipped %d duplicate run(s), nothing to do %d.',
-            $queued,
-            $skipped,
-            $nothingToDo,
-        ));
-
-        return self::SUCCESS;
-    }
-
-    /**
-     * @param  array<int, string>  $tenantIdentifiers
-     * @return \Illuminate\Support\Collection<int, Tenant>
-     */
-    private function resolveTenants(array $tenantIdentifiers)
-    {
-        $tenantIds = [];
-
-        foreach ($tenantIdentifiers as $identifier) {
-            $tenant = Tenant::query()
-                ->forTenant($identifier)
-                ->first();
-
-            if ($tenant instanceof Tenant) {
-                $tenantIds[] = (int) $tenant->getKey();
-            }
-        }
-
-        $tenantIds = array_values(array_unique($tenantIds));
-
-        if ($tenantIds === []) {
-            return collect();
-        }
-
-        return Tenant::query()
-            ->whereIn('id', $tenantIds)
-            ->orderBy('id')
-            ->get();
-    }
-}

apps/platform/app/Console/Commands/TenantpilotRunDeployRunbooks.php

@@ -1,56 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Console\Commands;
-
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Services\Runbooks\RunbookReason;
-use App\Support\OperationalControls\OperationalControlBlockedException;
-use Illuminate\Console\Command;
-use Illuminate\Validation\ValidationException;
-
-class TenantpilotRunDeployRunbooks extends Command
-{
-    protected $signature = 'tenantpilot:run-deploy-runbooks';
-
-    protected $description = 'Run deploy-time runbooks idempotently.';
-
-    public function handle(FindingsLifecycleBackfillRunbookService $runbookService): int
-    {
-        try {
-            $runbookService->start(
-                scope: FindingsLifecycleBackfillScope::allTenants(),
-                initiator: null,
-                reason: new RunbookReason(
-                    reasonCode: RunbookReason::CODE_DATA_REPAIR,
-                    reasonText: 'Deploy hook automated runbooks',
-                ),
-                source: 'deploy_hook',
-            );
-
-            $this->info('Deploy runbooks started (if needed).');
-
-            return self::SUCCESS;
-        } catch (OperationalControlBlockedException $e) {
-            $this->info('Deploy runbooks paused: '.$e->getMessage());
-
-            return self::SUCCESS;
-        } catch (ValidationException $e) {
-            $errors = $e->errors();
-
-            $skippable = isset($errors['preflight.affected_count']) || isset($errors['scope']);
-
-            if ($skippable) {
-                $this->info('Deploy runbooks skipped (nothing to do or already running).');
-
-                return self::SUCCESS;
-            }
-
-            $this->error('Deploy runbooks blocked by validation errors.');
-
-            return self::FAILURE;
-        }
-    }
-}

apps/platform/app/Filament/Pages/Reviews/CustomerReviewWorkspace.php

@@ -16,6 +16,11 @@
 use App\Support\Findings\FindingOutcomeSemantics;
 use App\Support\Filament\TablePaginationProfiles;
 use App\Support\ReviewPackStatus;
+use App\Support\Ui\ActionSurface\ActionSurfaceDeclaration;
+use App\Support\Ui\ActionSurface\Enums\ActionSurfaceInspectAffordance;
+use App\Support\Ui\ActionSurface\Enums\ActionSurfaceProfile;
+use App\Support\Ui\ActionSurface\Enums\ActionSurfaceSlot;
+use App\Support\Ui\ActionSurface\Enums\ActionSurfaceType;
 use App\Support\Ui\GovernanceArtifactTruth\ArtifactTruthEnvelope;
 use App\Support\Ui\GovernanceArtifactTruth\ArtifactTruthPresenter;
 use App\Support\Ui\GovernanceArtifactTruth\CompressedGovernanceOutcome;
@@ -57,6 +62,16 @@ class CustomerReviewWorkspace extends Page implements HasTable
 
     protected string $view = 'filament.pages.reviews.customer-review-workspace';
 
+    public static function actionSurfaceDeclaration(): ActionSurfaceDeclaration
+    {
+        return ActionSurfaceDeclaration::forPage(ActionSurfaceProfile::RunLog, ActionSurfaceType::ReadOnlyRegistryReport)
+            ->satisfy(ActionSurfaceSlot::ListHeader, 'Header actions provide a single Clear filters action for the customer review workspace.')
+            ->satisfy(ActionSurfaceSlot::InspectAffordance, ActionSurfaceInspectAffordance::ClickableRow->value)
+            ->exempt(ActionSurfaceSlot::ListBulkMoreGroup, 'The customer review workspace remains scan-first and does not expose bulk actions.')
+            ->satisfy(ActionSurfaceSlot::ListEmptyState, 'The empty state keeps exactly one Clear filters CTA when filters are active.')
+            ->exempt(ActionSurfaceSlot::DetailHeader, 'Row navigation opens the latest published review detail instead of an inline canonical detail panel.');
+    }
+
     public static function getNavigationGroup(): string
     {
         return __('localization.review.reporting');

apps/platform/app/Filament/Resources/FindingResource.php

@@ -308,8 +308,6 @@ public static function infolist(Schema $schema): Schema
                                 ? OperationRunLinks::tenantlessView((int) $record->current_operation_run_id, static::findingRunNavigationContext($record))
                                 : null)
                             ->openUrlInNewTab(),
-                        TextEntry::make('acknowledged_at')->dateTime()->placeholder('—'),
-                        TextEntry::make('acknowledged_by_user_id')->label('Acknowledged by')->placeholder('—'),
                         TextEntry::make('first_seen_at')->label('First seen')->dateTime()->placeholder('—'),
                         TextEntry::make('last_seen_at')->label('Last seen')->dateTime()->placeholder('—'),
                         TextEntry::make('times_seen')->label('Times seen')->placeholder('—'),
@@ -1000,7 +998,6 @@ public static function table(Table $table): Table
                                     if (! in_array((string) $record->status, [
                                         Finding::STATUS_NEW,
                                         Finding::STATUS_REOPENED,
-                                        Finding::STATUS_ACKNOWLEDGED,
                                     ], true)) {
                                         $skippedCount++;
 
@@ -1416,7 +1413,6 @@ public static function triageAction(): Actions\Action
                 ->visible(fn (Finding $record): bool => in_array((string) $record->status, [
                     Finding::STATUS_NEW,
                     Finding::STATUS_REOPENED,
-                    Finding::STATUS_ACKNOWLEDGED,
                 ], true))
                 ->action(function (Finding $record, FindingWorkflowService $workflow): void {
                     static::runWorkflowMutation(
@@ -1441,7 +1437,6 @@ public static function startProgressAction(): Actions\Action
                 ->color('info')
                 ->visible(fn (Finding $record): bool => in_array((string) $record->status, [
                     Finding::STATUS_TRIAGED,
-                    Finding::STATUS_ACKNOWLEDGED,
                 ], true))
                 ->action(function (Finding $record, FindingWorkflowService $workflow): void {
                     static::runWorkflowMutation(

apps/platform/app/Filament/Resources/FindingResource/Pages/ListFindings.php

@@ -10,14 +10,8 @@
 use App\Models\Tenant;
 use App\Models\User;
 use App\Services\Findings\FindingWorkflowService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
 use App\Support\Auth\Capabilities;
 use App\Support\Filament\CanonicalAdminTenantFilterState;
-use App\Support\OperationRunLinks;
-use App\Support\OpsUx\OperationUxPresenter;
-use App\Support\OpsUx\OpsUxBrowserEvents;
-use App\Support\OperationalControls\OperationalControlBlockedException;
 use App\Support\Rbac\UiEnforcement;
 use App\Support\Rbac\UiTooltips;
 use Filament\Actions;
@@ -108,77 +102,6 @@ protected function getHeaderActions(): array
     {
         $actions = [];
 
-        $actions[] = UiEnforcement::forAction(
-            Actions\Action::make('backfill_lifecycle')
-                ->label('Backfill findings lifecycle')
-                ->icon('heroicon-o-wrench-screwdriver')
-                ->color('gray')
-                ->requiresConfirmation()
-                ->modalHeading('Backfill findings lifecycle')
-                ->modalDescription('This will backfill legacy Findings data (lifecycle fields, SLA due dates, and drift duplicate consolidation) for the current tenant. The operation runs in the background.')
-                ->action(function (FindingsLifecycleBackfillRunbookService $runbookService): void {
-                    $user = auth()->user();
-
-                    if (! $user instanceof User) {
-                        abort(403);
-                    }
-
-                    $tenant = static::resolveTenantContextForCurrentPanel();
-
-                    if (! $tenant instanceof Tenant) {
-                        abort(404);
-                    }
-
-                    try {
-                        $opRun = $runbookService->start(
-                            scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-                            initiator: $user,
-                            reason: null,
-                            source: 'tenant_ui',
-                        );
-                    } catch (OperationalControlBlockedException $exception) {
-                        Notification::make()
-                            ->title($exception->title())
-                            ->body($exception->getMessage())
-                            ->warning()
-                            ->send();
-
-                        throw new \Filament\Support\Exceptions\Halt;
-                    }
-
-                    $runUrl = OperationRunLinks::view($opRun, $tenant);
-
-                    if ($opRun->wasRecentlyCreated === false) {
-                        OpsUxBrowserEvents::dispatchRunEnqueued($this);
-
-                        OperationUxPresenter::alreadyQueuedToast((string) $opRun->type)
-                            ->actions([
-                                Actions\Action::make('view_run')
-                                    ->label('Open operation')
-                                    ->url($runUrl),
-                            ])
-                            ->send();
-
-                        return;
-                    }
-
-                    OpsUxBrowserEvents::dispatchRunEnqueued($this);
-
-                    OperationUxPresenter::queuedToast((string) $opRun->type)
-                        ->body('The backfill will run in the background. You can continue working while it completes.')
-                        ->actions([
-                            Actions\Action::make('view_run')
-                                ->label('Open operation')
-                                ->url($runUrl),
-                        ])
-                        ->send();
-                })
-        )
-            ->preserveVisibility()
-            ->requireCapability(Capabilities::TENANT_MANAGE)
-            ->tooltip(UiTooltips::INSUFFICIENT_PERMISSION)
-            ->apply();
-
         $actions[] = UiEnforcement::forAction(
             Actions\Action::make('triage_all_matching')
                 ->label('Triage all matching')
@@ -248,7 +171,6 @@ protected function getHeaderActions(): array
                             if (! in_array((string) $finding->status, [
                                 Finding::STATUS_NEW,
                                 Finding::STATUS_REOPENED,
-                                Finding::STATUS_ACKNOWLEDGED,
                             ], true)) {
                                 $skippedCount++;
 

apps/platform/app/Filament/System/Pages/Ops/Controls.php

@@ -57,11 +57,6 @@ public static function canAccess(): bool
             && $user->hasCapability(PlatformCapabilities::OPS_CONTROLS_MANAGE);
     }
 
-    public function mount(): void
-    {
-        abort_unless(static::canAccess(), 403);
-    }
-
     public function getHeader(): ?View
     {
         return view('filament.system.pages.ops.partials.controls-header', [

apps/platform/app/Filament/System/Pages/Ops/Runbooks.php

@@ -4,26 +4,9 @@
 
 namespace App\Filament\System\Pages\Ops;
 
-use App\Models\OperationRun;
 use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Auth\BreakGlassSession;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Services\Runbooks\RunbookReason;
-use App\Services\System\AllowedTenantUniverse;
 use App\Support\Auth\PlatformCapabilities;
-use App\Support\OpsUx\OperationUxPresenter;
-use App\Support\OperationalControls\OperationalControlBlockedException;
-use App\Support\System\SystemOperationRunLinks;
-use Filament\Actions\Action;
-use Filament\Forms\Components\Radio;
-use Filament\Forms\Components\Select;
-use Filament\Forms\Components\Textarea;
-use Filament\Forms\Components\TextInput;
-use Filament\Notifications\Notification;
 use Filament\Pages\Page;
-use Illuminate\Validation\ValidationException;
 
 class Runbooks extends Page
 {
@@ -37,53 +20,6 @@ class Runbooks extends Page
 
     protected string $view = 'filament.system.pages.ops.runbooks';
 
-    public string $findingsScopeMode = FindingsLifecycleBackfillScope::MODE_ALL_TENANTS;
-
-    public ?int $findingsTenantId = null;
-
-    public string $scopeMode = FindingsLifecycleBackfillScope::MODE_ALL_TENANTS;
-
-    public ?int $tenantId = null;
-
-    /**
-     * @var array{affected_count: int, total_count: int, estimated_tenants?: int|null}|null
-     */
-    public ?array $findingsPreflight = null;
-
-    /**
-     * @var array{affected_count: int, total_count: int, estimated_tenants?: int|null}|null
-     */
-    public ?array $preflight = null;
-
-    public function findingsScopeLabel(): string
-    {
-        if ($this->findingsScopeMode === FindingsLifecycleBackfillScope::MODE_ALL_TENANTS) {
-            return 'All tenants';
-        }
-
-        $tenantName = $this->selectedTenantName($this->findingsTenantId);
-
-        if ($tenantName !== null) {
-            return "Single tenant ({$tenantName})";
-        }
-
-        return $this->findingsTenantId !== null ? "Single tenant (#{$this->findingsTenantId})" : 'Single tenant';
-    }
-
-    public function findingsLastRun(): ?OperationRun
-    {
-        return $this->lastRunForType(FindingsLifecycleBackfillRunbookService::RUNBOOK_KEY);
-    }
-
-    public function selectedTenantName(?int $tenantId): ?string
-    {
-        if ($tenantId === null) {
-            return null;
-        }
-
-        return Tenant::query()->whereKey($tenantId)->value('name');
-    }
-
     public static function canAccess(): bool
     {
         $user = auth('platform')->user();
@@ -95,231 +31,4 @@ public static function canAccess(): bool
         return $user->hasCapability(PlatformCapabilities::OPS_VIEW)
             && $user->hasCapability(PlatformCapabilities::RUNBOOKS_VIEW);
     }
-
-    /**
-     * @return array<Action>
-     */
-    protected function getHeaderActions(): array
-    {
-        return [
-            Action::make('preflight')
-                ->label('Preflight')
-                ->color('gray')
-                ->icon('heroicon-o-magnifying-glass')
-                ->form($this->findingsScopeForm())
-                ->action(function (array $data, FindingsLifecycleBackfillRunbookService $runbookService): void {
-                    $scope = $this->trustedFindingsScopeFromFormData($data, app(AllowedTenantUniverse::class));
-
-                    $this->findingsScopeMode = $scope->mode;
-                    $this->findingsTenantId = $scope->tenantId;
-                    $this->scopeMode = $scope->mode;
-                    $this->tenantId = $scope->tenantId;
-
-                    $this->findingsPreflight = $runbookService->preflight($scope);
-                    $this->preflight = $this->findingsPreflight;
-
-                    Notification::make()
-                        ->title('Preflight complete')
-                        ->success()
-                        ->send();
-                }),
-
-            Action::make('run')
-                ->label('Run…')
-                ->icon('heroicon-o-play')
-                ->color('danger')
-                ->requiresConfirmation()
-                ->modalHeading('Run: Rebuild Findings Lifecycle')
-                ->modalDescription('This operation may modify customer data. Review the preflight and confirm before running.')
-                ->form($this->findingsRunForm())
-                ->disabled(fn (): bool => ! is_array($this->findingsPreflight) || (int) ($this->findingsPreflight['affected_count'] ?? 0) <= 0)
-                ->action(function (array $data, FindingsLifecycleBackfillRunbookService $runbookService): void {
-                    if (! is_array($this->findingsPreflight) || (int) ($this->findingsPreflight['affected_count'] ?? 0) <= 0) {
-                        throw ValidationException::withMessages([
-                            'preflight' => 'Run preflight first.',
-                        ]);
-                    }
-
-                    $scope = $this->trustedFindingsScopeFromState(app(AllowedTenantUniverse::class));
-
-                    $user = auth('platform')->user();
-
-                    if (! $user instanceof PlatformUser) {
-                        abort(403);
-                    }
-
-                    if (! $user->hasCapability(PlatformCapabilities::RUNBOOKS_RUN)
-                        || ! $user->hasCapability(PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL)
-                    ) {
-                        abort(403);
-                    }
-
-                    if ($scope->isAllTenants()) {
-                        $typedConfirmation = (string) ($data['typed_confirmation'] ?? '');
-
-                        if ($typedConfirmation !== 'BACKFILL') {
-                            throw ValidationException::withMessages([
-                                'typed_confirmation' => 'Please type BACKFILL to confirm.',
-                            ]);
-                        }
-                    }
-
-                    $reason = RunbookReason::fromNullableArray([
-                        'reason_code' => $data['reason_code'] ?? null,
-                        'reason_text' => $data['reason_text'] ?? null,
-                    ]);
-
-                    try {
-                        $run = $runbookService->start(
-                            scope: $scope,
-                            initiator: $user,
-                            reason: $reason,
-                            source: 'system_ui',
-                        );
-                    } catch (OperationalControlBlockedException $exception) {
-                        Notification::make()
-                            ->title($exception->title())
-                            ->body($exception->getMessage())
-                            ->warning()
-                            ->send();
-
-                        throw new \Filament\Support\Exceptions\Halt;
-                    }
-
-                    $viewUrl = SystemOperationRunLinks::view($run);
-
-                    $toast = $run->wasRecentlyCreated
-                        ? OperationUxPresenter::queuedToast((string) $run->type)->body('The runbook will execute in the background.')
-                        : OperationUxPresenter::alreadyQueuedToast((string) $run->type);
-
-                    $toast
-                        ->actions([
-                            Action::make('view_run')
-                                ->label('View run')
-                                ->url($viewUrl),
-                        ])
-                        ->send();
-                }),
-        ];
-    }
-
-    /**
-     * @return array<int, \Filament\Schemas\Components\Component>
-     */
-    private function findingsScopeForm(): array
-    {
-        return [
-            Radio::make('scope_mode')
-                ->label('Scope')
-                ->options([
-                    FindingsLifecycleBackfillScope::MODE_ALL_TENANTS => 'All tenants',
-                    FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT => 'Single tenant',
-                ])
-                ->default($this->findingsScopeMode)
-                ->live()
-                ->required(),
-
-            Select::make('tenant_id')
-                ->label('Tenant')
-                ->searchable()
-                ->visible(fn (callable $get): bool => $get('scope_mode') === FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-                ->required(fn (callable $get): bool => $get('scope_mode') === FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-                ->getSearchResultsUsing(function (string $search, AllowedTenantUniverse $universe): array {
-                    return $universe
-                        ->query()
-                        ->where('name', 'like', "%{$search}%")
-                        ->orderBy('name')
-                        ->limit(25)
-                        ->pluck('name', 'id')
-                        ->all();
-                })
-                ->getOptionLabelUsing(function ($value, AllowedTenantUniverse $universe): ?string {
-                    if (! is_numeric($value)) {
-                        return null;
-                    }
-
-                    return $universe
-                        ->query()
-                        ->whereKey((int) $value)
-                        ->value('name');
-                }),
-        ];
-    }
-
-    /**
-     * @return array<int, \Filament\Schemas\Components\Component>
-     */
-    private function findingsRunForm(): array
-    {
-        return [
-            TextInput::make('typed_confirmation')
-                ->label('Type BACKFILL to confirm')
-                ->visible(fn (): bool => $this->findingsScopeMode === FindingsLifecycleBackfillScope::MODE_ALL_TENANTS)
-                ->required(fn (): bool => $this->findingsScopeMode === FindingsLifecycleBackfillScope::MODE_ALL_TENANTS)
-                ->in(['BACKFILL'])
-                ->validationMessages([
-                    'in' => 'Please type BACKFILL to confirm.',
-                ]),
-
-            Select::make('reason_code')
-                ->label('Reason code')
-                ->options(RunbookReason::options())
-                ->required(function (BreakGlassSession $breakGlass): bool {
-                    return $this->findingsScopeMode === FindingsLifecycleBackfillScope::MODE_ALL_TENANTS || $breakGlass->isActive();
-                }),
-
-            Textarea::make('reason_text')
-                ->label('Reason')
-                ->rows(4)
-                ->maxLength(500)
-                ->required(function (BreakGlassSession $breakGlass): bool {
-                    return $this->findingsScopeMode === FindingsLifecycleBackfillScope::MODE_ALL_TENANTS || $breakGlass->isActive();
-                }),
-        ];
-    }
-
-    private function lastRunForType(string $type): ?OperationRun
-    {
-        $platformTenant = Tenant::query()->where('external_id', 'platform')->first();
-
-        if (! $platformTenant instanceof Tenant) {
-            return null;
-        }
-
-        return OperationRun::query()
-            ->where('workspace_id', (int) $platformTenant->workspace_id)
-            ->where('type', $type)
-            ->latest('id')
-            ->first();
-    }
-
-    /**
-     * @param  array<string, mixed>  $data
-     */
-    private function trustedFindingsScopeFromFormData(array $data, AllowedTenantUniverse $allowedTenantUniverse): FindingsLifecycleBackfillScope
-    {
-        $scope = FindingsLifecycleBackfillScope::fromArray([
-            'mode' => $data['scope_mode'] ?? null,
-            'tenant_id' => $data['tenant_id'] ?? null,
-        ]);
-
-        if (! $scope->isSingleTenant()) {
-            return $scope;
-        }
-
-        $tenant = $allowedTenantUniverse->resolveAllowedOrFail($scope->tenantId);
-
-        return FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey());
-    }
-
-    private function trustedFindingsScopeFromState(AllowedTenantUniverse $allowedTenantUniverse): FindingsLifecycleBackfillScope
-    {
-        if ($this->findingsScopeMode !== FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT) {
-            return FindingsLifecycleBackfillScope::allTenants();
-        }
-
-        $tenant = $allowedTenantUniverse->resolveAllowedOrFail($this->findingsTenantId);
-
-        return FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey());
-    }
 }

apps/platform/app/Jobs/BackfillFindingLifecycleJob.php

@@ -1,398 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Jobs;
-
-use App\Models\Finding;
-use App\Models\Tenant;
-use App\Models\User;
-use App\Services\Findings\FindingSlaPolicy;
-use App\Services\OperationRunService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Support\OperationRunOutcome;
-use App\Support\OperationRunStatus;
-use App\Support\OpsUx\RunFailureSanitizer;
-use Carbon\CarbonImmutable;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Bus\Dispatchable;
-use Illuminate\Queue\InteractsWithQueue;
-use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Arr;
-use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Cache;
-use Throwable;
-
-class BackfillFindingLifecycleJob implements ShouldQueue
-{
-    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
-
-    public function __construct(
-        public readonly int $tenantId,
-        public readonly int $workspaceId,
-        public readonly ?int $initiatorUserId = null,
-    ) {}
-
-    public function handle(
-        OperationRunService $operationRuns,
-        FindingSlaPolicy $slaPolicy,
-        FindingsLifecycleBackfillRunbookService $runbookService,
-    ): void {
-        $tenant = Tenant::query()->find($this->tenantId);
-
-        if (! $tenant instanceof Tenant) {
-            return;
-        }
-
-        $initiator = $this->initiatorUserId !== null
-            ? User::query()->find($this->initiatorUserId)
-            : null;
-
-        $operationRun = $operationRuns->ensureRunWithIdentity(
-            tenant: $tenant,
-            type: 'findings.lifecycle.backfill',
-            identityInputs: [
-                'tenant_id' => $this->tenantId,
-                'trigger' => 'backfill',
-            ],
-            context: [
-                'workspace_id' => $this->workspaceId,
-                'initiator_user_id' => $this->initiatorUserId,
-            ],
-            initiator: $initiator instanceof User ? $initiator : null,
-        );
-
-        $lock = Cache::lock(sprintf('tenantpilot:findings:lifecycle_backfill:tenant:%d', $this->tenantId), 900);
-
-        if (! $lock->get()) {
-            if ($operationRun->status !== OperationRunStatus::Completed->value) {
-                $operationRuns->updateRun(
-                    $operationRun,
-                    status: OperationRunStatus::Completed->value,
-                    outcome: OperationRunOutcome::Blocked->value,
-                    failures: [
-                        [
-                            'code' => 'findings.lifecycle.backfill.lock_busy',
-                            'message' => 'Another findings lifecycle backfill is already running for this tenant.',
-                        ],
-                    ],
-                );
-            }
-
-            $runbookService->maybeFinalize($operationRun);
-
-            return;
-        }
-
-        try {
-            $total = (int) Finding::query()
-                ->where('tenant_id', $tenant->getKey())
-                ->count();
-
-            $operationRuns->updateRun(
-                $operationRun,
-                status: OperationRunStatus::Running->value,
-                outcome: OperationRunOutcome::Pending->value,
-                summaryCounts: [
-                    'total' => $total,
-                    'processed' => 0,
-                    'updated' => 0,
-                    'skipped' => 0,
-                    'failed' => 0,
-                ],
-            );
-
-            $operationRun->refresh();
-
-            $backfillStartedAt = $operationRun->started_at !== null
-                ? CarbonImmutable::instance($operationRun->started_at)
-                : CarbonImmutable::now('UTC');
-
-            Finding::query()
-                ->where('tenant_id', $tenant->getKey())
-                ->orderBy('id')
-                ->chunkById(200, function (Collection $findings) use ($tenant, $slaPolicy, $operationRuns, $operationRun, $backfillStartedAt): void {
-                    $processed = 0;
-                    $updated = 0;
-                    $skipped = 0;
-
-                    foreach ($findings as $finding) {
-                        if (! $finding instanceof Finding) {
-                            continue;
-                        }
-
-                        $processed++;
-
-                        $originalAttributes = $finding->getAttributes();
-
-                        $this->backfillLifecycleFields($finding, $backfillStartedAt);
-                        $this->backfillLegacyAcknowledgedStatus($finding);
-                        $this->backfillSlaFields($finding, $tenant, $slaPolicy, $backfillStartedAt);
-                        $this->backfillDriftRecurrenceKey($finding);
-
-                        if ($finding->isDirty()) {
-                            $finding->save();
-                            $updated++;
-                        } else {
-                            $finding->setRawAttributes($originalAttributes, sync: true);
-                            $skipped++;
-                        }
-                    }
-
-                    $operationRuns->incrementSummaryCounts($operationRun, [
-                        'processed' => $processed,
-                        'updated' => $updated,
-                        'skipped' => $skipped,
-                    ]);
-                });
-
-            $consolidatedDuplicates = $this->consolidateDriftDuplicates($tenant, $backfillStartedAt);
-
-            if ($consolidatedDuplicates > 0) {
-                $operationRuns->incrementSummaryCounts($operationRun, [
-                    'updated' => $consolidatedDuplicates,
-                ]);
-            }
-
-            $operationRuns->updateRun(
-                $operationRun,
-                status: OperationRunStatus::Completed->value,
-                outcome: OperationRunOutcome::Succeeded->value,
-            );
-
-            $runbookService->maybeFinalize($operationRun);
-        } catch (Throwable $e) {
-            $message = RunFailureSanitizer::sanitizeMessage($e->getMessage());
-            $reasonCode = RunFailureSanitizer::normalizeReasonCode($e->getMessage());
-
-            $operationRuns->updateRun(
-                $operationRun,
-                status: OperationRunStatus::Completed->value,
-                outcome: OperationRunOutcome::Failed->value,
-                failures: [[
-                    'code' => 'findings.lifecycle.backfill.failed',
-                    'reason_code' => $reasonCode,
-                    'message' => $message !== '' ? $message : 'Findings lifecycle backfill failed.',
-                ]],
-            );
-
-            $runbookService->maybeFinalize($operationRun);
-
-            throw $e;
-        } finally {
-            $lock->release();
-        }
-    }
-
-    private function backfillLifecycleFields(Finding $finding, CarbonImmutable $backfillStartedAt): void
-    {
-        $createdAt = $finding->created_at !== null ? CarbonImmutable::instance($finding->created_at) : $backfillStartedAt;
-
-        if ($finding->first_seen_at === null) {
-            $finding->first_seen_at = $createdAt;
-        }
-
-        if ($finding->last_seen_at === null) {
-            $finding->last_seen_at = $createdAt;
-        }
-
-        if ($finding->last_seen_at !== null && $finding->first_seen_at !== null) {
-            $lastSeen = CarbonImmutable::instance($finding->last_seen_at);
-            $firstSeen = CarbonImmutable::instance($finding->first_seen_at);
-
-            if ($lastSeen->lessThan($firstSeen)) {
-                $finding->last_seen_at = $firstSeen;
-            }
-        }
-
-        $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;
-
-        if ($timesSeen < 1) {
-            $finding->times_seen = 1;
-        }
-    }
-
-    private function backfillLegacyAcknowledgedStatus(Finding $finding): void
-    {
-        if ($finding->status !== Finding::STATUS_ACKNOWLEDGED) {
-            return;
-        }
-
-        $finding->status = Finding::STATUS_TRIAGED;
-
-        if ($finding->triaged_at === null) {
-            if ($finding->acknowledged_at !== null) {
-                $finding->triaged_at = CarbonImmutable::instance($finding->acknowledged_at);
-            } elseif ($finding->created_at !== null) {
-                $finding->triaged_at = CarbonImmutable::instance($finding->created_at);
-            }
-        }
-    }
-
-    private function backfillSlaFields(
-        Finding $finding,
-        Tenant $tenant,
-        FindingSlaPolicy $slaPolicy,
-        CarbonImmutable $backfillStartedAt,
-    ): void {
-        if (! Finding::isOpenStatus((string) $finding->status)) {
-            return;
-        }
-
-        if ($finding->sla_days === null) {
-            $finding->sla_days = $slaPolicy->daysForSeverity((string) $finding->severity, $tenant);
-        }
-
-        if ($finding->due_at === null) {
-            $finding->due_at = $slaPolicy->dueAtForSeverity((string) $finding->severity, $tenant, $backfillStartedAt);
-        }
-    }
-
-    private function backfillDriftRecurrenceKey(Finding $finding): void
-    {
-        if ($finding->finding_type !== Finding::FINDING_TYPE_DRIFT) {
-            return;
-        }
-
-        if ($finding->recurrence_key !== null && trim((string) $finding->recurrence_key) !== '') {
-            return;
-        }
-
-        $tenantId = (int) ($finding->tenant_id ?? 0);
-        $scopeKey = (string) ($finding->scope_key ?? '');
-        $subjectType = (string) ($finding->subject_type ?? '');
-        $subjectExternalId = (string) ($finding->subject_external_id ?? '');
-
-        if ($tenantId <= 0 || $scopeKey === '' || $subjectType === '' || $subjectExternalId === '') {
-            return;
-        }
-
-        $evidence = is_array($finding->evidence_jsonb) ? $finding->evidence_jsonb : [];
-        $kind = Arr::get($evidence, 'summary.kind');
-        $changeType = Arr::get($evidence, 'change_type');
-
-        $kind = is_string($kind) ? $kind : '';
-        $changeType = is_string($changeType) ? $changeType : '';
-
-        if ($kind === '') {
-            return;
-        }
-
-        $dimension = $this->recurrenceDimension($kind, $changeType);
-
-        $finding->recurrence_key = hash('sha256', sprintf(
-            'drift:%d:%s:%s:%s:%s',
-            $tenantId,
-            $scopeKey,
-            $subjectType,
-            $subjectExternalId,
-            $dimension,
-        ));
-    }
-
-    private function recurrenceDimension(string $kind, string $changeType): string
-    {
-        $kind = strtolower(trim($kind));
-        $changeType = strtolower(trim($changeType));
-
-        return match ($kind) {
-            'policy_snapshot', 'baseline_compare' => sprintf('%s:%s', $kind, $changeType !== '' ? $changeType : 'modified'),
-            default => $kind,
-        };
-    }
-
-    private function consolidateDriftDuplicates(Tenant $tenant, CarbonImmutable $backfillStartedAt): int
-    {
-        $duplicateKeys = Finding::query()
-            ->where('tenant_id', $tenant->getKey())
-            ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-            ->whereNotNull('recurrence_key')
-            ->select(['recurrence_key'])
-            ->groupBy('recurrence_key')
-            ->havingRaw('COUNT(*) > 1')
-            ->pluck('recurrence_key')
-            ->filter(static fn (mixed $value): bool => is_string($value) && trim($value) !== '')
-            ->values();
-
-        if ($duplicateKeys->isEmpty()) {
-            return 0;
-        }
-
-        $consolidated = 0;
-
-        foreach ($duplicateKeys as $recurrenceKey) {
-            if (! is_string($recurrenceKey) || $recurrenceKey === '') {
-                continue;
-            }
-
-            $findings = Finding::query()
-                ->where('tenant_id', $tenant->getKey())
-                ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-                ->where('recurrence_key', $recurrenceKey)
-                ->orderBy('id')
-                ->get();
-
-            $canonical = $this->chooseCanonicalDriftFinding($findings, $recurrenceKey);
-
-            foreach ($findings as $finding) {
-                if (! $finding instanceof Finding) {
-                    continue;
-                }
-
-                if ($canonical instanceof Finding && (int) $finding->getKey() === (int) $canonical->getKey()) {
-                    continue;
-                }
-
-                $finding->forceFill([
-                    'status' => Finding::STATUS_CLOSED,
-                    'resolved_at' => null,
-                    'resolved_reason' => null,
-                    'closed_at' => $backfillStartedAt,
-                    'closed_reason' => Finding::CLOSE_REASON_DUPLICATE,
-                    'closed_by_user_id' => null,
-                    'recurrence_key' => null,
-                ])->save();
-
-                $consolidated++;
-            }
-        }
-
-        return $consolidated;
-    }
-
-    /**
-     * @param  Collection<int, Finding>  $findings
-     */
-    private function chooseCanonicalDriftFinding(Collection $findings, string $recurrenceKey): ?Finding
-    {
-        if ($findings->isEmpty()) {
-            return null;
-        }
-
-        $openCandidates = $findings->filter(static fn (Finding $finding): bool => Finding::isOpenStatus((string) $finding->status));
-
-        $candidates = $openCandidates->isNotEmpty() ? $openCandidates : $findings;
-
-        $alreadyCanonical = $candidates->first(static fn (Finding $finding): bool => (string) $finding->fingerprint === $recurrenceKey);
-
-        if ($alreadyCanonical instanceof Finding) {
-            return $alreadyCanonical;
-        }
-
-        /** @var Finding $sorted */
-        $sorted = $candidates
-            ->sortByDesc(function (Finding $finding): array {
-                $lastSeen = $finding->last_seen_at !== null ? CarbonImmutable::instance($finding->last_seen_at)->getTimestamp() : 0;
-                $createdAt = $finding->created_at !== null ? CarbonImmutable::instance($finding->created_at)->getTimestamp() : 0;
-
-                return [
-                    max($lastSeen, $createdAt),
-                    (int) $finding->getKey(),
-                ];
-            })
-            ->first();
-
-        return $sorted;
-    }
-}

apps/platform/app/Jobs/BackfillFindingLifecycleTenantIntoWorkspaceRunJob.php

@@ -1,378 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Jobs;
-
-use App\Models\Finding;
-use App\Models\OperationRun;
-use App\Models\Tenant;
-use App\Services\Findings\FindingSlaPolicy;
-use App\Services\OperationRunService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Support\OpsUx\RunFailureSanitizer;
-use Carbon\CarbonImmutable;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Bus\Dispatchable;
-use Illuminate\Queue\InteractsWithQueue;
-use Illuminate\Queue\SerializesModels;
-use Illuminate\Support\Arr;
-use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Cache;
-use Throwable;
-
-class BackfillFindingLifecycleTenantIntoWorkspaceRunJob implements ShouldQueue
-{
-    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
-
-    public function __construct(
-        public readonly int $operationRunId,
-        public readonly int $workspaceId,
-        public readonly int $tenantId,
-    ) {}
-
-    public function handle(
-        OperationRunService $operationRunService,
-        FindingSlaPolicy $slaPolicy,
-        FindingsLifecycleBackfillRunbookService $runbookService,
-    ): void {
-        $tenant = Tenant::query()->find($this->tenantId);
-
-        if (! $tenant instanceof Tenant) {
-            return;
-        }
-
-        if ((int) $tenant->workspace_id !== $this->workspaceId) {
-            return;
-        }
-
-        $run = OperationRun::query()->find($this->operationRunId);
-
-        if (! $run instanceof OperationRun) {
-            return;
-        }
-
-        if ((int) $run->workspace_id !== $this->workspaceId) {
-            return;
-        }
-
-        if ($run->tenant_id !== null) {
-            return;
-        }
-
-        if ($run->status === 'queued') {
-            $operationRunService->updateRun($run, status: 'running');
-        }
-
-        $lock = Cache::lock(sprintf('tenantpilot:findings:lifecycle_backfill:tenant:%d', $this->tenantId), 900);
-
-        if (! $lock->get()) {
-            $operationRunService->appendFailures($run, [
-                [
-                    'code' => 'findings.lifecycle.backfill.lock_busy',
-                    'message' => sprintf('Tenant %d is already running a findings lifecycle backfill.', $this->tenantId),
-                ],
-            ]);
-
-            $operationRunService->incrementSummaryCounts($run, [
-                'failed' => 1,
-                'processed' => 1,
-            ]);
-
-            $operationRunService->maybeCompleteBulkRun($run);
-            $runbookService->maybeFinalize($run);
-
-            return;
-        }
-
-        try {
-            $backfillStartedAt = $run->started_at !== null
-                ? CarbonImmutable::instance($run->started_at)
-                : CarbonImmutable::now('UTC');
-
-            Finding::query()
-                ->where('tenant_id', $tenant->getKey())
-                ->orderBy('id')
-                ->chunkById(200, function (Collection $findings) use ($tenant, $slaPolicy, $operationRunService, $run, $backfillStartedAt): void {
-                    $updated = 0;
-                    $skipped = 0;
-
-                    foreach ($findings as $finding) {
-                        if (! $finding instanceof Finding) {
-                            continue;
-                        }
-
-                        $originalAttributes = $finding->getAttributes();
-
-                        $this->backfillLifecycleFields($finding, $backfillStartedAt);
-                        $this->backfillLegacyAcknowledgedStatus($finding);
-                        $this->backfillSlaFields($finding, $tenant, $slaPolicy, $backfillStartedAt);
-                        $this->backfillDriftRecurrenceKey($finding);
-
-                        if ($finding->isDirty()) {
-                            $finding->save();
-                            $updated++;
-                        } else {
-                            $finding->setRawAttributes($originalAttributes, sync: true);
-                            $skipped++;
-                        }
-                    }
-
-                    if ($updated > 0 || $skipped > 0) {
-                        $operationRunService->incrementSummaryCounts($run, [
-                            'updated' => $updated,
-                            'skipped' => $skipped,
-                        ]);
-                    }
-                });
-
-            $consolidatedDuplicates = $this->consolidateDriftDuplicates($tenant, $backfillStartedAt);
-
-            if ($consolidatedDuplicates > 0) {
-                $operationRunService->incrementSummaryCounts($run, [
-                    'updated' => $consolidatedDuplicates,
-                ]);
-            }
-
-            $operationRunService->incrementSummaryCounts($run, [
-                'processed' => 1,
-            ]);
-
-            $operationRunService->maybeCompleteBulkRun($run);
-            $runbookService->maybeFinalize($run);
-        } catch (Throwable $e) {
-            $message = RunFailureSanitizer::sanitizeMessage($e->getMessage());
-            $reasonCode = RunFailureSanitizer::normalizeReasonCode($e->getMessage());
-
-            $operationRunService->appendFailures($run, [[
-                'code' => 'findings.lifecycle.backfill.failed',
-                'reason_code' => $reasonCode,
-                'message' => $message !== '' ? $message : sprintf('Tenant %d findings lifecycle backfill failed.', $this->tenantId),
-            ]]);
-
-            $operationRunService->incrementSummaryCounts($run, [
-                'failed' => 1,
-                'processed' => 1,
-            ]);
-
-            $operationRunService->maybeCompleteBulkRun($run);
-            $runbookService->maybeFinalize($run);
-
-            throw $e;
-        } finally {
-            $lock->release();
-        }
-    }
-
-    private function backfillLifecycleFields(Finding $finding, CarbonImmutable $backfillStartedAt): void
-    {
-        $createdAt = $finding->created_at !== null ? CarbonImmutable::instance($finding->created_at) : $backfillStartedAt;
-
-        if ($finding->first_seen_at === null) {
-            $finding->first_seen_at = $createdAt;
-        }
-
-        if ($finding->last_seen_at === null) {
-            $finding->last_seen_at = $createdAt;
-        }
-
-        if ($finding->last_seen_at !== null && $finding->first_seen_at !== null) {
-            $lastSeen = CarbonImmutable::instance($finding->last_seen_at);
-            $firstSeen = CarbonImmutable::instance($finding->first_seen_at);
-
-            if ($lastSeen->lessThan($firstSeen)) {
-                $finding->last_seen_at = $firstSeen;
-            }
-        }
-
-        $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;
-
-        if ($timesSeen < 1) {
-            $finding->times_seen = 1;
-        }
-    }
-
-    private function backfillLegacyAcknowledgedStatus(Finding $finding): void
-    {
-        if ($finding->status !== Finding::STATUS_ACKNOWLEDGED) {
-            return;
-        }
-
-        $finding->status = Finding::STATUS_TRIAGED;
-
-        if ($finding->triaged_at === null) {
-            if ($finding->acknowledged_at !== null) {
-                $finding->triaged_at = CarbonImmutable::instance($finding->acknowledged_at);
-            } elseif ($finding->created_at !== null) {
-                $finding->triaged_at = CarbonImmutable::instance($finding->created_at);
-            }
-        }
-    }
-
-    private function backfillSlaFields(
-        Finding $finding,
-        Tenant $tenant,
-        FindingSlaPolicy $slaPolicy,
-        CarbonImmutable $backfillStartedAt,
-    ): void {
-        if (! Finding::isOpenStatus((string) $finding->status)) {
-            return;
-        }
-
-        if ($finding->sla_days === null) {
-            $finding->sla_days = $slaPolicy->daysForSeverity((string) $finding->severity, $tenant);
-        }
-
-        if ($finding->due_at === null) {
-            $finding->due_at = $slaPolicy->dueAtForSeverity((string) $finding->severity, $tenant, $backfillStartedAt);
-        }
-    }
-
-    private function backfillDriftRecurrenceKey(Finding $finding): void
-    {
-        if ($finding->finding_type !== Finding::FINDING_TYPE_DRIFT) {
-            return;
-        }
-
-        if ($finding->recurrence_key !== null && trim((string) $finding->recurrence_key) !== '') {
-            return;
-        }
-
-        $tenantId = (int) ($finding->tenant_id ?? 0);
-        $scopeKey = (string) ($finding->scope_key ?? '');
-        $subjectType = (string) ($finding->subject_type ?? '');
-        $subjectExternalId = (string) ($finding->subject_external_id ?? '');
-
-        if ($tenantId <= 0 || $scopeKey === '' || $subjectType === '' || $subjectExternalId === '') {
-            return;
-        }
-
-        $evidence = is_array($finding->evidence_jsonb) ? $finding->evidence_jsonb : [];
-        $kind = Arr::get($evidence, 'summary.kind');
-        $changeType = Arr::get($evidence, 'change_type');
-
-        $kind = is_string($kind) ? $kind : '';
-        $changeType = is_string($changeType) ? $changeType : '';
-
-        if ($kind === '') {
-            return;
-        }
-
-        $dimension = $this->recurrenceDimension($kind, $changeType);
-
-        $finding->recurrence_key = hash('sha256', sprintf(
-            'drift:%d:%s:%s:%s:%s',
-            $tenantId,
-            $scopeKey,
-            $subjectType,
-            $subjectExternalId,
-            $dimension,
-        ));
-    }
-
-    private function recurrenceDimension(string $kind, string $changeType): string
-    {
-        $kind = strtolower(trim($kind));
-        $changeType = strtolower(trim($changeType));
-
-        return match ($kind) {
-            'policy_snapshot', 'baseline_compare' => sprintf('%s:%s', $kind, $changeType !== '' ? $changeType : 'modified'),
-            default => $kind,
-        };
-    }
-
-    private function consolidateDriftDuplicates(Tenant $tenant, CarbonImmutable $backfillStartedAt): int
-    {
-        $duplicateKeys = Finding::query()
-            ->where('tenant_id', $tenant->getKey())
-            ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-            ->whereNotNull('recurrence_key')
-            ->select(['recurrence_key'])
-            ->groupBy('recurrence_key')
-            ->havingRaw('COUNT(*) > 1')
-            ->pluck('recurrence_key')
-            ->filter(static fn (mixed $value): bool => is_string($value) && trim($value) !== '')
-            ->values();
-
-        if ($duplicateKeys->isEmpty()) {
-            return 0;
-        }
-
-        $consolidated = 0;
-
-        foreach ($duplicateKeys as $recurrenceKey) {
-            if (! is_string($recurrenceKey) || $recurrenceKey === '') {
-                continue;
-            }
-
-            $findings = Finding::query()
-                ->where('tenant_id', $tenant->getKey())
-                ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-                ->where('recurrence_key', $recurrenceKey)
-                ->orderBy('id')
-                ->get();
-
-            $canonical = $this->chooseCanonicalDriftFinding($findings, $recurrenceKey);
-
-            foreach ($findings as $finding) {
-                if (! $finding instanceof Finding) {
-                    continue;
-                }
-
-                if ($canonical instanceof Finding && (int) $finding->getKey() === (int) $canonical->getKey()) {
-                    continue;
-                }
-
-                $finding->forceFill([
-                    'status' => Finding::STATUS_CLOSED,
-                    'resolved_at' => null,
-                    'resolved_reason' => null,
-                    'closed_at' => $backfillStartedAt,
-                    'closed_reason' => Finding::CLOSE_REASON_DUPLICATE,
-                    'closed_by_user_id' => null,
-                    'recurrence_key' => null,
-                ])->save();
-
-                $consolidated++;
-            }
-        }
-
-        return $consolidated;
-    }
-
-    /**
-     * @param  Collection<int, Finding>  $findings
-     */
-    private function chooseCanonicalDriftFinding(Collection $findings, string $recurrenceKey): ?Finding
-    {
-        if ($findings->isEmpty()) {
-            return null;
-        }
-
-        $openCandidates = $findings->filter(static fn (Finding $finding): bool => Finding::isOpenStatus((string) $finding->status));
-
-        $candidates = $openCandidates->isNotEmpty() ? $openCandidates : $findings;
-
-        $alreadyCanonical = $candidates->first(static fn (Finding $finding): bool => (string) $finding->fingerprint === $recurrenceKey);
-
-        if ($alreadyCanonical instanceof Finding) {
-            return $alreadyCanonical;
-        }
-
-        /** @var Finding $sorted */
-        $sorted = $candidates
-            ->sortByDesc(function (Finding $finding): array {
-                $lastSeen = $finding->last_seen_at !== null ? CarbonImmutable::instance($finding->last_seen_at)->getTimestamp() : 0;
-                $createdAt = $finding->created_at !== null ? CarbonImmutable::instance($finding->created_at)->getTimestamp() : 0;
-
-                return [
-                    max($lastSeen, $createdAt),
-                    (int) $finding->getKey(),
-                ];
-            })
-            ->first();
-
-        return $sorted;
-    }
-}

apps/platform/app/Jobs/BackfillFindingLifecycleWorkspaceJob.php

@@ -1,95 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Jobs;
-
-use App\Models\OperationRun;
-use App\Services\OperationRunService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\System\AllowedTenantUniverse;
-use App\Support\OperationRunOutcome;
-use App\Support\OperationRunStatus;
-use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Foundation\Bus\Dispatchable;
-use Illuminate\Queue\InteractsWithQueue;
-use Illuminate\Queue\SerializesModels;
-
-class BackfillFindingLifecycleWorkspaceJob implements ShouldQueue
-{
-    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
-
-    public function __construct(
-        public readonly int $operationRunId,
-        public readonly int $workspaceId,
-    ) {}
-
-    public function handle(
-        OperationRunService $operationRunService,
-        AllowedTenantUniverse $allowedTenantUniverse,
-        FindingsLifecycleBackfillRunbookService $runbookService,
-    ): void {
-        $run = OperationRun::query()->find($this->operationRunId);
-
-        if (! $run instanceof OperationRun) {
-            return;
-        }
-
-        if ((int) $run->workspace_id !== $this->workspaceId) {
-            return;
-        }
-
-        if ($run->tenant_id !== null) {
-            return;
-        }
-
-        $tenantIds = $allowedTenantUniverse
-            ->query()
-            ->where('workspace_id', $this->workspaceId)
-            ->orderBy('id')
-            ->pluck('id')
-            ->map(static fn (mixed $id): int => (int) $id)
-            ->all();
-
-        $tenantCount = count($tenantIds);
-
-        $operationRunService->updateRun(
-            $run,
-            status: OperationRunStatus::Running->value,
-            outcome: OperationRunOutcome::Pending->value,
-            summaryCounts: [
-                'tenants' => $tenantCount,
-                'total' => $tenantCount,
-                'processed' => 0,
-                'updated' => 0,
-                'skipped' => 0,
-                'failed' => 0,
-            ],
-        );
-
-        if ($tenantCount === 0) {
-            $operationRunService->updateRun(
-                $run,
-                status: OperationRunStatus::Completed->value,
-                outcome: OperationRunOutcome::Succeeded->value,
-            );
-
-            $runbookService->maybeFinalize($run);
-
-            return;
-        }
-
-        foreach ($tenantIds as $tenantId) {
-            if ($tenantId <= 0) {
-                continue;
-            }
-
-            BackfillFindingLifecycleTenantIntoWorkspaceRunJob::dispatch(
-                operationRunId: (int) $run->getKey(),
-                workspaceId: $this->workspaceId,
-                tenantId: $tenantId,
-            );
-        }
-    }
-}

apps/platform/app/Jobs/CompareBaselineToTenantJob.php

@@ -1871,8 +1871,11 @@ private function upsertFindings(
             } else {
                 $this->observeFinding(
                     finding: $finding,
+                    tenant: $tenant,
                     observedAt: $observedAt,
                     currentOperationRunId: (int) $this->operationRun->getKey(),
+                    severity: (string) $driftItem['severity'],
+                    slaPolicy: $slaPolicy,
                 );
             }
 
@@ -1947,12 +1950,21 @@ private function upsertFindings(
         ];
     }
 
-    private function observeFinding(Finding $finding, CarbonImmutable $observedAt, int $currentOperationRunId): void
+    private function observeFinding(
+        Finding $finding,
+        Tenant $tenant,
+        CarbonImmutable $observedAt,
+        int $currentOperationRunId,
+        string $severity,
+        FindingSlaPolicy $slaPolicy,
+    ): void
     {
         if ($finding->first_seen_at === null) {
             $finding->first_seen_at = $observedAt;
         }
 
+        $firstSeenAt = CarbonImmutable::instance($finding->first_seen_at);
+
         if ($finding->last_seen_at === null || $observedAt->greaterThan(CarbonImmutable::instance($finding->last_seen_at))) {
             $finding->last_seen_at = $observedAt;
         }
@@ -1964,6 +1976,14 @@ private function observeFinding(Finding $finding, CarbonImmutable $observedAt, i
         } elseif ($timesSeen < 1) {
             $finding->times_seen = 1;
         }
+
+        if ($finding->sla_days === null) {
+            $finding->sla_days = $slaPolicy->daysForSeverity($severity, $tenant);
+        }
+
+        if ($finding->due_at === null) {
+            $finding->due_at = $slaPolicy->dueAtForSeverity($severity, $tenant, $firstSeenAt);
+        }
     }
 
     /**

apps/platform/app/Models/Finding.php

@@ -33,8 +33,6 @@ class Finding extends Model
 
     public const string STATUS_NEW = 'new';
 
-    public const string STATUS_ACKNOWLEDGED = 'acknowledged';
-
     public const string STATUS_TRIAGED = 'triaged';
 
     public const string STATUS_IN_PROGRESS = 'in_progress';
@@ -169,10 +167,7 @@ public static function terminalStatuses(): array
      */
     public static function openStatusesForQuery(): array
     {
-        return [
-            ...self::openStatuses(),
-            self::STATUS_ACKNOWLEDGED,
-        ];
+        return self::openStatuses();
     }
 
     /**
@@ -295,10 +290,6 @@ public static function isReopenReason(?string $reason): bool
 
     public static function canonicalizeStatus(?string $status): ?string
     {
-        if ($status === self::STATUS_ACKNOWLEDGED) {
-            return self::STATUS_TRIAGED;
-        }
-
         return $status;
     }
 
@@ -324,23 +315,6 @@ public function isRiskAccepted(): bool
         return (string) $this->status === self::STATUS_RISK_ACCEPTED;
     }
 
-    public function acknowledge(User $user): self
-    {
-        if ($this->status === self::STATUS_ACKNOWLEDGED) {
-            return $this;
-        }
-
-        $this->forceFill([
-            'status' => self::STATUS_ACKNOWLEDGED,
-            'acknowledged_at' => now(),
-            'acknowledged_by_user_id' => $user->getKey(),
-        ]);
-
-        $this->save();
-
-        return $this;
-    }
-
     public function resolve(string $reason): self
     {
         $this->forceFill([

apps/platform/app/Policies/FindingPolicy.php

@@ -49,10 +49,7 @@ public function update(User $user, Finding $finding): Response|bool
 
     public function triage(User $user, Finding $finding): Response|bool
     {
-        return $this->canMutateWithAnyCapability($user, $finding, [
-            Capabilities::TENANT_FINDINGS_TRIAGE,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
-        ]);
+        return $this->canMutateWithCapability($user, $finding, Capabilities::TENANT_FINDINGS_TRIAGE);
     }
 
     public function assign(User $user, Finding $finding): Response|bool

apps/platform/app/Services/Auth/RoleCapabilityMap.php

@@ -28,7 +28,6 @@ class RoleCapabilityMap
             Capabilities::TENANT_FINDINGS_RESOLVE,
             Capabilities::TENANT_FINDINGS_CLOSE,
             Capabilities::TENANT_FINDINGS_RISK_ACCEPT,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
             Capabilities::FINDING_EXCEPTION_VIEW,
             Capabilities::FINDING_EXCEPTION_MANAGE,
             Capabilities::TENANT_VERIFICATION_ACKNOWLEDGE,
@@ -74,7 +73,6 @@ class RoleCapabilityMap
             Capabilities::TENANT_FINDINGS_RESOLVE,
             Capabilities::TENANT_FINDINGS_CLOSE,
             Capabilities::TENANT_FINDINGS_RISK_ACCEPT,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
             Capabilities::FINDING_EXCEPTION_VIEW,
             Capabilities::FINDING_EXCEPTION_MANAGE,
             Capabilities::TENANT_VERIFICATION_ACKNOWLEDGE,
@@ -112,7 +110,6 @@ class RoleCapabilityMap
             Capabilities::TENANT_INVENTORY_SYNC_RUN,
             Capabilities::TENANT_FINDINGS_VIEW,
             Capabilities::TENANT_FINDINGS_TRIAGE,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
             Capabilities::FINDING_EXCEPTION_VIEW,
 
             Capabilities::TENANT_MEMBERSHIP_VIEW,

apps/platform/app/Services/EntraAdminRoles/EntraAdminRolesFindingGenerator.php

@@ -163,7 +163,7 @@ private function upsertFinding(
             ->first();
 
         if ($existing instanceof Finding) {
-            $this->observeFinding($existing, $observedAt);
+            $this->observeFinding($existing, $tenant, $observedAt, $severity);
 
             $existing->forceFill([
                 'severity' => $severity,
@@ -253,7 +253,7 @@ private function handleGaAggregate(
                 ->first();
 
             if ($existing instanceof Finding) {
-                $this->observeFinding($existing, $observedAt);
+                $this->observeFinding($existing, $tenant, $observedAt, Finding::SEVERITY_HIGH);
 
                 $existing->forceFill([
                     'severity' => Finding::SEVERITY_HIGH,
@@ -380,24 +380,32 @@ private function resolveSlaPolicy(): FindingSlaPolicy
         return $this->slaPolicy ?? app(FindingSlaPolicy::class);
     }
 
-    private function observeFinding(Finding $finding, CarbonImmutable $observedAt): void
+    private function observeFinding(Finding $finding, Tenant $tenant, CarbonImmutable $observedAt, string $severity): void
     {
         if ($finding->first_seen_at === null) {
             $finding->first_seen_at = $observedAt;
         }
 
+        $firstSeenAt = CarbonImmutable::instance($finding->first_seen_at);
+
         $lastSeenAt = $finding->last_seen_at;
         $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;
 
         if ($lastSeenAt === null || $observedAt->greaterThan(CarbonImmutable::instance($lastSeenAt))) {
             $finding->last_seen_at = $observedAt;
             $finding->times_seen = max(0, $timesSeen) + 1;
-
-            return;
+        } elseif ($timesSeen < 1) {
+            $finding->times_seen = 1;
         }
 
-        if ($timesSeen < 1) {
-            $finding->times_seen = 1;
+        $slaPolicy = $this->resolveSlaPolicy();
+
+        if ($finding->sla_days === null) {
+            $finding->sla_days = $slaPolicy->daysForSeverity($severity, $tenant);
+        }
+
+        if ($finding->due_at === null) {
+            $finding->due_at = $slaPolicy->dueAtForSeverity($severity, $tenant, $firstSeenAt);
         }
     }
 

apps/platform/app/Services/Findings/FindingWorkflowService.php

@@ -46,17 +46,13 @@ public static function meaningfulActivityActionValues(): array
 
     public function triage(Finding $finding, Tenant $tenant, User $actor): Finding
     {
-        $this->authorize($finding, $tenant, $actor, [
-            Capabilities::TENANT_FINDINGS_TRIAGE,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
-        ]);
+        $this->authorize($finding, $tenant, $actor, [Capabilities::TENANT_FINDINGS_TRIAGE]);
 
         $currentStatus = (string) $finding->status;
 
         if (! in_array($currentStatus, [
             Finding::STATUS_NEW,
             Finding::STATUS_REOPENED,
-            Finding::STATUS_ACKNOWLEDGED,
         ], true)) {
             throw new InvalidArgumentException('Finding cannot be triaged from the current status.');
         }
@@ -82,12 +78,9 @@ public function triage(Finding $finding, Tenant $tenant, User $actor): Finding
 
     public function startProgress(Finding $finding, Tenant $tenant, User $actor): Finding
     {
-        $this->authorize($finding, $tenant, $actor, [
-            Capabilities::TENANT_FINDINGS_TRIAGE,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
-        ]);
+        $this->authorize($finding, $tenant, $actor, [Capabilities::TENANT_FINDINGS_TRIAGE]);
 
-        if (! in_array((string) $finding->status, [Finding::STATUS_TRIAGED, Finding::STATUS_ACKNOWLEDGED], true)) {
+        if ((string) $finding->status !== Finding::STATUS_TRIAGED) {
             throw new InvalidArgumentException('Finding cannot be moved to in-progress from the current status.');
         }
 
@@ -369,10 +362,7 @@ private function riskAcceptWithoutAuthorization(Finding $finding, Tenant $tenant
 
     public function reopen(Finding $finding, Tenant $tenant, User $actor, string $reason): Finding
     {
-        $this->authorize($finding, $tenant, $actor, [
-            Capabilities::TENANT_FINDINGS_TRIAGE,
-            Capabilities::TENANT_FINDINGS_ACKNOWLEDGE,
-        ]);
+        $this->authorize($finding, $tenant, $actor, [Capabilities::TENANT_FINDINGS_TRIAGE]);
 
         if (! in_array((string) $finding->status, Finding::terminalStatuses(), true)) {
             throw new InvalidArgumentException('Only terminal findings can be reopened.');

apps/platform/app/Services/PermissionPosture/PermissionPostureFindingGenerator.php

@@ -140,7 +140,7 @@ private function handleMissingPermission(
             ->first();
 
         if ($finding instanceof Finding) {
-            $this->observeFinding($finding, $observedAt);
+            $this->observeFinding($finding, $tenant, $observedAt, $severity);
 
             $finding->forceFill([
                 'severity' => $severity,
@@ -216,7 +216,7 @@ private function handleErrorPermission(
             ->first();
 
         if ($existing instanceof Finding) {
-            $this->observeFinding($existing, $observedAt);
+            $this->observeFinding($existing, $tenant, $observedAt, $severity);
 
             $existing->forceFill([
                 'severity' => $severity,
@@ -349,24 +349,30 @@ private function resolveObservedAt(array $comparison, ?OperationRun $operationRu
         return CarbonImmutable::now();
     }
 
-    private function observeFinding(Finding $finding, CarbonImmutable $observedAt): void
+    private function observeFinding(Finding $finding, Tenant $tenant, CarbonImmutable $observedAt, string $severity): void
     {
         if ($finding->first_seen_at === null) {
             $finding->first_seen_at = $observedAt;
         }
 
+        $firstSeenAt = CarbonImmutable::instance($finding->first_seen_at);
+
         $lastSeenAt = $finding->last_seen_at;
         $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;
 
         if ($lastSeenAt === null || $observedAt->greaterThan(CarbonImmutable::instance($lastSeenAt))) {
             $finding->last_seen_at = $observedAt;
             $finding->times_seen = max(0, $timesSeen) + 1;
-
-            return;
+        } elseif ($timesSeen < 1) {
+            $finding->times_seen = 1;
         }
 
-        if ($timesSeen < 1) {
-            $finding->times_seen = 1;
+        if ($finding->sla_days === null) {
+            $finding->sla_days = $this->slaPolicy->daysForSeverity($severity, $tenant);
+        }
+
+        if ($finding->due_at === null) {
+            $finding->due_at = $this->slaPolicy->dueAtForSeverity($severity, $tenant, $firstSeenAt);
         }
     }
 

apps/platform/app/Services/Runbooks/FindingsLifecycleBackfillRunbookService.php

@@ -1,739 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Runbooks;
-
-use App\Jobs\BackfillFindingLifecycleJob;
-use App\Jobs\BackfillFindingLifecycleWorkspaceJob;
-use App\Models\Finding;
-use App\Models\OperationRun;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Models\User;
-use App\Models\Workspace;
-use App\Notifications\OperationRunCompleted;
-use App\Services\Alerts\AlertDispatchService;
-use App\Services\Audit\AuditRecorder;
-use App\Services\Audit\WorkspaceAuditLogger;
-use App\Services\Auth\BreakGlassSession;
-use App\Services\Intune\AuditLogger;
-use App\Services\OperationRunService;
-use App\Services\System\AllowedTenantUniverse;
-use App\Support\Audit\AuditActionId;
-use App\Support\Audit\AuditActorSnapshot;
-use App\Support\Audit\AuditTargetSnapshot;
-use App\Support\OperationCatalog;
-use App\Support\OperationRunOutcome;
-use App\Support\OperationRunStatus;
-use App\Support\OperationalControls\OperationalControlBlockedException;
-use App\Support\OperationalControls\OperationalControlEvaluator;
-use App\Support\System\SystemOperationRunLinks;
-use Illuminate\Support\Facades\Cache;
-use Illuminate\Support\Facades\DB;
-use Illuminate\Validation\ValidationException;
-use Throwable;
-
-class FindingsLifecycleBackfillRunbookService
-{
-    public const string RUNBOOK_KEY = 'findings.lifecycle.backfill';
-
-    public function __construct(
-        private readonly AllowedTenantUniverse $allowedTenantUniverse,
-        private readonly BreakGlassSession $breakGlassSession,
-        private readonly OperationRunService $operationRunService,
-        private readonly AuditLogger $auditLogger,
-        private readonly AlertDispatchService $alertDispatchService,
-        private readonly OperationalControlEvaluator $operationalControls,
-        private readonly AuditRecorder $auditRecorder,
-        private readonly WorkspaceAuditLogger $workspaceAuditLogger,
-    ) {}
-
-    /**
-     * @return array{affected_count: int, total_count: int, estimated_tenants?: int|null}
-     */
-    public function preflight(FindingsLifecycleBackfillScope $scope): array
-    {
-        $result = $this->computePreflight($scope);
-
-        $this->auditSafely(
-            action: 'platform.ops.runbooks.preflight',
-            scope: $scope,
-            operationRunId: null,
-            initiator: null,
-            context: [
-                'preflight' => $result,
-            ],
-        );
-
-        return $result;
-    }
-
-    public function start(
-        FindingsLifecycleBackfillScope $scope,
-        User|PlatformUser|null $initiator,
-        ?RunbookReason $reason,
-        string $source,
-    ): OperationRun {
-        $source = trim($source);
-
-        if ($source === '') {
-            throw ValidationException::withMessages([
-                'source' => 'A run source is required.',
-            ]);
-        }
-
-        $isBreakGlassActive = $this->breakGlassSession->isActive();
-
-        if ($scope->isAllTenants() || $isBreakGlassActive) {
-            if (! $reason instanceof RunbookReason) {
-                throw ValidationException::withMessages([
-                    'reason' => 'A reason is required for this run.',
-                ]);
-            }
-        }
-
-        $preflight = $this->computePreflight($scope);
-
-        if (($preflight['affected_count'] ?? 0) <= 0) {
-            throw ValidationException::withMessages([
-                'preflight.affected_count' => 'Nothing to do for this scope.',
-            ]);
-        }
-
-        $workspace = null;
-        $tenant = null;
-
-        if ($scope->isSingleTenant()) {
-            $tenant = Tenant::query()->whereKey((int) $scope->tenantId)->firstOrFail();
-            $this->allowedTenantUniverse->ensureAllowed($tenant);
-
-            $workspace = $tenant->workspace;
-        } else {
-            $platformTenant = $this->platformTenant();
-            $workspace = $platformTenant->workspace;
-        }
-
-        if (! $workspace instanceof Workspace) {
-            throw new \RuntimeException('Platform tenant is missing its workspace.');
-        }
-
-        $decision = $this->operationalControls->evaluate(self::RUNBOOK_KEY, $workspace);
-
-        if ($decision->isPaused()) {
-            $this->auditBlockedStart(
-                decision: $decision,
-                scope: $scope,
-                workspace: $workspace,
-                tenant: $tenant,
-                initiator: $initiator,
-                source: $source,
-            );
-
-            throw OperationalControlBlockedException::forDecision(
-                decision: $decision,
-                actionLabel: OperationCatalog::label(self::RUNBOOK_KEY),
-            );
-        }
-
-        if ($scope->isAllTenants()) {
-            $lockKey = sprintf('tenantpilot:runbooks:%s:workspace:%d', self::RUNBOOK_KEY, (int) $workspace->getKey());
-            $lock = Cache::lock($lockKey, 900);
-
-            if (! $lock->get()) {
-                throw ValidationException::withMessages([
-                    'scope' => 'Another run is already in progress for this scope.',
-                ]);
-            }
-
-            try {
-                return $this->startAllTenants(
-                    workspace: $workspace,
-                    initiator: $initiator,
-                    reason: $reason,
-                    preflight: $preflight,
-                    source: $source,
-                    isBreakGlassActive: $isBreakGlassActive,
-                );
-            } finally {
-                $lock->release();
-            }
-        }
-
-        return $this->startSingleTenant(
-            tenant: $tenant,
-            initiator: $initiator,
-            reason: $reason,
-            preflight: $preflight,
-            source: $source,
-            isBreakGlassActive: $isBreakGlassActive,
-        );
-    }
-
-    public function maybeFinalize(OperationRun $run): void
-    {
-        $run->refresh();
-
-        if ($run->status !== OperationRunStatus::Completed->value) {
-            return;
-        }
-
-        $context = is_array($run->context) ? $run->context : [];
-
-        if ((string) data_get($context, 'runbook.key') !== self::RUNBOOK_KEY) {
-            return;
-        }
-
-        $lockKey = sprintf('tenantpilot:runbooks:%s:finalize:%d', self::RUNBOOK_KEY, (int) $run->getKey());
-        $lock = Cache::lock($lockKey, 86400);
-
-        if (! $lock->get()) {
-            return;
-        }
-
-        try {
-            $this->auditSafely(
-                action: $run->outcome === OperationRunOutcome::Failed->value
-                    ? 'platform.ops.runbooks.failed'
-                    : 'platform.ops.runbooks.completed',
-                scope: $this->scopeFromRunContext($context),
-                operationRunId: (int) $run->getKey(),
-                context: [
-                    'status' => (string) $run->status,
-                    'outcome' => (string) $run->outcome,
-                    'is_break_glass' => (bool) data_get($context, 'platform_initiator.is_break_glass', false),
-                    'reason_code' => data_get($context, 'reason.reason_code'),
-                    'reason_text' => data_get($context, 'reason.reason_text'),
-                ],
-            );
-
-            $this->notifyInitiatorSafely($run);
-
-            if ($run->outcome === OperationRunOutcome::Failed->value) {
-                $this->dispatchFailureAlertSafely($run);
-            }
-        } finally {
-            $lock->release();
-        }
-    }
-
-    /**
-     * @return array{affected_count: int, total_count: int, estimated_tenants?: int|null}
-     */
-    private function computePreflight(FindingsLifecycleBackfillScope $scope): array
-    {
-        if ($scope->isSingleTenant()) {
-            $tenant = Tenant::query()->whereKey((int) $scope->tenantId)->firstOrFail();
-            $this->allowedTenantUniverse->ensureAllowed($tenant);
-
-            return $this->computeTenantPreflight($tenant);
-        }
-
-        $platformTenant = $this->platformTenant();
-        $workspaceId = (int) ($platformTenant->workspace_id ?? 0);
-
-        $tenants = $this->allowedTenantUniverse
-            ->query()
-            ->where('workspace_id', $workspaceId)
-            ->orderBy('id')
-            ->get();
-
-        $affected = 0;
-        $total = 0;
-
-        foreach ($tenants as $tenant) {
-            if (! $tenant instanceof Tenant) {
-                continue;
-            }
-
-            $counts = $this->computeTenantPreflight($tenant);
-
-            $affected += (int) ($counts['affected_count'] ?? 0);
-            $total += (int) ($counts['total_count'] ?? 0);
-        }
-
-        return [
-            'affected_count' => $affected,
-            'total_count' => $total,
-            'estimated_tenants' => $tenants->count(),
-        ];
-    }
-
-    /**
-     * @return array{affected_count: int, total_count: int}
-     */
-    private function computeTenantPreflight(Tenant $tenant): array
-    {
-        $query = Finding::query()->where('tenant_id', (int) $tenant->getKey());
-
-        $total = (int) (clone $query)->count();
-
-        $affected = 0;
-
-        (clone $query)
-            ->orderBy('id')
-            ->chunkById(500, function ($findings) use (&$affected): void {
-                foreach ($findings as $finding) {
-                    if (! $finding instanceof Finding) {
-                        continue;
-                    }
-
-                    if ($this->findingNeedsBackfill($finding)) {
-                        $affected++;
-                    }
-                }
-            });
-
-        $affected += $this->countDriftDuplicateConsolidations($tenant);
-
-        return [
-            'affected_count' => $affected,
-            'total_count' => $total,
-        ];
-    }
-
-    private function findingNeedsBackfill(Finding $finding): bool
-    {
-        if ($finding->first_seen_at === null || $finding->last_seen_at === null) {
-            return true;
-        }
-
-        if ($finding->last_seen_at !== null && $finding->first_seen_at !== null) {
-            if ($finding->last_seen_at->lt($finding->first_seen_at)) {
-                return true;
-            }
-        }
-
-        $timesSeen = is_numeric($finding->times_seen) ? (int) $finding->times_seen : 0;
-
-        if ($timesSeen < 1) {
-            return true;
-        }
-
-        if ($finding->status === Finding::STATUS_ACKNOWLEDGED) {
-            return true;
-        }
-
-        if (Finding::isOpenStatus((string) $finding->status)) {
-            if ($finding->sla_days === null || $finding->due_at === null) {
-                return true;
-            }
-        }
-
-        if ($finding->finding_type === Finding::FINDING_TYPE_DRIFT) {
-            $recurrenceKey = $finding->recurrence_key !== null ? trim((string) $finding->recurrence_key) : '';
-
-            if ($recurrenceKey === '') {
-                $scopeKey = trim((string) ($finding->scope_key ?? ''));
-                $subjectType = trim((string) ($finding->subject_type ?? ''));
-                $subjectExternalId = trim((string) ($finding->subject_external_id ?? ''));
-
-                if ($scopeKey !== '' && $subjectType !== '' && $subjectExternalId !== '') {
-                    $evidence = is_array($finding->evidence_jsonb) ? $finding->evidence_jsonb : [];
-                    $kind = data_get($evidence, 'summary.kind');
-
-                    if (is_string($kind) && trim($kind) !== '') {
-                        return true;
-                    }
-                }
-            }
-        }
-
-        return false;
-    }
-
-    private function countDriftDuplicateConsolidations(Tenant $tenant): int
-    {
-        $rows = Finding::query()
-            ->where('tenant_id', (int) $tenant->getKey())
-            ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-            ->whereNotNull('recurrence_key')
-            ->select(['recurrence_key', DB::raw('COUNT(*) as count')])
-            ->groupBy('recurrence_key')
-            ->havingRaw('COUNT(*) > 1')
-            ->get();
-
-        $duplicates = 0;
-
-        foreach ($rows as $row) {
-            $count = is_numeric($row->count ?? null) ? (int) $row->count : 0;
-
-            if ($count > 1) {
-                $duplicates += ($count - 1);
-            }
-        }
-
-        return $duplicates;
-    }
-
-    private function startAllTenants(
-        Workspace $workspace,
-        User|PlatformUser|null $initiator,
-        ?RunbookReason $reason,
-        array $preflight,
-        string $source,
-        bool $isBreakGlassActive,
-    ): OperationRun {
-        $run = $this->operationRunService->ensureWorkspaceRunWithIdentity(
-            workspace: $workspace,
-            type: self::RUNBOOK_KEY,
-            identityInputs: [
-                'runbook' => self::RUNBOOK_KEY,
-                'scope' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-            ],
-            context: $this->buildRunContext(
-                workspaceId: (int) $workspace->getKey(),
-                scope: FindingsLifecycleBackfillScope::allTenants(),
-                initiator: $initiator,
-                reason: $reason,
-                preflight: $preflight,
-                source: $source,
-                isBreakGlassActive: $isBreakGlassActive,
-            ),
-            initiator: $initiator instanceof User ? $initiator : null,
-        );
-
-        if ($initiator instanceof PlatformUser && $run->wasRecentlyCreated) {
-            $run->update(['initiator_name' => $initiator->name ?: $initiator->email]);
-            $run->refresh();
-        }
-
-        $this->auditSafely(
-            action: 'platform.ops.runbooks.start',
-            scope: FindingsLifecycleBackfillScope::allTenants(),
-            operationRunId: (int) $run->getKey(),
-            initiator: $initiator,
-            context: [
-                'preflight' => $preflight,
-                'is_break_glass' => $isBreakGlassActive,
-            ] + ($reason instanceof RunbookReason ? $reason->toArray() : []),
-        );
-
-        if (! $run->wasRecentlyCreated) {
-            return $run;
-        }
-
-        $this->operationRunService->dispatchOrFail($run, function () use ($run, $workspace): void {
-            BackfillFindingLifecycleWorkspaceJob::dispatch(
-                operationRunId: (int) $run->getKey(),
-                workspaceId: (int) $workspace->getKey(),
-            );
-        });
-
-        return $run;
-    }
-
-    private function startSingleTenant(
-        ?Tenant $tenant,
-        User|PlatformUser|null $initiator,
-        ?RunbookReason $reason,
-        array $preflight,
-        string $source,
-        bool $isBreakGlassActive,
-    ): OperationRun {
-        if (! $tenant instanceof Tenant) {
-            throw new \RuntimeException('Target tenant is required for single-tenant runs.');
-        }
-
-        $run = $this->operationRunService->ensureRunWithIdentity(
-            tenant: $tenant,
-            type: self::RUNBOOK_KEY,
-            identityInputs: [
-                'tenant_id' => (int) $tenant->getKey(),
-                'trigger' => 'backfill',
-            ],
-            context: $this->buildRunContext(
-                workspaceId: (int) $tenant->workspace_id,
-                scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-                initiator: $initiator,
-                reason: $reason,
-                preflight: $preflight,
-                source: $source,
-                isBreakGlassActive: $isBreakGlassActive,
-            ),
-            initiator: $initiator instanceof User ? $initiator : null,
-        );
-
-        if ($initiator instanceof PlatformUser && $run->wasRecentlyCreated) {
-            $run->update(['initiator_name' => $initiator->name ?: $initiator->email]);
-            $run->refresh();
-        }
-
-        $this->auditSafely(
-            action: 'platform.ops.runbooks.start',
-            scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-            operationRunId: (int) $run->getKey(),
-            initiator: $initiator,
-            context: [
-                'preflight' => $preflight,
-                'is_break_glass' => $isBreakGlassActive,
-            ] + ($reason instanceof RunbookReason ? $reason->toArray() : []),
-        );
-
-        if (! $run->wasRecentlyCreated) {
-            return $run;
-        }
-
-        $this->operationRunService->dispatchOrFail($run, function () use ($tenant): void {
-            BackfillFindingLifecycleJob::dispatch(
-                tenantId: (int) $tenant->getKey(),
-                workspaceId: (int) $tenant->workspace_id,
-                initiatorUserId: null,
-            );
-        });
-
-        return $run;
-    }
-
-    private function platformTenant(): Tenant
-    {
-        $tenant = Tenant::query()->where('external_id', 'platform')->first();
-
-        if (! $tenant instanceof Tenant) {
-            throw new \RuntimeException('Platform tenant is missing.');
-        }
-
-        return $tenant;
-    }
-
-    /**
-     * @return array<string, mixed>
-     */
-    private function buildRunContext(
-        int $workspaceId,
-        FindingsLifecycleBackfillScope $scope,
-        User|PlatformUser|null $initiator,
-        ?RunbookReason $reason,
-        array $preflight,
-        string $source,
-        bool $isBreakGlassActive,
-    ): array {
-        $context = [
-            'workspace_id' => $workspaceId,
-            'runbook' => [
-                'key' => self::RUNBOOK_KEY,
-                'scope' => $scope->mode,
-                'target_tenant_id' => $scope->tenantId,
-                'source' => $source,
-            ],
-            'preflight' => [
-                'affected_count' => (int) ($preflight['affected_count'] ?? 0),
-                'total_count' => (int) ($preflight['total_count'] ?? 0),
-                'estimated_tenants' => $preflight['estimated_tenants'] ?? null,
-            ],
-        ];
-
-        if ($reason instanceof RunbookReason) {
-            $context['reason'] = $reason->toArray();
-        }
-
-        if ($initiator instanceof PlatformUser) {
-            $context['platform_initiator'] = [
-                'platform_user_id' => (int) $initiator->getKey(),
-                'email' => (string) $initiator->email,
-                'name' => (string) $initiator->name,
-                'is_break_glass' => $isBreakGlassActive,
-            ];
-        } elseif ($initiator instanceof User) {
-            $context['tenant_initiator'] = [
-                'user_id' => (int) $initiator->getKey(),
-                'email' => (string) $initiator->email,
-                'name' => (string) $initiator->name,
-            ];
-        }
-
-        return $context;
-    }
-
-    private function scopeFromRunContext(array $context): FindingsLifecycleBackfillScope
-    {
-        $scope = data_get($context, 'runbook.scope');
-        $tenantId = data_get($context, 'runbook.target_tenant_id');
-
-        if ($scope === FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT && is_numeric($tenantId)) {
-            return FindingsLifecycleBackfillScope::singleTenant((int) $tenantId);
-        }
-
-        return FindingsLifecycleBackfillScope::allTenants();
-    }
-
-    /**
-     * @param  array<string, mixed>  $context
-     */
-    private function auditSafely(
-        string $action,
-        FindingsLifecycleBackfillScope $scope,
-        ?int $operationRunId,
-        User|PlatformUser|null $initiator,
-        array $context = [],
-    ): void {
-        try {
-            $metadata = [
-                'runbook_key' => self::RUNBOOK_KEY,
-                'scope' => $scope->mode,
-                'target_tenant_id' => $scope->tenantId,
-                'operation_run_id' => $operationRunId,
-                'ip' => request()->ip(),
-                'user_agent' => request()->userAgent(),
-            ];
-
-            if ($initiator instanceof User && $scope->isSingleTenant()) {
-                $tenant = Tenant::query()->whereKey((int) $scope->tenantId)->first();
-
-                if ($tenant instanceof Tenant) {
-                    $this->auditLogger->log(
-                        tenant: $tenant,
-                        action: $action,
-                        context: [
-                            'metadata' => array_filter($metadata, static fn (mixed $value): bool => $value !== null),
-                        ] + $context,
-                        actorId: (int) $initiator->getKey(),
-                        actorEmail: (string) $initiator->email,
-                        actorName: (string) $initiator->name,
-                        status: 'success',
-                        resourceType: 'operation_run',
-                        resourceId: $operationRunId !== null ? (string) $operationRunId : null,
-                    );
-
-                    return;
-                }
-            }
-
-            $platformTenant = $this->platformTenant();
-            $platformActor = $initiator instanceof PlatformUser
-                ? $initiator
-                : auth('platform')->user();
-
-            $actorId = $platformActor instanceof PlatformUser ? (int) $platformActor->getKey() : null;
-            $actorEmail = $platformActor instanceof PlatformUser ? (string) $platformActor->email : null;
-            $actorName = $platformActor instanceof PlatformUser ? (string) $platformActor->name : null;
-
-            $this->auditLogger->log(
-                tenant: $platformTenant,
-                action: $action,
-                context: [
-                    'metadata' => array_filter($metadata, static fn (mixed $value): bool => $value !== null),
-                ] + $context,
-                actorId: $actorId,
-                actorEmail: $actorEmail,
-                actorName: $actorName,
-                status: 'success',
-                resourceType: 'operation_run',
-                resourceId: $operationRunId !== null ? (string) $operationRunId : null,
-            );
-        } catch (Throwable) {
-            // Audit is fail-safe (must not crash runbooks).
-        }
-    }
-
-    private function auditBlockedStart(
-        \App\Support\OperationalControls\OperationalControlDecision $decision,
-        FindingsLifecycleBackfillScope $scope,
-        Workspace $workspace,
-        ?Tenant $tenant,
-        User|PlatformUser|null $initiator,
-        string $source,
-    ): void {
-        try {
-            $metadata = array_filter([
-                'control_key' => $decision->controlKey,
-                'scope_type' => $decision->matchedScopeType,
-                'workspace_id' => (int) $workspace->getKey(),
-                'reason_text' => $decision->reasonText,
-                'expires_at' => $decision->expiresAt?->toIso8601String(),
-                'actor_id' => $initiator instanceof User || $initiator instanceof PlatformUser ? (int) $initiator->getKey() : null,
-                'requested_scope' => $scope->mode,
-                'target_tenant_id' => $scope->tenantId,
-                'source' => $source,
-                'runbook_key' => self::RUNBOOK_KEY,
-            ], static fn (mixed $value): bool => $value !== null && $value !== '');
-
-            $summary = sprintf('%s blocked by operational control', OperationCatalog::label(self::RUNBOOK_KEY));
-
-            if ($scope->isAllTenants()) {
-                $this->auditRecorder->record(
-                    action: AuditActionId::OperationalControlExecutionBlocked,
-                    context: ['metadata' => $metadata],
-                    actor: $initiator instanceof PlatformUser ? AuditActorSnapshot::platform($initiator) : null,
-                    target: new AuditTargetSnapshot(
-                        type: 'operational_control',
-                        id: $decision->sourceActivationId,
-                        label: OperationCatalog::label(self::RUNBOOK_KEY),
-                    ),
-                    outcome: 'blocked',
-                    summary: $summary,
-                );
-
-                return;
-            }
-
-            if (! $tenant instanceof Tenant) {
-                return;
-            }
-
-            $this->workspaceAuditLogger->log(
-                workspace: $workspace,
-                action: AuditActionId::OperationalControlExecutionBlocked,
-                context: ['metadata' => $metadata],
-                actor: $initiator,
-                status: 'blocked',
-                resourceType: 'operational_control',
-                resourceId: $decision->sourceActivationId !== null ? (string) $decision->sourceActivationId : null,
-                targetLabel: OperationCatalog::label(self::RUNBOOK_KEY),
-                summary: $summary,
-                tenant: $tenant,
-            );
-        } catch (Throwable) {
-            // Audit is fail-safe (must not crash runbooks).
-        }
-    }
-
-    private function notifyInitiatorSafely(OperationRun $run): void
-    {
-        try {
-            $platformUserId = data_get($run->context, 'platform_initiator.platform_user_id');
-
-            if (! is_numeric($platformUserId)) {
-                return;
-            }
-
-            $platformUser = PlatformUser::query()->whereKey((int) $platformUserId)->first();
-
-            if (! $platformUser instanceof PlatformUser) {
-                return;
-            }
-
-            $platformUser->notify(new OperationRunCompleted($run));
-        } catch (Throwable) {
-            // Notifications must not crash the runbook.
-        }
-    }
-
-    private function dispatchFailureAlertSafely(OperationRun $run): void
-    {
-        try {
-            $platformTenant = $this->platformTenant();
-            $workspace = $platformTenant->workspace;
-
-            if (! $workspace instanceof Workspace) {
-                return;
-            }
-
-            $this->alertDispatchService->dispatchEvent($workspace, [
-                'tenant_id' => (int) $platformTenant->getKey(),
-                'event_type' => 'operations.run.failed',
-                'severity' => 'high',
-                'title' => 'Operation failed: Findings lifecycle backfill',
-                'body' => 'A findings lifecycle backfill run failed.',
-                'metadata' => [
-                    'operation_run_id' => (int) $run->getKey(),
-                    'operation_type' => $run->canonicalOperationType(),
-                    'scope' => (string) data_get($run->context, 'runbook.scope', ''),
-                    'view_run_url' => SystemOperationRunLinks::view($run),
-                ],
-            ]);
-        } catch (Throwable) {
-            // Alerts must not crash the runbook.
-        }
-    }
-}

apps/platform/app/Services/Runbooks/FindingsLifecycleBackfillScope.php

@@ -1,81 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Runbooks;
-
-use Illuminate\Validation\ValidationException;
-
-final readonly class FindingsLifecycleBackfillScope
-{
-    public const string MODE_ALL_TENANTS = 'all_tenants';
-
-    public const string MODE_SINGLE_TENANT = 'single_tenant';
-
-    private function __construct(
-        public string $mode,
-        public ?int $tenantId,
-    ) {}
-
-    public static function allTenants(): self
-    {
-        return new self(
-            mode: self::MODE_ALL_TENANTS,
-            tenantId: null,
-        );
-    }
-
-    public static function singleTenant(int $tenantId): self
-    {
-        $tenantId = (int) $tenantId;
-
-        if ($tenantId <= 0) {
-            throw ValidationException::withMessages([
-                'scope.tenant_id' => 'Select a valid tenant.',
-            ]);
-        }
-
-        return new self(
-            mode: self::MODE_SINGLE_TENANT,
-            tenantId: $tenantId,
-        );
-    }
-
-    /**
-     * @param  array<string, mixed>  $data
-     */
-    public static function fromArray(array $data): self
-    {
-        $mode = trim((string) ($data['mode'] ?? ''));
-
-        if ($mode === '' || $mode === self::MODE_ALL_TENANTS) {
-            return self::allTenants();
-        }
-
-        if ($mode !== self::MODE_SINGLE_TENANT) {
-            throw ValidationException::withMessages([
-                'scope.mode' => 'Select a valid scope mode.',
-            ]);
-        }
-
-        $tenantId = $data['tenant_id'] ?? null;
-
-        if (! is_numeric($tenantId)) {
-            throw ValidationException::withMessages([
-                'scope.tenant_id' => 'Select a tenant.',
-            ]);
-        }
-
-        return self::singleTenant((int) $tenantId);
-    }
-
-    public function isAllTenants(): bool
-    {
-        return $this->mode === self::MODE_ALL_TENANTS;
-    }
-
-    public function isSingleTenant(): bool
-    {
-        return $this->mode === self::MODE_SINGLE_TENANT;
-    }
-}

apps/platform/app/Services/SystemConsole/OperationRunTriageService.php

@@ -17,7 +17,6 @@ final class OperationRunTriageService
         'inventory.sync',
         'policy.sync',
         'directory.groups.sync',
-        'findings.lifecycle.backfill',
         'rbac.health_check',
         'entra.admin_roles.scan',
         'tenant.review_pack.generate',
@@ -28,7 +27,6 @@ final class OperationRunTriageService
         'inventory.sync',
         'policy.sync',
         'directory.groups.sync',
-        'findings.lifecycle.backfill',
         'rbac.health_check',
         'entra.admin_roles.scan',
         'tenant.review_pack.generate',

apps/platform/app/Services/TenantReviews/TenantReviewSectionFactory.php

@@ -128,7 +128,7 @@ private function openRisksSection(?EvidenceSnapshotItem $findingsItem): array
     {
         $summary = $this->summary($findingsItem);
         $entries = collect(Arr::wrap($summary['entries'] ?? []))
-            ->filter(static fn (mixed $entry): bool => is_array($entry) && in_array((string) ($entry['status'] ?? ''), ['open', 'in_progress', 'acknowledged'], true))
+            ->filter(static fn (mixed $entry): bool => is_array($entry) && in_array((string) ($entry['status'] ?? ''), ['open', 'new', 'triaged', 'in_progress', 'reopened'], true))
             ->sortByDesc(static fn (array $entry): int => match ((string) ($entry['severity'] ?? 'low')) {
                 'critical' => 4,
                 'high' => 3,

apps/platform/app/Support/Auth/Capabilities.php

@@ -91,8 +91,6 @@ class Capabilities
 
     public const TENANT_FINDINGS_RISK_ACCEPT = 'tenant_findings.risk_accept';
 
-    public const TENANT_FINDINGS_ACKNOWLEDGE = 'tenant_findings.acknowledge';
-
     public const FINDING_EXCEPTION_VIEW = 'finding_exception.view';
 
     public const FINDING_EXCEPTION_MANAGE = 'finding_exception.manage';

apps/platform/app/Support/Auth/PlatformCapabilities.php

@@ -30,8 +30,6 @@ class PlatformCapabilities
 
     public const RUNBOOKS_RUN = 'platform.runbooks.run';
 
-    public const RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL = 'platform.runbooks.findings.lifecycle_backfill';
-
     public const OPS_CONTROLS_MANAGE = 'platform.ops.controls.manage';
 
     /**

apps/platform/app/Support/Baselines/BaselineCompareStats.php

@@ -796,7 +796,6 @@ private static function findingAttentionCounts(Tenant $tenant): array
         $activeNonNewFindingsCount = Finding::query()
             ->where('tenant_id', $tenantId)
             ->whereIn('status', [
-                Finding::STATUS_ACKNOWLEDGED,
                 Finding::STATUS_TRIAGED,
                 Finding::STATUS_IN_PROGRESS,
                 Finding::STATUS_REOPENED,

apps/platform/app/Support/Concerns/DerivesWorkspaceIdFromTenant.php

@@ -99,7 +99,7 @@ private static function resolveTenantWorkspaceId(Model $model, int $tenantId): i
         $tenant = $model->relationLoaded('tenant') ? $model->getRelation('tenant') : null;
 
         if (! $tenant instanceof Tenant || (int) $tenant->getKey() !== $tenantId) {
-            $tenant = Tenant::query()->find($tenantId);
+            $tenant = Tenant::query()->withTrashed()->find($tenantId);
         }
 
         if (! $tenant instanceof Tenant) {

apps/platform/app/Support/Filament/FilterOptionCatalog.php

@@ -103,9 +103,9 @@ public static function baselineProfileStatuses(): array
     /**
      * @return array<string, string>
      */
-    public static function findingStatuses(bool $includeLegacyAcknowledged = true): array
+    public static function findingStatuses(): array
     {
-        $options = self::badgeOptions(BadgeDomain::FindingStatus, [
+        return self::badgeOptions(BadgeDomain::FindingStatus, [
             Finding::STATUS_NEW,
             Finding::STATUS_TRIAGED,
             Finding::STATUS_IN_PROGRESS,
@@ -114,21 +114,6 @@ public static function findingStatuses(bool $includeLegacyAcknowledged = true):
             Finding::STATUS_CLOSED,
             Finding::STATUS_RISK_ACCEPTED,
         ]);
-
-        if (! $includeLegacyAcknowledged) {
-            return $options;
-        }
-
-        return [
-            Finding::STATUS_NEW => $options[Finding::STATUS_NEW],
-            Finding::STATUS_TRIAGED => $options[Finding::STATUS_TRIAGED],
-            Finding::STATUS_ACKNOWLEDGED => self::legacyFindingAcknowledgedLabel(),
-            Finding::STATUS_IN_PROGRESS => $options[Finding::STATUS_IN_PROGRESS],
-            Finding::STATUS_REOPENED => $options[Finding::STATUS_REOPENED],
-            Finding::STATUS_RESOLVED => $options[Finding::STATUS_RESOLVED],
-            Finding::STATUS_CLOSED => $options[Finding::STATUS_CLOSED],
-            Finding::STATUS_RISK_ACCEPTED => $options[Finding::STATUS_RISK_ACCEPTED],
-        ];
     }
 
     /**
@@ -312,11 +297,6 @@ private static function badgeOptions(BadgeDomain $domain, array $values): array
             ->all();
     }
 
-    private static function legacyFindingAcknowledgedLabel(): string
-    {
-        return BadgeCatalog::spec(BadgeDomain::FindingStatus, Finding::STATUS_ACKNOWLEDGED)->label.' (legacy acknowledged)';
-    }
-
     private static function platformLabel(string $platform): string
     {
         return match (Str::of($platform)

apps/platform/app/Support/Livewire/TrustedState/TrustedStatePolicy.php

@@ -12,8 +12,6 @@ final class TrustedStatePolicy
 
     public const TENANT_REQUIRED_PERMISSIONS = 'tenant_required_permissions';
 
-    public const SYSTEM_RUNBOOKS = 'system_runbooks';
-
     /**
      * @return array{
      *     name: string,
@@ -329,92 +327,6 @@ public function firstSlice(): array
                     'scopedTenant',
                 ],
             ],
-            self::SYSTEM_RUNBOOKS => [
-                'component_name' => 'System runbooks',
-                'plane' => 'system_platform',
-                'route_anchor' => null,
-                'authority_sources' => [
-                    'allowed_tenant_universe',
-                    'explicit_scoped_query',
-                ],
-                'locked_identities' => [],
-                'locked_identity_fields' => [],
-                'mutable_selectors' => [
-                    'findingsTenantId',
-                    'tenantId',
-                    'findingsScopeMode',
-                    'scopeMode',
-                ],
-                'mutable_selector_fields' => [
-                    $this->field(
-                        name: 'findingsTenantId',
-                        stateClass: TrustedStateClass::Presentation,
-                        phpType: '?int',
-                        sourceOfTruth: 'allowed_tenant_universe',
-                        usedForProtectedAction: true,
-                        revalidationRequired: true,
-                        implementationMarkers: [
-                            'public ?int $findingsTenantId = null;',
-                            'resolveAllowedOrFail($this->findingsTenantId)',
-                        ],
-                        notes: 'Single-tenant runbook proposal only; it must be validated against the operator allowed-tenant universe.',
-                    ),
-                    $this->field(
-                        name: 'tenantId',
-                        stateClass: TrustedStateClass::Presentation,
-                        phpType: '?int',
-                        sourceOfTruth: 'allowed_tenant_universe',
-                        usedForProtectedAction: false,
-                        revalidationRequired: false,
-                        implementationMarkers: [
-                            'public ?int $tenantId = null;',
-                        ],
-                        notes: 'Mirrored display state for the last trusted preflight result.',
-                    ),
-                    $this->field(
-                        name: 'findingsScopeMode',
-                        stateClass: TrustedStateClass::Presentation,
-                        phpType: 'string',
-                        sourceOfTruth: 'presentation_only',
-                        usedForProtectedAction: true,
-                        revalidationRequired: true,
-                        implementationMarkers: [
-                            'public string $findingsScopeMode = FindingsLifecycleBackfillScope::MODE_ALL_TENANTS;',
-                            'trustedFindingsScopeFromState(',
-                        ],
-                        notes: 'Scope mode remains mutable UI state but protected actions re-normalize it into a trusted scope DTO.',
-                    ),
-                    $this->field(
-                        name: 'scopeMode',
-                        stateClass: TrustedStateClass::Presentation,
-                        phpType: 'string',
-                        sourceOfTruth: 'presentation_only',
-                        usedForProtectedAction: false,
-                        revalidationRequired: false,
-                        implementationMarkers: [
-                            'public string $scopeMode = FindingsLifecycleBackfillScope::MODE_ALL_TENANTS;',
-                        ],
-                        notes: 'Mirrored display state for the last trusted preflight result.',
-                    ),
-                ],
-                'server_derived_authority_fields' => [
-                    $this->field(
-                        name: 'findingsScope',
-                        stateClass: TrustedStateClass::ServerDerivedAuthority,
-                        phpType: 'FindingsLifecycleBackfillScope',
-                        sourceOfTruth: 'allowed_tenant_universe',
-                        usedForProtectedAction: true,
-                        revalidationRequired: true,
-                        implementationMarkers: [
-                            'trustedFindingsScopeFromFormData(',
-                            'trustedFindingsScopeFromState(',
-                            'resolveAllowedOrFail(',
-                        ],
-                        notes: 'Protected actions must convert mutable selector state into a trusted scope DTO via AllowedTenantUniverse.',
-                    ),
-                ],
-                'forbidden_public_authority_fields' => [],
-            ],
         ];
     }
 

apps/platform/app/Support/OperationCatalog.php

@@ -278,7 +278,6 @@ private static function canonicalDefinitions(): array
             'tenant.review.compose' => new CanonicalOperationType('tenant.review.compose', 'platform_foundation', 'tenant_review', 'Review composition', true, 60),
             'tenant.evidence.snapshot.generate' => new CanonicalOperationType('tenant.evidence.snapshot.generate', 'platform_foundation', 'evidence_snapshot', 'Evidence snapshot generation', true, 120),
             'rbac.health_check' => new CanonicalOperationType('rbac.health_check', 'intune', null, 'RBAC health check', false, 30),
-            'findings.lifecycle.backfill' => new CanonicalOperationType('findings.lifecycle.backfill', 'platform_foundation', null, 'Findings lifecycle backfill', false, 300),
         ];
     }
 
@@ -290,27 +289,36 @@ private static function operationAliases(): array
         return [
             new OperationTypeAlias('policy.sync', 'policy.sync', 'canonical', true),
             new OperationTypeAlias('policy.sync_one', 'policy.sync', 'legacy_alias', false, 'Legacy single-policy sync values resolve to the canonical policy.sync operation.', 'Prefer policy.sync on platform-owned read paths.'),
+            new OperationTypeAlias('policy.snapshot', 'policy.snapshot', 'canonical', true),
             new OperationTypeAlias('policy.capture_snapshot', 'policy.snapshot', 'canonical', true),
             new OperationTypeAlias('policy.delete', 'policy.delete', 'canonical', true),
+            new OperationTypeAlias('policy.restore', 'policy.restore', 'canonical', true),
             new OperationTypeAlias('policy.unignore', 'policy.restore', 'legacy_alias', false, 'Legacy policy.unignore values resolve to policy.restore for operator-facing wording.', 'Prefer policy.restore on new platform-owned read models.'),
             new OperationTypeAlias('policy.export', 'policy.export', 'canonical', true),
             new OperationTypeAlias('provider.connection.check', 'provider.connection.check', 'canonical', true),
+            new OperationTypeAlias('inventory.sync', 'inventory.sync', 'canonical', true),
             new OperationTypeAlias('inventory_sync', 'inventory.sync', 'legacy_alias', false, 'Legacy inventory_sync storage values resolve to the canonical inventory.sync operation.', 'Preserve stored values during rollout while showing inventory.sync semantics on read paths.'),
             new OperationTypeAlias('provider.inventory.sync', 'inventory.sync', 'legacy_alias', false, 'Provider-prefixed historical inventory sync values share the same operator meaning as inventory sync.', 'Avoid emitting provider.inventory.sync on new platform-owned surfaces.'),
             new OperationTypeAlias('compliance.snapshot', 'compliance.snapshot', 'canonical', true),
             new OperationTypeAlias('provider.compliance.snapshot', 'compliance.snapshot', 'legacy_alias', false, 'Provider-prefixed compliance snapshot values resolve to the canonical compliance.snapshot operation.', 'Avoid emitting provider.compliance.snapshot on new platform-owned surfaces.'),
+            new OperationTypeAlias('directory.groups.sync', 'directory.groups.sync', 'canonical', true),
             new OperationTypeAlias('entra_group_sync', 'directory.groups.sync', 'legacy_alias', false, 'Historical entra_group_sync values resolve to directory.groups.sync.', 'Prefer directory.groups.sync on new platform-owned read models.'),
             new OperationTypeAlias('backup_set.update', 'backup_set.update', 'canonical', true),
+            new OperationTypeAlias('backup_set.archive', 'backup_set.archive', 'canonical', true),
             new OperationTypeAlias('backup_set.delete', 'backup_set.archive', 'canonical', true),
             new OperationTypeAlias('backup_set.restore', 'backup_set.restore', 'canonical', true),
             new OperationTypeAlias('backup_set.force_delete', 'backup_set.delete', 'legacy_alias', false, 'Force-delete wording is normalized to the canonical delete label.', 'Use backup_set.delete for new platform-owned summaries.'),
+            new OperationTypeAlias('backup.schedule.execute', 'backup.schedule.execute', 'canonical', true),
             new OperationTypeAlias('backup_schedule_run', 'backup.schedule.execute', 'legacy_alias', false, 'Historical backup_schedule_run values resolve to backup.schedule.execute.', 'Prefer backup.schedule.execute on canonical read paths.'),
+            new OperationTypeAlias('backup.schedule.retention', 'backup.schedule.retention', 'canonical', true),
             new OperationTypeAlias('backup_schedule_retention', 'backup.schedule.retention', 'legacy_alias', false, 'Legacy backup schedule retention values resolve to backup.schedule.retention.', 'Prefer dotted canonical backup schedule naming on new read paths.'),
+            new OperationTypeAlias('backup.schedule.purge', 'backup.schedule.purge', 'canonical', true),
             new OperationTypeAlias('backup_schedule_purge', 'backup.schedule.purge', 'legacy_alias', false, 'Legacy backup schedule purge values resolve to backup.schedule.purge.', 'Prefer dotted canonical backup schedule naming on new read paths.'),
             new OperationTypeAlias('restore.execute', 'restore.execute', 'canonical', true),
             new OperationTypeAlias('assignments.fetch', 'assignments.fetch', 'canonical', true),
             new OperationTypeAlias('assignments.restore', 'assignments.restore', 'canonical', true),
             new OperationTypeAlias('ops.reconcile_adapter_runs', 'ops.reconcile_adapter_runs', 'canonical', true),
+            new OperationTypeAlias('directory.role_definitions.sync', 'directory.role_definitions.sync', 'canonical', true),
             new OperationTypeAlias('directory_role_definitions.sync', 'directory.role_definitions.sync', 'legacy_alias', false, 'Legacy directory_role_definitions.sync values resolve to directory.role_definitions.sync.', 'Prefer dotted role-definition naming on new read paths.'),
             new OperationTypeAlias('restore_run.delete', 'restore_run.delete', 'canonical', true),
             new OperationTypeAlias('restore_run.restore', 'restore_run.restore', 'canonical', true),
@@ -325,13 +333,13 @@ private static function operationAliases(): array
             new OperationTypeAlias('baseline.compare', 'baseline.compare', 'canonical', true),
             new OperationTypeAlias('baseline_capture', 'baseline.capture', 'legacy_alias', false, 'Historical baseline_capture values resolve to baseline.capture.', 'Prefer baseline.capture on canonical read paths.'),
             new OperationTypeAlias('baseline_compare', 'baseline.compare', 'legacy_alias', false, 'Historical baseline_compare values resolve to baseline.compare.', 'Prefer baseline.compare on canonical read paths.'),
+            new OperationTypeAlias('permission.posture.check', 'permission.posture.check', 'canonical', true),
             new OperationTypeAlias('permission_posture_check', 'permission.posture.check', 'legacy_alias', false, 'Historical permission_posture_check values resolve to permission.posture.check.', 'Prefer dotted permission posture naming on new read paths.'),
             new OperationTypeAlias('entra.admin_roles.scan', 'entra.admin_roles.scan', 'canonical', true),
             new OperationTypeAlias('tenant.review_pack.generate', 'tenant.review_pack.generate', 'canonical', true),
             new OperationTypeAlias('tenant.review.compose', 'tenant.review.compose', 'canonical', true),
             new OperationTypeAlias('tenant.evidence.snapshot.generate', 'tenant.evidence.snapshot.generate', 'canonical', true),
             new OperationTypeAlias('rbac.health_check', 'rbac.health_check', 'canonical', true),
-            new OperationTypeAlias('findings.lifecycle.backfill', 'findings.lifecycle.backfill', 'canonical', true),
         ];
     }
 }

apps/platform/app/Support/Ui/ActionSurface/ActionSurfaceExemptions.php

@@ -640,23 +640,18 @@ public static function spec195ResidualSurfaceInventory(): array
                 'discoveryState' => 'outside_primary_discovery',
                 'closureDecision' => 'separately_governed',
                 'reasonCategory' => 'workflow_specific_governance',
-                'explicitReason' => 'Runbooks is a workflow utility hub with its own trusted-state, authorization, and confirmation semantics rather than a declaration-backed record or table surface.',
+                'explicitReason' => 'Runbooks remains a system utility shell outside the declaration-backed record or table surface; it currently exposes no supported launch action after lifecycle-backfill removal.',
                 'evidence' => [
                     [
                         'kind' => 'feature_livewire_test',
-                        'reference' => 'tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillStartTest.php',
-                        'proves' => 'The runbooks shell enforces preflight-first execution, typed confirmation, and capability-gated run behavior.',
+                        'reference' => 'tests/Feature/System/OpsRunbooks/RemoveFindingsLifecycleBackfillRunbookSurfaceTest.php',
+                        'proves' => 'The runbooks shell stays accessible to authorized platform operators while exposing no findings lifecycle backfill launch action.',
                     ],
                     [
                         'kind' => 'authorization_test',
                         'reference' => 'tests/Feature/System/Spec113/AuthorizationSemanticsTest.php',
                         'proves' => 'The system plane still returns 403 when runbook-view capabilities are missing.',
                     ],
-                    [
-                        'kind' => 'guard_test',
-                        'reference' => 'tests/Feature/Guards/LivewireTrustedStateGuardTest.php',
-                        'proves' => 'Runbooks keeps its trusted-state policy under explicit guard coverage.',
-                    ],
                 ],
                 'followUpAction' => 'add_guard_only',
                 'mustRemainBaselineExempt' => false,

apps/platform/database/factories/FindingFactory.php

@@ -73,18 +73,6 @@ public function permissionPosture(): static
         ]);
     }
 
-    /**
-     * State for legacy acknowledged findings.
-     */
-    public function acknowledged(): static
-    {
-        return $this->state(fn (array $attributes): array => [
-            'status' => Finding::STATUS_ACKNOWLEDGED,
-            'acknowledged_at' => now(),
-            'acknowledged_by_user_id' => null,
-        ]);
-    }
-
     /**
      * State for triaged findings.
      */

apps/platform/database/seeders/PlatformUserSeeder.php

@@ -41,7 +41,6 @@ public function run(): void
                     PlatformCapabilities::OPS_VIEW,
                     PlatformCapabilities::RUNBOOKS_VIEW,
                     PlatformCapabilities::RUNBOOKS_RUN,
-                    PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
                     PlatformCapabilities::OPS_CONTROLS_MANAGE,
                 ],
                 'is_active' => true,

apps/platform/resources/views/filament/components/product-knowledge/contextual-help.blade.php

@@ -1,7 +1,10 @@
 @php
+    use App\Support\Verification\VerificationLinkBehavior;
+
     $help = is_array($help ?? null) ? $help : [];
     $links = is_array($help['docs_links'] ?? null) ? $help['docs_links'] : [];
     $steps = is_array($help['troubleshooting_steps'] ?? null) ? $help['troubleshooting_steps'] : [];
+    $linkBehavior = app(VerificationLinkBehavior::class);
     $headline = is_string($help['headline'] ?? null) && trim((string) ($help['headline'] ?? '')) !== ''
         ? (string) ($help['headline'])
         : 'Contextual help';
@@ -57,9 +60,16 @@
                 <div class="flex flex-wrap gap-2">
                     @foreach ($links as $link)
                         @php
+                            $linkLabel = is_string($link['label'] ?? null) && trim((string) ($link['label'] ?? '')) !== ''
+                                ? (string) $link['label']
+                                : 'Open';
                             $linkUrl = is_string($link['url'] ?? null) && trim((string) ($link['url'] ?? '')) !== ''
                                 ? (string) $link['url']
                                 : null;
+                            $behavior = $linkUrl !== null
+                                ? $linkBehavior->describe($linkLabel, $linkUrl)
+                                : null;
+                            $testId = 'contextual-help-link-'.\Illuminate\Support\Str::slug($linkLabel);
                         @endphp
 
                         @if ($linkUrl)
@@ -68,8 +78,11 @@
                                 :href="$linkUrl"
                                 size="sm"
                                 color="primary"
+                                :target="(bool) ($behavior['opens_in_new_tab'] ?? false) ? '_blank' : null"
+                                :rel="(bool) ($behavior['opens_in_new_tab'] ?? false) ? 'noopener noreferrer' : null"
+                                :data-testid="$testId"
                             >
-                                {{ (string) ($link['label'] ?? 'Open') }}
+                                {{ $linkLabel }}
                             </x-filament::button>
                         @endif
                     @endforeach

apps/platform/resources/views/filament/system/pages/ops/runbooks.blade.php

@@ -1,13 +1,3 @@
-@php
-    $findingsLastRun = $this->findingsLastRun();
-    $findingsLastRunStatusSpec = $findingsLastRun
-        ? \App\Support\Badges\BadgeRenderer::spec(\App\Support\Badges\BadgeDomain::OperationRunStatus, (string) $findingsLastRun->status)
-        : null;
-    $findingsLastRunOutcomeSpec = $findingsLastRun && (string) $findingsLastRun->status === 'completed'
-        ? \App\Support\Badges\BadgeRenderer::spec(\App\Support\Badges\BadgeDomain::OperationRunOutcome, (string) $findingsLastRun->outcome)
-        : null;
-@endphp
-
 <x-filament-panels::page>
     <div class="space-y-6">
         <x-filament::section>
@@ -17,7 +7,7 @@
                 <div>
                     <p class="text-sm font-semibold text-amber-700 dark:text-amber-300">Operator warning</p>
                     <p class="mt-1 text-sm text-gray-600 dark:text-gray-300">
-                        Runbooks can modify or assess customer data across tenants. Always run preflight first, and ensure you have the correct scope selected.
+                        Runbooks can modify or assess customer data across tenants. When supported runbooks are available, verify scope and confirmation requirements before execution.
                     </p>
                 </div>
             </div>
@@ -25,100 +15,17 @@
 
         <x-filament::section>
             <x-slot name="heading">
-                Rebuild Findings Lifecycle
+                No supported runbooks
             </x-slot>
 
             <x-slot name="description">
-                Backfills legacy findings lifecycle fields, SLA due dates, and consolidates drift duplicate findings.
+                Supported platform runbooks will appear here when they are part of current product truth.
             </x-slot>
 
-            <x-slot name="afterHeader">
-                <x-filament::badge color="info" size="sm">
-                    {{ $this->findingsScopeLabel() }}
-                </x-filament::badge>
-            </x-slot>
-
-            <div class="space-y-4">
-                @if ($findingsLastRun)
-                    <div class="flex flex-wrap items-center gap-x-4 gap-y-2 rounded-lg bg-gray-50 px-4 py-3 dark:bg-white/5">
-                        <span class="text-xs font-semibold uppercase tracking-wider text-gray-500 dark:text-gray-400">Last run</span>
-
-                        <span class="text-sm text-gray-700 dark:text-gray-300">
-                            {{ $findingsLastRun->created_at?->diffForHumans() ?? '—' }}
-                        </span>
-
-                        @if ($findingsLastRunStatusSpec)
-                            <x-filament::badge
-                                :color="$findingsLastRunStatusSpec->color"
-                                :icon="$findingsLastRunStatusSpec->icon"
-                                size="sm"
-                            >
-                                {{ $findingsLastRunStatusSpec->label }}
-                            </x-filament::badge>
-                        @endif
-
-                        @if ($findingsLastRunOutcomeSpec)
-                            <x-filament::badge
-                                :color="$findingsLastRunOutcomeSpec->color"
-                                :icon="$findingsLastRunOutcomeSpec->icon"
-                                size="sm"
-                            >
-                                {{ $findingsLastRunOutcomeSpec->label }}
-                            </x-filament::badge>
-                        @endif
-
-                        @if ($findingsLastRun->initiator_name)
-                            <span class="text-xs text-gray-500 dark:text-gray-400">
-                                by {{ $findingsLastRun->initiator_name }}
-                            </span>
-                        @endif
-                    </div>
-                @endif
-
-                @if (is_array($this->findingsPreflight))
-                    <div class="grid grid-cols-1 gap-4 sm:grid-cols-3">
-                        <x-filament::section>
-                            <div class="text-center">
-                                <p class="text-xs font-semibold uppercase tracking-wider text-gray-500 dark:text-gray-400">Affected</p>
-                                <p class="mt-2 text-3xl font-bold tabular-nums text-gray-950 dark:text-white">
-                                    {{ number_format((int) ($this->findingsPreflight['affected_count'] ?? 0)) }}
-                                </p>
-                            </div>
-                        </x-filament::section>
-
-                        <x-filament::section>
-                            <div class="text-center">
-                                <p class="text-xs font-semibold uppercase tracking-wider text-gray-500 dark:text-gray-400">Total scanned</p>
-                                <p class="mt-2 text-3xl font-bold tabular-nums text-gray-950 dark:text-white">
-                                    {{ number_format((int) ($this->findingsPreflight['total_count'] ?? 0)) }}
-                                </p>
-                            </div>
-                        </x-filament::section>
-
-                        <x-filament::section>
-                            <div class="text-center">
-                                <p class="text-xs font-semibold uppercase tracking-wider text-gray-500 dark:text-gray-400">Estimated tenants</p>
-                                <p class="mt-2 text-3xl font-bold tabular-nums text-gray-950 dark:text-white">
-                                    {{ is_numeric($this->findingsPreflight['estimated_tenants'] ?? null) ? number_format((int) $this->findingsPreflight['estimated_tenants']) : '—' }}
-                                </p>
-                            </div>
-                        </x-filament::section>
-                    </div>
-
-                    @if ((int) ($this->findingsPreflight['affected_count'] ?? 0) <= 0)
-                        <div class="flex items-center gap-2 text-sm text-gray-500 dark:text-gray-400">
-                            <x-heroicon-m-check-circle class="h-5 w-5 text-success-500" />
-                            Nothing to do for the current scope.
-                        </div>
-                    @endif
-                @else
-                    <div class="flex items-center gap-2 text-sm text-gray-500 dark:text-gray-400">
-                        <x-heroicon-m-magnifying-glass class="h-5 w-5" />
-                        Run <span class="mx-1 font-semibold text-gray-700 dark:text-gray-200">Preflight</span> to see how many findings would change for the selected scope.
-                    </div>
-                @endif
+            <div class="flex items-center gap-2 text-sm text-gray-500 dark:text-gray-400">
+                <x-heroicon-m-check-circle class="h-5 w-5 text-success-500" />
+                There are no operator-run repair runbooks exposed on this surface.
             </div>
         </x-filament::section>
-
     </div>
 </x-filament-panels::page>

apps/platform/tests/Browser/OnboardingDraftRefreshTest.php

@@ -61,18 +61,6 @@
     ]);
     session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
 
-    $visibleSelectValue = <<<'JS'
-(() => {
-    const select = [...document.querySelectorAll('select')].find((element) => {
-        const style = window.getComputedStyle(element);
-
-        return style.display !== 'none' && style.visibility !== 'hidden';
-    });
-
-    return select?.value ?? null;
-})()
-JS;
-
     $page = visit(route('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()]));
 
     $page
@@ -87,8 +75,8 @@
         ->assertRoute('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()])
         ->assertSee('Verify access')
         ->assertSee('Status: Not started')
-        ->click('Provider connection')
-        ->assertScript($visibleSelectValue, (string) $connection->getKey())
+        ->click('Select an existing connection or create a new one.')
+        ->assertSee('Edit selected connection')
         ->click('Create new connection')
         ->check('internal:label="Dedicated override"s')
         ->fill('[type="password"]', 'browser-only-secret')
@@ -97,8 +85,8 @@
         ->waitForText('Status: Not started')
         ->assertRoute('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()])
         ->assertSee('Verify access')
-        ->click('Provider connection')
-        ->assertScript($visibleSelectValue, (string) $connection->getKey())
+        ->click('Select an existing connection or create a new one.')
+        ->assertSee('Edit selected connection')
         ->click('Create new connection')
         ->check('internal:label="Dedicated override"s')
         ->assertValue('[type="password"]', '');

apps/platform/tests/Browser/OnboardingDraftVerificationResumeTest.php

@@ -86,18 +86,6 @@
     ]);
     session()->put(WorkspaceContext::SESSION_KEY, (int) $workspace->getKey());
 
-    $visibleSelectValue = <<<'JS'
-(() => {
-    const select = [...document.querySelectorAll('select')].find((element) => {
-        const style = window.getComputedStyle(element);
-
-        return style.display !== 'none' && style.visibility !== 'hidden';
-    });
-
-    return select?.value ?? null;
-})()
-JS;
-
     $page = visit(route('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()]));
 
     $page
@@ -113,8 +101,8 @@
         ->assertRoute('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()])
         ->assertSee('Status: Needs attention')
         ->assertSee('Start verification')
-        ->click('Provider connection')
-        ->assertScript($visibleSelectValue, (string) $selectedConnection->getKey());
+        ->click('Select an existing connection or create a new one.')
+        ->assertSee('Edit selected connection');
 });
 
 it('preserves bootstrap revisit state and blocked activation guards after refresh', function (): void {
@@ -328,32 +316,14 @@
         ->assertNoJavaScriptErrors()
         ->assertRoute('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()])
         ->wait(1)
-        ->assertScript("document.querySelector('[data-testid=\"verification-assist-trigger\"]') !== null", true)
-        ->click('[data-testid="verification-assist-trigger"]')
-        ->assertScript("document.querySelector('[data-testid=\"verification-assist-root\"]') !== null", true)
-        ->assertAttribute('[data-testid="verification-assist-full-page"]', 'target', '_blank');
-
-    $page->script(<<<'JS'
-Object.defineProperty(navigator, 'clipboard', {
-    configurable: true,
-    value: {
-        writeText: async () => Promise.resolve(),
-    },
-});
-
-document.querySelector('[data-testid="verification-assist-copy-application"]')?.click();
-JS);
-
-    $page
-        ->waitForText('Copied')
-        ->assertAttribute('[data-testid="verification-assist-full-page"]', 'rel', 'noopener noreferrer')
-        ->click('[data-testid="verification-assist-full-page"]')
+        ->assertScript("document.querySelector('[data-testid=\"contextual-help-link-open-required-permissions\"]') !== null", true)
+        ->assertAttribute('[data-testid="contextual-help-link-open-required-permissions"]', 'target', '_blank')
+        ->assertAttribute('[data-testid="contextual-help-link-open-required-permissions"]', 'rel', 'noopener noreferrer')
+        ->click('[data-testid="contextual-help-link-open-required-permissions"]')
         ->wait(1)
         ->assertRoute('admin.onboarding.draft', ['onboardingDraft' => (int) $draft->getKey()])
-        ->assertScript("document.querySelector('[data-testid=\"verification-assist-root\"]') !== null", true)
-        ->click('Close')
-        ->click('Provider connection')
-        ->assertSee('Select an existing connection or create a new one.');
+        ->click('Select an existing connection or create a new one.')
+        ->assertSee('Edit selected connection');
 });
 
 it('opens the permissions assist from report remediation steps without leaving onboarding', function (): void {

apps/platform/tests/Feature/Auth/RemoveAcknowledgedCapabilityAliasTest.php

@@ -0,0 +1,23 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Services\Auth\RoleCapabilityMap;
+use App\Support\Auth\Capabilities;
+use App\Support\TenantRole;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
+
+uses(RefreshDatabase::class);
+
+it('removes the acknowledged findings capability alias from shared RBAC truth', function (): void {
+    expect(Capabilities::isKnown('tenant_findings.acknowledge'))->toBeFalse();
+    expect(RoleCapabilityMap::rolesWithCapability('tenant_findings.acknowledge'))->toBe([]);
+});
+
+it('keeps the canonical findings triage capability available to operators', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'operator');
+
+    expect(RoleCapabilityMap::hasCapability(TenantRole::Operator, Capabilities::TENANT_FINDINGS_TRIAGE))->toBeTrue();
+    expect(Gate::forUser($user)->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
+});

apps/platform/tests/Feature/BaselineDriftEngine/BaselineCaptureAuditEventsTest.php

@@ -9,6 +9,7 @@
 use App\Services\Intune\AuditLogger;
 use App\Services\OperationRunService;
 use App\Support\Baselines\BaselineCaptureMode;
+use App\Support\OperationRunType;
 
 it('writes audit events for baseline capture start and completion with scope + gap summary', function () {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
@@ -35,7 +36,7 @@
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/BaselineDriftEngine/BaselineSnapshotNoTenantIdentifiersTest.php

@@ -58,7 +58,7 @@
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/BaselineDriftEngine/CaptureBaselineContentTest.php

@@ -12,6 +12,7 @@
 use App\Services\Intune\AuditLogger;
 use App\Services\OperationRunService;
 use App\Support\Baselines\BaselineSubjectKey;
+use App\Support\OperationRunType;
 
 it('Baseline capture stores content fidelity hash when PolicyVersion evidence exists', function () {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
@@ -73,7 +74,7 @@
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/BaselineDriftEngine/CaptureBaselineFullContentOnDemandTest.php

@@ -18,6 +18,7 @@
 use App\Support\Baselines\BaselineCaptureMode;
 use App\Support\Baselines\BaselineSubjectKey;
 use App\Support\Baselines\PolicyVersionCapturePurpose;
+use App\Support\OperationRunType;
 
 it('Baseline capture (full content) captures evidence on demand when missing', function () {
     config()->set('tenantpilot.baselines.full_content_capture.enabled', true);
@@ -119,7 +120,7 @@ public function capture(
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/BaselineDriftEngine/CaptureBaselineMetaFallbackTest.php

@@ -64,7 +64,7 @@
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/Baselines/BaselineCaptureRbacRoleDefinitionsTest.php

@@ -14,6 +14,7 @@
 use App\Services\Intune\AuditLogger;
 use App\Services\OperationRunService;
 use App\Support\Baselines\BaselineSubjectKey;
+use App\Support\OperationRunType;
 
 it('captures intune role definitions with identity metadata and excludes role assignments from the baseline snapshot', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
@@ -104,7 +105,7 @@
     $operationRuns = app(OperationRunService::class);
     $run = $operationRuns->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/Baselines/BaselineCaptureTest.php

@@ -17,6 +17,7 @@
 use App\Support\Baselines\BaselineReasonCodes;
 use App\Support\Baselines\BaselineSnapshotLifecycleState;
 use App\Support\Baselines\BaselineSubjectKey;
+use App\Support\OperationRunType;
 use Illuminate\Support\Facades\Queue;
 
 function createBaselineCaptureInventoryBasis(
@@ -65,7 +66,7 @@ function runBaselineCaptureJob(
 
     /** @var OperationRun $run */
     $run = $result['run'];
-    expect($run->type)->toBe('baseline_capture');
+    expect($run->type)->toBe(OperationRunType::BaselineCapture->value);
     expect($run->status)->toBe('queued');
     expect($run->tenant_id)->toBe((int) $tenant->getKey());
 
@@ -104,7 +105,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe(BaselineReasonCodes::CAPTURE_INVENTORY_MISSING);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture when the latest inventory sync was blocked', function () {
@@ -135,7 +136,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe(BaselineReasonCodes::CAPTURE_INVENTORY_BLOCKED);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture when the latest inventory sync failed without falling back to an older success', function () {
@@ -166,7 +167,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe(BaselineReasonCodes::CAPTURE_INVENTORY_FAILED);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture when the latest inventory coverage is unusable for the baseline scope', function () {
@@ -189,7 +190,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe(BaselineReasonCodes::CAPTURE_UNUSABLE_COVERAGE);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture for a draft profile with reason code', function () {
@@ -209,7 +210,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe('baseline.capture.profile_not_active');
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture for an archived profile with reason code', function () {
@@ -228,7 +229,7 @@ function runBaselineCaptureJob(
     expect($result['reason_code'])->toBe('baseline.capture.profile_not_active');
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('rejects capture for a tenant from a different workspace', function () {
@@ -274,7 +275,7 @@ function runBaselineCaptureJob(
     expect($result2['ok'])->toBeTrue();
 
     expect($result1['run']->getKey())->toBe($result2['run']->getKey());
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(1);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(1);
 });
 
 // --- Snapshot dedupe + capture job execution ---
@@ -321,7 +322,7 @@ function runBaselineCaptureJob(
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),
@@ -476,7 +477,7 @@ function runBaselineCaptureJob(
 
     $run1 = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),
@@ -499,7 +500,7 @@ function runBaselineCaptureJob(
         'tenant_id' => (int) $tenant->getKey(),
         'user_id' => (int) $user->getKey(),
         'initiator_name' => $user->name,
-        'type' => 'baseline_capture',
+        'type' => OperationRunType::BaselineCapture->value,
         'status' => 'queued',
         'outcome' => 'pending',
         'run_identity_hash' => hash('sha256', 'second-run-'.now()->timestamp),
@@ -586,7 +587,7 @@ function runBaselineCaptureJob(
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),
@@ -662,7 +663,7 @@ function runBaselineCaptureJob(
     $opService = app(OperationRunService::class);
     $run = $opService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/Baselines/BaselineCompareFindingsTest.php

@@ -528,6 +528,133 @@
     expect((string) data_get($finding->evidence_jsonb, 'current.hash'))->not->toBe($currentHash1);
 });
 
+it('repairs missing due-state fields on an existing open drift finding without extending the original due date', function () {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    \Carbon\CarbonImmutable::setTestNow(\Carbon\CarbonImmutable::parse('2026-02-24T10:00:00Z'));
+
+    $profile = BaselineProfile::factory()->active()->create([
+        'workspace_id' => $tenant->workspace_id,
+        'scope_jsonb' => ['policy_types' => ['deviceConfiguration'], 'foundation_types' => []],
+    ]);
+
+    $snapshot = BaselineSnapshot::factory()->create([
+        'workspace_id' => $tenant->workspace_id,
+        'baseline_profile_id' => $profile->getKey(),
+    ]);
+
+    $profile->update(['active_snapshot_id' => $snapshot->getKey()]);
+
+    $inventorySyncRun = createInventorySyncOperationRunWithCoverage(
+        tenant: $tenant,
+        statusByType: ['deviceConfiguration' => 'succeeded'],
+    );
+
+    $builder = app(InventoryMetaContract::class);
+    $hasher = app(DriftHasher::class);
+
+    $baselineContract = $builder->build(
+        policyType: 'deviceConfiguration',
+        subjectExternalId: 'policy-x-uuid',
+        metaJsonb: ['odata_type' => '#microsoft.graph.deviceConfiguration', 'etag' => 'E_BASELINE'],
+    );
+
+    $displayName = 'Policy X';
+    $subjectKey = BaselineSubjectKey::fromDisplayName($displayName);
+    expect($subjectKey)->not->toBeNull();
+    $workspaceSafeExternalId = BaselineSubjectKey::workspaceSafeSubjectExternalId('deviceConfiguration', (string) $subjectKey);
+
+    BaselineSnapshotItem::factory()->create([
+        'baseline_snapshot_id' => $snapshot->getKey(),
+        'subject_type' => 'policy',
+        'subject_external_id' => $workspaceSafeExternalId,
+        'subject_key' => (string) $subjectKey,
+        'policy_type' => 'deviceConfiguration',
+        'baseline_hash' => $hasher->hashNormalized($baselineContract),
+        'meta_jsonb' => ['display_name' => $displayName],
+    ]);
+
+    InventoryItem::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'workspace_id' => $tenant->workspace_id,
+        'external_id' => 'policy-x-uuid',
+        'policy_type' => 'deviceConfiguration',
+        'meta_jsonb' => ['odata_type' => '#microsoft.graph.deviceConfiguration', 'etag' => 'E_CURRENT_1'],
+        'display_name' => $displayName,
+        'last_seen_operation_run_id' => (int) $inventorySyncRun->getKey(),
+        'last_seen_at' => now(),
+    ]);
+
+    $opService = app(OperationRunService::class);
+
+    $run1 = $opService->ensureRunWithIdentity(
+        tenant: $tenant,
+        type: OperationRunType::BaselineCompare->value,
+        identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
+        context: [
+            'baseline_profile_id' => (int) $profile->getKey(),
+            'baseline_snapshot_id' => (int) $snapshot->getKey(),
+            'effective_scope' => ['policy_types' => ['deviceConfiguration'], 'foundation_types' => []],
+        ],
+        initiator: $user,
+    );
+
+    (new CompareBaselineToTenantJob($run1))->handle(
+        app(BaselineSnapshotIdentity::class),
+        app(AuditLogger::class),
+        $opService,
+    );
+
+    $scopeKey = 'baseline_profile:'.$profile->getKey();
+
+    $finding = Finding::query()
+        ->where('tenant_id', $tenant->getKey())
+        ->where('source', 'baseline.compare')
+        ->where('scope_key', $scopeKey)
+        ->sole();
+
+    $expectedSlaDays = (int) $finding->sla_days;
+    $expectedDueAt = $finding->due_at?->toIso8601String();
+
+    expect($expectedSlaDays)->toBeGreaterThan(0)
+        ->and($expectedDueAt)->not->toBeNull();
+
+    $finding->forceFill([
+        'sla_days' => null,
+        'due_at' => null,
+    ])->save();
+
+    \Carbon\CarbonImmutable::setTestNow(\Carbon\CarbonImmutable::parse('2026-02-24T11:00:00Z'));
+
+    $run2 = $opService->ensureRunWithIdentity(
+        tenant: $tenant,
+        type: OperationRunType::BaselineCompare->value,
+        identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
+        context: [
+            'baseline_profile_id' => (int) $profile->getKey(),
+            'baseline_snapshot_id' => (int) $snapshot->getKey(),
+            'effective_scope' => ['policy_types' => ['deviceConfiguration'], 'foundation_types' => []],
+        ],
+        initiator: $user,
+    );
+
+    (new CompareBaselineToTenantJob($run2))->handle(
+        app(BaselineSnapshotIdentity::class),
+        app(AuditLogger::class),
+        $opService,
+    );
+
+    $finding->refresh();
+
+    expect($finding->first_seen_at?->toIso8601String())->toBe('2026-02-24T10:00:00+00:00')
+        ->and($finding->last_seen_at?->toIso8601String())->toBe('2026-02-24T11:00:00+00:00')
+        ->and($finding->times_seen)->toBe(2)
+        ->and($finding->sla_days)->toBe($expectedSlaDays)
+        ->and($finding->due_at?->toIso8601String())->toBe($expectedDueAt);
+
+    \Carbon\CarbonImmutable::setTestNow();
+});
+
 it('does not create new finding identities when a new snapshot is captured', function () {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
 

apps/platform/tests/Feature/Baselines/BaselineCompareMatrixCompareAllActionTest.php

@@ -15,6 +15,7 @@
 use App\Support\Governance\GovernanceSubjectTaxonomyRegistry;
 use App\Support\OperationRunOutcome;
 use App\Support\OperationRunStatus;
+use App\Support\OperationRunType;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Queue;
 use Livewire\Livewire;
@@ -69,14 +70,14 @@
 
     $activeRuns = OperationRun::query()
         ->where('workspace_id', (int) $fixture['workspace']->getKey())
-        ->where('type', 'baseline_compare')
+        ->where('type', OperationRunType::BaselineCompare->value)
         ->get();
 
     expect($activeRuns)->toHaveCount(2)
         ->and($activeRuns->every(static fn (OperationRun $run): bool => $run->tenant_id !== null))->toBeTrue()
         ->and($activeRuns->every(static fn (OperationRun $run): bool => (string) $run->status === OperationRunStatus::Queued->value))->toBeTrue()
         ->and($activeRuns->every(static fn (OperationRun $run): bool => (string) $run->outcome === OperationRunOutcome::Pending->value))->toBeTrue()
-        ->and(OperationRun::query()->whereNull('tenant_id')->where('type', 'baseline_compare')->count())->toBe(0);
+        ->and(OperationRun::query()->whereNull('tenant_id')->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });
 
 it('runs compare assigned tenants from the matrix page and keeps feedback on tenant-owned runs', function (): void {
@@ -97,7 +98,7 @@
 
     expect(OperationRun::query()
         ->where('workspace_id', (int) $fixture['workspace']->getKey())
-        ->where('type', 'baseline_compare')
+        ->where('type', OperationRunType::BaselineCompare->value)
         ->whereNull('tenant_id')
         ->count())->toBe(0);
 });

apps/platform/tests/Feature/Console/RemoveFindingsLifecycleBackfillCommandsTest.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
+
+uses(RefreshDatabase::class);
+
+it('does not register findings lifecycle backfill or deploy-runbook commands', function (): void {
+    $commands = array_keys(Artisan::all());
+
+    expect($commands)
+        ->not->toContain('tenantpilot:findings:backfill-lifecycle')
+        ->not->toContain('tenantpilot:run-deploy-runbooks');
+
+    expect((string) file_get_contents(base_path('routes/console.php')))
+        ->not->toContain('tenantpilot:findings:backfill-lifecycle')
+        ->not->toContain('tenantpilot:run-deploy-runbooks');
+});

apps/platform/tests/Feature/Console/Spec113/DeployRunbooksCommandTest.php

@@ -1,31 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\OperationRun;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Services\Runbooks\RunbookReason;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-it('delegates deploy-time runbooks to the shared runbook service', function () {
-    $run = OperationRun::factory()->create();
-
-    $this->mock(FindingsLifecycleBackfillRunbookService::class, function ($mock) use ($run): void {
-        $mock->shouldReceive('start')
-            ->once()
-            ->withArgs(function ($scope, $initiator, $reason, $source): bool {
-                return $scope instanceof FindingsLifecycleBackfillScope
-                    && $scope->isAllTenants()
-                    && $initiator === null
-                    && $reason instanceof RunbookReason
-                    && $source === 'deploy_hook';
-            })
-            ->andReturn($run);
-    });
-
-    $this->artisan('tenantpilot:run-deploy-runbooks')
-        ->assertExitCode(0);
-});

apps/platform/tests/Feature/DirectoryGroups/StartSyncTest.php

@@ -3,6 +3,7 @@
 use App\Jobs\EntraGroupSyncJob;
 use App\Services\Directory\EntraGroupSyncService;
 use App\Services\Providers\ProviderOperationStartResult;
+use App\Support\OperationRunType;
 use Illuminate\Support\Facades\Queue;
 
 it('starts a manual group sync by creating a run and dispatching a job', function () {
@@ -21,7 +22,7 @@
     expect($run)
         ->and($run->tenant_id)->toBe($tenant->getKey())
         ->and($run->user_id)->toBe($user->getKey())
-        ->and($run->type)->toBe('entra_group_sync')
+        ->and($run->type)->toBe(OperationRunType::DirectoryGroupsSync->value)
         ->and($run->status)->toBe('queued')
         ->and($run->context['selection_key'] ?? null)->toBe('groups-v1:all')
         ->and($run->context['provider_connection_id'] ?? null)->toBeInt();

apps/platform/tests/Feature/DirectoryGroups/SyncJobUpsertsGroupsTest.php

@@ -7,6 +7,7 @@
 use App\Services\Graph\GraphResponse;
 use App\Services\Intune\AuditLogger;
 use App\Services\OperationRunService;
+use App\Support\OperationRunType;
 
 it('sync job upserts groups and updates run counters', function () {
 
@@ -54,7 +55,7 @@
     $opService = app(OperationRunService::class);
     $opRun = $opService->ensureRun(
         tenant: $tenant,
-        type: 'entra_group_sync',
+        type: OperationRunType::DirectoryGroupsSync->value,
         inputs: ['selection_key' => 'groups-v1:all'],
         initiator: $user,
     );

apps/platform/tests/Feature/DirectoryGroups/SyncRetentionPurgeTest.php

@@ -7,6 +7,7 @@
 use App\Services\Graph\GraphResponse;
 use App\Services\Intune\AuditLogger;
 use App\Services\OperationRunService;
+use App\Support\OperationRunType;
 use Illuminate\Support\Facades\Config;
 
 it('purges cached groups older than the retention window', function () {
@@ -34,7 +35,7 @@
     $opService = app(OperationRunService::class);
     $opRun = $opService->ensureRun(
         tenant: $tenant,
-        type: 'entra_group_sync',
+        type: OperationRunType::DirectoryGroupsSync->value,
         inputs: ['selection_key' => 'groups-v1:all'],
         initiator: $user,
     );

apps/platform/tests/Feature/EntraAdminRoles/EntraAdminRolesFindingGeneratorTest.php

@@ -195,6 +195,54 @@ function makeGenerator(): EntraAdminRolesFindingGenerator
         ->and($finding->last_seen_at?->toIso8601String())->toBe('2026-02-24T11:00:00+00:00');
 });
 
+it('repairs missing due-state fields on an existing open finding without extending the original due date', function (): void {
+    [$user, $tenant] = createMinimalUserWithTenant();
+
+    $generator = makeGenerator();
+
+    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T10:00:00Z'));
+    $generator->generate($tenant, buildPayload(
+        [gaRoleDef()],
+        [makeEntraAssignment('a1', 'def-ga', 'user-1')],
+        '2026-02-24T10:00:00Z',
+    ));
+
+    $finding = Finding::query()
+        ->where('tenant_id', $tenant->getKey())
+        ->where('finding_type', Finding::FINDING_TYPE_ENTRA_ADMIN_ROLES)
+        ->firstOrFail();
+
+    $expectedDueAt = $finding->due_at?->toIso8601String();
+
+    expect($finding->sla_days)->toBe(3)
+        ->and($expectedDueAt)->toBe('2026-02-27T10:00:00+00:00');
+
+    $finding->forceFill([
+        'sla_days' => null,
+        'due_at' => null,
+    ])->save();
+
+    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T11:00:00Z'));
+    $result = $generator->generate($tenant, buildPayload(
+        [gaRoleDef()],
+        [makeEntraAssignment('a1', 'def-ga', 'user-1')],
+        '2026-02-24T11:00:00Z',
+    ));
+
+    $finding->refresh();
+
+    expect($result->created)->toBe(0)
+        ->and($result->unchanged)->toBe(1)
+        ->and($finding->status)->toBe(Finding::STATUS_NEW)
+        ->and($finding->first_seen_at?->toIso8601String())->toBe('2026-02-24T10:00:00+00:00')
+        ->and($finding->last_seen_at?->toIso8601String())->toBe('2026-02-24T11:00:00+00:00')
+        ->and($finding->times_seen)->toBe(2)
+        ->and($finding->sla_days)->toBe(3)
+        ->and($finding->due_at?->toIso8601String())->toBe($expectedDueAt);
+
+    CarbonImmutable::setTestNow();
+});
+
 it('auto-resolves when assignment is removed', function (): void {
     [$user, $tenant] = createMinimalUserWithTenant();
 
@@ -444,7 +492,7 @@ function makeGenerator(): EntraAdminRolesFindingGenerator
         ->and($finding->subject_external_id)->toBe('user-1:def-ga');
 });
 
-it('auto-resolve applies to acknowledged findings too', function (): void {
+it('auto-resolve applies to triaged findings too', function (): void {
     [$user, $tenant] = createMinimalUserWithTenant();
 
     $generator = makeGenerator();
@@ -456,20 +504,19 @@ function makeGenerator(): EntraAdminRolesFindingGenerator
     );
     $generator->generate($tenant, $payload);
 
-    // Acknowledge the finding
+    // Triage the finding
     $finding = Finding::query()
         ->where('tenant_id', $tenant->getKey())
         ->where('subject_external_id', 'user-1:def-ga')
         ->first();
     $finding->forceFill([
-        'status' => Finding::STATUS_ACKNOWLEDGED,
-        'acknowledged_at' => now(),
-        'acknowledged_by_user_id' => $user->getKey(),
+        'status' => Finding::STATUS_TRIAGED,
+        'triaged_at' => now(),
     ])->save();
 
-    expect($finding->fresh()->status)->toBe(Finding::STATUS_ACKNOWLEDGED);
+    expect($finding->fresh()->status)->toBe(Finding::STATUS_TRIAGED);
 
-    // Scan 2: remove → should auto-resolve even though acknowledged
+    // Scan 2: remove -> should auto-resolve even though triaged
     $payload2 = buildPayload([gaRoleDef()], []);
     $result = $generator->generate($tenant, $payload2);
 

apps/platform/tests/Feature/Filament/BaselineCompareLandingStartSurfaceTest.php

@@ -115,7 +115,7 @@
 
     $run = OperationRun::query()
         ->where('tenant_id', (int) $tenant->getKey())
-        ->where('type', 'baseline_compare')
+        ->where('type', OperationRunType::BaselineCompare->value)
         ->latest('id')
         ->first();
 
@@ -192,7 +192,7 @@
         ->assertStatus(200);
 
     Queue::assertNotPushed(CompareBaselineToTenantJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_compare')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });
 
 it('shows mixed-strategy compare rejection truth on the tenant landing surface', function (): void {
@@ -250,7 +250,7 @@
         ->assertStatus(200);
 
     Queue::assertNotPushed(CompareBaselineToTenantJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_compare')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });
 
 it('can refresh stats without calling mount directly', function (): void {

apps/platform/tests/Feature/Filament/BaselineProfileCaptureStartSurfaceTest.php

@@ -9,6 +9,7 @@
 use App\Models\OperationRun;
 use App\Models\Tenant;
 use App\Support\Baselines\BaselineCaptureMode;
+use App\Support\OperationRunType;
 use App\Support\Workspaces\WorkspaceContext;
 use Filament\Actions\Action;
 use Filament\Actions\ActionGroup;
@@ -121,7 +122,7 @@ function seedCaptureProfileForTenant(
 
     $run = OperationRun::query()
         ->where('tenant_id', (int) $tenant->getKey())
-        ->where('type', 'baseline_capture')
+        ->where('type', OperationRunType::BaselineCapture->value)
         ->latest('id')
         ->first();
 
@@ -151,7 +152,7 @@ function seedCaptureProfileForTenant(
         ->assertStatus(200);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('does not start full-content capture when rollout is disabled', function (): void {
@@ -174,7 +175,7 @@ function seedCaptureProfileForTenant(
         ->assertStatus(200);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });
 
 it('shows readiness copy without exposing raw canonical scope json on the capture start surface', function (): void {
@@ -228,5 +229,5 @@ function seedCaptureProfileForTenant(
         ->assertStatus(200);
 
     Queue::assertNotPushed(CaptureBaselineSnapshotJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_capture')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCapture->value)->count())->toBe(0);
 });

apps/platform/tests/Feature/Filament/BaselineProfileCompareStartSurfaceTest.php

@@ -14,6 +14,7 @@
 use App\Support\Baselines\Compare\CompareStrategyRegistry;
 use App\Support\Baselines\Compare\IntuneCompareStrategy;
 use App\Support\Governance\GovernanceSubjectTaxonomyRegistry;
+use App\Support\OperationRunType;
 use App\Support\Workspaces\WorkspaceContext;
 use Filament\Actions\Action;
 use Filament\Actions\ActionGroup;
@@ -92,7 +93,7 @@ function seedComparableBaselineProfileForTenant(Tenant $tenant, BaselineCaptureM
 
     $run = OperationRun::query()
         ->where('tenant_id', (int) $tenant->getKey())
-        ->where('type', 'baseline_compare')
+        ->where('type', OperationRunType::BaselineCompare->value)
         ->latest('id')
         ->first();
 
@@ -120,7 +121,7 @@ function seedComparableBaselineProfileForTenant(Tenant $tenant, BaselineCaptureM
         ->assertStatus(200);
 
     Queue::assertNotPushed(CompareBaselineToTenantJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_compare')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });
 
 it('shows mixed-strategy compare rejection truth on the workspace start surface', function (): void {
@@ -167,7 +168,7 @@ function seedComparableBaselineProfileForTenant(Tenant $tenant, BaselineCaptureM
         ->assertStatus(200);
 
     Queue::assertNotPushed(CompareBaselineToTenantJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_compare')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });
 
 it('moves compare-matrix navigation into related context while keeping compare-assigned-tenants secondary', function (): void {
@@ -275,5 +276,5 @@ function seedComparableBaselineProfileForTenant(Tenant $tenant, BaselineCaptureM
         ->assertStatus(200);
 
     Queue::assertNotPushed(CompareBaselineToTenantJob::class);
-    expect(OperationRun::query()->where('type', 'baseline_compare')->count())->toBe(0);
+    expect(OperationRun::query()->where('type', OperationRunType::BaselineCompare->value)->count())->toBe(0);
 });

apps/platform/tests/Feature/Filament/Spec113/AdminFindingsNoMaintenanceActionsTest.php

@@ -1,21 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\FindingResource\Pages\ListFindings;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-it('exposes the findings lifecycle backfill action for entitled tenant operators', function () {
-    [$user, $tenant] = createUserWithTenant(role: 'owner');
-
-    $this->actingAs($user);
-    Filament::setTenant($tenant, true);
-
-    Livewire::test(ListFindings::class)
-    ->assertActionExists('backfill_lifecycle')
-    ->assertActionEnabled('backfill_lifecycle');
-});

apps/platform/tests/Feature/Findings/Concerns/InteractsWithFindingsWorkflow.php

@@ -34,7 +34,6 @@ protected function makeFindingForWorkflow(Tenant $tenant, string $status = Findi
         $factory = Finding::factory()->for($tenant);
 
         $factory = match ($status) {
-            Finding::STATUS_ACKNOWLEDGED => $factory->acknowledged(),
             Finding::STATUS_TRIAGED => $factory->triaged(),
             Finding::STATUS_IN_PROGRESS => $factory->inProgress(),
             Finding::STATUS_REOPENED => $factory->reopened(),

apps/platform/tests/Feature/Findings/FindingBackfillTest.php

@@ -1,136 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Jobs\BackfillFindingLifecycleJob;
-use App\Models\Finding;
-use Carbon\CarbonImmutable;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-it('backfills legacy findings (ack → triaged, lifecycle fields, due_at from backfill time)', function (): void {
-    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T10:00:00Z'));
-
-    [$user, $tenant] = createUserWithTenant(role: 'manager');
-
-    $finding = Finding::factory()->for($tenant)->create([
-        'severity' => Finding::SEVERITY_MEDIUM,
-        'status' => Finding::STATUS_ACKNOWLEDGED,
-        'acknowledged_at' => CarbonImmutable::parse('2026-02-20T00:00:00Z'),
-        'acknowledged_by_user_id' => (int) $user->getKey(),
-        'first_seen_at' => null,
-        'last_seen_at' => null,
-        'times_seen' => null,
-        'sla_days' => null,
-        'due_at' => null,
-        'triaged_at' => null,
-        'created_at' => CarbonImmutable::parse('2026-02-10T00:00:00Z'),
-        'updated_at' => CarbonImmutable::parse('2026-02-10T00:00:00Z'),
-    ]);
-
-    BackfillFindingLifecycleJob::dispatchSync(
-        tenantId: (int) $tenant->getKey(),
-        workspaceId: (int) $tenant->workspace_id,
-        initiatorUserId: (int) $user->getKey(),
-    );
-
-    $finding->refresh();
-
-    expect($finding->status)->toBe(Finding::STATUS_TRIAGED)
-        ->and($finding->triaged_at?->toIso8601String())->toBe('2026-02-20T00:00:00+00:00')
-        ->and($finding->first_seen_at?->toIso8601String())->toBe('2026-02-10T00:00:00+00:00')
-        ->and($finding->last_seen_at?->toIso8601String())->toBe('2026-02-10T00:00:00+00:00')
-        ->and($finding->times_seen)->toBe(1)
-        ->and($finding->sla_days)->toBe(14)
-        ->and($finding->due_at?->toIso8601String())->toBe('2026-03-10T10:00:00+00:00')
-        ->and($finding->acknowledged_at?->toIso8601String())->toBe('2026-02-20T00:00:00+00:00')
-        ->and((int) $finding->acknowledged_by_user_id)->toBe((int) $user->getKey());
-
-    CarbonImmutable::setTestNow();
-});
-
-it('computes drift recurrence keys and consolidates drift duplicates', function (): void {
-    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T10:00:00Z'));
-
-    [$user, $tenant] = createUserWithTenant(role: 'manager');
-
-    $scopeKey = hash('sha256', 'scope-drift-backfill-duplicate');
-
-    $evidence = [
-        'change_type' => 'modified',
-        'summary' => [
-            'kind' => 'policy_snapshot',
-            'changed_fields' => ['snapshot_hash'],
-        ],
-        'baseline' => ['policy_id' => 'policy-dupe'],
-        'current' => ['policy_id' => 'policy-dupe'],
-    ];
-
-    $open = Finding::factory()->for($tenant)->create([
-        'finding_type' => Finding::FINDING_TYPE_DRIFT,
-        'scope_key' => $scopeKey,
-        'subject_type' => 'policy',
-        'subject_external_id' => 'policy-dupe',
-        'status' => Finding::STATUS_NEW,
-        'recurrence_key' => null,
-        'evidence_jsonb' => $evidence,
-        'first_seen_at' => null,
-        'last_seen_at' => null,
-        'times_seen' => null,
-        'sla_days' => null,
-        'due_at' => null,
-        'created_at' => CarbonImmutable::parse('2026-02-20T00:00:00Z'),
-        'updated_at' => CarbonImmutable::parse('2026-02-20T00:00:00Z'),
-    ]);
-
-    $duplicate = Finding::factory()->for($tenant)->create([
-        'finding_type' => Finding::FINDING_TYPE_DRIFT,
-        'scope_key' => $scopeKey,
-        'subject_type' => 'policy',
-        'subject_external_id' => 'policy-dupe',
-        'status' => Finding::STATUS_RESOLVED,
-        'resolved_at' => CarbonImmutable::parse('2026-02-21T00:00:00Z'),
-        'resolved_reason' => Finding::RESOLVE_REASON_REMEDIATED,
-        'recurrence_key' => null,
-        'evidence_jsonb' => $evidence,
-        'first_seen_at' => null,
-        'last_seen_at' => null,
-        'times_seen' => null,
-        'created_at' => CarbonImmutable::parse('2026-02-18T00:00:00Z'),
-        'updated_at' => CarbonImmutable::parse('2026-02-18T00:00:00Z'),
-    ]);
-
-    BackfillFindingLifecycleJob::dispatchSync(
-        tenantId: (int) $tenant->getKey(),
-        workspaceId: (int) $tenant->workspace_id,
-        initiatorUserId: (int) $user->getKey(),
-    );
-
-    $tenantId = (int) $tenant->getKey();
-    $expectedRecurrenceKey = hash(
-        'sha256',
-        sprintf('drift:%d:%s:policy:%s:policy_snapshot:modified', $tenantId, $scopeKey, 'policy-dupe'),
-    );
-
-    expect(Finding::query()
-        ->where('tenant_id', $tenantId)
-        ->where('finding_type', Finding::FINDING_TYPE_DRIFT)
-        ->where('recurrence_key', $expectedRecurrenceKey)
-        ->count())->toBe(1);
-
-    $open->refresh();
-    $duplicate->refresh();
-
-    expect($open->recurrence_key)->toBe($expectedRecurrenceKey)
-        ->and($open->status)->toBe(Finding::STATUS_NEW);
-
-    expect($duplicate->recurrence_key)->toBeNull()
-        ->and($duplicate->status)->toBe(Finding::STATUS_CLOSED)
-        ->and($duplicate->resolved_reason)->toBeNull()
-        ->and($duplicate->resolved_at)->toBeNull()
-        ->and($duplicate->closed_reason)->toBe(Finding::CLOSE_REASON_DUPLICATE)
-        ->and($duplicate->closed_at?->toIso8601String())->toBe('2026-02-24T10:00:00+00:00');
-
-    CarbonImmutable::setTestNow();
-});

apps/platform/tests/Feature/Findings/FindingWorkflowGuardTest.php

@@ -22,9 +22,8 @@
         ->toContain(AuditActionId::FindingReopened->value);
 });
 
-it('keeps only legacy compatibility lifecycle helpers on the model', function (): void {
-    expect(method_exists(Finding::class, 'acknowledge'))->toBeTrue()
-        ->and(method_exists(Finding::class, 'resolve'))->toBeTrue()
+it('keeps only the surviving model lifecycle helpers', function (): void {
+    expect(method_exists(Finding::class, 'resolve'))->toBeTrue()
         ->and(method_exists(Finding::class, 'reopen'))->toBeTrue()
         ->and(method_exists(Finding::class, 'triage'))->toBeFalse()
         ->and(method_exists(Finding::class, 'startProgress'))->toBeFalse()

apps/platform/tests/Feature/Findings/FindingWorkflowRegressionTest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Finding;
+use App\Models\User;
+use App\Services\Findings\FindingWorkflowService;
+use App\Support\Audit\AuditActionId;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('keeps canonical findings workflow behavior after removing the backfill runtime surfaces', function (): void {
+    [$owner, $tenant] = createUserWithTenant(role: 'owner');
+    $assignee = User::factory()->create();
+    createUserWithTenant(tenant: $tenant, user: $assignee, role: 'operator');
+
+    $service = app(FindingWorkflowService::class);
+    $finding = $this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW, [
+        'owner_user_id' => null,
+        'assignee_user_id' => null,
+        'sla_days' => 14,
+        'due_at' => now()->addDays(14),
+    ]);
+
+    $triaged = $service->triage($finding, $tenant, $owner);
+    $assigned = $service->assign(
+        finding: $triaged,
+        tenant: $tenant,
+        actor: $owner,
+        assigneeUserId: (int) $assignee->getKey(),
+        ownerUserId: (int) $owner->getKey(),
+    );
+    $inProgress = $service->startProgress($assigned, $tenant, $owner);
+    $resolved = $service->resolve($inProgress, $tenant, $owner, Finding::RESOLVE_REASON_REMEDIATED);
+    $riskAccepted = $service->riskAccept(
+        $this->makeFindingForWorkflow($tenant, Finding::STATUS_NEW),
+        $tenant,
+        $owner,
+        Finding::CLOSE_REASON_ACCEPTED_RISK,
+    );
+
+    expect($triaged->status)->toBe(Finding::STATUS_TRIAGED)
+        ->and($triaged->triaged_at)->not->toBeNull()
+        ->and((int) $assigned->owner_user_id)->toBe((int) $owner->getKey())
+        ->and((int) $assigned->assignee_user_id)->toBe((int) $assignee->getKey())
+        ->and($assigned->sla_days)->toBe(14)
+        ->and($assigned->due_at)->not->toBeNull()
+        ->and($inProgress->status)->toBe(Finding::STATUS_IN_PROGRESS)
+        ->and($inProgress->in_progress_at)->not->toBeNull()
+        ->and($resolved->status)->toBe(Finding::STATUS_RESOLVED)
+        ->and($resolved->resolved_reason)->toBe(Finding::RESOLVE_REASON_REMEDIATED)
+        ->and($riskAccepted->status)->toBe(Finding::STATUS_RISK_ACCEPTED)
+        ->and($riskAccepted->closed_reason)->toBe(Finding::CLOSE_REASON_ACCEPTED_RISK);
+
+    expect($this->latestFindingAudit($triaged, AuditActionId::FindingTriaged))->not->toBeNull()
+        ->and($this->latestFindingAudit($assigned, AuditActionId::FindingAssigned))->not->toBeNull()
+        ->and($this->latestFindingAudit($inProgress, AuditActionId::FindingInProgress))->not->toBeNull()
+        ->and($this->latestFindingAudit($resolved, AuditActionId::FindingResolved))->not->toBeNull()
+        ->and($this->latestFindingAudit($riskAccepted, AuditActionId::FindingRiskAccepted))->not->toBeNull();
+});

apps/platform/tests/Feature/Findings/FindingsIntakeQueueTest.php

@@ -101,8 +101,10 @@ function makeIntakeFinding(Tenant $tenant, array $attributes = []): Finding
         'assignee_user_id' => (int) $otherAssignee->getKey(),
     ]);
 
-    $acknowledged = Finding::factory()->for($tenantA)->acknowledged()->create([
+    $acknowledged = Finding::factory()->for($tenantA)->create([
         'workspace_id' => (int) $tenantA->workspace_id,
+        'status' => 'acknowledged',
+        'acknowledged_at' => now(),
         'assignee_user_id' => null,
         'subject_external_id' => 'acknowledged',
     ]);

apps/platform/tests/Feature/Findings/OperationalControlFindingsBackfillGateTest.php

@@ -1,101 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\Resources\FindingResource\Pages\ListFindings;
-use App\Jobs\BackfillFindingLifecycleJob;
-use App\Models\AuditLog;
-use App\Models\Finding;
-use App\Models\OperationalControlActivation;
-use App\Models\OperationRun;
-use App\Support\Audit\AuditActionId;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-it('keeps the findings backfill action visible but blocks execution when a control is active', function (): void {
-    Queue::fake();
-
-    [$user, $tenant] = createUserWithTenant(role: 'owner');
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    OperationalControlActivation::factory()->workspaceScoped()->create([
-        'control_key' => 'findings.lifecycle.backfill',
-        'workspace_id' => (int) $tenant->workspace_id,
-        'reason_text' => 'Workspace-specific pause.',
-    ]);
-
-    $this->actingAs($user);
-    Filament::setTenant($tenant, true);
-
-    Livewire::test(ListFindings::class)
-        ->assertActionExists('backfill_lifecycle')
-        ->assertActionEnabled('backfill_lifecycle')
-        ->callAction('backfill_lifecycle')
-        ->assertNotified('Findings lifecycle backfill paused');
-
-    expect(OperationRun::query()->where('type', 'findings.lifecycle.backfill')->count())->toBe(0);
-
-    $audit = AuditLog::query()
-        ->where('action', AuditActionId::OperationalControlExecutionBlocked->value)
-        ->latest('id')
-        ->first();
-
-    expect($audit)->not->toBeNull()
-        ->and($audit?->workspace_id)->toBe((int) $tenant->workspace_id)
-        ->and($audit?->tenant_id)->toBe((int) $tenant->getKey())
-        ->and($audit?->status)->toBe('blocked')
-        ->and($audit?->metadata['control_key'] ?? null)->toBe('findings.lifecycle.backfill')
-        ->and($audit?->metadata['workspace_id'] ?? null)->toBe((int) $tenant->workspace_id);
-});
-
-it('does not block findings backfill for a different workspace when the pause is workspace-scoped', function (): void {
-    Queue::fake();
-
-    [$blockedUser, $blockedTenant] = createUserWithTenant(role: 'owner');
-    [$allowedUser, $allowedTenant] = createUserWithTenant(role: 'owner');
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $allowedTenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    OperationalControlActivation::factory()->workspaceScoped()->create([
-        'control_key' => 'findings.lifecycle.backfill',
-        'workspace_id' => (int) $blockedTenant->workspace_id,
-        'reason_text' => 'Paused only for the blocked workspace.',
-    ]);
-
-    $this->actingAs($allowedUser);
-    Filament::setTenant($allowedTenant, true);
-
-    Livewire::test(ListFindings::class)
-        ->assertActionExists('backfill_lifecycle')
-        ->assertActionEnabled('backfill_lifecycle')
-        ->callAction('backfill_lifecycle');
-
-    $run = OperationRun::query()
-        ->where('type', 'findings.lifecycle.backfill')
-        ->where('tenant_id', (int) $allowedTenant->getKey())
-        ->latest('id')
-        ->first();
-
-    expect($run)->not->toBeNull();
-
-    Queue::assertPushed(BackfillFindingLifecycleJob::class, function (BackfillFindingLifecycleJob $job) use ($allowedTenant): bool {
-        return $job->tenantId === (int) $allowedTenant->getKey()
-            && $job->workspaceId === (int) $allowedTenant->workspace_id;
-    });
-
-    expect(AuditLog::query()
-        ->where('action', AuditActionId::OperationalControlExecutionBlocked->value)
-        ->where('tenant_id', (int) $allowedTenant->getKey())
-        ->exists())->toBeFalse();
-});

apps/platform/tests/Feature/Findings/RemoveAcknowledgedCompatibilityWorkflowTest.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Finding;
+use App\Services\Findings\FindingWorkflowService;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('rejects triage from the removed acknowledged status', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $finding = Finding::factory()->for($tenant)->create([
+        'status' => 'acknowledged',
+        'acknowledged_at' => now(),
+        'acknowledged_by_user_id' => $user->getKey(),
+    ]);
+
+    expect(fn () => app(FindingWorkflowService::class)->triage($finding, $tenant, $user))
+        ->toThrow(\InvalidArgumentException::class, 'Finding cannot be triaged from the current status.');
+});
+
+it('rejects start progress from the removed acknowledged status', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $finding = Finding::factory()->for($tenant)->create([
+        'status' => 'acknowledged',
+        'triaged_at' => now()->subMinute(),
+        'acknowledged_at' => now(),
+        'acknowledged_by_user_id' => $user->getKey(),
+    ]);
+
+    expect(fn () => app(FindingWorkflowService::class)->startProgress($finding, $tenant, $user))
+        ->toThrow(\InvalidArgumentException::class, 'Finding cannot be moved to in-progress from the current status.');
+});

apps/platform/tests/Feature/Findings/RemoveFindingsLifecycleBackfillActionTest.php

@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Resources\FindingResource\Pages\ListFindings;
+use App\Models\Finding;
+use App\Models\OperationRun;
+use Filament\Facades\Filament;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+it('removes the tenant findings lifecycle backfill header action without removing canonical workflow actions', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $finding = Finding::factory()->for($tenant)->create([
+        'status' => Finding::STATUS_NEW,
+    ]);
+
+    $this->actingAs($user);
+    Filament::setTenant($tenant, true);
+
+    Livewire::test(ListFindings::class)
+        ->assertActionDoesNotExist('backfill_lifecycle')
+        ->assertActionExists('triage_all_matching')
+        ->assertTableActionVisible('triage', $finding)
+        ->assertTableActionVisible('assign', $finding)
+        ->assertTableActionVisible('resolve', $finding)
+        ->assertTableActionVisible('request_exception', $finding);
+
+    expect(OperationRun::query()->where('type', 'findings.lifecycle.backfill')->exists())->toBeFalse();
+});

apps/platform/tests/Feature/Guards/LivewireTrustedStateGuardTest.php

@@ -12,7 +12,6 @@ function livewireTrustedStateFirstSliceFixtures(): array
     return [
         TrustedStatePolicy::MANAGED_TENANT_ONBOARDING_WIZARD => 'app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php',
         TrustedStatePolicy::TENANT_REQUIRED_PERMISSIONS => 'app/Filament/Pages/TenantRequiredPermissions.php',
-        TrustedStatePolicy::SYSTEM_RUNBOOKS => 'app/Filament/System/Pages/Ops/Runbooks.php',
     ];
 }
 

apps/platform/tests/Feature/Models/FindingResolvedTest.php

@@ -59,15 +59,18 @@
         ]);
 });
 
-it('supports legacy model helper compatibility for acknowledge', function (): void {
+it('keeps stale acknowledged metadata as passive data only', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
-    $finding = Finding::factory()->for($tenant)->permissionPosture()->create();
+    $finding = Finding::factory()->for($tenant)->permissionPosture()->create([
+        'status' => 'acknowledged',
+        'acknowledged_at' => now(),
+        'acknowledged_by_user_id' => $user->getKey(),
+    ]);
 
-    $finding->acknowledge($user);
-
-    expect($finding->status)->toBe(Finding::STATUS_ACKNOWLEDGED)
+    expect($finding->status)->toBe('acknowledged')
         ->and($finding->acknowledged_at)->not->toBeNull()
-        ->and($finding->acknowledged_by_user_id)->toBe($user->getKey());
+        ->and($finding->acknowledged_by_user_id)->toBe($user->getKey())
+        ->and($finding->hasOpenStatus())->toBeFalse();
 });
 
 it('exposes v2 open and terminal status helpers', function (): void {
@@ -84,31 +87,26 @@
         Finding::STATUS_RISK_ACCEPTED,
     ]);
 
-    expect(Finding::openStatusesForQuery())->toContain(Finding::STATUS_ACKNOWLEDGED);
+    expect(Finding::openStatusesForQuery())->toBe(Finding::openStatuses());
 });
 
-it('maps legacy acknowledged status to triaged in v2 helpers', function (): void {
-    expect(Finding::canonicalizeStatus(Finding::STATUS_ACKNOWLEDGED))
-        ->toBe(Finding::STATUS_TRIAGED);
+it('does not treat acknowledged as canonical in v2 helpers', function (): void {
+    expect(Finding::canonicalizeStatus('acknowledged'))->toBe('acknowledged');
 
-    expect(Finding::isOpenStatus(Finding::STATUS_ACKNOWLEDGED))->toBeTrue();
-    expect(Finding::isTerminalStatus(Finding::STATUS_ACKNOWLEDGED))->toBeFalse();
+    expect(Finding::isOpenStatus('acknowledged'))->toBeFalse();
+    expect(Finding::isTerminalStatus('acknowledged'))->toBeFalse();
 });
 
-it('preserves acknowledged metadata when resolving an acknowledged finding', function (): void {
+it('rejects resolving a stale acknowledged finding', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
-    $finding = Finding::factory()->for($tenant)->permissionPosture()->acknowledged()->create([
+    $finding = Finding::factory()->for($tenant)->permissionPosture()->create([
+        'status' => 'acknowledged',
+        'acknowledged_at' => now(),
         'acknowledged_by_user_id' => $user->getKey(),
     ]);
 
-    expect($finding->status)->toBe(Finding::STATUS_ACKNOWLEDGED);
-
-    $finding = app(FindingWorkflowService::class)->resolve($finding, $tenant, $user, Finding::RESOLVE_REASON_REMEDIATED);
-
-    expect($finding->status)->toBe(Finding::STATUS_RESOLVED)
-        ->and($finding->acknowledged_at)->not->toBeNull()
-        ->and($finding->acknowledged_by_user_id)->toBe($user->getKey())
-        ->and($finding->resolved_at)->not->toBeNull();
+    expect(fn () => app(FindingWorkflowService::class)->resolve($finding, $tenant, $user, Finding::RESOLVE_REASON_REMEDIATED))
+        ->toThrow(\InvalidArgumentException::class, 'Only open findings can be resolved.');
 });
 
 it('has STATUS_RESOLVED constant', function (): void {

apps/platform/tests/Feature/Monitoring/AuditCoverageGovernanceTest.php

@@ -14,6 +14,7 @@
 use App\Support\Audit\AuditOutcome;
 use App\Support\Baselines\BaselineCaptureMode;
 use App\Support\Baselines\BaselineReasonCodes;
+use App\Support\OperationRunType;
 
 it('derives summary-first audit semantics for baseline capture workflow events', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
@@ -36,7 +37,7 @@
     $operationRunService = app(OperationRunService::class);
     $run = $operationRunService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),
@@ -97,7 +98,7 @@
     $operationRunService = app(OperationRunService::class);
     $run = $operationRunService->ensureRunWithIdentity(
         tenant: $tenant,
-        type: 'baseline_capture',
+        type: OperationRunType::BaselineCapture->value,
         identityInputs: ['baseline_profile_id' => (int) $profile->getKey()],
         context: [
             'baseline_profile_id' => (int) $profile->getKey(),

apps/platform/tests/Feature/Monitoring/HeaderContextBarTest.php

@@ -26,7 +26,7 @@
         ->get('/admin/operations')
         ->assertOk()
         ->assertSee($workspaceName ?? 'Select workspace')
-        ->assertSee('Search tenants…')
+            ->assertSee(__('localization.shell.search_tenants'))
         ->assertSee('Switch workspace')
         ->assertSee('admin/select-tenant')
         ->assertSee('Clear tenant scope')
@@ -66,7 +66,7 @@
         ->get('/admin/workspaces')
         ->assertOk()
         ->assertSee('Choose a workspace first.')
-        ->assertDontSee('Search tenants…');
+            ->assertDontSee(__('localization.shell.search_tenants'));
 });
 
 it('keeps tenant-scoped pages selector read-only while exposing the clear tenant scope action', function (): void {

apps/platform/tests/Feature/OperationalControls/NoAdHocOperationalControlBypassTest.php

@@ -10,12 +10,12 @@
     $checks = [
         [
             'file' => $root.'/app/Filament/Resources/FindingResource/Pages/ListFindings.php',
-            'required' => [
-                'FindingsLifecycleBackfillRunbookService',
-                'OperationalControlBlockedException',
-                'FindingsLifecycleBackfillScope::singleTenant(',
-            ],
+            'required' => [],
             'forbidden' => [
+                'FindingsLifecycleBackfillRunbookService',
+                'FindingsLifecycleBackfillScope',
+                'Backfill findings lifecycle',
+                'backfill_lifecycle',
                 "config('tenantpilot.allow_admin_maintenance_actions'",
                 'allow_admin_maintenance_actions',
                 'OperationalControlActivation::',
@@ -23,12 +23,12 @@
         ],
         [
             'file' => $root.'/app/Filament/System/Pages/Ops/Runbooks.php',
-            'required' => [
-                'FindingsLifecycleBackfillRunbookService',
-                'OperationalControlBlockedException',
-                '$runbookService->start(',
-            ],
+            'required' => [],
             'forbidden' => [
+                'FindingsLifecycleBackfillRunbookService',
+                'FindingsLifecycleBackfillScope',
+                'findings.lifecycle.backfill',
+                'Rebuild Findings Lifecycle',
                 'OperationalControlActivation::',
                 "config('tenantpilot.allow_admin_maintenance_actions'",
             ],
@@ -66,4 +66,16 @@
             expect($source)->not->toContain($needle);
         }
     }
+
+    foreach ([
+        $root.'/app/Console/Commands/TenantpilotBackfillFindingLifecycle.php',
+        $root.'/app/Console/Commands/TenantpilotRunDeployRunbooks.php',
+        $root.'/app/Services/Runbooks/FindingsLifecycleBackfillRunbookService.php',
+        $root.'/app/Services/Runbooks/FindingsLifecycleBackfillScope.php',
+        $root.'/app/Jobs/BackfillFindingLifecycleJob.php',
+        $root.'/app/Jobs/BackfillFindingLifecycleWorkspaceJob.php',
+        $root.'/app/Jobs/BackfillFindingLifecycleTenantIntoWorkspaceRunJob.php',
+    ] as $removedPath) {
+        expect(file_exists($removedPath))->toBeFalse("Removed findings lifecycle backfill artifact still exists: {$removedPath}");
+    }
 })->group('surface-guard');

apps/platform/tests/Feature/OpsUx/CanonicalViewRunLinksTest.php

@@ -93,7 +93,7 @@
             'tenant_id' => (int) $tenant->getKey(),
             'tableFilters' => [
                 'type' => [
-                    'value' => 'inventory_sync',
+                    'value' => 'inventory.sync',
                 ],
             ],
         ]));

apps/platform/tests/Feature/OpsUx/Regression/BackupRetentionTerminalNotificationTest.php

@@ -6,6 +6,7 @@
 use App\Models\BackupSchedule;
 use App\Models\BackupSet;
 use App\Models\OperationRun;
+use App\Support\OperationRunType;
 
 it('completes backup retention runs without persisting terminal notifications for system runs', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'manager');
@@ -62,7 +63,7 @@
 
     $retentionRun = OperationRun::query()
         ->where('tenant_id', (int) $tenant->getKey())
-        ->where('type', 'backup_schedule_retention')
+        ->where('type', OperationRunType::BackupScheduleRetention->value)
         ->latest('id')
         ->first();
 

apps/platform/tests/Feature/PermissionPosture/PermissionPostureFindingGeneratorTest.php

@@ -104,19 +104,17 @@ function errorPermission(string $key, array $features = []): array
         ->and($finding->resolved_reason)->toBe('permission_granted');
 });
 
-// (3) Auto-resolves acknowledged finding preserving metadata
-it('auto-resolves acknowledged finding preserving acknowledged metadata', function (): void {
+// (3) Auto-resolves triaged finding preserving triaged metadata
+it('auto-resolves triaged finding preserving triaged metadata', function (): void {
     [$user, $tenant] = createUserWithTenant();
     $generator = app(PermissionPostureFindingGenerator::class);
 
     $generator->generate($tenant, buildComparison([missingPermission('Perm.A')]));
 
     $finding = Finding::query()->where('tenant_id', $tenant->getKey())->first();
-    $ackUser = User::factory()->create();
     $finding->forceFill([
-        'status' => Finding::STATUS_ACKNOWLEDGED,
-        'acknowledged_at' => now(),
-        'acknowledged_by_user_id' => $ackUser->getKey(),
+        'status' => Finding::STATUS_TRIAGED,
+        'triaged_at' => now(),
     ])->save();
 
     $result = $generator->generate($tenant, buildComparison([grantedPermission('Perm.A')], 'granted'));
@@ -124,8 +122,7 @@ function errorPermission(string $key, array $features = []): array
     $finding->refresh();
     expect($result->findingsResolved)->toBe(1)
         ->and($finding->status)->toBe(Finding::STATUS_RESOLVED)
-        ->and($finding->acknowledged_at)->not->toBeNull()
-        ->and($finding->acknowledged_by_user_id)->toBe($ackUser->getKey());
+        ->and($finding->triaged_at)->not->toBeNull();
 });
 
 // (4) No duplicates on idempotent run
@@ -152,6 +149,45 @@ function errorPermission(string $key, array $features = []): array
     CarbonImmutable::setTestNow();
 });
 
+it('repairs missing due-state fields on an existing open finding without extending the original due date', function (): void {
+    [$user, $tenant] = createUserWithTenant();
+    $generator = app(PermissionPostureFindingGenerator::class);
+
+    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T10:00:00Z'));
+    $generator->generate($tenant, buildComparison([
+        missingPermission('Perm.A', ['policy-sync', 'backup']),
+    ]));
+
+    $finding = Finding::query()->where('tenant_id', $tenant->getKey())->firstOrFail();
+    $expectedDueAt = $finding->due_at?->toIso8601String();
+
+    expect($finding->sla_days)->toBe(7)
+        ->and($expectedDueAt)->toBe('2026-03-03T10:00:00+00:00');
+
+    $finding->forceFill([
+        'sla_days' => null,
+        'due_at' => null,
+    ])->save();
+
+    CarbonImmutable::setTestNow(CarbonImmutable::parse('2026-02-24T11:00:00Z'));
+    $result = $generator->generate($tenant, buildComparison([
+        missingPermission('Perm.A', ['policy-sync', 'backup']),
+    ]));
+
+    $finding->refresh();
+
+    expect($result->findingsCreated)->toBe(0)
+        ->and($result->findingsUnchanged)->toBe(1)
+        ->and($finding->status)->toBe(Finding::STATUS_NEW)
+        ->and($finding->first_seen_at?->toIso8601String())->toBe('2026-02-24T10:00:00+00:00')
+        ->and($finding->last_seen_at?->toIso8601String())->toBe('2026-02-24T11:00:00+00:00')
+        ->and($finding->times_seen)->toBe(2)
+        ->and($finding->sla_days)->toBe(7)
+        ->and($finding->due_at?->toIso8601String())->toBe($expectedDueAt);
+
+    CarbonImmutable::setTestNow();
+});
+
 // (5) Re-opens resolved finding when permission revoked again
 it('re-opens resolved finding when permission is revoked again', function (): void {
     [$user, $tenant] = createUserWithTenant();

apps/platform/tests/Feature/Rbac/RoleMatrix/ManagerAccessTest.php

@@ -11,7 +11,7 @@
     expect($gate->allows(Capabilities::TENANT_VIEW, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_SYNC, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_INVENTORY_SYNC_RUN, $tenant))->toBeTrue();
-    expect($gate->allows(Capabilities::TENANT_FINDINGS_ACKNOWLEDGE, $tenant))->toBeTrue();
+    expect($gate->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_MANAGE, $tenant))->toBeTrue();
 
     expect($gate->allows(Capabilities::TENANT_BACKUP_SCHEDULES_RUN, $tenant))->toBeTrue();

apps/platform/tests/Feature/Rbac/RoleMatrix/OperatorAccessTest.php

@@ -11,7 +11,7 @@
     expect($gate->allows(Capabilities::TENANT_VIEW, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_SYNC, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_INVENTORY_SYNC_RUN, $tenant))->toBeTrue();
-    expect($gate->allows(Capabilities::TENANT_FINDINGS_ACKNOWLEDGE, $tenant))->toBeTrue();
+    expect($gate->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
 
     expect($gate->allows(Capabilities::PROVIDER_VIEW, $tenant))->toBeTrue();
 

apps/platform/tests/Feature/Rbac/RoleMatrix/OwnerAccessTest.php

@@ -11,7 +11,7 @@
     expect($gate->allows(Capabilities::TENANT_VIEW, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_SYNC, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_INVENTORY_SYNC_RUN, $tenant))->toBeTrue();
-    expect($gate->allows(Capabilities::TENANT_FINDINGS_ACKNOWLEDGE, $tenant))->toBeTrue();
+    expect($gate->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_MANAGE, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_DELETE, $tenant))->toBeTrue();
     expect($gate->allows(Capabilities::TENANT_MEMBERSHIP_MANAGE, $tenant))->toBeTrue();

apps/platform/tests/Feature/Rbac/RoleMatrix/ReadonlyAccessTest.php

@@ -16,7 +16,7 @@
 
     expect($gate->allows(Capabilities::TENANT_SYNC, $tenant))->toBeFalse();
     expect($gate->allows(Capabilities::TENANT_INVENTORY_SYNC_RUN, $tenant))->toBeFalse();
-    expect($gate->allows(Capabilities::TENANT_FINDINGS_ACKNOWLEDGE, $tenant))->toBeFalse();
+    expect($gate->allows(Capabilities::TENANT_FINDINGS_TRIAGE, $tenant))->toBeFalse();
     expect($gate->allows(Capabilities::TENANT_MANAGE, $tenant))->toBeFalse();
     expect($gate->allows(Capabilities::TENANT_DELETE, $tenant))->toBeFalse();
 

apps/platform/tests/Feature/Support/Badges/FindingBadgeTest.php

@@ -24,10 +24,10 @@
         ->and($spec->color)->toBe('warning');
 });
 
-it('still renders acknowledged status badge', function (): void {
-    $spec = BadgeCatalog::spec(BadgeDomain::FindingStatus, Finding::STATUS_ACKNOWLEDGED);
+it('renders unknown for removed acknowledged status badges', function (): void {
+    $spec = BadgeCatalog::spec(BadgeDomain::FindingStatus, 'acknowledged');
 
-    expect($spec->label)->toBe('Triaged')
+    expect($spec->label)->toBe('Unknown')
         ->and($spec->color)->toBe('gray');
 });
 

apps/platform/tests/Feature/System/OpsControls/RemoveFindingsLifecycleBackfillControlTraceTest.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\System\Pages\Ops\Controls;
+use App\Models\PlatformUser;
+use App\Support\Auth\PlatformCapabilities;
+use App\Support\OperationalControls\OperationalControlCatalog;
+use Filament\Facades\Filament;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function (): void {
+    Filament::setCurrentPanel('system');
+    Filament::bootCurrentPanel();
+});
+
+it('does not expose findings lifecycle backfill in operational controls or the control catalog', function (): void {
+    $user = PlatformUser::factory()->create([
+        'capabilities' => [
+            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
+            PlatformCapabilities::OPS_CONTROLS_MANAGE,
+        ],
+        'is_active' => true,
+    ]);
+
+    $this->actingAs($user, 'platform');
+
+    $this->get(Controls::getUrl(panel: 'system'))
+        ->assertSuccessful()
+        ->assertDontSee('Findings lifecycle backfill')
+        ->assertDontSee("mountAction('pause_findings_lifecycle_backfill')", escape: false)
+        ->assertDontSee("mountAction('resume_findings_lifecycle_backfill')", escape: false)
+        ->assertDontSee("mountAction('view_history_findings_lifecycle_backfill')", escape: false);
+
+    $catalog = app(OperationalControlCatalog::class);
+
+    expect($catalog->keys())->not->toContain('findings.lifecycle.backfill')
+        ->and(fn (): array => $catalog->definition('findings.lifecycle.backfill'))
+        ->toThrow(InvalidArgumentException::class);
+});

apps/platform/tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillAuditFailSafeTest.php

@@ -1,87 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Finding;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Intune\AuditLogger;
-use App\Services\OperationRunService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\Auth\PlatformCapabilities;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('does not crash when audit logging fails and still finalizes a failed run', function () {
-    $this->mock(AuditLogger::class, function ($mock): void {
-        $mock->shouldReceive('log')->andThrow(new RuntimeException('audit unavailable'));
-    });
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    $runbook = app(FindingsLifecycleBackfillRunbookService::class);
-
-    $run = $runbook->start(
-        scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-        initiator: $user,
-        reason: null,
-        source: 'system_ui',
-    );
-
-    $runs = app(OperationRunService::class);
-
-    $runs->updateRun(
-        $run,
-        status: 'completed',
-        outcome: 'failed',
-        failures: [
-            [
-                'code' => 'test.failed',
-                'message' => 'Forced failure for audit fail-safe test.',
-            ],
-        ],
-    );
-
-    $runbook->maybeFinalize($run);
-
-    $run->refresh();
-
-    expect($run->status)->toBe('completed');
-    expect($run->outcome)->toBe('failed');
-});

apps/platform/tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillBreakGlassTest.php

@@ -1,111 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\System\Pages\Dashboard;
-use App\Filament\System\Pages\Ops\Runbooks;
-use App\Models\AuditLog;
-use App\Models\Finding;
-use App\Models\OperationRun;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\Auth\PlatformCapabilities;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-
-    config()->set('tenantpilot.break_glass.enabled', true);
-    config()->set('tenantpilot.break_glass.ttl_minutes', 15);
-});
-
-it('requires a reason when break-glass is active and records break-glass on the run + audit', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $customerTenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $customerTenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-            PlatformCapabilities::USE_BREAK_GLASS,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Dashboard::class)
-        ->callAction('enter_break_glass', data: [
-            'reason' => 'Recovery test',
-        ])
-        ->assertHasNoActionErrors();
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $customerTenant->getKey(),
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [])
-        ->assertHasActionErrors(['reason_code', 'reason_text']);
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $customerTenant->getKey(),
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [
-            'reason_code' => 'INCIDENT',
-            'reason_text' => 'Break-glass backfill required',
-        ])
-        ->assertHasNoActionErrors()
-        ->assertNotified();
-
-    $run = OperationRun::query()
-        ->where('type', 'findings.lifecycle.backfill')
-        ->latest('id')
-        ->first();
-
-    expect($run)->not->toBeNull();
-    expect((int) $run?->tenant_id)->toBe((int) $customerTenant->getKey());
-    expect(data_get($run?->context, 'platform_initiator.is_break_glass'))->toBeTrue();
-    expect(data_get($run?->context, 'reason.reason_code'))->toBe('INCIDENT');
-    expect(data_get($run?->context, 'reason.reason_text'))->toBe('Break-glass backfill required');
-
-    $audit = AuditLog::query()
-        ->where('action', 'platform.ops.runbooks.start')
-        ->latest('id')
-        ->first();
-
-    expect($audit)->not->toBeNull();
-    expect($audit?->metadata['is_break_glass'] ?? null)->toBe(true);
-    expect($audit?->metadata['reason_code'] ?? null)->toBe('INCIDENT');
-    expect($audit?->metadata['reason_text'] ?? null)->toBe('Break-glass backfill required');
-});

apps/platform/tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillIdempotencyTest.php

@@ -1,78 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Jobs\BackfillFindingLifecycleJob;
-use App\Models\Finding;
-use App\Models\Tenant;
-use App\Services\OperationRunService;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-use Illuminate\Validation\ValidationException;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('is idempotent: after a successful run, preflight reports nothing to do', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $runbook = app(FindingsLifecycleBackfillRunbookService::class);
-
-    $initial = $runbook->preflight(FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()));
-
-    expect($initial['affected_count'])->toBe(1);
-
-    $runbook->start(
-        scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-        initiator: null,
-        reason: null,
-        source: 'system_ui',
-    );
-
-    $job = new BackfillFindingLifecycleJob(
-        tenantId: (int) $tenant->getKey(),
-        workspaceId: (int) $tenant->workspace_id,
-        initiatorUserId: null,
-    );
-
-    $job->handle(
-        app(OperationRunService::class),
-        app(\App\Services\Findings\FindingSlaPolicy::class),
-        $runbook,
-    );
-
-    $after = $runbook->preflight(FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()));
-
-    expect($after['affected_count'])->toBe(0);
-
-    expect(fn () => $runbook->start(
-        scope: FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()),
-        initiator: null,
-        reason: null,
-        source: 'system_ui',
-    ))->toThrow(ValidationException::class);
-});

apps/platform/tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillPreflightTest.php

@@ -1,202 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Models\Finding;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Runbooks\FindingsLifecycleBackfillRunbookService;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\Auth\PlatformCapabilities;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('computes single-tenant preflight counts', function () {
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-    ]);
-
-    $service = app(FindingsLifecycleBackfillRunbookService::class);
-
-    $result = $service->preflight(FindingsLifecycleBackfillScope::singleTenant((int) $tenant->getKey()));
-
-    expect($result['total_count'])->toBe(2);
-    expect($result['affected_count'])->toBe(1);
-});
-
-it('computes all-tenants preflight counts scoped to the platform workspace', function () {
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenantA = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    $tenantB = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    $otherTenant = Tenant::factory()->create();
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenantA->getKey(),
-        'due_at' => null,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenantB->getKey(),
-        'sla_days' => null,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $otherTenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $service = app(FindingsLifecycleBackfillRunbookService::class);
-
-    $result = $service->preflight(FindingsLifecycleBackfillScope::allTenants());
-
-    expect($result['estimated_tenants'])->toBe(2);
-    expect($result['total_count'])->toBe(2);
-    expect($result['affected_count'])->toBe(2);
-});
-
-it('accepts an allowed single-tenant selection during preflight', function () {
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(\App\Filament\System\Pages\Ops\Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $tenant->getKey(),
-        ])
-        ->assertHasNoActionErrors()
-        ->assertSet('findingsTenantId', (int) $tenant->getKey())
-        ->assertSet('preflight.affected_count', 1);
-});
-
-it('rejects platform tenant selection during preflight', function () {
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    assertScopedSelectorRejected(
-        Livewire::test(\App\Filament\System\Pages\Ops\Runbooks::class),
-        'preflight',
-        [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $platformTenant->getKey(),
-        ],
-    );
-});
-
-it('resets to an all-tenant trusted scope even when stale single-tenant selector state remains on the page', function () {
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenantA = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-        'name' => 'Scope Tenant A',
-    ]);
-
-    $tenantB = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-        'name' => 'Scope Tenant B',
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenantA->getKey(),
-        'due_at' => null,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenantB->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(\App\Filament\System\Pages\Ops\Runbooks::class)
-        ->set('findingsScopeMode', FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-        ->set('findingsTenantId', (int) $tenantA->getKey())
-        ->set('scopeMode', FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-        ->set('tenantId', (int) $tenantA->getKey())
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-            'tenant_id' => (int) $tenantA->getKey(),
-        ])
-        ->assertHasNoActionErrors()
-        ->assertSet('findingsScopeMode', FindingsLifecycleBackfillScope::MODE_ALL_TENANTS)
-        ->assertSet('findingsTenantId', null)
-        ->assertSet('scopeMode', FindingsLifecycleBackfillScope::MODE_ALL_TENANTS)
-        ->assertSet('tenantId', null)
-        ->assertSet('preflight.estimated_tenants', 2)
-        ->assertSet('preflight.affected_count', 2);
-});

apps/platform/tests/Feature/System/OpsRunbooks/FindingsLifecycleBackfillStartTest.php

@@ -1,253 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\System\Pages\Ops\Runbooks;
-use App\Models\AuditLog;
-use App\Models\Finding;
-use App\Models\OperationRun;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\Auth\PlatformCapabilities;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('disables running when preflight indicates nothing to do', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-        ])
-        ->assertSet('preflight.affected_count', 0)
-        ->assertActionDisabled('run');
-});
-
-it('requires typed confirmation and a reason for all-tenants runs', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [])
-        ->assertHasActionErrors([
-            'typed_confirmation',
-            'reason_code',
-            'reason_text',
-        ]);
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [
-            'typed_confirmation' => 'backfill',
-            'reason_code' => 'DATA_REPAIR',
-            'reason_text' => 'Test run',
-        ])
-        ->assertHasActionErrors(['typed_confirmation']);
-});
-
-it('rejects forged single-tenant selector state on run and records no run or start audit', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $allowedTenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $allowedTenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $allowedTenant->getKey(),
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->set('findingsScopeMode', FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-        ->set('findingsTenantId', (int) $platformTenant->getKey())
-        ->set('scopeMode', FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-        ->set('tenantId', (int) $platformTenant->getKey())
-        ->callAction('run', data: [])
-        ->assertHasActionErrors();
-
-    expect(OperationRun::query()->where('type', 'findings.lifecycle.backfill')->count())->toBe(0)
-        ->and(AuditLog::query()->where('action', 'platform.ops.runbooks.start')->count())->toBe(0);
-});
-
-it('records a start audit with the canonical single-tenant scope when an allowed run is queued', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $tenant->getKey(),
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [])
-        ->assertHasNoActionErrors()
-        ->assertNotified('Findings lifecycle backfill queued');
-
-    $run = OperationRun::query()
-        ->where('type', 'findings.lifecycle.backfill')
-        ->latest('id')
-        ->first();
-
-    expect($run)->not->toBeNull();
-
-    $audit = AuditLog::query()
-        ->where('action', 'platform.ops.runbooks.start')
-        ->latest('id')
-        ->first();
-
-    expect($audit)->not->toBeNull()
-        ->and($audit?->resource_id)->toBe((string) $run?->getKey())
-        ->and($audit?->metadata['scope'] ?? null)->toBe(FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT)
-        ->and($audit?->metadata['target_tenant_id'] ?? null)->toBe((int) $tenant->getKey())
-        ->and($audit?->metadata['operation_run_id'] ?? null)->toBe((int) $run?->getKey());
-});
-
-it('returns 403 for runbook execution when the platform user is in scope but lacks run capability', function () {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_SINGLE_TENANT,
-            'tenant_id' => (int) $tenant->getKey(),
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [])
-        ->assertForbidden();
-
-    expect(OperationRun::query()->where('type', 'findings.lifecycle.backfill')->count())->toBe(0)
-        ->and(AuditLog::query()->where('action', 'platform.ops.runbooks.start')->count())->toBe(0);
-});

apps/platform/tests/Feature/System/OpsRunbooks/OperationalControlRunbookGateTest.php

@@ -1,89 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\System\Pages\Ops\Runbooks;
-use App\Models\AuditLog;
-use App\Models\Finding;
-use App\Models\OperationalControlActivation;
-use App\Models\OperationRun;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Support\Audit\AuditActionId;
-use App\Support\Auth\PlatformCapabilities;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Support\Facades\Queue;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function (): void {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('blocks all-tenant findings lifecycle runbooks when the control is globally paused', function (): void {
-    Queue::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    OperationalControlActivation::factory()->forGlobalScope()->create([
-        'control_key' => 'findings.lifecycle.backfill',
-        'reason_text' => 'Paused during incident response.',
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => 'all_tenants',
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [
-            'typed_confirmation' => 'BACKFILL',
-            'reason_code' => 'DATA_REPAIR',
-            'reason_text' => 'Attempt blocked by control',
-        ])
-        ->assertNotified('Findings lifecycle backfill paused');
-
-    expect(OperationRun::query()->where('type', 'findings.lifecycle.backfill')->count())->toBe(0);
-
-    $audit = AuditLog::query()
-        ->where('action', AuditActionId::OperationalControlExecutionBlocked->value)
-        ->latest('id')
-        ->first();
-
-    expect($audit)->not->toBeNull()
-        ->and($audit?->workspace_id)->toBeNull()
-        ->and($audit?->tenant_id)->toBeNull()
-        ->and($audit?->status)->toBe('blocked')
-        ->and($audit?->metadata['control_key'] ?? null)->toBe('findings.lifecycle.backfill')
-        ->and($audit?->metadata['requested_scope'] ?? null)->toBe('all_tenants');
-});

apps/platform/tests/Feature/System/OpsRunbooks/OpsUxStartSurfaceContractTest.php

@@ -1,89 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-use App\Filament\System\Pages\Ops\Runbooks;
-use App\Models\Finding;
-use App\Models\OperationRun;
-use App\Models\PlatformUser;
-use App\Models\Tenant;
-use App\Services\Runbooks\FindingsLifecycleBackfillScope;
-use App\Support\Auth\PlatformCapabilities;
-use App\Support\System\SystemOperationRunLinks;
-use Filament\Facades\Filament;
-use Illuminate\Foundation\Testing\RefreshDatabase;
-use Illuminate\Notifications\DatabaseNotification;
-use Illuminate\Support\Facades\Notification as NotificationFacade;
-use Illuminate\Support\Facades\Queue;
-use Livewire\Livewire;
-
-uses(RefreshDatabase::class);
-
-beforeEach(function () {
-    Filament::setCurrentPanel('system');
-    Filament::bootCurrentPanel();
-
-    Tenant::factory()->create([
-        'tenant_id' => null,
-        'external_id' => 'platform',
-        'name' => 'Platform',
-    ]);
-});
-
-it('uses an intent-only toast with a working view-run link and does not emit queued database notifications', function () {
-    Queue::fake();
-    NotificationFacade::fake();
-
-    $platformTenant = Tenant::query()->where('external_id', 'platform')->firstOrFail();
-
-    $tenant = Tenant::factory()->create([
-        'workspace_id' => (int) $platformTenant->workspace_id,
-    ]);
-
-    Finding::factory()->create([
-        'tenant_id' => (int) $tenant->getKey(),
-        'due_at' => null,
-    ]);
-
-    $user = PlatformUser::factory()->create([
-        'capabilities' => [
-            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
-            PlatformCapabilities::OPS_VIEW,
-            PlatformCapabilities::RUNBOOKS_VIEW,
-            PlatformCapabilities::RUNBOOKS_RUN,
-            PlatformCapabilities::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL,
-        ],
-        'is_active' => true,
-    ]);
-
-    $this->actingAs($user, 'platform');
-
-    Livewire::test(Runbooks::class)
-        ->callAction('preflight', data: [
-            'scope_mode' => FindingsLifecycleBackfillScope::MODE_ALL_TENANTS,
-        ])
-        ->assertSet('preflight.affected_count', 1)
-        ->callAction('run', data: [
-            'typed_confirmation' => 'BACKFILL',
-            'reason_code' => 'DATA_REPAIR',
-            'reason_text' => 'Operator test',
-        ])
-        ->assertHasNoActionErrors()
-        ->assertNotified('Findings lifecycle backfill queued');
-
-    NotificationFacade::assertNothingSent();
-    expect(DatabaseNotification::query()->count())->toBe(0);
-
-    $run = OperationRun::query()
-        ->where('type', 'findings.lifecycle.backfill')
-        ->latest('id')
-        ->first();
-
-    expect($run)->not->toBeNull();
-
-    $viewUrl = SystemOperationRunLinks::view($run);
-
-    $this->get($viewUrl)
-        ->assertSuccessful()
-        ->assertSee('Operation #'.(int) $run?->getKey());
-});

apps/platform/tests/Feature/System/OpsRunbooks/RemoveFindingsLifecycleBackfillRunbookSurfaceTest.php

@@ -0,0 +1,59 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\System\Pages\Ops\Runbooks;
+use App\Models\PlatformUser;
+use App\Support\Auth\PlatformCapabilities;
+use Filament\Facades\Filament;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function (): void {
+    Filament::setCurrentPanel('system');
+    Filament::bootCurrentPanel();
+});
+
+it('keeps the system runbooks page accessible without findings lifecycle backfill launch surfaces', function (): void {
+    $user = PlatformUser::factory()->create([
+        'capabilities' => [
+            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
+            PlatformCapabilities::OPS_VIEW,
+            PlatformCapabilities::RUNBOOKS_VIEW,
+            PlatformCapabilities::RUNBOOKS_RUN,
+        ],
+        'is_active' => true,
+    ]);
+
+    $this->actingAs($user, 'platform');
+
+    $this->get(Runbooks::getUrl(panel: 'system'))
+        ->assertSuccessful()
+        ->assertSee('No supported runbooks')
+        ->assertDontSee('Rebuild Findings Lifecycle')
+        ->assertDontSee('Backfills legacy findings lifecycle fields')
+        ->assertDontSee('Preflight')
+        ->assertDontSee('preflight')
+        ->assertDontSee('Run: Rebuild Findings Lifecycle')
+        ->assertDontSee('BACKFILL');
+
+    Livewire::test(Runbooks::class)
+        ->assertActionDoesNotExist('preflight')
+        ->assertActionDoesNotExist('run');
+});
+
+it('preserves runbooks view authorization semantics after removing the backfill runbook', function (): void {
+    $user = PlatformUser::factory()->create([
+        'capabilities' => [
+            PlatformCapabilities::ACCESS_SYSTEM_PANEL,
+            PlatformCapabilities::OPS_VIEW,
+        ],
+        'is_active' => true,
+    ]);
+
+    $this->actingAs($user, 'platform')
+        ->get(Runbooks::getUrl(panel: 'system'))
+        ->assertForbidden();
+});

apps/platform/tests/Feature/TenantRBAC/RoleDefinitionsSyncNowTest.php

@@ -6,6 +6,7 @@
 use App\Services\Providers\ProviderOperationStartResult;
 use App\Services\Directory\RoleDefinitionsSyncService;
 use App\Support\OperationRunLinks;
+use App\Support\OperationRunType;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
 
@@ -36,7 +37,7 @@
 
     $run = $result->run;
 
-    expect($run->type)->toBe('directory_role_definitions.sync');
+    expect($run->type)->toBe(OperationRunType::DirectoryRoleDefinitionsSync->value);
     expect($run->context['provider_connection_id'] ?? null)->toBeInt();
 
     $url = OperationRunLinks::tenantlessView($run);

apps/platform/tests/Feature/TenantReview/TenantReviewCanonicalControlReferenceTest.php

@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use App\Models\Finding;
+
 it('passes shared canonical control references through tenant review composition', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'owner');
     $snapshot = seedTenantReviewEvidence($tenant, findingCount: 0, driftCount: 1);
@@ -14,5 +16,30 @@
         ->and($review->canonicalControlReferences()[0]['control_key'])->toBe('endpoint_hardening_compliance')
         ->and($executiveSummary->summary_payload['canonical_control_count'])->toBe(1)
         ->and($executiveSummary->summary_payload['canonical_controls'][0]['control_key'])->toBe('endpoint_hardening_compliance')
-        ->and($openRisks->summary_payload['canonical_controls'])->toBe([]);
+        ->and($openRisks->summary_payload['canonical_controls'][0]['control_key'] ?? null)->toBe('endpoint_hardening_compliance');
+});
+
+it('excludes removed acknowledged findings from open risk highlights', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    Finding::factory()->for($tenant)->create([
+        'workspace_id' => (int) $tenant->workspace_id,
+        'status' => 'acknowledged',
+        'subject_external_id' => 'legacy-acknowledged',
+    ]);
+
+    $triagedFinding = Finding::factory()->for($tenant)->create([
+        'workspace_id' => (int) $tenant->workspace_id,
+        'status' => Finding::STATUS_TRIAGED,
+        'subject_external_id' => 'canonical-triaged',
+    ]);
+
+    $snapshot = seedTenantReviewEvidence($tenant, findingCount: 0, driftCount: 0);
+    $review = composeTenantReviewForTest($tenant, $user, $snapshot);
+    $openRisks = $review->sections->firstWhere('section_key', 'open_risks');
+    $entries = $openRisks->render_payload['entries'] ?? [];
+
+    expect($entries)->toHaveCount(1)
+        ->and($entries[0]['id'] ?? null)->toBe((int) $triagedFinding->getKey())
+        ->and(collect($entries)->pluck('status')->all())->not->toContain('acknowledged');
 });

apps/platform/tests/Feature/Workspaces/GlobalContextShellContractTest.php

@@ -23,7 +23,7 @@
         ->assertSee('Tenant Panel Entry')
         ->assertSee('Switch tenant')
         ->assertSee('Clear tenant scope')
-        ->assertDontSee('Search tenants…')
+            ->assertDontSee(__('localization.shell.search_tenants'))
         ->assertDontSee('admin/select-tenant');
 });
 

apps/platform/tests/Unit/Badges/FindingBadgesTest.php

@@ -33,7 +33,7 @@
     expect($triaged->color)->toBe('gray');
 
     $legacyAcknowledged = BadgeCatalog::spec(BadgeDomain::FindingStatus, 'acknowledged');
-    expect($legacyAcknowledged->label)->toBe('Triaged');
+    expect($legacyAcknowledged->label)->toBe('Unknown');
     expect($legacyAcknowledged->color)->toBe('gray');
 
     $inProgress = BadgeCatalog::spec(BadgeDomain::FindingStatus, 'in_progress');

apps/platform/tests/Unit/Findings/FindingStatusSemanticsTest.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Finding;
+
+it('exposes only canonical open statuses for findings', function (): void {
+    expect(Finding::openStatuses())->toBe([
+        Finding::STATUS_NEW,
+        Finding::STATUS_TRIAGED,
+        Finding::STATUS_IN_PROGRESS,
+        Finding::STATUS_REOPENED,
+    ]);
+
+    expect(Finding::openStatusesForQuery())->toBe(Finding::openStatuses());
+});
+
+it('does not treat acknowledged as a canonical open or terminal status', function (): void {
+    expect(Finding::canonicalizeStatus('acknowledged'))->toBe('acknowledged');
+    expect(Finding::isOpenStatus('acknowledged'))->toBeFalse();
+    expect(Finding::isTerminalStatus('acknowledged'))->toBeFalse();
+});

apps/platform/tests/Unit/Operations/OperationLifecyclePolicyValidatorTest.php

@@ -9,15 +9,14 @@
     $types = app(OperationLifecyclePolicy::class)->coveredTypeNames();
 
     expect($types)->toBe([
-        'baseline_capture',
-        'baseline_compare',
-        'inventory_sync',
+        'baseline.capture',
+        'baseline.compare',
+        'inventory.sync',
         'policy.sync',
-        'policy.sync_one',
-        'entra_group_sync',
-        'directory_role_definitions.sync',
+        'directory.groups.sync',
+        'directory.role_definitions.sync',
         'backup_set.update',
-        'backup_schedule_run',
+        'backup.schedule.execute',
         'restore.execute',
         'tenant.review_pack.generate',
         'tenant.review.compose',
@@ -28,19 +27,19 @@
 it('requires direct failed-job bridges for lifecycle policy entries that declare them', function (): void {
     $validator = app(OperationLifecyclePolicyValidator::class);
 
-    expect($validator->jobUsesDirectFailedBridge('baseline_capture'))->toBeTrue()
-        ->and($validator->jobUsesDirectFailedBridge('baseline_compare'))->toBeTrue()
-        ->and($validator->jobUsesDirectFailedBridge('inventory_sync'))->toBeTrue()
+    expect($validator->jobUsesDirectFailedBridge('baseline.capture'))->toBeTrue()
+        ->and($validator->jobUsesDirectFailedBridge('baseline.compare'))->toBeTrue()
+        ->and($validator->jobUsesDirectFailedBridge('inventory.sync'))->toBeTrue()
         ->and($validator->jobUsesDirectFailedBridge('policy.sync'))->toBeTrue()
         ->and($validator->jobUsesDirectFailedBridge('tenant.review.compose'))->toBeTrue()
-        ->and($validator->jobUsesDirectFailedBridge('backup_schedule_run'))->toBeFalse();
+        ->and($validator->jobUsesDirectFailedBridge('backup.schedule.execute'))->toBeFalse();
 });
 
 it('requires explicit timeout and fail-on-timeout declarations for covered jobs', function (): void {
     $validator = app(OperationLifecyclePolicyValidator::class);
 
-    expect($validator->jobTimeoutSeconds('baseline_capture'))->toBe(300)
-        ->and($validator->jobFailsOnTimeout('baseline_capture'))->toBeTrue()
+    expect($validator->jobTimeoutSeconds('baseline.capture'))->toBe(300)
+        ->and($validator->jobFailsOnTimeout('baseline.capture'))->toBeTrue()
         ->and($validator->jobTimeoutSeconds('backup_set.update'))->toBe(240)
         ->and($validator->jobFailsOnTimeout('backup_set.update'))->toBeTrue()
         ->and($validator->jobTimeoutSeconds('restore.execute'))->toBe(420)

apps/platform/tests/Unit/Support/Auth/RemoveFindingsLifecycleBackfillCapabilityTraceTest.php

@@ -0,0 +1,14 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Support\Auth\PlatformCapabilities;
+
+it('removes the platform capability and seeder grant for findings lifecycle backfill', function (): void {
+    expect(defined(PlatformCapabilities::class.'::RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL'))->toBeFalse()
+        ->and(PlatformCapabilities::all())->not->toContain('platform.runbooks.findings.lifecycle_backfill');
+
+    expect((string) file_get_contents(database_path('seeders/PlatformUserSeeder.php')))
+        ->not->toContain('RUNBOOKS_FINDINGS_LIFECYCLE_BACKFILL')
+        ->not->toContain('platform.runbooks.findings.lifecycle_backfill');
+});

apps/platform/tests/Unit/Support/Filament/FindingStatusFilterCatalogTest.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Models\Finding;
+use App\Support\Filament\FilterOptionCatalog;
+
+it('exposes only canonical finding statuses in the shared filter catalog', function (): void {
+    expect(FilterOptionCatalog::findingStatuses())->toBe([
+        Finding::STATUS_NEW => 'New',
+        Finding::STATUS_TRIAGED => 'Triaged',
+        Finding::STATUS_IN_PROGRESS => 'In progress',
+        Finding::STATUS_REOPENED => 'Reopened',
+        Finding::STATUS_RESOLVED => 'Resolved',
+        Finding::STATUS_CLOSED => 'Closed',
+        Finding::STATUS_RISK_ACCEPTED => 'Risk accepted',
+    ]);
+});
+
+it('does not offer acknowledged as a legacy findings filter option', function (): void {
+    expect(FilterOptionCatalog::findingStatuses())->not->toHaveKey('acknowledged');
+});

apps/platform/tests/Unit/Support/GovernanceInbox/GovernanceInboxSectionBuilderTest.php

@@ -15,6 +15,7 @@
 use App\Support\Navigation\CanonicalNavigationContext;
 use App\Support\OperationRunOutcome;
 use App\Support\OperationRunStatus;
+use App\Support\OperationRunType;
 use App\Support\PortfolioTriage\PortfolioArrivalContextToken;
 use App\Support\PortfolioTriage\TenantTriageReviewFingerprint;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -64,6 +65,7 @@
     OperationRun::factory()
         ->forTenant($bravoTenant)
         ->create([
+            'type' => OperationRunType::InventorySync->value,
             'status' => OperationRunStatus::Queued->value,
             'outcome' => OperationRunOutcome::Pending->value,
             'created_at' => now()->subMinutes(6),

apps/platform/tests/Unit/Support/OperationCatalog/RemoveFindingsLifecycleBackfillCatalogTraceTest.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Support\OperationCatalog;
+
+it('removes findings lifecycle backfill from the supported operation catalog', function (): void {
+    expect(OperationCatalog::canonicalInventory())->not->toHaveKey('findings.lifecycle.backfill')
+        ->and(OperationCatalog::aliasInventory())->not->toHaveKey('findings.lifecycle.backfill')
+        ->and(OperationCatalog::rawValuesForCanonical('findings.lifecycle.backfill'))->toBe([])
+        ->and(OperationCatalog::label('findings.lifecycle.backfill'))->toBe('Unknown operation');
+});

apps/platform/tests/Unit/Support/ProductTelemetry/ProductTelemetryRecorderTest.php

@@ -53,6 +53,29 @@
     ]);
 });
 
+it('records a tenant-owned usage event for an archived tenant', function () {
+    $workspace = Workspace::factory()->create();
+    $tenant = Tenant::factory()->for($workspace)->archived()->create();
+    $user = User::factory()->create();
+
+    $event = app(ProductTelemetryRecorder::class)->record(
+        eventName: ProductUsageEventCatalog::ONBOARDING_CHECKPOINT_COMPLETED,
+        workspaceId: (int) $workspace->getKey(),
+        tenantId: (int) $tenant->getKey(),
+        userId: (int) $user->getKey(),
+        subjectType: 'tenant_onboarding_session',
+        subjectId: 99,
+        metadata: [
+            'checkpoint_key' => 'verify_access',
+            'lifecycle_state' => 'draft',
+        ],
+    );
+
+    expect($event->workspace_id)->toBe((int) $workspace->getKey())
+        ->and($event->tenant_id)->toBe((int) $tenant->getKey())
+        ->and($event->feature_area)->toBe('onboarding');
+});
+
 it('rejects unknown event names before writing telemetry rows', function () {
     $workspace = Workspace::factory()->create();
     $tenant = Tenant::factory()->for($workspace)->create();

docs/HANDOVER.md

@@ -473,7 +473,6 @@ ### Deployment: Dokploy (staging → production)
 
 ### Platform runbooks
 
-- `FindingsLifecycleBackfillRunbookService` ([app/Services/Runbooks/FindingsLifecycleBackfillRunbookService.php](app/Services/Runbooks/FindingsLifecycleBackfillRunbookService.php)) — safe backfill of findings lifecycle fields
 - Accessible at `/system/ops/runbooks` with platform capabilities
 
 ---

docs/product/implementation-ledger.md

@@ -15,7 +15,7 @@ ## Purpose
 
 ## Current Product Position
 
-TenantPilot ist aktuell ein starkes internes Governance- und Operations-Produkt mit belastbaren Foundations fuer Execution Truth, Baselines/Drift, Findings, Evidence, Reviews, Review Packs, Supportability, Telemetry und Safety Controls. Die Repo-Wahrheit liegt damit ueber einer simplen Lesart von "R1 done / R2 partial". Gleichzeitig ist das Produkt noch nicht voll als kundenseitig konsumierbare Review- und Portfolio-Plattform ausgereift: Customer-safe Review Consumption, Cross-Tenant-Workflows und kommerzielle Lifecycle-Reife sind noch unvollstaendig. Zusaetzlich zeigt der Repo-Stand eine schmale Findings-Cleanup-Lane: sichtbare Lifecycle-Backfill-Runtime-Surfaces, `acknowledged`-Kompatibilitaet und fehlende explizite Creation-Time-Invariant-Absicherung sollten als getrennte Folgespecs behandelt werden.
+TenantPilot ist aktuell ein starkes internes Governance- und Operations-Produkt mit belastbaren Foundations fuer Execution Truth, Baselines/Drift, Findings, Evidence, Reviews, Review Packs, Supportability, Telemetry und Safety Controls und inzwischen repo-real umgesetzten Customer-safe Review Consumption, Risk-Acceptance/Exception-Workflow, Findings-/Governance-Inboxen und einer DE/EN-Locale-Foundation. Die Repo-Wahrheit liegt damit klar ueber einer simplen Lesart von "R1 done / R2 partial". Gleichzeitig ist das Produkt noch nicht voll als kundenseitig konsumierbare Portfolio- und Commercial-Plattform ausgereift: Cross-Tenant-Workflows, Compare/Promotion, Billing-/Lifecycle-Reife und Private-AI-Governance bleiben unvollstaendig. Zusaetzlich zeigt der Repo-Stand weiterhin eine schmale Findings-Cleanup-Lane: sichtbare Lifecycle-Backfill-Runtime-Surfaces, `acknowledged`-Kompatibilitaet und fehlende explizite Creation-Time-Invariant-Absicherung sollten als getrennte Folgespecs behandelt werden.
 
 ## Status Model
 
@@ -41,24 +41,24 @@ ## Roadmap Coverage Summary
 | Roadmap Area | Status | Evidence Level | UI Ready | Tested | Sellable | Notes |
 |---|---|---:|---|---|---|---|
 | R1 Golden Master Governance | adopted | strong | yes | repo tests, not run | yes | Baselines, Drift, Findings und OperationRun-Truth sind breit im Produkt verankert. |
-| R2 Tenant Reviews, Evidence & Control Foundation | adopted | strong | yes | repo tests, not run | almost | Review-, Evidence- und Control-Foundations sind stark; Customer Review Workspace fehlt noch. |
+| R2 Tenant Reviews, Evidence & Control Foundation | adopted | strong | yes | repo tests, not run | yes | Reviews, Evidence, Review Packs, Customer Review Workspace und Control-/Exception-Layer greifen als reale Governance-Surface zusammen. |
 | Alert escalation + notification routing | implemented_verified | strong | partial | repo tests, not run | yes | Alert-Regeln, Dispatch, Cooldown und Quiet Hours sind real. |
 | Governance & Architecture Hardening | implemented_partial | strong | partial | repo tests, not run | foundation-only | Viele Hardening-Slices sind bereits im Code, die Lane bleibt aber aktiv. |
-| UI & Product Maturity Polish | implemented_partial | medium | partial | partial repo tests, not run | no | Einzelne Polishing-Slices sind da, aber kein geschlossenes "fertig"-Signal auf Theme-Ebene. |
+| UI & Product Maturity Polish | implemented_partial | strong | partial | partial repo tests, not run | no | Empty States, Navigation, Localization und read-only Review-Polish sind real, aber kein geschlossenes Theme-Completion-Signal. |
 | Secret & Security Hardening | implemented_verified | strong | yes | repo tests, not run | almost | Provider-Verifikation, Permission-Diagnostics und Redaction sind belastbar. |
 | Baseline Drift Engine (Cutover) | adopted | strong | yes | repo tests, not run | yes | Compare- und Drift-Workflow wirken als produktive Kernfunktion. |
-| R1.9 Platform Localization v1 | planned | none | no | no | no | Keine belastbare Locale-Foundation im Repo gefunden. |
+| R1.9 Platform Localization v1 | implemented_verified | strong | yes | repo tests, not run | foundation-only | Locale-Resolver, Override/Praeferenz, Workspace-Default, Fallback und lokalisierte Notifications sind repo-real. |
 | Product Scalability & Self-Service Foundation | implemented_partial | strong | yes | repo tests, not run | almost | Onboarding, Support, Help und Entitlements sind weit; Billing, Trial und Demo-Reife fehlen. |
 | R2.0 Canonical Control Catalog Foundation | implemented_verified | strong | partial | repo tests, not run | foundation-only | Bereits implementiert und in Evidence/Reviews referenziert, aber kein eigenstaendiger Kundennutzen-Surface. |
-| R2 Completion: customer review, support, help | implemented_partial | strong | yes | repo tests, not run | almost | Support und Help sind real; kundensichere Review-Consumption ist noch offen. |
-| Findings Workflow v2 / Execution Layer | implemented_partial | strong | yes | repo tests, not run | almost | Triage, Ownership, Alerts und Hygiene sind vorhanden; der naechste Operator-Layer fehlt und Legacy-Cleanup um Backfill-/Status-Kompatibilitaet bleibt offen. |
+| R2 Completion: customer review, support, help | adopted | strong | yes | repo tests, not run | yes | Customer Review Workspace, Support Diagnostics/Requests und Help-Katalog sind repo-real. |
+| Findings Workflow v2 / Execution Layer | adopted | strong | yes | repo tests, not run | almost | Triage, Ownership, My Work, Intake, Governance Inbox, Exceptions und Alerts/Hygiene sind real; Cross-Tenant-Decisioning bleibt spaeter. |
 | Policy Lifecycle / Ghost Policies | specified | weak | no | no | no | Als Richtung sichtbar, aber nicht als repo-verifizierter Workflow. |
 | Platform Operations Maturity | implemented_partial | strong | yes | repo tests, not run | almost | System Panel, Control Tower und Ops Controls sind real; CSV/Raw Drilldowns bleiben offen. |
 | Product Usage, Customer Health & Operational Controls | adopted | strong | yes | repo tests, not run | almost | Diese Mid-term-Lane ist im Repo bereits substanziell vorhanden. |
 | Private AI Execution & Usage Governance Foundation | planned | none | no | no | no | Keine belastbare AI-Governance-Foundation im Repo. |
 | MSP Portfolio & Operations | implemented_partial | medium | partial | repo tests, not run | foundation-only | Portfolio-Triage ist da; Compare/Promotion und Decision Workboard fehlen. |
-| Human-in-the-Loop Autonomous Governance | planned | none | no | no | no | Kein repo-verifizierter Decision-Pack- oder Approval-Workflow. |
-| Drift & Change Governance | specified | weak | no | no | no | Einzelne Foundations existieren, die thematische Produkt-Lane aber nicht. |
+| Human-in-the-Loop Autonomous Governance | planned | none | no | no | no | Kein repo-verifizierter Decision-Pack- oder Approval-Workflow jenseits des jetzigen Exception-/Review-Layers. |
+| Drift & Change Governance | implemented_partial | strong | yes | repo tests, not run | almost | Drift review, accepted-risk governance, exception validity und Governance-Inbox-Surfaces sind repo-real; portfolio-weite Eskalation bleibt offen. |
 | Standardization & Policy Quality | planned | none | no | no | no | Keine starke Repo-Evidence fuer eine Intune-Linting- oder Policy-Quality-Oberflaeche. |
 | PSA / Ticketing Handoff | planned | none | no | no | no | Support Requests existieren, externe Handoff-Integration aber nicht. |
 
@@ -69,10 +69,13 @@ ## Implemented Capabilities
 | OperationRun truth layer | implemented_verified | yes | partial | repo tests, not run | yes | foundation-only | `app/Models/OperationRun.php`; `tests/Feature/System/*`; `tests/Feature/ReviewPack/*` |
 | Baseline profiles, snapshots and compare | implemented_verified | yes | yes | repo tests, not run | yes | yes | `app/Models/BaselineProfile.php`; `app/Models/BaselineSnapshot.php`; `app/Services/Baselines/BaselineCompareService.php` |
 | Drift findings and governance pressure | adopted | yes | yes | repo tests, not run | yes | yes | `app/Models/Finding.php`; `app/Filament/Widgets/Dashboard/RecentDriftFindings.php`; `tests/Feature/Findings/*` |
+| Findings inboxes and governance inbox | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Filament/Pages/Findings/MyFindingsInbox.php`; `app/Filament/Pages/Findings/FindingsIntakeQueue.php`; `app/Filament/Pages/Governance/GovernanceInbox.php`; `tests/Feature/Findings/MyWorkInboxTest.php`; `tests/Feature/Governance/*` |
+| Finding exceptions and risk acceptance workflow | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Models/FindingException.php`; `app/Services/Findings/FindingExceptionService.php`; `app/Filament/Resources/FindingExceptionResource.php`; `tests/Feature/Findings/FindingExceptionWorkflowTest.php` |
 | Restore workflow with safety gates | implemented_verified | yes | yes | repo tests, not run | yes | yes | `app/Models/OperationRun.php`; restore gates and tests in `tests/Feature/Restore/*` |
 | Evidence snapshots | implemented_verified | yes | yes | repo tests, not run | yes | foundation-only | `app/Models/EvidenceSnapshot.php`; `app/Services/Evidence/EvidenceSnapshotService.php`; `tests/Feature/Evidence/*` |
 | Tenant reviews | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Models/TenantReview.php`; `app/Services/TenantReviews/TenantReviewService.php`; `tests/Feature/TenantReview/*` |
 | Review pack generation and export | implemented_verified | yes | yes | repo tests, not run | yes | yes | `app/Models/ReviewPack.php`; `app/Services/ReviewPackService.php`; `tests/Feature/ReviewPack/*` |
+| Customer review workspace | implemented_verified | yes | yes | repo tests, not run | yes | yes | `app/Filament/Pages/Reviews/CustomerReviewWorkspace.php`; `tests/Feature/Reviews/*`; `tests/Browser/Reviews/CustomerReviewWorkspaceSmokeTest.php` |
 | Alerts and notification routing | implemented_verified | yes | partial | repo tests, not run | yes | yes | `app/Services/Alerts/AlertDispatchService.php`; `tests/Feature/*Alert*` |
 | Provider health, onboarding readiness and required permissions | adopted | yes | yes | repo tests, not run | yes | almost | `app/Jobs/ProviderConnectionHealthCheckJob.php`; `app/Services/Onboarding/OnboardingLifecycleService.php`; `app/Filament/Pages/TenantRequiredPermissions.php` |
 | Permission posture reporting | implemented_verified | yes | yes | repo tests, not run | yes | yes | `app/Services/PermissionPosture/PermissionPostureFindingGenerator.php`; `tests/Feature/PermissionPosture/*` |
@@ -81,6 +84,7 @@ ## Implemented Capabilities
 | Support diagnostics | adopted | yes | yes | repo tests, not run | yes | almost | `app/Support/SupportDiagnostics/SupportDiagnosticBundleBuilder.php`; `app/Filament/Pages/TenantDashboard.php`; `tests/Feature/SupportDiagnostics/*` |
 | In-app support requests | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Models/SupportRequest.php`; `app/Support/SupportRequests/*`; `tests/Feature/SupportRequests/*` |
 | Product knowledge and contextual help | implemented_partial | yes | yes | repo tests, not run | partial | almost | `app/Support/ProductKnowledge/ContextualHelpCatalog.php`; `tests/Feature/Onboarding/ProductKnowledgeOnboardingHelpTest.php` |
+| Localization foundation | implemented_verified | yes | yes | repo tests, not run | partial | foundation-only | `app/Services/Localization/LocaleResolver.php`; `app/Http/Controllers/LocalizationController.php`; `tests/Feature/Localization/*` |
 | Product telemetry | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Models/ProductUsageEvent.php`; `app/Filament/System/Widgets/ProductTelemetryKpis.php`; `tests/Feature/System/ProductTelemetry/*` |
 | Customer health scoring | implemented_verified | yes | yes | repo tests, not run | partial | almost | `app/Filament/System/Widgets/CustomerHealthKpis.php`; `app/Filament/System/Widgets/CustomerHealthTopWorkspaces.php`; `tests/Feature/System/CustomerHealth/*` |
 | Operational controls | implemented_verified | yes | yes | repo tests, not run | yes | almost | `app/Models/OperationalControlActivation.php`; `app/Support/OperationalControls/*`; `tests/Feature/System/OpsControls/*` |
@@ -99,14 +103,15 @@ ## Foundation-Only Capabilities
 - Canonical control catalog: starke semantische Foundation fuer Evidence, Findings und Reviews.
 - Stored reports substrate: wichtig fuer Reports, Evidence und Diagnostics, aber kein eigenstaendiges Produktversprechen.
 - Evidence snapshot substrate: tragende technische Basis fuer Reviews und Exports.
+- Localization foundation: resolved locale precedence, Workspace-Default, User-Praeferenz/Override und Notification-Formatting sind real, aber Enablement statt eigener Produkt-Surface.
 - Operational control registry and evaluator: starke Safety-Control-Foundation, primar operatorseitig.
 - Customer health scoring: reale interne SaaS-Operations-Layer, aber noch keine eigenstaendige Kundenoberflaeche.
 - Portfolio triage continuity: sinnvoller Multi-Tenant-Unterbau, aber noch kein vollstaendiges Portfolio-Produkt.
 
 ## Partial Capabilities
 
-- Customer-facing review consumption: Tenant Reviews, Evidence Snapshots und Review Packs sind stark, aber ein repo-verifizierter Customer Review Workspace fehlt.
-- Findings Workflow v2: Triage, Assignment, Hygiene und Notifications sind vorhanden, aber kein konsolidierter Decision-/Inbox-Layer; zusaetzlich bleibt Cleanup debt um Lifecycle-Backfill-Surfaces, `acknowledged`-Kompatibilitaet und explizite Creation-Time-Invarianten.
+- Customer-facing review consumption: Tenant Reviews, Evidence Snapshots, Review Packs und der Customer Review Workspace sind repo-real, aber portfolio-weite Consumption- und Sharing-Patterns bleiben offen.
+- Findings Workflow v2: Triage, Assignment, My Work, Intake, Governance Inbox, Exceptions und Notifications sind vorhanden; spaetere Cross-Tenant-Decisioning-Layer und Cleanup debt um Lifecycle-Backfill-Surfaces, `acknowledged`-Kompatibilitaet und explizite Creation-Time-Invarianten bleiben offen.
 - Product scalability and self-service: Onboarding, Support, Help und Entitlements sind weit, Billing-, Trial- und Demo-Reife aber nicht.
 - MSP portfolio operations: Portfolio-Triage ist vorhanden, Cross-Tenant Compare und Promotion fehlen.
 - Platform operations maturity: Control Tower und Ops Controls sind stark, aber einige geplante operatorseitige Drilldowns/Exports fehlen noch.
@@ -114,13 +119,12 @@ ## Partial Capabilities
 
 ## Planned But Not Implemented
 
-- Platform Localization v1
 - Private AI Execution & Usage Governance Foundation
 - Human-in-the-Loop Autonomous Governance
 - Standardization & Policy Quality / Intune Linting
 - PSA / Ticketing Handoff
-- Customer Review Workspace v1
 - Cross-Tenant Compare and Promotion v1
+- Policy Lifecycle / Ghost Policies
 - Later compliance overlays beyond the current control/evidence foundation
 
 ## Release Readiness
@@ -128,8 +132,8 @@ ## Release Readiness
 | Release / Theme | Readiness | Notes |
 |---|---|---|
 | R1 Golden Master Governance | implemented | Die zentrale Governance- und Execution-Layer ist repo-verifiziert und breit adoptiert. |
-| R2 Tenant Reviews & Evidence Packs | partially implemented | Reviews, Evidence Snapshots und Review Packs sind stark; kundensichere Consumption fehlt noch. |
-| R3 MSP Portfolio OS | foundation only | Portfolio-Triage ist da, aber Compare/Promotion und Decision Workflows fehlen. |
+| R2 Tenant Reviews & Evidence Packs | implemented | Reviews, Evidence Snapshots, Review Packs, Customer Review Workspace und Exception-/Accepted-Risk-Workflow sind repo-real; breitere Commercial-Polish-Themen bleiben separat. |
+| R3 MSP Portfolio OS | foundation only | Portfolio-Triage und Governance-Surfaces sind da, aber Compare/Promotion und portfolio-weite Action-Layer fehlen. |
 | Later Compliance Light | foundation only | Canonical Controls, Evidence und Exceptions existieren als Grundlage; ein Compliance-Produkt ist nicht repo-proven. |
 
 ## Commercial Readiness
@@ -138,14 +142,16 @@ ### Demo-ready
 
 - Baseline compare and drift walkthroughs
 - Review pack generation and export
+- Customer-safe review workspace walkthroughs
 - Provider health, onboarding readiness and required permissions
 - Support diagnostics
 - Permission posture and Entra admin roles reporting
 
 ### Almost sellable
 
-- Review-driven governance workflow around tenant reviews and review packs
+- Review-driven governance workflow rund um Tenant Reviews, Customer Review Workspace, accepted risks und Review Packs
 - Baseline drift and restore governance
+- Findings workflow mit persönlicher Inbox, Intake, Governance Inbox und Exception-Handling
 - Alerting and run visibility for governance operations
 - Support requests with contextual diagnostics
 - Provider readiness and permission posture reporting
@@ -159,6 +165,7 @@ ### Foundation-only
 - Canonical control catalog
 - Stored reports substrate
 - Evidence snapshot substrate
+- Localization foundation
 - Product telemetry
 - Customer health scoring
 - Operational controls
@@ -166,9 +173,7 @@ ### Foundation-only
 
 ### Not sellable yet
 
-- Customer Review Workspace v1
 - Cross-Tenant Compare and Promotion v1
-- Localization v1
 - Private AI Execution Governance Foundation
 - External Support Desk / PSA Handoff
 - Compliance Light product layer
@@ -177,40 +182,39 @@ ## Open Gaps & Blockers
 
 | Gap | Type | Impact | Roadmap Area | Recommended Spec |
 |---|---|---|---|---|
-| Customer-safe review workspace is missing | Release blocker | Existing review and evidence assets cannot yet be consumed as a clear customer-facing surface | R2 completion / Tenant Reviews | P0 Customer Review Workspace v1 |
-| No consolidated operator decision inbox | UX blocker | Operators still move between findings, runs, alerts and portfolio surfaces to act | Findings Workflow / MSP Portfolio | P0 Decision-Based Governance Inbox v1 |
+| Decisioning still spans multiple repo-real inboxes | UX blocker | My Findings, Intake, Governance Inbox und Exception Queue sind real, aber Operators springen weiter zwischen mehreren Spezial-Surfaces und es gibt noch keinen portfolio-weiten Action-Layer | Findings Workflow / MSP Portfolio | P1 Governance Decision Surface Convergence |
 | Findings lifecycle backfill runtime surfaces remain productized | Cleanup blocker | Runbooks, commands, capabilities and tenant actions still expose a pre-production repair path that should not ship as product truth | Findings Workflow / Legacy Removal | P1 Remove Findings Lifecycle Backfill Runtime Surfaces |
 | Legacy `acknowledged` status compatibility still survives | Semantics blocker | Status helpers, filters, badges, capability aliases and tests keep non-canonical workflow semantics alive | Findings Workflow / RBAC | P1 Remove Legacy Acknowledged Finding Status Compatibility |
 | Creation-time finding invariants are implied but not explicitly protected | Integrity blocker | Future finding generators could regress into partial lifecycle writes and recreate the need for repair tooling | Findings Workflow / Data Integrity | P1 Enforce Creation-Time Finding Invariants |
 | Cross-tenant compare and promotion is not repo-proven | Release blocker | MSP portfolio story remains partial | MSP Portfolio & Operations | P1 Cross-Tenant Compare and Promotion v1 |
-| Localization foundation is absent | UX blocker | Product polish and DACH-readiness remain limited | R1.9 Platform Localization v1 | P1 Localization v1 |
 | Entitlements stop short of full commercial lifecycle | Commercialization blocker | Plan gating exists, but trial, grace and suspension semantics remain incomplete | Product Scalability & Self-Service Foundation | P2 Commercial Entitlements and Billing-State Maturity |
 | Support requests do not hand off to an external desk | Commercialization blocker | Support operations still depend on manual follow-through outside the product | R2 completion / Support | P2 External Support Desk / PSA Handoff |
 | AI governance foundation is absent | Architecture blocker | Future AI features would risk trust and policy drift if added directly | Private AI Execution & Usage Governance | P3 Private AI Execution Governance Foundation |
-| Roadmap understates current repo truth | Architecture blocker | Prioritization can drift because strategy docs lag implementation | Product planning / roadmap maintenance | none - docs alignment |
+| Roadmap understates current repo truth | Architecture blocker | Prioritization can drift because strategy docs still lag neuere Review-, Findings- und Localization-Surfaces | Product planning / roadmap maintenance | none - docs alignment |
 | Test files were not executed for this ledger update | Testing blocker | This document relies on code plus test presence, not live runtime validation | all areas | none - run targeted suites |
 
 ## Recommended Next Specs
 
-- `P0 Customer Review Workspace v1`: turns existing reviews, evidence and review-pack outputs into a customer-safe read-only product surface.
-- `P0 Decision-Based Governance Inbox v1`: consolidates existing findings, runs, alerts and triage signals into one operator work surface.
+- `P1 Governance Decision Surface Convergence`: verbindet My Findings, Intake, Governance Inbox, Customer Review Workspace und Exception Queue zu weniger Operator-Journeys und bereitet die Portfolio-Ebene vor.
 - `P1 Remove Findings Lifecycle Backfill Runtime Surfaces`: removes visible pre-production repair tooling from runbooks, commands, actions, capabilities and deploy/runtime hooks.
 - `P1 Remove Legacy Acknowledged Finding Status Compatibility`: collapses findings workflow semantics onto the canonical `triaged` model and removes stale RBAC/query aliases.
 - `P1 Enforce Creation-Time Finding Invariants`: proves that new findings are lifecycle-ready at write time so no repair backfill has to return later.
 - `P1 Cross-Tenant Compare and Promotion v1`: needed to move from portfolio visibility to portfolio action.
-- `P1 Localization v1`: still absent in repo and becomes more expensive the later it lands.
 - `P2 Commercial Entitlements and Billing-State Maturity`: extends the already real entitlement substrate into a usable commercial lifecycle.
 - `P2 External Support Desk / PSA Handoff`: extends support requests beyond internal persistence.
 - `P3 Private AI Execution Governance Foundation`: should exist before feature-level AI adoption, not after it.
 
 ## Roadmap Drift Notes
 
+- `roadmap.md` understates current R2 completion. Customer Review Workspace, published review handoff, review-pack downloads und der Finding-Exception-/Risk-Acceptance-Workflow sind bereits repo-real.
+- `roadmap.md` understates findings workflow maturity. My Findings, Intake, Governance Inbox und Exception Queue existieren bereits im Repo.
+- `roadmap.md` understates localization maturity. Locale resolution order, Workspace-Default, User-Praeferenz, lokalisierte Notifications und Fallback-Tests sind implementiert.
 - `roadmap.md` understates the current R2 control foundation. Canonical controls, stored reports, permission posture and Entra admin roles are already repo-real, not just near-term ideas.
 - `roadmap.md` understates product supportability. Support diagnostics, in-app support requests and contextual help already exist in the repo.
 - `roadmap.md` understates operational maturity. Product telemetry, customer health and operational controls are already implemented and wired into the system panel.
 - `roadmap.md` understates commercial foundations. A workspace entitlement resolver, plan profiles and enforcement points already exist, even though full billing-state maturity does not.
-- The roadmap is stronger at describing missing customer-facing consumption than missing backend foundations. Customer Review Workspace v1, Cross-Tenant Compare and Promotion, Localization and AI Governance still look genuinely unimplemented.
-- The main drift pattern is underestimation, not overestimation. The only place where optimism should still be resisted is customer-facing review maturity: internal review and evidence foundations are strong, but the repo does not yet prove a finished customer review workspace.
+- The roadmap is now better at describing still-missing portfolio- und commercial-Layer than the current state of review/findings/localization implementation. Cross-Tenant Compare and Promotion, full billing-state maturity, external PSA handoff and AI Governance still look genuinely unimplemented.
+- The main drift pattern is underestimation, not overestimation. Customer-facing review consumption is no longer the clearest missing piece; portfolio action and commercial lifecycle are.
 
 ## Evidence Sources
 
@@ -227,12 +231,19 @@ ## Evidence Sources
 - `apps/platform/app/Filament/Pages/TenantDashboard.php`
 - `apps/platform/app/Filament/System/Pages/Dashboard.php`
 - `apps/platform/app/Filament/Pages/TenantRequiredPermissions.php`
+- `apps/platform/app/Filament/Pages/Reviews/CustomerReviewWorkspace.php`
+- `apps/platform/app/Filament/Pages/Findings/MyFindingsInbox.php`
+- `apps/platform/app/Filament/Pages/Findings/FindingsIntakeQueue.php`
+- `apps/platform/app/Filament/Pages/Governance/GovernanceInbox.php`
+- `apps/platform/app/Filament/Pages/Monitoring/FindingExceptionsQueue.php`
 
 Wichtige Models:
 
 - `apps/platform/app/Models/OperationRun.php`
 - `apps/platform/app/Models/Finding.php`
 - `apps/platform/app/Models/FindingException.php`
+- `apps/platform/app/Models/FindingExceptionDecision.php`
+- `apps/platform/app/Models/FindingExceptionEvidenceReference.php`
 - `apps/platform/app/Models/BaselineProfile.php`
 - `apps/platform/app/Models/BaselineSnapshot.php`
 - `apps/platform/app/Models/EvidenceSnapshot.php`
@@ -251,6 +262,7 @@ ## Evidence Sources
 - `apps/platform/app/Services/Evidence/EvidenceSnapshotService.php`
 - `apps/platform/app/Services/Baselines/BaselineCompareService.php`
 - `apps/platform/app/Services/Alerts/AlertDispatchService.php`
+- `apps/platform/app/Services/Findings/FindingExceptionService.php`
 - `apps/platform/app/Jobs/ProviderConnectionHealthCheckJob.php`
 - `apps/platform/app/Services/Onboarding/OnboardingLifecycleService.php`
 - `apps/platform/app/Services/Entitlements/WorkspaceEntitlementResolver.php`
@@ -258,6 +270,7 @@ ## Evidence Sources
 - `apps/platform/app/Support/Governance/Controls/CanonicalControlCatalog.php`
 - `apps/platform/app/Services/Audit/WorkspaceAuditLogger.php`
 - `apps/platform/app/Services/Auth/CapabilityResolver.php`
+- `apps/platform/app/Services/Localization/LocaleResolver.php`
 
 Wichtige Test-Anker im Repo:
 
@@ -276,4 +289,4 @@ ## Evidence Sources
 
 ## Last Updated
 
-2026-04-27 on branch `248-private-ai-policy-foundation`
+2026-04-29 on branch `platform-dev`