Spec 197: standardize shared detail family contracts (#237)

## Summary
- standardize the shared verification report family across operation detail, onboarding, and tenant verification widget hosts
- standardize normalized settings and normalized diff family wrappers across policy, policy version, and finding detail hosts
- add parity and guard coverage plus the full Spec 197 artifacts, including recorded manual smoke evidence

## Testing
- focused Sail regression pack from `specs/197-shared-detail-contract/quickstart.md`
- local integrated-browser manual smoke for SC-197-003 and SC-197-004

Co-authored-by: Ahmed Darrazi <ahmed.darrazi@live.de>
Reviewed-on: #237

.github/agents/copilot-instructions.md

@@ -186,6 +186,8 @@ ## Active Technologies
 - PostgreSQL via existing `operation_runs.type`, `operation_runs.context`, `baseline_profiles.scope_jsonb`, `baseline_snapshot_items`, findings, evidence payloads, and current config-backed registries; no new top-level tables planned (204-platform-core-vocabulary-hardening)
 - PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Laravel Sail, existing `BaselineCompareService`, `CompareBaselineToTenantJob`, `CompareStrategyRegistry`, `IntuneCompareStrategy`, `CurrentStateHashResolver`, and current finding lifecycle services (205-compare-job-cleanup)
 - PostgreSQL via existing baseline snapshots, baseline snapshot items, inventory items, `operation_runs`, findings, and current run-context JSON; no new storage planned (205-compare-job-cleanup)
+- PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Tailwind CSS v4, existing `VerificationReportViewer`, `VerificationReportChangeIndicator`, `PolicyNormalizer`, `VersionDiff`, `DriftFindingDiffBuilder`, and `SettingsCatalogSettingsTable` (197-shared-detail-contract)
+- PostgreSQL unchanged; no new persistence, cache store, or durable UI artifact (197-shared-detail-contract)
 
 - PHP 8.4.15 (feat/005-bulk-operations)
 
@@ -220,8 +222,8 @@ ## Code Style
 PHP 8.4.15: Follow standard conventions
 
 ## Recent Changes
+- 197-shared-detail-contract: Added PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Tailwind CSS v4, existing `VerificationReportViewer`, `VerificationReportChangeIndicator`, `PolicyNormalizer`, `VersionDiff`, `DriftFindingDiffBuilder`, and `SettingsCatalogSettingsTable`
 - 205-compare-job-cleanup: Added PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Laravel Sail, existing `BaselineCompareService`, `CompareBaselineToTenantJob`, `CompareStrategyRegistry`, `IntuneCompareStrategy`, `CurrentStateHashResolver`, and current finding lifecycle services
 - 204-platform-core-vocabulary-hardening: Added PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Laravel Sail, existing `GovernanceSubjectTaxonomyRegistry`, `BaselineScope`, `CompareStrategyRegistry`, `OperationCatalog`, `OperationRunType`, `ReasonTranslator`, `ReasonResolutionEnvelope`, `ProviderReasonTranslator`, and current Filament monitoring or review surfaces
-- 203-baseline-compare-strategy: Added PHP 8.4.15 + Laravel 12, Filament v5, Livewire v4, Pest v4, Laravel Sail, existing `BaselineCompareService`, `CompareBaselineToTenantJob`, `SubjectResolver`, `CurrentStateHashResolver`, `DriftHasher`, `BaselineCompareSummaryAssessor`, and finding lifecycle services
 <!-- MANUAL ADDITIONS START -->
 <!-- MANUAL ADDITIONS END -->

apps/platform/app/Filament/Pages/Monitoring/EvidenceOverview.php

@@ -20,14 +20,25 @@
 use App\Support\Ui\GovernanceArtifactTruth\ArtifactTruthEnvelope;
 use App\Support\Ui\GovernanceArtifactTruth\ArtifactTruthPresenter;
 use App\Support\Workspaces\WorkspaceContext;
+use App\Support\Filament\TablePaginationProfiles;
 use BackedEnum;
 use Filament\Actions\Action;
 use Filament\Pages\Page;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Concerns\InteractsWithTable;
+use Filament\Tables\Contracts\HasTable;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
 use Illuminate\Auth\AuthenticationException;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
 use UnitEnum;
 
-class EvidenceOverview extends Page
+class EvidenceOverview extends Page implements HasTable
 {
+    use InteractsWithTable;
+
     protected static bool $isDiscovered = false;
 
     protected static bool $shouldRegisterNavigation = false;
@@ -45,7 +56,12 @@ class EvidenceOverview extends Page
      */
     public array $rows = [];
 
-    public ?int $tenantFilter = null;
+    /**
+     * @var array<int, Tenant>|null
+     */
+    private ?array $accessibleTenants = null;
+
+    private ?Collection $cachedSnapshots = null;
 
     public static function actionSurfaceDeclaration(): ActionSurfaceDeclaration
     {
@@ -59,85 +75,92 @@ public static function actionSurfaceDeclaration(): ActionSurfaceDeclaration
 
     public function mount(): void
     {
-        $user = auth()->user();
+        $this->authorizeWorkspaceAccess();
+        $this->seedTableStateFromQuery();
+        $this->rows = $this->rowsForState($this->tableFilters ?? [], $this->tableSearch)->values()->all();
 
-        if (! $user instanceof User) {
-            throw new AuthenticationException;
-        }
+        $this->mountInteractsWithTable();
+    }
 
-        $workspaceContext = app(WorkspaceContext::class);
-        $workspace = $workspaceContext->currentWorkspaceForMemberOrFail($user, request());
-        $workspaceId = (int) $workspace->getKey();
+    public function table(Table $table): Table
+    {
+        return $table
+            ->defaultSort('tenant_name')
+            ->defaultPaginationPageOption(25)
+            ->paginated(TablePaginationProfiles::customPage())
+            ->persistFiltersInSession()
+            ->persistSearchInSession()
+            ->persistSortInSession()
+            ->searchable()
+            ->searchPlaceholder('Search tenant or next step')
+            ->records(function (
+                ?string $sortColumn,
+                ?string $sortDirection,
+                ?string $search,
+                array $filters,
+                int $page,
+                int $recordsPerPage
+            ): LengthAwarePaginator {
+                $rows = $this->rowsForState($filters, $search);
+                $rows = $this->sortRows($rows, $sortColumn, $sortDirection);
 
-        $accessibleTenants = $user->tenants()
-            ->where('tenants.workspace_id', $workspaceId)
-            ->orderBy('tenants.name')
-            ->get()
-            ->filter(fn (Tenant $tenant): bool => (int) $tenant->workspace_id === $workspaceId && $user->can('evidence.view', $tenant))
-            ->values();
-
-        $this->tenantFilter = is_numeric(request()->query('tenant_id')) ? (int) request()->query('tenant_id') : null;
-
-        $tenantIds = $accessibleTenants->pluck('id')->map(static fn (mixed $id): int => (int) $id)->all();
-
-        $query = EvidenceSnapshot::query()
-            ->with('tenant')
-            ->where('workspace_id', $workspaceId)
-            ->whereIn('tenant_id', $tenantIds)
-            ->where('status', 'active')
-            ->latest('generated_at');
-
-        if ($this->tenantFilter !== null) {
-            $query->where('tenant_id', $this->tenantFilter);
-        }
-
-        $snapshots = $query->get()->unique('tenant_id')->values();
-        $currentReviewTenantIds = TenantReview::query()
-            ->where('workspace_id', $workspaceId)
-            ->whereIn('tenant_id', $snapshots->pluck('tenant_id')->map(static fn (mixed $tenantId): int => (int) $tenantId)->all())
-            ->whereIn('status', [
-                TenantReviewStatus::Draft->value,
-                TenantReviewStatus::Ready->value,
-                TenantReviewStatus::Published->value,
+                return $this->paginateRows($rows, $page, $recordsPerPage);
+            })
+            ->filters([
+                SelectFilter::make('tenant_id')
+                    ->label('Tenant')
+                    ->options(fn (): array => $this->tenantFilterOptions())
+                    ->searchable(),
             ])
-            ->pluck('tenant_id')
-            ->mapWithKeys(static fn (mixed $tenantId): array => [(int) $tenantId => true])
-            ->all();
-
-        $this->rows = $snapshots->map(function (EvidenceSnapshot $snapshot) use ($currentReviewTenantIds): array {
-            $truth = $this->snapshotTruth($snapshot);
-            $freshnessSpec = BadgeCatalog::spec(BadgeDomain::GovernanceArtifactFreshness, $truth->freshnessState);
-            $tenantId = (int) $snapshot->tenant_id;
-            $hasCurrentReview = $currentReviewTenantIds[$tenantId] ?? false;
-            $nextStep = ! $hasCurrentReview && $truth->contentState === 'trusted' && $truth->freshnessState === 'current'
-                ? 'Create a current review from this evidence snapshot'
-                : $truth->nextStepText();
-
-            return [
-                'tenant_name' => $snapshot->tenant?->name ?? 'Unknown tenant',
-                'tenant_id' => $tenantId,
-                'snapshot_id' => (int) $snapshot->getKey(),
-                'completeness_state' => (string) $snapshot->completeness_state,
-                'generated_at' => $snapshot->generated_at?->toDateTimeString(),
-                'missing_dimensions' => (int) (($snapshot->summary['missing_dimensions'] ?? 0)),
-                'stale_dimensions' => (int) (($snapshot->summary['stale_dimensions'] ?? 0)),
-                'artifact_truth' => [
-                    'label' => $truth->primaryLabel,
-                    'color' => $truth->primaryBadgeSpec()->color,
-                    'icon' => $truth->primaryBadgeSpec()->icon,
-                    'explanation' => $truth->primaryExplanation,
-                ],
-                'freshness' => [
-                    'label' => $freshnessSpec->label,
-                    'color' => $freshnessSpec->color,
-                    'icon' => $freshnessSpec->icon,
-                ],
-                'next_step' => $nextStep,
-                'view_url' => $snapshot->tenant
-                    ? EvidenceSnapshotResource::getUrl('view', ['record' => $snapshot], tenant: $snapshot->tenant)
-                    : null,
-            ];
-        })->all();
+            ->columns([
+                TextColumn::make('tenant_name')
+                    ->label('Tenant')
+                    ->sortable(),
+                TextColumn::make('artifact_truth_label')
+                    ->label('Artifact truth')
+                    ->badge()
+                    ->color(fn (array $record): string => (string) ($record['artifact_truth_color'] ?? 'gray'))
+                    ->icon(fn (array $record): ?string => is_string($record['artifact_truth_icon'] ?? null) ? $record['artifact_truth_icon'] : null)
+                    ->description(fn (array $record): ?string => is_string($record['artifact_truth_explanation'] ?? null) ? $record['artifact_truth_explanation'] : null)
+                    ->sortable()
+                    ->wrap(),
+                TextColumn::make('freshness_label')
+                    ->label('Freshness')
+                    ->badge()
+                    ->color(fn (array $record): string => (string) ($record['freshness_color'] ?? 'gray'))
+                    ->icon(fn (array $record): ?string => is_string($record['freshness_icon'] ?? null) ? $record['freshness_icon'] : null)
+                    ->sortable(),
+                TextColumn::make('generated_at')
+                    ->label('Generated')
+                    ->placeholder('—')
+                    ->sortable(),
+                TextColumn::make('missing_dimensions')
+                    ->label('Not collected yet')
+                    ->numeric()
+                    ->sortable(),
+                TextColumn::make('stale_dimensions')
+                    ->label('Refresh recommended')
+                    ->numeric()
+                    ->sortable(),
+                TextColumn::make('next_step')
+                    ->label('Next step')
+                    ->wrap(),
+            ])
+            ->recordUrl(fn ($record): ?string => is_array($record) ? (is_string($record['view_url'] ?? null) ? $record['view_url'] : null) : null)
+            ->actions([])
+            ->bulkActions([])
+            ->emptyStateHeading('No evidence snapshots in this scope')
+            ->emptyStateDescription(fn (): string => $this->hasActiveOverviewFilters()
+                ? 'Clear the current filters to return to the full workspace evidence overview.'
+                : 'Adjust filters or create a tenant snapshot to populate the workspace overview.')
+            ->emptyStateActions([
+                Action::make('clear_filters')
+                    ->label('Clear filters')
+                    ->icon('heroicon-o-x-mark')
+                    ->color('gray')
+                    ->visible(fn (): bool => $this->hasActiveOverviewFilters())
+                    ->action(fn (): mixed => $this->clearOverviewFilters()),
+            ]);
     }
 
     /**
@@ -149,11 +172,26 @@ protected function getHeaderActions(): array
             Action::make('clear_filters')
                 ->label('Clear filters')
                 ->color('gray')
-                ->visible(fn (): bool => $this->tenantFilter !== null)
-                ->url(route('admin.evidence.overview')),
+                ->visible(fn (): bool => $this->hasActiveOverviewFilters())
+                ->action(fn (): mixed => $this->clearOverviewFilters()),
         ];
     }
 
+    public function clearOverviewFilters(): void
+    {
+        $this->tableFilters = [
+            'tenant_id' => ['value' => null],
+        ];
+        $this->tableDeferredFilters = $this->tableFilters;
+        $this->tableSearch = '';
+        $this->rows = $this->rowsForState($this->tableFilters, $this->tableSearch)->values()->all();
+
+        session()->put($this->getTableFiltersSessionKey(), $this->tableFilters);
+        session()->put($this->getTableSearchSessionKey(), $this->tableSearch);
+
+        $this->resetPage();
+    }
+
     private function snapshotTruth(EvidenceSnapshot $snapshot, bool $fresh = false): ArtifactTruthEnvelope
     {
         $presenter = app(ArtifactTruthPresenter::class);
@@ -162,4 +200,290 @@ private function snapshotTruth(EvidenceSnapshot $snapshot, bool $fresh = false):
             ? $presenter->forEvidenceSnapshotFresh($snapshot)
             : $presenter->forEvidenceSnapshot($snapshot);
     }
+
+    private function authorizeWorkspaceAccess(): void
+    {
+        $user = auth()->user();
+
+        if (! $user instanceof User) {
+            throw new AuthenticationException;
+        }
+
+        app(WorkspaceContext::class)->currentWorkspaceForMemberOrFail($user, request());
+    }
+
+    /**
+     * @return array<int, Tenant>
+     */
+    private function accessibleTenants(): array
+    {
+        if (is_array($this->accessibleTenants)) {
+            return $this->accessibleTenants;
+        }
+
+        $user = auth()->user();
+
+        if (! $user instanceof User) {
+            return $this->accessibleTenants = [];
+        }
+
+        $workspaceId = $this->workspaceId();
+
+        return $this->accessibleTenants = $user->tenants()
+            ->where('tenants.workspace_id', $workspaceId)
+            ->orderBy('tenants.name')
+            ->get()
+            ->filter(fn (Tenant $tenant): bool => (int) $tenant->workspace_id === $workspaceId && $user->can('evidence.view', $tenant))
+            ->values()
+            ->all();
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function tenantFilterOptions(): array
+    {
+        return collect($this->accessibleTenants())
+            ->mapWithKeys(static fn (Tenant $tenant): array => [
+                (string) $tenant->getKey() => $tenant->name,
+            ])
+            ->all();
+    }
+
+    /**
+     * @param  array<string, mixed>  $filters
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function rowsForState(array $filters = [], ?string $search = null): Collection
+    {
+        $rows = $this->baseRows();
+        $tenantFilter = $this->normalizeTenantFilter($filters['tenant_id']['value'] ?? data_get($this->tableFilters, 'tenant_id.value'));
+        $normalizedSearch = Str::lower(trim((string) ($search ?? $this->tableSearch)));
+
+        if ($tenantFilter !== null) {
+            $rows = $rows->where('tenant_id', $tenantFilter);
+        }
+
+        if ($normalizedSearch === '') {
+            return $rows;
+        }
+
+        return $rows->filter(function (array $row) use ($normalizedSearch): bool {
+            $haystack = implode(' ', [
+                (string) ($row['tenant_name'] ?? ''),
+                (string) ($row['artifact_truth_label'] ?? ''),
+                (string) ($row['artifact_truth_explanation'] ?? ''),
+                (string) ($row['freshness_label'] ?? ''),
+                (string) ($row['next_step'] ?? ''),
+            ]);
+
+            return str_contains(Str::lower($haystack), $normalizedSearch);
+        });
+    }
+
+    /**
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function baseRows(): Collection
+    {
+        $snapshots = $this->latestAccessibleSnapshots();
+        $currentReviewTenantIds = $this->currentReviewTenantIds($snapshots);
+
+        return $snapshots->mapWithKeys(function (EvidenceSnapshot $snapshot) use ($currentReviewTenantIds): array {
+            return [(string) $snapshot->getKey() => $this->rowForSnapshot($snapshot, $currentReviewTenantIds)];
+        });
+    }
+
+    /**
+     * @return Collection<int, EvidenceSnapshot>
+     */
+    private function latestAccessibleSnapshots(): Collection
+    {
+        if ($this->cachedSnapshots instanceof Collection) {
+            return $this->cachedSnapshots;
+        }
+
+        $tenantIds = collect($this->accessibleTenants())
+            ->map(static fn (Tenant $tenant): int => (int) $tenant->getKey())
+            ->all();
+
+        $query = EvidenceSnapshot::query()
+            ->with('tenant')
+            ->where('workspace_id', $this->workspaceId())
+            ->where('status', 'active')
+            ->latest('generated_at');
+
+        if ($tenantIds === []) {
+            $query->whereRaw('1 = 0');
+        } else {
+            $query->whereIn('tenant_id', $tenantIds);
+        }
+
+        return $this->cachedSnapshots = $query->get()->unique('tenant_id')->values();
+    }
+
+    /**
+     * @param  Collection<int, EvidenceSnapshot>  $snapshots
+     * @return array<int, bool>
+     */
+    private function currentReviewTenantIds(Collection $snapshots): array
+    {
+        return TenantReview::query()
+            ->where('workspace_id', $this->workspaceId())
+            ->whereIn('tenant_id', $snapshots->pluck('tenant_id')->map(static fn (mixed $tenantId): int => (int) $tenantId)->all())
+            ->whereIn('status', [
+                TenantReviewStatus::Draft->value,
+                TenantReviewStatus::Ready->value,
+                TenantReviewStatus::Published->value,
+            ])
+            ->pluck('tenant_id')
+            ->mapWithKeys(static fn (mixed $tenantId): array => [(int) $tenantId => true])
+            ->all();
+    }
+
+    /**
+     * @param  array<int, bool>  $currentReviewTenantIds
+     * @return array<string, mixed>
+     */
+    private function rowForSnapshot(EvidenceSnapshot $snapshot, array $currentReviewTenantIds): array
+    {
+        $truth = $this->snapshotTruth($snapshot);
+        $freshnessSpec = BadgeCatalog::spec(BadgeDomain::GovernanceArtifactFreshness, $truth->freshnessState);
+        $tenantId = (int) $snapshot->tenant_id;
+        $hasCurrentReview = $currentReviewTenantIds[$tenantId] ?? false;
+        $nextStep = ! $hasCurrentReview && $truth->contentState === 'trusted' && $truth->freshnessState === 'current'
+            ? 'Create a current review from this evidence snapshot'
+            : $truth->nextStepText();
+
+        return [
+            'tenant_name' => $snapshot->tenant?->name ?? 'Unknown tenant',
+            'tenant_id' => $tenantId,
+            'snapshot_id' => (int) $snapshot->getKey(),
+            'generated_at' => $snapshot->generated_at?->toDateTimeString(),
+            'missing_dimensions' => (int) ($snapshot->summary['missing_dimensions'] ?? 0),
+            'stale_dimensions' => (int) ($snapshot->summary['stale_dimensions'] ?? 0),
+            'artifact_truth_label' => $truth->primaryLabel,
+            'artifact_truth_color' => $truth->primaryBadgeSpec()->color,
+            'artifact_truth_icon' => $truth->primaryBadgeSpec()->icon,
+            'artifact_truth_explanation' => $truth->primaryExplanation,
+            'artifact_truth' => [
+                'label' => $truth->primaryLabel,
+                'color' => $truth->primaryBadgeSpec()->color,
+                'icon' => $truth->primaryBadgeSpec()->icon,
+                'explanation' => $truth->primaryExplanation,
+            ],
+            'freshness_label' => $freshnessSpec->label,
+            'freshness_color' => $freshnessSpec->color,
+            'freshness_icon' => $freshnessSpec->icon,
+            'freshness' => [
+                'label' => $freshnessSpec->label,
+                'color' => $freshnessSpec->color,
+                'icon' => $freshnessSpec->icon,
+            ],
+            'next_step' => $nextStep,
+            'view_url' => $snapshot->tenant
+                ? EvidenceSnapshotResource::getUrl('view', ['record' => $snapshot], tenant: $snapshot->tenant)
+                : null,
+        ];
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function sortRows(Collection $rows, ?string $sortColumn, ?string $sortDirection): Collection
+    {
+        $sortColumn = in_array($sortColumn, ['tenant_name', 'artifact_truth_label', 'freshness_label', 'generated_at', 'missing_dimensions', 'stale_dimensions'], true)
+            ? $sortColumn
+            : 'tenant_name';
+        $descending = Str::lower((string) ($sortDirection ?? 'asc')) === 'desc';
+
+        $records = $rows->all();
+
+        uasort($records, static function (array $left, array $right) use ($sortColumn, $descending): int {
+            $comparison = in_array($sortColumn, ['missing_dimensions', 'stale_dimensions'], true)
+                ? ((int) ($left[$sortColumn] ?? 0)) <=> ((int) ($right[$sortColumn] ?? 0))
+                : strnatcasecmp((string) ($left[$sortColumn] ?? ''), (string) ($right[$sortColumn] ?? ''));
+
+            if ($comparison === 0) {
+                $comparison = strnatcasecmp((string) ($left['tenant_name'] ?? ''), (string) ($right['tenant_name'] ?? ''));
+            }
+
+            return $descending ? ($comparison * -1) : $comparison;
+        });
+
+        return collect($records);
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     */
+    private function paginateRows(Collection $rows, int $page, int $recordsPerPage): LengthAwarePaginator
+    {
+        return new LengthAwarePaginator(
+            items: $rows->forPage($page, $recordsPerPage),
+            total: $rows->count(),
+            perPage: $recordsPerPage,
+            currentPage: $page,
+        );
+    }
+
+    private function seedTableStateFromQuery(): void
+    {
+        $query = request()->query();
+
+        if (array_key_exists('search', $query)) {
+            $this->tableSearch = trim((string) request()->query('search', ''));
+        }
+
+        if (! array_key_exists('tenant_id', $query)) {
+            return;
+        }
+
+        $tenantFilter = $this->normalizeTenantFilter(request()->query('tenant_id'));
+
+        if ($tenantFilter === null) {
+            return;
+        }
+
+        $this->tableFilters = [
+            'tenant_id' => ['value' => (string) $tenantFilter],
+        ];
+        $this->tableDeferredFilters = $this->tableFilters;
+    }
+
+    private function normalizeTenantFilter(mixed $value): ?int
+    {
+        if (! is_numeric($value)) {
+            return null;
+        }
+
+        $requestedTenantId = (int) $value;
+        $allowedTenantIds = collect($this->accessibleTenants())
+            ->map(static fn (Tenant $tenant): int => (int) $tenant->getKey())
+            ->all();
+
+        return in_array($requestedTenantId, $allowedTenantIds, true)
+            ? $requestedTenantId
+            : null;
+    }
+
+    private function hasActiveOverviewFilters(): bool
+    {
+        return filled(data_get($this->tableFilters, 'tenant_id.value'))
+            || trim((string) $this->tableSearch) !== '';
+    }
+
+    private function workspaceId(): int
+    {
+        $user = auth()->user();
+
+        if (! $user instanceof User) {
+            throw new AuthenticationException;
+        }
+
+        return (int) app(WorkspaceContext::class)
+            ->currentWorkspaceForMemberOrFail($user, request())
+            ->getKey();
+    }
 }

apps/platform/app/Filament/Pages/TenantRequiredPermissions.php

@@ -10,16 +10,30 @@
 use App\Models\User;
 use App\Models\WorkspaceMembership;
 use App\Services\Intune\TenantRequiredPermissionsViewModelBuilder;
+use App\Support\Badges\BadgeDomain;
+use App\Support\Badges\BadgeRenderer;
+use App\Support\Filament\TablePaginationProfiles;
 use App\Support\Ui\ActionSurface\ActionSurfaceDeclaration;
 use App\Support\Ui\ActionSurface\Enums\ActionSurfaceProfile;
 use App\Support\Ui\ActionSurface\Enums\ActionSurfaceSlot;
 use App\Support\Workspaces\WorkspaceContext;
+use Filament\Actions\Action;
 use Filament\Pages\Page;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Concerns\InteractsWithTable;
+use Filament\Tables\Contracts\HasTable;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
 use Livewire\Attributes\Locked;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 
-class TenantRequiredPermissions extends Page
+class TenantRequiredPermissions extends Page implements HasTable
 {
+    use InteractsWithTable;
+
     protected static bool $isDiscovered = false;
 
     protected static bool $shouldRegisterNavigation = false;
@@ -40,25 +54,16 @@ public static function actionSurfaceDeclaration(): ActionSurfaceDeclaration
             ->satisfy(ActionSurfaceSlot::ListEmptyState, 'The inline permissions matrix provides purposeful no-data, all-clear, and no-matches states with verification or reset guidance.');
     }
 
-    public string $status = 'missing';
-
-    public string $type = 'all';
-
-    /**
-     * @var array<int, string>
-     */
-    public array $features = [];
-
-    public string $search = '';
-
-    /**
-     * @var array<string, mixed>
-     */
-    public array $viewModel = [];
-
     #[Locked]
     public ?int $scopedTenantId = null;
 
+    /**
+     * @var array<string, mixed>|null
+     */
+    private ?array $cachedViewModel = null;
+
+    private ?string $cachedViewModelStateKey = null;
+
     public static function canAccess(): bool
     {
         return static::hasScopedTenantAccess(static::resolveScopedTenant());
@@ -69,9 +74,9 @@ public function currentTenant(): ?Tenant
         return $this->trustedScopedTenant();
     }
 
-    public function mount(): void
+    public function mount(Tenant|string|null $tenant = null): void
     {
-        $tenant = static::resolveScopedTenant();
+        $tenant = static::resolveScopedTenant($tenant);
 
         if (! $tenant instanceof Tenant || ! static::hasScopedTenantAccess($tenant)) {
             abort(404);
@@ -81,109 +86,120 @@ public function mount(): void
         $this->heading = $tenant->getFilamentName();
         $this->subheading = 'Required permissions';
 
-        $queryFeatures = request()->query('features', $this->features);
-
-        $state = TenantRequiredPermissionsViewModelBuilder::normalizeFilterState([
-            'status' => request()->query('status', $this->status),
-            'type' => request()->query('type', $this->type),
-            'features' => is_array($queryFeatures) ? $queryFeatures : [],
-            'search' => request()->query('search', $this->search),
-        ]);
-
-        $this->status = $state['status'];
-        $this->type = $state['type'];
-        $this->features = $state['features'];
-        $this->search = $state['search'];
-
-        $this->refreshViewModel();
+        $this->seedTableStateFromQuery();
+        $this->mountInteractsWithTable();
     }
 
-    public function updatedStatus(): void
+    public function table(Table $table): Table
     {
-        $this->refreshViewModel();
+        return $table
+            ->defaultSort('sort_priority')
+            ->defaultPaginationPageOption(25)
+            ->paginated(TablePaginationProfiles::customPage())
+            ->persistFiltersInSession()
+            ->persistSearchInSession()
+            ->persistSortInSession()
+            ->searchable()
+            ->searchPlaceholder('Search permission key or description…')
+            ->records(function (
+                ?string $sortColumn,
+                ?string $sortDirection,
+                ?string $search,
+                array $filters,
+                int $page,
+                int $recordsPerPage
+            ): LengthAwarePaginator {
+                $state = $this->filterState(filters: $filters, search: $search);
+                $rows = $this->permissionRowsForState($state);
+                $rows = $this->sortPermissionRows($rows, $sortColumn, $sortDirection);
+
+                return $this->paginatePermissionRows($rows, $page, $recordsPerPage);
+            })
+            ->filters([
+                SelectFilter::make('status')
+                    ->label('Status')
+                    ->default('missing')
+                    ->options([
+                        'missing' => 'Missing',
+                        'present' => 'Present',
+                        'all' => 'All',
+                    ]),
+                SelectFilter::make('type')
+                    ->label('Type')
+                    ->default('all')
+                    ->options([
+                        'all' => 'All',
+                        'application' => 'Application',
+                        'delegated' => 'Delegated',
+                    ]),
+                SelectFilter::make('features')
+                    ->label('Features')
+                    ->multiple()
+                    ->options(fn (): array => $this->featureFilterOptions())
+                    ->searchable(),
+            ])
+            ->columns([
+                TextColumn::make('key')
+                    ->label('Permission')
+                    ->description(fn (array $record): ?string => is_string($record['description'] ?? null) ? $record['description'] : null)
+                    ->wrap()
+                    ->sortable(),
+                TextColumn::make('type_label')
+                    ->label('Type')
+                    ->badge()
+                    ->color('gray')
+                    ->sortable(),
+                TextColumn::make('status')
+                    ->label('Status')
+                    ->badge()
+                    ->formatStateUsing(BadgeRenderer::label(BadgeDomain::TenantPermissionStatus))
+                    ->color(BadgeRenderer::color(BadgeDomain::TenantPermissionStatus))
+                    ->icon(BadgeRenderer::icon(BadgeDomain::TenantPermissionStatus))
+                    ->iconColor(BadgeRenderer::iconColor(BadgeDomain::TenantPermissionStatus))
+                    ->sortable(),
+                TextColumn::make('features_label')
+                    ->label('Features')
+                    ->wrap()
+                    ->toggleable(),
+            ])
+            ->actions([])
+            ->bulkActions([])
+            ->emptyStateHeading(fn (): string => $this->permissionsEmptyStateHeading())
+            ->emptyStateDescription(fn (): string => $this->permissionsEmptyStateDescription())
+            ->emptyStateActions([
+                Action::make('clear_filters')
+                    ->label('Clear filters')
+                    ->icon('heroicon-o-x-mark')
+                    ->color('gray')
+                    ->visible(fn (): bool => $this->hasActivePermissionFilters())
+                    ->action(fn (): mixed => $this->clearPermissionFilters()),
+            ]);
     }
 
-    public function updatedType(): void
+    /**
+     * @return array<string, mixed>
+     */
+    public function viewModel(): array
     {
-        $this->refreshViewModel();
+        return $this->viewModelForState($this->filterState());
     }
 
-    public function updatedFeatures(): void
+    public function clearPermissionFilters(): void
     {
-        $this->refreshViewModel();
-    }
+        $this->tableFilters = [
+            'status' => ['value' => 'missing'],
+            'type' => ['value' => 'all'],
+            'features' => ['values' => []],
+        ];
+        $this->tableDeferredFilters = $this->tableFilters;
+        $this->tableSearch = '';
+        $this->cachedViewModel = null;
+        $this->cachedViewModelStateKey = null;
 
-    public function updatedSearch(): void
-    {
-        $this->refreshViewModel();
-    }
+        session()->put($this->getTableFiltersSessionKey(), $this->tableFilters);
+        session()->put($this->getTableSearchSessionKey(), $this->tableSearch);
 
-    public function applyFeatureFilter(string $feature): void
-    {
-        $feature = trim($feature);
-
-        if ($feature === '') {
-            return;
-        }
-
-        if (in_array($feature, $this->features, true)) {
-            $this->features = array_values(array_filter(
-                $this->features,
-                static fn (string $value): bool => $value !== $feature,
-            ));
-        } else {
-            $this->features[] = $feature;
-        }
-
-        $this->features = array_values(array_unique($this->features));
-
-        $this->refreshViewModel();
-    }
-
-    public function clearFeatureFilter(): void
-    {
-        $this->features = [];
-
-        $this->refreshViewModel();
-    }
-
-    public function resetFilters(): void
-    {
-        $this->status = 'missing';
-        $this->type = 'all';
-        $this->features = [];
-        $this->search = '';
-
-        $this->refreshViewModel();
-    }
-
-    private function refreshViewModel(): void
-    {
-        $tenant = $this->trustedScopedTenant();
-
-        if (! $tenant instanceof Tenant) {
-            $this->viewModel = [];
-
-            return;
-        }
-
-        $builder = app(TenantRequiredPermissionsViewModelBuilder::class);
-
-        $this->viewModel = $builder->build($tenant, [
-            'status' => $this->status,
-            'type' => $this->type,
-            'features' => $this->features,
-            'search' => $this->search,
-        ]);
-
-        $filters = $this->viewModel['filters'] ?? null;
-
-        if (is_array($filters)) {
-            $this->status = (string) ($filters['status'] ?? $this->status);
-            $this->type = (string) ($filters['type'] ?? $this->type);
-            $this->features = is_array($filters['features'] ?? null) ? $filters['features'] : $this->features;
-            $this->search = (string) ($filters['search'] ?? $this->search);
-        }
+        $this->resetPage();
     }
 
     public function reRunVerificationUrl(): string
@@ -208,8 +224,18 @@ public function manageProviderConnectionUrl(): ?string
         return ProviderConnectionResource::getUrl('index', ['tenant' => $tenant], panel: 'admin');
     }
 
-    protected static function resolveScopedTenant(): ?Tenant
+    protected static function resolveScopedTenant(Tenant|string|null $tenant = null): ?Tenant
     {
+        if ($tenant instanceof Tenant) {
+            return $tenant;
+        }
+
+        if (is_string($tenant) && $tenant !== '') {
+            return Tenant::query()
+                ->where('external_id', $tenant)
+                ->first();
+        }
+
         $routeTenant = request()->route('tenant');
 
         if ($routeTenant instanceof Tenant) {
@@ -222,6 +248,14 @@ protected static function resolveScopedTenant(): ?Tenant
                 ->first();
         }
 
+        $queryTenant = request()->query('tenant');
+
+        if (is_string($queryTenant) && $queryTenant !== '') {
+            return Tenant::query()
+                ->where('external_id', $queryTenant)
+                ->first();
+        }
+
         return null;
     }
 
@@ -293,4 +327,216 @@ private function trustedScopedTenant(): ?Tenant
             return null;
         }
     }
+
+    /**
+     * @param  array<string, mixed>  $filters
+     * @return array{status:'missing'|'present'|'all',type:'application'|'delegated'|'all',features:array<int, string>,search:string}
+     */
+    private function filterState(array $filters = [], ?string $search = null): array
+    {
+        return TenantRequiredPermissionsViewModelBuilder::normalizeFilterState([
+            'status' => $filters['status']['value'] ?? data_get($this->tableFilters, 'status.value'),
+            'type' => $filters['type']['value'] ?? data_get($this->tableFilters, 'type.value'),
+            'features' => $filters['features']['values'] ?? data_get($this->tableFilters, 'features.values', []),
+            'search' => $search ?? $this->tableSearch,
+        ]);
+    }
+
+    /**
+     * @param  array{status:'missing'|'present'|'all',type:'application'|'delegated'|'all',features:array<int, string>,search:string}  $state
+     * @return array<string, mixed>
+     */
+    private function viewModelForState(array $state): array
+    {
+        $tenant = $this->trustedScopedTenant();
+
+        if (! $tenant instanceof Tenant) {
+            return [];
+        }
+
+        $stateKey = json_encode([$tenant->getKey(), $state]);
+
+        if ($this->cachedViewModelStateKey === $stateKey && is_array($this->cachedViewModel)) {
+            return $this->cachedViewModel;
+        }
+
+        $builder = app(TenantRequiredPermissionsViewModelBuilder::class);
+
+        $this->cachedViewModelStateKey = $stateKey ?: null;
+        $this->cachedViewModel = $builder->build($tenant, $state);
+
+        return $this->cachedViewModel;
+    }
+
+    /**
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function permissionRowsForState(array $state): Collection
+    {
+        return collect($this->viewModelForState($state)['permissions'] ?? [])
+            ->filter(fn (mixed $row): bool => is_array($row) && is_string($row['key'] ?? null))
+            ->mapWithKeys(function (array $row): array {
+                $key = (string) $row['key'];
+
+                return [
+                    $key => [
+                        'key' => $key,
+                        'description' => is_string($row['description'] ?? null) ? $row['description'] : null,
+                        'type' => (string) ($row['type'] ?? 'application'),
+                        'type_label' => ($row['type'] ?? 'application') === 'delegated' ? 'Delegated' : 'Application',
+                        'status' => (string) ($row['status'] ?? 'missing'),
+                        'features_label' => implode(', ', array_filter((array) ($row['features'] ?? []), 'is_string')),
+                        'sort_priority' => $this->statusSortWeight((string) ($row['status'] ?? 'missing')),
+                    ],
+                ];
+            });
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function sortPermissionRows(Collection $rows, ?string $sortColumn, ?string $sortDirection): Collection
+    {
+        $sortColumn = in_array($sortColumn, ['sort_priority', 'key', 'type_label', 'status', 'features_label'], true)
+            ? $sortColumn
+            : 'sort_priority';
+        $descending = Str::lower((string) ($sortDirection ?? 'asc')) === 'desc';
+
+        $records = $rows->all();
+
+        uasort($records, static function (array $left, array $right) use ($sortColumn, $descending): int {
+            $comparison = match ($sortColumn) {
+                'sort_priority' => ((int) ($left['sort_priority'] ?? 0)) <=> ((int) ($right['sort_priority'] ?? 0)),
+                default => strnatcasecmp(
+                    (string) ($left[$sortColumn] ?? ''),
+                    (string) ($right[$sortColumn] ?? ''),
+                ),
+            };
+
+            if ($comparison === 0) {
+                $comparison = strnatcasecmp(
+                    (string) ($left['key'] ?? ''),
+                    (string) ($right['key'] ?? ''),
+                );
+            }
+
+            return $descending ? ($comparison * -1) : $comparison;
+        });
+
+        return collect($records);
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     */
+    private function paginatePermissionRows(Collection $rows, int $page, int $recordsPerPage): LengthAwarePaginator
+    {
+        return new LengthAwarePaginator(
+            items: $rows->forPage($page, $recordsPerPage),
+            total: $rows->count(),
+            perPage: $recordsPerPage,
+            currentPage: $page,
+        );
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    private function featureFilterOptions(): array
+    {
+        return collect(data_get($this->viewModelForState([
+            'status' => 'all',
+            'type' => 'all',
+            'features' => [],
+            'search' => '',
+        ]), 'overview.feature_impacts', []))
+            ->filter(fn (mixed $impact): bool => is_array($impact) && is_string($impact['feature'] ?? null))
+            ->mapWithKeys(fn (array $impact): array => [
+                (string) $impact['feature'] => (string) $impact['feature'],
+            ])
+            ->all();
+    }
+
+    private function permissionsEmptyStateHeading(): string
+    {
+        $viewModel = $this->viewModel();
+        $counts = is_array(data_get($viewModel, 'overview.counts')) ? data_get($viewModel, 'overview.counts') : [];
+        $state = $this->filterState();
+        $allPermissions = data_get($this->viewModelForState([
+            'status' => 'all',
+            'type' => 'all',
+            'features' => [],
+            'search' => '',
+        ]), 'permissions', []);
+
+        $missingTotal = (int) ($counts['missing_application'] ?? 0)
+            + (int) ($counts['missing_delegated'] ?? 0)
+            + (int) ($counts['error'] ?? 0);
+        $requiredTotal = $missingTotal + (int) ($counts['present'] ?? 0);
+
+        if (! is_array($allPermissions) || $allPermissions === []) {
+            return 'No permissions configured';
+        }
+
+        if ($state['status'] === 'missing' && $missingTotal === 0 && $state['type'] === 'all' && $state['features'] === [] && trim($state['search']) === '') {
+            return 'All required permissions are present';
+        }
+
+        return 'No matches';
+    }
+
+    private function permissionsEmptyStateDescription(): string
+    {
+        return match ($this->permissionsEmptyStateHeading()) {
+            'No permissions configured' => 'No required permissions are currently configured in config/intune_permissions.php.',
+            'All required permissions are present' => 'Switch Status to All if you want to review the full matrix.',
+            default => 'No permissions match the current filters.',
+        };
+    }
+
+    private function hasActivePermissionFilters(): bool
+    {
+        $state = $this->filterState();
+
+        return $state['status'] !== 'missing'
+            || $state['type'] !== 'all'
+            || $state['features'] !== []
+            || trim($state['search']) !== '';
+    }
+
+    private function seedTableStateFromQuery(): void
+    {
+        $query = request()->query();
+
+        if (! array_key_exists('status', $query) && ! array_key_exists('type', $query) && ! array_key_exists('features', $query) && ! array_key_exists('search', $query)) {
+            return;
+        }
+
+        $queryFeatures = request()->query('features', []);
+
+        $state = TenantRequiredPermissionsViewModelBuilder::normalizeFilterState([
+            'status' => request()->query('status', 'missing'),
+            'type' => request()->query('type', 'all'),
+            'features' => is_array($queryFeatures) ? $queryFeatures : [],
+            'search' => request()->query('search', ''),
+        ]);
+
+        $this->tableFilters = [
+            'status' => ['value' => $state['status']],
+            'type' => ['value' => $state['type']],
+            'features' => ['values' => $state['features']],
+        ];
+        $this->tableDeferredFilters = $this->tableFilters;
+        $this->tableSearch = $state['search'];
+    }
+
+    private function statusSortWeight(string $status): int
+    {
+        return match ($status) {
+            'missing' => 0,
+            'error' => 1,
+            default => 2,
+        };
+    }
 }

apps/platform/app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php

@@ -1760,6 +1760,8 @@ private function verificationReportViewData(): array
                 'previousRunUrl' => null,
                 'canAcknowledge' => false,
                 'acknowledgements' => [],
+                'surface' => [],
+                'redactionNotes' => [],
                 'assistVisibility' => $assistVisibility,
                 'assistActionName' => 'wizardVerificationRequiredPermissionsAssist',
                 'technicalDetailsActionName' => 'wizardVerificationTechnicalDetails',
@@ -1809,7 +1811,28 @@ private function verificationReportViewData(): array
         $targetScope = is_array($targetScope) ? $targetScope : [];
 
         $failures = is_array($run->failure_summary ?? null) ? $run->failure_summary : [];
-        $verificationReport = VerificationReportViewer::report($run);
+        $surface = VerificationReportViewer::surface($run, $acknowledgements, [
+            'hostKind' => 'onboarding_wizard',
+            'changeIndicator' => $changeIndicator,
+            'previousRunUrl' => $previousRunUrl,
+            'nextStepPlacement' => ($assistVisibility['is_visible'] ?? false) ? 'host_action_zone' : 'shared_zone',
+            'hostActions' => array_values(array_filter([
+                ($assistVisibility['is_visible'] ?? false)
+                    ? ['kind' => 'assist', 'label' => 'View required permissions', 'ownedByHost' => true]
+                    : null,
+                ['kind' => 'technical_details', 'label' => 'Technical details', 'ownedByHost' => true],
+                $canAcknowledge
+                    ? ['kind' => 'acknowledge', 'label' => 'Acknowledge', 'ownedByHost' => true]
+                    : null,
+            ])),
+            'hostVariation' => [
+                'ownsNoRunState' => true,
+                'ownsActiveState' => true,
+                'supportsAssist' => (bool) ($assistVisibility['is_visible'] ?? false),
+                'supportsAcknowledge' => $canAcknowledge,
+                'supportsTechnicalDetailsTrigger' => true,
+            ],
+        ]);
 
         return [
             'run' => [
@@ -1832,6 +1855,8 @@ private function verificationReportViewData(): array
             'previousRunUrl' => $previousRunUrl,
             'canAcknowledge' => $canAcknowledge,
             'acknowledgements' => $acknowledgements,
+            'surface' => $surface,
+            'redactionNotes' => VerificationReportViewer::redactionNotes($report),
             'assistVisibility' => $assistVisibility,
             'assistActionName' => 'wizardVerificationRequiredPermissionsAssist',
             'technicalDetailsActionName' => 'wizardVerificationTechnicalDetails',

apps/platform/app/Filament/Resources/FindingResource.php

@@ -5,6 +5,7 @@
 use App\Filament\Concerns\InteractsWithTenantOwnedRecords;
 use App\Filament\Concerns\ResolvesPanelTenantContext;
 use App\Filament\Resources\FindingResource\Pages;
+use App\Filament\Support\NormalizedDiffSurface;
 use App\Models\Finding;
 use App\Models\FindingException;
 use App\Models\PolicyVersion;
@@ -412,11 +413,6 @@ public static function infolist(Schema $schema): Schema
                 Section::make('Diff')
                     ->visible(fn (Finding $record): bool => $record->finding_type === Finding::FINDING_TYPE_DRIFT)
                     ->schema([
-                        TextEntry::make('diff_unavailable')
-                            ->label('')
-                            ->state(fn (Finding $record): string => static::driftDiffUnavailableMessage($record))
-                            ->visible(fn (Finding $record): bool => ! static::canRenderDriftDiff($record))
-                            ->columnSpanFull(),
                         ViewEntry::make('rbac_role_definition_diff')
                             ->label('')
                             ->view('filament.infolists.entries.rbac-role-definition-diff')
@@ -429,13 +425,13 @@ public static function infolist(Schema $schema): Schema
                             ->state(function (Finding $record): array {
                                 $tenant = static::resolveTenantContextForCurrentPanel();
                                 if (! $tenant) {
-                                    return static::unavailableDiffState('No tenant context');
+                                    return NormalizedDiffSurface::build(static::unavailableDiffState('No tenant context'), 'finding');
                                 }
 
                                 [$baselineVersion, $currentVersion] = static::resolveDriftDiffVersions($record, $tenant);
 
                                 if (! static::hasRequiredDiffVersions($record, $baselineVersion, $currentVersion)) {
-                                    return static::unavailableDiffState('Diff unavailable — referenced policy versions are missing.');
+                                    return NormalizedDiffSurface::build(static::unavailableDiffState('Diff unavailable — referenced policy versions are missing.'), 'finding');
                                 }
 
                                 $diff = app(DriftFindingDiffBuilder::class)->buildSettingsDiff($baselineVersion, $currentVersion);
@@ -452,9 +448,9 @@ public static function infolist(Schema $schema): Schema
                                     );
                                 }
 
-                                return $diff;
+                                return NormalizedDiffSurface::build($diff, 'finding');
                             })
-                            ->visible(fn (Finding $record): bool => static::canRenderDriftDiff($record) && Arr::get($record->evidence_jsonb ?? [], 'summary.kind') === 'policy_snapshot')
+                            ->visible(fn (Finding $record): bool => Arr::get($record->evidence_jsonb ?? [], 'summary.kind') === 'policy_snapshot')
                             ->columnSpanFull(),
 
                         ViewEntry::make('scope_tags_diff')

apps/platform/app/Filament/Resources/InventoryItemResource.php

@@ -10,14 +10,11 @@
 use App\Models\Tenant;
 use App\Models\User;
 use App\Services\Auth\CapabilityResolver;
-use App\Services\Inventory\DependencyQueryService;
-use App\Services\Inventory\DependencyTargets\DependencyTargetResolver;
 use App\Support\Auth\Capabilities;
 use App\Support\Badges\BadgeDomain;
 use App\Support\Badges\BadgeRenderer;
 use App\Support\Badges\TagBadgeDomain;
 use App\Support\Badges\TagBadgeRenderer;
-use App\Support\Enums\RelationshipType;
 use App\Support\Filament\FilterOptionCatalog;
 use App\Support\Inventory\InventoryPolicyTypeMeta;
 use App\Support\Ui\ActionSurface\ActionSurfaceDeclaration;
@@ -179,29 +176,6 @@ public static function infolist(Schema $schema): Schema
                         ViewEntry::make('dependencies')
                             ->label('')
                             ->view('filament.components.dependency-edges')
-                            ->state(function (InventoryItem $record) {
-                                $direction = request()->query('direction', 'all');
-                                $relationshipType = request()->query('relationship_type', 'all');
-                                $relationshipType = is_string($relationshipType) ? $relationshipType : 'all';
-
-                                $relationshipType = $relationshipType === 'all'
-                                    ? null
-                                    : RelationshipType::tryFrom($relationshipType)?->value;
-
-                                $service = app(DependencyQueryService::class);
-                                $resolver = app(DependencyTargetResolver::class);
-                                $tenant = static::resolveTenantContextForCurrentPanel();
-
-                                $edges = collect();
-                                if ($direction === 'inbound' || $direction === 'all') {
-                                    $edges = $edges->merge($service->getInboundEdges($record, $relationshipType));
-                                }
-                                if ($direction === 'outbound' || $direction === 'all') {
-                                    $edges = $edges->merge($service->getOutboundEdges($record, $relationshipType));
-                                }
-
-                                return $resolver->attachRenderedTargets($edges->take(100), $tenant); // both directions combined
-                            })
                             ->columnSpanFull(),
                     ])
                     ->columnSpanFull(),

apps/platform/app/Filament/Resources/OperationRunResource.php

@@ -1178,6 +1178,18 @@ private static function verificationReportViewData(OperationRun $record): array
             'changeIndicator' => $changeIndicator,
             'previousRunUrl' => $previousRunUrl,
             'acknowledgements' => $acknowledgements,
+            'surface' => VerificationReportViewer::surface($record, $acknowledgements, [
+                'hostKind' => 'operation_run_detail',
+                'changeIndicator' => $changeIndicator,
+                'previousRunUrl' => $previousRunUrl,
+                'hostVariation' => [
+                    'ownsNoRunState' => false,
+                    'ownsActiveState' => false,
+                    'supportsAssist' => false,
+                    'supportsAcknowledge' => false,
+                    'supportsTechnicalDetailsTrigger' => false,
+                ],
+            ]),
             'redactionNotes' => VerificationReportViewer::redactionNotes($report),
         ];
     }

apps/platform/app/Filament/Resources/PolicyResource.php

@@ -7,6 +7,7 @@
 use App\Filament\Concerns\ScopesGlobalSearchToTenant;
 use App\Filament\Resources\PolicyResource\Pages;
 use App\Filament\Resources\PolicyResource\RelationManagers\VersionsRelationManager;
+use App\Filament\Support\NormalizedSettingsSurface;
 use App\Jobs\BulkPolicyDeleteJob;
 use App\Jobs\BulkPolicyExportJob;
 use App\Jobs\BulkPolicyUnignoreJob;
@@ -238,25 +239,13 @@ public static function infolist(Schema $schema): Schema
                         Tab::make('Settings')
                             ->id('settings')
                             ->schema([
-                                ViewEntry::make('settings_catalog')
+                                ViewEntry::make('settings')
                                     ->label('')
                                     ->view('filament.infolists.entries.normalized-settings')
                                     ->state(function (Policy $record) {
-                                        return static::settingsTabState($record);
+                                        return NormalizedSettingsSurface::build(static::settingsTabState($record), 'policy');
                                     })
-                                    ->visible(fn (Policy $record) => static::hasSettingsTable($record) &&
-                                        $record->versions()->exists()
-                                    ),
-
-                                ViewEntry::make('settings_standard')
-                                    ->label('')
-                                    ->view('filament.infolists.entries.policy-settings-standard')
-                                    ->state(function (Policy $record) {
-                                        return static::settingsTabState($record);
-                                    })
-                                    ->visible(fn (Policy $record) => ! static::hasSettingsTable($record) &&
-                                        $record->versions()->exists()
-                                    ),
+                                    ->visible(fn (Policy $record) => $record->versions()->exists()),
 
                                 TextEntry::make('no_settings_available')
                                     ->label('Settings')
@@ -301,16 +290,7 @@ public static function infolist(Schema $schema): Schema
                             ->label('')
                             ->view('filament.infolists.entries.normalized-settings')
                             ->state(function (Policy $record) {
-                                $normalized = app(PolicyNormalizer::class)->normalize(
-                                    static::latestSnapshot($record),
-                                    $record->policy_type ?? '',
-                                    $record->platform
-                                );
-
-                                $normalized['context'] = 'policy';
-                                $normalized['record_id'] = (string) $record->getKey();
-
-                                return $normalized;
+                                return NormalizedSettingsSurface::build(static::settingsTabState($record), 'policy');
                             }),
                     ])
                     ->columnSpanFull()

apps/platform/app/Filament/Resources/PolicyVersionResource.php

@@ -6,6 +6,8 @@
 use App\Filament\Concerns\ResolvesPanelTenantContext;
 use App\Filament\Concerns\ScopesGlobalSearchToTenant;
 use App\Filament\Resources\PolicyVersionResource\Pages;
+use App\Filament\Support\NormalizedDiffSurface;
+use App\Filament\Support\NormalizedSettingsSurface;
 use App\Jobs\BulkPolicyVersionForceDeleteJob;
 use App\Jobs\BulkPolicyVersionPruneJob;
 use App\Jobs\BulkPolicyVersionRestoreJob;
@@ -180,7 +182,7 @@ public static function infolist(Schema $schema): Schema
                         Tab::make('Normalized settings')
                             ->id('normalized-settings')
                             ->schema([
-                                Infolists\Components\ViewEntry::make('normalized_settings_catalog')
+                                Infolists\Components\ViewEntry::make('normalized_settings')
                                     ->view('filament.infolists.entries.normalized-settings')
                                     ->state(function (PolicyVersion $record) {
                                         $normalized = app(PolicyNormalizer::class)->normalize(
@@ -189,29 +191,12 @@ public static function infolist(Schema $schema): Schema
                                             $record->platform
                                         );
 
-                                        $normalized['context'] = 'version';
-                                        $normalized['record_id'] = (string) $record->getKey();
-
-                                        return $normalized;
-                                    })
-                                    ->visible(fn (PolicyVersion $record) => in_array($record->policy_type, ['settingsCatalogPolicy', 'endpointSecurityPolicy', 'securityBaselinePolicy'], true)),
-
-                                Infolists\Components\ViewEntry::make('normalized_settings_standard')
-                                    ->view('filament.infolists.entries.policy-settings-standard')
-                                    ->state(function (PolicyVersion $record) {
-                                        $normalized = app(PolicyNormalizer::class)->normalize(
-                                            is_array($record->snapshot) ? $record->snapshot : [],
-                                            $record->policy_type ?? '',
-                                            $record->platform
-                                        );
-
                                         $normalized['context'] = 'version';
                                         $normalized['record_id'] = (string) $record->getKey();
                                         $normalized['policy_type'] = $record->policy_type;
 
-                                        return $normalized;
-                                    })
-                                    ->visible(fn (PolicyVersion $record) => ! in_array($record->policy_type, ['settingsCatalogPolicy', 'endpointSecurityPolicy', 'securityBaselinePolicy'], true)),
+                                        return NormalizedSettingsSurface::build($normalized, 'policy_version');
+                                    }),
                             ]),
                         Tab::make('Raw JSON')
                             ->id('raw-json')
@@ -238,7 +223,7 @@ public static function infolist(Schema $schema): Schema
                                         $result = $diff->compare($from, $to);
                                         $result['policy_type'] = $record->policy_type;
 
-                                        return $result;
+                                        return NormalizedDiffSurface::build($result, 'policy_version');
                                     }),
                                 Infolists\Components\ViewEntry::make('diff_json')
                                     ->label('Raw diff (advanced)')

apps/platform/app/Filament/Support/NormalizedDiffSurface.php

@@ -0,0 +1,155 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Support;
+
+final class NormalizedDiffSurface
+{
+    /**
+     * @param  array<string, mixed>  $diff
+     * @return array<string, mixed>
+     */
+    public static function build(array $diff, string $hostKind): array
+    {
+        $summary = is_array($diff['summary'] ?? null) ? $diff['summary'] : [];
+        $added = is_array($diff['added'] ?? null) ? $diff['added'] : [];
+        $removed = is_array($diff['removed'] ?? null) ? $diff['removed'] : [];
+        $changed = is_array($diff['changed'] ?? null) ? $diff['changed'] : [];
+        $message = is_string($summary['message'] ?? null) && trim((string) $summary['message']) !== ''
+            ? trim((string) $summary['message'])
+            : null;
+
+        $addedCount = is_numeric($summary['added'] ?? null) ? (int) $summary['added'] : count($added);
+        $removedCount = is_numeric($summary['removed'] ?? null) ? (int) $summary['removed'] : count($removed);
+        $changedCount = is_numeric($summary['changed'] ?? null) ? (int) $summary['changed'] : count($changed);
+        $availabilityState = self::availabilityState($message, $addedCount, $removedCount, $changedCount);
+
+        return [
+            'hostKind' => $hostKind,
+            'availabilityState' => $availabilityState,
+            'summary' => [
+                'added' => $addedCount,
+                'removed' => $removedCount,
+                'changed' => $changedCount,
+                'message' => $message,
+            ],
+            'viewModes' => [
+                ['key' => 'grouped', 'label' => 'Grouped diff', 'default' => true],
+            ],
+            'sectionBehavior' => [
+                'preservesGroupOrder' => true,
+                'supportsExpansion' => true,
+                'supportsFullscreen' => true,
+            ],
+            'renderExpectations' => [
+                'ownsAvailabilityState' => true,
+                'ownsZeroDiffMessaging' => true,
+                'keepsHostFramingOutsideCore' => true,
+            ],
+            'groups' => [
+                self::group('changed', 'Changed', $changed, false),
+                self::group('added', 'Added', $added, true),
+                self::group('removed', 'Removed', $removed, true),
+            ],
+            'scriptRendering' => [
+                'policyType' => $diff['policy_type'] ?? null,
+                'showScriptContent' => (bool) config('tenantpilot.display.show_script_content', false),
+            ],
+            'emptyState' => self::emptyState($availabilityState, $message, $addedCount, $removedCount, $changedCount),
+            'raw' => [
+                'added' => $added,
+                'removed' => $removed,
+                'changed' => $changed,
+            ],
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $items
+     * @return array<string, mixed>
+     */
+    private static function group(string $key, string $label, array $items, bool $collapsed): array
+    {
+        return [
+            'key' => $key,
+            'label' => $label,
+            'collapsed' => $collapsed,
+            'count' => count($items),
+            'items' => self::groupByBlock($items),
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $items
+     * @return array<string, array<string, mixed>>
+     */
+    private static function groupByBlock(array $items): array
+    {
+        $groups = [];
+
+        foreach ($items as $path => $value) {
+            if (! is_string($path) || $path === '') {
+                continue;
+            }
+
+            $parts = explode(' > ', $path, 2);
+            $group = count($parts) === 2 ? $parts[0] : 'Other';
+            $label = count($parts) === 2 ? $parts[1] : $path;
+
+            $groups[$group][$label] = $value;
+        }
+
+        ksort($groups);
+
+        return $groups;
+    }
+
+    private static function availabilityState(?string $message, int $addedCount, int $removedCount, int $changedCount): string
+    {
+        if ($message !== null && str_contains(strtolower($message), 'unavailable')) {
+            return 'unavailable';
+        }
+
+        if ($message !== null && str_contains(strtolower($message), 'partial')) {
+            return 'partial';
+        }
+
+        return 'available';
+    }
+
+    /**
+     * @return array{title: string, message: string}|null
+     */
+    private static function emptyState(
+        string $availabilityState,
+        ?string $message,
+        int $addedCount,
+        int $removedCount,
+        int $changedCount,
+    ): ?array
+    {
+        if ($availabilityState === 'unavailable' && $message !== null) {
+            return [
+                'title' => 'Diff unavailable',
+                'message' => $message,
+            ];
+        }
+
+        if ($availabilityState === 'partial' && $message !== null) {
+            return [
+                'title' => 'Diff partially available',
+                'message' => $message,
+            ];
+        }
+
+        if ($availabilityState === 'available' && ($addedCount + $removedCount + $changedCount) === 0) {
+            return [
+                'title' => 'No normalized changes',
+                'message' => $message ?? 'No normalized changes were found.',
+            ];
+        }
+
+        return null;
+    }
+}

apps/platform/app/Filament/Support/NormalizedSettingsSurface.php

@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Filament\Support;
+
+final class NormalizedSettingsSurface
+{
+    /**
+     * @param  array<string, mixed>  $normalized
+     * @return array<string, mixed>
+     */
+    public static function build(array $normalized, string $hostKind): array
+    {
+        $warnings = collect($normalized['warnings'] ?? [])
+            ->filter(static fn (mixed $warning): bool => is_string($warning) && trim($warning) !== '')
+            ->map(static fn (string $warning): string => trim($warning))
+            ->values()
+            ->all();
+
+        $settingsTable = is_array($normalized['settings_table'] ?? null) ? $normalized['settings_table'] : null;
+        $settingsTableRows = is_array($settingsTable['rows'] ?? null) ? $settingsTable['rows'] : [];
+        $blocks = collect($normalized['settings'] ?? [])
+            ->filter(static fn (mixed $block): bool => is_array($block))
+            ->values()
+            ->all();
+
+        $context = is_string($normalized['context'] ?? null) && $normalized['context'] !== ''
+            ? (string) $normalized['context']
+            : 'policy';
+
+        $variant = $settingsTableRows !== [] ? 'settings_catalog_table' : 'standard_blocks';
+
+        return [
+            'hostKind' => $hostKind,
+            'context' => $context,
+            'variant' => $variant,
+            'warnings' => $warnings,
+            'settingsTable' => $settingsTableRows !== [] ? $settingsTable : null,
+            'blocks' => $blocks,
+            'sectionBehavior' => [
+                'preservesSectionOrder' => true,
+                'supportsExpansion' => true,
+                'ownsEmptyState' => true,
+            ],
+            'renderExpectations' => [
+                'ownsWarningsInWrapper' => true,
+                'ownsSubtypeDelegation' => true,
+                'keepsHostFramingOutsideCore' => true,
+            ],
+            'emptyState' => $settingsTableRows === [] && $blocks === []
+                ? [
+                    'title' => 'No settings available.',
+                    'message' => 'No normalized settings payload is available for this host.',
+                ]
+                : null,
+            'titlePolicy' => [
+                'showWrapperTitle' => false,
+            ],
+            'recordId' => $normalized['record_id'] ?? null,
+            'policyType' => $normalized['policy_type'] ?? null,
+        ];
+    }
+}

apps/platform/app/Filament/Support/VerificationReportViewer.php

@@ -5,6 +5,8 @@
 namespace App\Filament\Support;
 
 use App\Models\OperationRun;
+use App\Support\Badges\BadgeDomain;
+use App\Support\Badges\BadgeRenderer;
 use App\Support\RedactionIntegrity;
 use App\Support\Verification\VerificationReportFingerprint;
 use App\Support\Verification\VerificationReportSanitizer;
@@ -91,6 +93,276 @@ public static function shouldRenderForRun(OperationRun $run): bool
         return in_array((string) $run->type, ['provider.connection.check'], true);
     }
 
+    /**
+     * @param  array<string, array<string, mixed>>  $acknowledgements
+     * @param  array{
+     *     hostKind?: string,
+     *     changeIndicator?: array{state: string, previous_report_id: int}|null,
+     *     previousRunUrl?: string|null,
+     *     nextStepPlacement?: 'shared_zone'|'host_action_zone',
+     *     hostActions?: array<int, array{kind: string, label: string, ownedByHost: bool}>,
+     *     hostVariation?: array{
+     *         ownsNoRunState?: bool,
+     *         ownsActiveState?: bool,
+     *         supportsAssist?: bool,
+     *         supportsAcknowledge?: bool,
+     *         supportsTechnicalDetailsTrigger?: bool
+     *     },
+     *     optionalZones?: array<int, string>
+     * }  $options
+     * @return array<string, mixed>
+     */
+    public static function surface(OperationRun $run, array $acknowledgements = [], array $options = []): array
+    {
+        $report = self::report($run);
+        $summary = is_array($report['summary'] ?? null) ? $report['summary'] : [];
+        $counts = is_array($summary['counts'] ?? null) ? $summary['counts'] : [];
+        $groupedChecks = self::groupedChecks($report, $acknowledgements);
+        $changeIndicator = $options['changeIndicator'] ?? null;
+        $hostKind = is_string($options['hostKind'] ?? null) && $options['hostKind'] !== ''
+            ? (string) $options['hostKind']
+            : 'operation_run_detail';
+        $nextStepPlacement = ($options['nextStepPlacement'] ?? 'shared_zone') === 'host_action_zone'
+            ? 'host_action_zone'
+            : 'shared_zone';
+
+        $hostActions = collect($options['hostActions'] ?? [])
+            ->filter(static fn (mixed $action): bool => is_array($action))
+            ->map(static function (array $action): array {
+                $kind = is_string($action['kind'] ?? null) ? trim((string) $action['kind']) : 'navigation';
+                $label = is_string($action['label'] ?? null) ? trim((string) $action['label']) : 'Action';
+
+                return [
+                    'kind' => $kind !== '' ? $kind : 'navigation',
+                    'label' => $label !== '' ? $label : 'Action',
+                    'ownedByHost' => (bool) ($action['ownedByHost'] ?? true),
+                ];
+            })
+            ->values()
+            ->all();
+
+        $hostVariation = [
+            'ownsNoRunState' => (bool) (($options['hostVariation']['ownsNoRunState'] ?? false)),
+            'ownsActiveState' => (bool) (($options['hostVariation']['ownsActiveState'] ?? false)),
+            'supportsAssist' => (bool) (($options['hostVariation']['supportsAssist'] ?? false)),
+            'supportsAcknowledge' => (bool) (($options['hostVariation']['supportsAcknowledge'] ?? false)),
+            'supportsTechnicalDetailsTrigger' => (bool) (($options['hostVariation']['supportsTechnicalDetailsTrigger'] ?? false)),
+        ];
+
+        $optionalZones = collect($options['optionalZones'] ?? ['technical_details', 'change_indicator', 'previous_run_context'])
+            ->filter(static fn (mixed $zone): bool => is_string($zone) && trim($zone) !== '')
+            ->map(static fn (string $zone): string => trim($zone))
+            ->values()
+            ->all();
+
+        $overall = $summary['overall'] ?? null;
+        $overallSpec = BadgeRenderer::spec(BadgeDomain::VerificationReportOverall, $overall);
+
+        return [
+            'hostKind' => $hostKind,
+            'coreState' => $report === null ? 'unavailable' : 'completed',
+            'summary' => [
+                'overall' => $overall,
+                'overallLabel' => $overallSpec->label,
+                'counts' => [
+                    'total' => (int) ($counts['total'] ?? 0),
+                    'pass' => (int) ($counts['pass'] ?? 0),
+                    'fail' => (int) ($counts['fail'] ?? 0),
+                    'warn' => (int) ($counts['warn'] ?? 0),
+                    'skip' => (int) ($counts['skip'] ?? 0),
+                    'running' => (int) ($counts['running'] ?? 0),
+                ],
+                'changeIndicator' => is_array($changeIndicator) ? $changeIndicator : null,
+            ],
+            'issueGroups' => $groupedChecks['issueGroups'],
+            'passedChecks' => $groupedChecks['passedChecks'],
+            'diagnostics' => [
+                'hasTechnicalZone' => true,
+                'fingerprint' => is_array($report) ? self::fingerprint($report) : null,
+                'previousRunUrl' => is_string($options['previousRunUrl'] ?? null) && $options['previousRunUrl'] !== ''
+                    ? (string) $options['previousRunUrl']
+                    : null,
+                'operationRunId' => (int) $run->getKey(),
+                'flow' => (string) $run->type,
+                'completedAt' => $run->completed_at?->toJSON(),
+            ],
+            'viewZones' => [
+                ['key' => 'issues', 'label' => 'Issues', 'defaultVisible' => true],
+                ['key' => 'passed', 'label' => 'Passed', 'defaultVisible' => false],
+            ],
+            'nextSteps' => self::nextSteps($groupedChecks['issueGroups'], $nextStepPlacement),
+            'hostActions' => $hostActions,
+            'hostVariation' => $hostVariation,
+            'optionalZones' => $optionalZones,
+            'emptyState' => $report === null
+                ? [
+                    'title' => 'Verification report unavailable',
+                    'message' => 'This operation doesn’t have a report yet. If it is still running, refresh in a moment. If it already completed, start verification again.',
+                ]
+                : null,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>|null  $report
+     * @param  array<string, array<string, mixed>>  $acknowledgements
+     * @return array{issueGroups: array<int, array{label: string, checks: array<int, array<string, mixed>>, acknowledged?: bool}>, passedChecks: array<int, array<string, mixed>>}
+     */
+    private static function groupedChecks(?array $report, array $acknowledgements): array
+    {
+        $checks = is_array($report['checks'] ?? null) ? $report['checks'] : [];
+        $ackByKey = [];
+
+        foreach ($acknowledgements as $checkKey => $acknowledgement) {
+            if (! is_string($checkKey) || $checkKey === '' || ! is_array($acknowledgement)) {
+                continue;
+            }
+
+            $ackByKey[$checkKey] = $acknowledgement;
+        }
+
+        $blockers = [];
+        $failures = [];
+        $warnings = [];
+        $acknowledgedIssues = [];
+        $passed = [];
+
+        foreach ($checks as $check) {
+            if (! is_array($check)) {
+                continue;
+            }
+
+            $key = is_string($check['key'] ?? null) ? trim((string) $check['key']) : '';
+
+            if ($key === '') {
+                continue;
+            }
+
+            $status = is_string($check['status'] ?? null) ? strtolower(trim((string) $check['status'])) : '';
+            $blocking = (bool) ($check['blocking'] ?? false);
+            $normalizedCheck = self::normalizeCheck($check, $ackByKey[$key] ?? null);
+
+            if ($normalizedCheck['acknowledgement'] !== null) {
+                $acknowledgedIssues[] = $normalizedCheck;
+
+                continue;
+            }
+
+            if ($status === 'pass') {
+                $passed[] = $normalizedCheck;
+
+                continue;
+            }
+
+            if ($status === 'fail' && $blocking) {
+                $blockers[] = $normalizedCheck;
+
+                continue;
+            }
+
+            if ($status === 'fail') {
+                $failures[] = $normalizedCheck;
+
+                continue;
+            }
+
+            if ($status === 'warn') {
+                $warnings[] = $normalizedCheck;
+            }
+        }
+
+        $sortChecks = static fn (array $left, array $right): int => strcmp((string) ($left['key'] ?? ''), (string) ($right['key'] ?? ''));
+
+        usort($blockers, $sortChecks);
+        usort($failures, $sortChecks);
+        usort($warnings, $sortChecks);
+        usort($acknowledgedIssues, $sortChecks);
+        usort($passed, $sortChecks);
+
+        return [
+            'issueGroups' => array_values(array_filter([
+                ['label' => 'Blockers', 'checks' => $blockers],
+                ['label' => 'Failures', 'checks' => $failures],
+                ['label' => 'Warnings', 'checks' => $warnings],
+                ['label' => 'Acknowledged issues', 'checks' => $acknowledgedIssues, 'acknowledged' => true],
+            ], static fn (array $group): bool => ($group['checks'] ?? []) !== [])),
+            'passedChecks' => $passed,
+        ];
+    }
+
+    /**
+     * @param  array<string, mixed>  $check
+     * @param  array<string, mixed>|null  $acknowledgement
+     * @return array<string, mixed>
+     */
+    private static function normalizeCheck(array $check, ?array $acknowledgement): array
+    {
+        $nextSteps = collect($check['next_steps'] ?? [])
+            ->filter(static fn (mixed $step): bool => is_array($step))
+            ->map(static function (array $step): array {
+                $label = is_string($step['label'] ?? null) ? trim((string) $step['label']) : '';
+                $url = is_string($step['url'] ?? null) ? trim((string) $step['url']) : '';
+
+                return [
+                    'label' => $label,
+                    'url' => $url,
+                ];
+            })
+            ->filter(static fn (array $step): bool => $step['label'] !== '' && $step['url'] !== '')
+            ->values()
+            ->all();
+
+        return [
+            'key' => is_string($check['key'] ?? null) ? trim((string) $check['key']) : '',
+            'title' => is_string($check['title'] ?? null) && trim((string) $check['title']) !== ''
+                ? trim((string) $check['title'])
+                : 'Check',
+            'message' => is_string($check['message'] ?? null) && trim((string) $check['message']) !== ''
+                ? trim((string) $check['message'])
+                : null,
+            'status' => is_string($check['status'] ?? null) ? trim((string) $check['status']) : null,
+            'severity' => is_string($check['severity'] ?? null) ? trim((string) $check['severity']) : null,
+            'reason_code' => is_string($check['reason_code'] ?? null) ? trim((string) $check['reason_code']) : null,
+            'blocking' => (bool) ($check['blocking'] ?? false),
+            'next_steps' => $nextSteps,
+            'acknowledgement' => is_array($acknowledgement) ? $acknowledgement : null,
+        ];
+    }
+
+    /**
+     * @param  array<int, array{label: string, checks: array<int, array<string, mixed>>, acknowledged?: bool}>  $issueGroups
+     * @return array<int, array{label: string, placement: string, ownedByHost: bool, actionKind: string|null}>
+     */
+    private static function nextSteps(array $issueGroups, string $placement): array
+    {
+        $steps = [];
+
+        foreach ($issueGroups as $group) {
+            foreach ($group['checks'] as $check) {
+                foreach ($check['next_steps'] ?? [] as $step) {
+                    if (! is_array($step)) {
+                        continue;
+                    }
+
+                    $label = is_string($step['label'] ?? null) ? trim((string) $step['label']) : '';
+
+                    if ($label === '' || array_key_exists($label, $steps)) {
+                        continue;
+                    }
+
+                    $steps[$label] = [
+                        'label' => $label,
+                        'placement' => $placement,
+                        'ownedByHost' => $placement === 'host_action_zone',
+                        'actionKind' => $placement === 'host_action_zone' ? 'assist' : 'navigation',
+                    ];
+                }
+            }
+        }
+
+        return array_values($steps);
+    }
+
     /**
      * @param  array<string, mixed>|null  $report
      * @return array<int, string>

apps/platform/app/Filament/Widgets/Tenant/TenantVerificationReport.php

@@ -5,6 +5,7 @@
 namespace App\Filament\Widgets\Tenant;
 
 use App\Filament\Resources\TenantResource\Pages\ViewTenant;
+use App\Filament\Support\VerificationReportChangeIndicator;
 use App\Filament\Support\VerificationReportViewer;
 use App\Models\OperationRun;
 use App\Models\Tenant;
@@ -189,6 +190,12 @@ protected function getViewData(): array
         $report = $run instanceof OperationRun
             ? VerificationReportViewer::report($run)
             : null;
+        $changeIndicator = $run instanceof OperationRun
+            ? VerificationReportChangeIndicator::forRun($run)
+            : null;
+        $previousRunUrl = is_array($changeIndicator) && is_numeric($changeIndicator['previous_report_id'] ?? null)
+            ? OperationRunLinks::tenantlessView((int) $changeIndicator['previous_report_id'])
+            : null;
 
         $isInProgress = $run instanceof OperationRun
             && (string) $run->status !== OperationRunStatus::Completed->value;
@@ -230,6 +237,20 @@ protected function getViewData(): array
             'runData' => $runData,
             'runUrl' => $run instanceof OperationRun ? OperationRunLinks::tenantlessView($run) : null,
             'report' => $report,
+            'surface' => $run instanceof OperationRun
+                ? VerificationReportViewer::surface($run, [], [
+                    'hostKind' => 'tenant_widget',
+                    'changeIndicator' => $changeIndicator,
+                    'previousRunUrl' => $previousRunUrl,
+                    'hostVariation' => [
+                        'ownsNoRunState' => true,
+                        'ownsActiveState' => true,
+                        'supportsAssist' => false,
+                        'supportsAcknowledge' => false,
+                        'supportsTechnicalDetailsTrigger' => false,
+                    ],
+                ])
+                : [],
             'redactionNotes' => VerificationReportViewer::redactionNotes($report),
             'isInProgress' => $isInProgress,
             'showStartAction' => ! ($run instanceof OperationRun) && $isTenantMember && $canOperate,

apps/platform/app/Livewire/InventoryItemDependencyEdgesTable.php

@@ -0,0 +1,264 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Livewire;
+
+use App\Filament\Resources\InventoryItemResource;
+use App\Models\InventoryItem;
+use App\Models\Tenant;
+use App\Services\Inventory\DependencyQueryService;
+use App\Services\Inventory\DependencyTargets\DependencyTargetResolver;
+use App\Support\Enums\RelationshipType;
+use App\Support\Filament\TablePaginationProfiles;
+use Filament\Facades\Filament;
+use Filament\Tables\Columns\TextColumn;
+use Filament\Tables\Filters\SelectFilter;
+use Filament\Tables\Table;
+use Filament\Tables\TableComponent;
+use Illuminate\Contracts\View\View;
+use Illuminate\Pagination\LengthAwarePaginator;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Str;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+class InventoryItemDependencyEdgesTable extends TableComponent
+{
+    public int $inventoryItemId;
+
+    private ?InventoryItem $cachedInventoryItem = null;
+
+    public function mount(int $inventoryItemId): void
+    {
+        $this->inventoryItemId = $inventoryItemId;
+
+        $this->resolveInventoryItem();
+    }
+
+    public function table(Table $table): Table
+    {
+        return $table
+            ->queryStringIdentifier('inventoryItemDependencyEdges'.Str::studly((string) $this->inventoryItemId))
+            ->defaultSort('relationship_label')
+            ->defaultPaginationPageOption(10)
+            ->paginated(TablePaginationProfiles::picker())
+            ->striped()
+            ->deferLoading(! app()->runningUnitTests())
+            ->records(function (
+                ?string $sortColumn,
+                ?string $sortDirection,
+                ?string $search,
+                array $filters,
+                int $page,
+                int $recordsPerPage
+            ): LengthAwarePaginator {
+                $rows = $this->dependencyRows(
+                    direction: (string) ($filters['direction']['value'] ?? 'all'),
+                    relationshipType: $this->normalizeRelationshipType($filters['relationship_type']['value'] ?? null),
+                );
+
+                $rows = $this->sortRows($rows, $sortColumn, $sortDirection);
+
+                return $this->paginateRows($rows, $page, $recordsPerPage);
+            })
+            ->filters([
+                SelectFilter::make('direction')
+                    ->label('Direction')
+                    ->default('all')
+                    ->options([
+                        'all' => 'All',
+                        'inbound' => 'Inbound',
+                        'outbound' => 'Outbound',
+                    ]),
+                SelectFilter::make('relationship_type')
+                    ->label('Relationship')
+                    ->options([
+                        'all' => 'All',
+                        ...RelationshipType::options(),
+                    ])
+                    ->default('all')
+                    ->searchable(),
+            ])
+            ->columns([
+                TextColumn::make('relationship_label')
+                    ->label('Relationship')
+                    ->badge()
+                    ->sortable(),
+                TextColumn::make('target_label')
+                    ->label('Target')
+                    ->badge()
+                    ->url(fn (array $record): ?string => is_string($record['target_url'] ?? null) ? $record['target_url'] : null)
+                    ->tooltip(fn (array $record): ?string => is_string($record['target_tooltip'] ?? null) ? $record['target_tooltip'] : null)
+                    ->wrap(),
+                TextColumn::make('missing_state')
+                    ->label('Status')
+                    ->badge()
+                    ->placeholder('—')
+                    ->color(fn (?string $state): string => $state === 'Missing' ? 'danger' : 'gray')
+                    ->icon(fn (?string $state): ?string => $state === 'Missing' ? 'heroicon-m-exclamation-triangle' : null)
+                    ->description(fn (array $record): ?string => is_string($record['missing_hint'] ?? null) ? $record['missing_hint'] : null)
+                    ->wrap(),
+            ])
+            ->actions([])
+            ->bulkActions([])
+            ->emptyStateHeading('No dependencies found')
+            ->emptyStateDescription('Change direction or relationship filters to review a different dependency scope.');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.inventory-item-dependency-edges-table');
+    }
+
+    /**
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function dependencyRows(string $direction, ?string $relationshipType): Collection
+    {
+        $inventoryItem = $this->resolveInventoryItem();
+        $tenant = $this->resolveCurrentTenant();
+        $service = app(DependencyQueryService::class);
+        $resolver = app(DependencyTargetResolver::class);
+
+        $edges = collect();
+
+        if ($direction === 'inbound' || $direction === 'all') {
+            $edges = $edges->merge($service->getInboundEdges($inventoryItem, $relationshipType));
+        }
+
+        if ($direction === 'outbound' || $direction === 'all') {
+            $edges = $edges->merge($service->getOutboundEdges($inventoryItem, $relationshipType));
+        }
+
+        return $resolver->attachRenderedTargets($edges->take(100), $tenant)
+            ->map(function (array $edge): array {
+                $targetId = $edge['target_id'] ?? null;
+                $renderedTarget = is_array($edge['rendered_target'] ?? null) ? $edge['rendered_target'] : [];
+                $badgeText = is_string($renderedTarget['badge_text'] ?? null) ? $renderedTarget['badge_text'] : null;
+                $linkUrl = is_string($renderedTarget['link_url'] ?? null) ? $renderedTarget['link_url'] : null;
+                $lastKnownName = is_string(data_get($edge, 'metadata.last_known_name')) ? data_get($edge, 'metadata.last_known_name') : null;
+                $isMissing = ($edge['target_type'] ?? null) === 'missing';
+
+                $missingHint = null;
+
+                if ($isMissing) {
+                    $missingHint = 'Missing target';
+
+                    if (filled($lastKnownName)) {
+                        $missingHint .= ". Last known: {$lastKnownName}";
+                    }
+
+                    $rawRef = data_get($edge, 'metadata.raw_ref');
+                    $encodedRef = $rawRef !== null ? json_encode($rawRef) : null;
+
+                    if (is_string($encodedRef) && $encodedRef !== '') {
+                        $missingHint .= '. Ref: '.Str::limit($encodedRef, 200);
+                    }
+                }
+
+                $fallbackLabel = null;
+
+                if (filled($lastKnownName)) {
+                    $fallbackLabel = $lastKnownName;
+                } elseif (is_string($targetId) && $targetId !== '') {
+                    $fallbackLabel = 'ID: '.substr($targetId, 0, 6).'…';
+                } else {
+                    $fallbackLabel = 'External reference';
+                }
+
+                $relationshipType = (string) ($edge['relationship_type'] ?? 'unknown');
+
+                return [
+                    'id' => (string) ($edge['id'] ?? Str::uuid()->toString()),
+                    'relationship_label' => RelationshipType::options()[$relationshipType] ?? Str::headline($relationshipType),
+                    'target_label' => $badgeText ?? $fallbackLabel,
+                    'target_url' => $linkUrl,
+                    'target_tooltip' => is_string($targetId) ? $targetId : null,
+                    'missing_state' => $isMissing ? 'Missing' : null,
+                    'missing_hint' => $missingHint,
+                ];
+            })
+            ->mapWithKeys(fn (array $row): array => [$row['id'] => $row]);
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     * @return Collection<string, array<string, mixed>>
+     */
+    private function sortRows(Collection $rows, ?string $sortColumn, ?string $sortDirection): Collection
+    {
+        $sortColumn = in_array($sortColumn, ['relationship_label', 'target_label', 'missing_state'], true)
+            ? $sortColumn
+            : 'relationship_label';
+        $descending = Str::lower((string) ($sortDirection ?? 'asc')) === 'desc';
+
+        $records = $rows->all();
+
+        uasort($records, static function (array $left, array $right) use ($sortColumn, $descending): int {
+            $comparison = strnatcasecmp(
+                (string) ($left[$sortColumn] ?? ''),
+                (string) ($right[$sortColumn] ?? ''),
+            );
+
+            if ($comparison === 0) {
+                $comparison = strnatcasecmp(
+                    (string) ($left['target_label'] ?? ''),
+                    (string) ($right['target_label'] ?? ''),
+                );
+            }
+
+            return $descending ? ($comparison * -1) : $comparison;
+        });
+
+        return collect($records);
+    }
+
+    /**
+     * @param  Collection<string, array<string, mixed>>  $rows
+     */
+    private function paginateRows(Collection $rows, int $page, int $recordsPerPage): LengthAwarePaginator
+    {
+        return new LengthAwarePaginator(
+            items: $rows->forPage($page, $recordsPerPage),
+            total: $rows->count(),
+            perPage: $recordsPerPage,
+            currentPage: $page,
+        );
+    }
+
+    private function resolveInventoryItem(): InventoryItem
+    {
+        if ($this->cachedInventoryItem instanceof InventoryItem) {
+            return $this->cachedInventoryItem;
+        }
+
+        $inventoryItem = InventoryItem::query()->findOrFail($this->inventoryItemId);
+        $tenant = $this->resolveCurrentTenant();
+
+        if ((int) $inventoryItem->tenant_id !== (int) $tenant->getKey() || ! InventoryItemResource::canView($inventoryItem)) {
+            throw new NotFoundHttpException;
+        }
+
+        return $this->cachedInventoryItem = $inventoryItem;
+    }
+
+    private function resolveCurrentTenant(): Tenant
+    {
+        $tenant = Filament::getTenant();
+
+        if (! $tenant instanceof Tenant) {
+            throw new NotFoundHttpException;
+        }
+
+        return $tenant;
+    }
+
+    private function normalizeRelationshipType(mixed $value): ?string
+    {
+        if (! is_string($value) || $value === '' || $value === 'all') {
+            return null;
+        }
+
+        return RelationshipType::tryFrom($value)?->value;
+    }
+}

apps/platform/app/Services/Intune/TenantRequiredPermissionsViewModelBuilder.php

@@ -53,6 +53,8 @@ public function build(Tenant $tenant, array $filters = []): array
         $filteredPermissions = self::applyFilterState($allPermissions, $state);
         $freshness = self::deriveFreshness(self::parseLastRefreshedAt($comparison['last_refreshed_at'] ?? null));
 
+        $summaryPermissions = $filteredPermissions;
+
         return [
             'tenant' => [
                 'id' => (int) $tenant->getKey(),
@@ -60,9 +62,9 @@ public function build(Tenant $tenant, array $filters = []): array
                 'name' => (string) $tenant->name,
             ],
             'overview' => [
-                'overall' => self::deriveOverallStatus($allPermissions, (bool) ($freshness['is_stale'] ?? true)),
-                'counts' => self::deriveCounts($allPermissions),
-                'feature_impacts' => self::deriveFeatureImpacts($allPermissions),
+                'overall' => self::deriveOverallStatus($summaryPermissions, (bool) ($freshness['is_stale'] ?? true)),
+                'counts' => self::deriveCounts($summaryPermissions),
+                'feature_impacts' => self::deriveFeatureImpacts($summaryPermissions),
                 'freshness' => $freshness,
             ],
             'permissions' => $filteredPermissions,

apps/platform/resources/views/filament/components/dependency-edges.blade.php

@@ -1,85 +1,6 @@
-@php /** @var callable $getState */ @endphp
-
 <div class="space-y-4">
-    <form method="GET" class="flex items-center gap-2">
-        <label for="direction" class="text-sm text-gray-600">Direction</label>
-        <select id="direction" name="direction" class="fi-input fi-select">
-            <option value="all" {{ request('direction', 'all') === 'all' ? 'selected' : '' }}>All</option>
-            <option value="inbound" {{ request('direction') === 'inbound' ? 'selected' : '' }}>Inbound</option>
-            <option value="outbound" {{ request('direction') === 'outbound' ? 'selected' : '' }}>Outbound</option>
-        </select>
-
-        <label for="relationship_type" class="text-sm text-gray-600">Relationship</label>
-        <select id="relationship_type" name="relationship_type" class="fi-input fi-select">
-            <option value="all" {{ request('relationship_type', 'all') === 'all' ? 'selected' : '' }}>All</option>
-            @foreach (\App\Support\Enums\RelationshipType::options() as $value => $label)
-                <option value="{{ $value }}" {{ request('relationship_type') === $value ? 'selected' : '' }}>{{ $label }}</option>
-            @endforeach
-        </select>
-        <button type="submit" class="fi-btn">Apply</button>
-    </form>
-
-    @php
-        $raw = $getState();
-        $edges = $raw instanceof \Illuminate\Support\Collection ? $raw : collect($raw);
-    @endphp
-
-    @if ($edges->isEmpty())
-        <div class="text-sm text-gray-500">No dependencies found</div>
-    @else
-        <div class="divide-y">
-            @foreach ($edges->groupBy('relationship_type') as $type => $group)
-                <div class="py-2">
-                    <div class="text-xs uppercase tracking-wide text-gray-600 mb-2">{{ str_replace('_', ' ', $type) }}</div>
-                    <ul class="space-y-1">
-                        @foreach ($group as $edge)
-                            @php
-                                $isMissing = ($edge['target_type'] ?? null) === 'missing';
-                                $targetId = $edge['target_id'] ?? null;
-                                $rendered = $edge['rendered_target'] ?? [];
-                                $badgeText = is_array($rendered) ? ($rendered['badge_text'] ?? null) : null;
-                                $linkUrl = is_array($rendered) ? ($rendered['link_url'] ?? null) : null;
-
-                                $missingTitle = 'Missing target';
-                                $lastKnownName = $edge['metadata']['last_known_name'] ?? null;
-                                if (is_string($lastKnownName) && $lastKnownName !== '') {
-                                    $missingTitle .= ". Last known: {$lastKnownName}";
-                                }
-                                $rawRef = $edge['metadata']['raw_ref'] ?? null;
-                                if ($rawRef !== null) {
-                                    $encodedRef = json_encode($rawRef);
-                                    if (is_string($encodedRef) && $encodedRef !== '') {
-                                        $missingTitle .= '. Ref: '.\Illuminate\Support\Str::limit($encodedRef, 200);
-                                    }
-                                }
-
-                                $fallbackDisplay = null;
-                                if (is_string($lastKnownName) && $lastKnownName !== '') {
-                                    $fallbackDisplay = $lastKnownName;
-                                } elseif (is_string($targetId) && $targetId !== '') {
-                                    $fallbackDisplay = 'ID: '.substr($targetId, 0, 6).'…';
-                                } else {
-                                    $fallbackDisplay = 'External reference';
-                                }
-                            @endphp
-                            <li class="flex items-center gap-2 text-sm">
-                                @if (is_string($badgeText) && $badgeText !== '')
-                                    @if (is_string($linkUrl) && $linkUrl !== '')
-                                        <a class="fi-badge" href="{{ $linkUrl }}" title="{{ is_string($targetId) ? $targetId : '' }}">{{ $badgeText }}</a>
-                                    @else
-                                        <span class="fi-badge" title="{{ is_string($targetId) ? $targetId : '' }}">{{ $badgeText }}</span>
-                                    @endif
-                                @else
-                                    <span class="fi-badge" title="{{ is_string($targetId) ? $targetId : '' }}">{{ $fallbackDisplay }}</span>
-                                @endif
-                                @if ($isMissing)
-                                    <span class="fi-badge fi-badge-danger" title="{{ $missingTitle }}">Missing</span>
-                                @endif
-                            </li>
-                        @endforeach
-                    </ul>
-                </div>
-            @endforeach
-        </div>
-    @endif
+    <livewire:inventory-item-dependency-edges-table
+        :inventory-item-id="(int) $getRecord()->getKey()"
+        :key="'inventory-item-dependency-edges-'.$getRecord()->getKey()"
+    />
 </div>

apps/platform/resources/views/filament/components/verification-report-viewer.blade.php

@@ -1,108 +1,34 @@
 @php
-    $report = $report ?? null;
-    $report = is_array($report) ? $report : null;
-
-    $run = $run ?? null;
-    $run = is_array($run) ? $run : null;
-
-    $fingerprint = $fingerprint ?? null;
-    $fingerprint = is_string($fingerprint) && trim($fingerprint) !== '' ? trim($fingerprint) : null;
-
-    $changeIndicator = $changeIndicator ?? null;
-    $changeIndicator = is_array($changeIndicator) ? $changeIndicator : null;
-
-    $previousRunUrl = $previousRunUrl ?? null;
-    $previousRunUrl = is_string($previousRunUrl) && $previousRunUrl !== '' ? $previousRunUrl : null;
-
-    $acknowledgements = $acknowledgements ?? [];
-    $acknowledgements = is_array($acknowledgements) ? $acknowledgements : [];
-    $redactionNotes = $redactionNotes ?? [];
-    $redactionNotes = is_array($redactionNotes) ? array_values(array_filter($redactionNotes, 'is_string')) : [];
-
-    $summary = $report['summary'] ?? null;
-    $summary = is_array($summary) ? $summary : null;
-
-    $counts = is_array($summary['counts'] ?? null) ? $summary['counts'] : [];
-
-    $checks = $report['checks'] ?? null;
-    $checks = is_array($checks) ? $checks : [];
-
-    $ackByKey = [];
-
-    foreach ($acknowledgements as $checkKey => $ack) {
-        if (! is_string($checkKey) || $checkKey === '' || ! is_array($ack)) {
-            continue;
-        }
-
-        $ackByKey[$checkKey] = $ack;
-    }
-
-    $blockers = [];
-    $failures = [];
-    $warnings = [];
-    $acknowledgedIssues = [];
-    $passed = [];
-
-    foreach ($checks as $check) {
-        $check = is_array($check) ? $check : [];
-
-        $key = $check['key'] ?? null;
-        $key = is_string($key) ? trim($key) : '';
-
-        if ($key === '') {
-            continue;
-        }
-
-        $statusValue = $check['status'] ?? null;
-        $statusValue = is_string($statusValue) ? strtolower(trim($statusValue)) : '';
-
-        $blocking = $check['blocking'] ?? false;
-        $blocking = is_bool($blocking) ? $blocking : false;
-
-        if (array_key_exists($key, $ackByKey)) {
-            $acknowledgedIssues[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'pass') {
-            $passed[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'fail' && $blocking) {
-            $blockers[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'fail') {
-            $failures[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'warn') {
-            $warnings[] = $check;
-        }
-    }
-
-    $sortChecks = static function (array $a, array $b): int {
-        return strcmp((string) ($a['key'] ?? ''), (string) ($b['key'] ?? ''));
-    };
-
-    usort($blockers, $sortChecks);
-    usort($failures, $sortChecks);
-    usort($warnings, $sortChecks);
-    usort($acknowledgedIssues, $sortChecks);
-    usort($passed, $sortChecks);
+    $surface = is_array($surface ?? null) ? $surface : [];
+    $coreState = is_string($surface['coreState'] ?? null) ? (string) $surface['coreState'] : 'unavailable';
+    $redactionNotes = is_array($redactionNotes ?? null)
+        ? array_values(array_filter($redactionNotes, 'is_string'))
+        : [];
+    $canAcknowledge = (bool) ($canAcknowledge ?? false);
+    $ackAction = $ackAction ?? null;
+    $showAssist = (bool) ($showAssist ?? false);
+    $assistActionName = is_string($assistActionName ?? null) && trim((string) $assistActionName) !== ''
+        ? trim((string) $assistActionName)
+        : 'wizardVerificationRequiredPermissionsAssist';
+    $linkBehavior = $linkBehavior ?? app(\App\Support\Verification\VerificationLinkBehavior::class);
+    $emptyState = is_array($surface['emptyState'] ?? null) ? $surface['emptyState'] : null;
 @endphp
 
-<div class="space-y-4">
-    @if ($report === null || $summary === null)
-        <div class="rounded-lg border border-gray-200 bg-white p-4 text-sm text-gray-600 shadow-sm dark:border-gray-800 dark:bg-gray-900 dark:text-gray-300">
+<div
+    data-shared-detail-family="verification-report"
+    data-host-kind="{{ (string) ($surface['hostKind'] ?? 'operation_run_detail') }}"
+    class="space-y-4"
+>
+    @if ($coreState === 'unavailable')
+        <div
+            data-shared-zone="unavailable"
+            class="rounded-lg border border-gray-200 bg-white p-4 text-sm text-gray-600 shadow-sm dark:border-gray-800 dark:bg-gray-900 dark:text-gray-300"
+        >
             <div class="font-medium text-gray-900 dark:text-white">
-                Verification report unavailable
+                {{ $emptyState['title'] ?? 'Verification report unavailable' }}
             </div>
             <div class="mt-1">
-                This operation doesn’t have a report yet. If it’s still running, refresh in a moment. If it already completed, start verification again.
+                {{ $emptyState['message'] ?? 'This operation does not have a report yet.' }}
             </div>
             <div class="mt-2 text-xs text-gray-600 dark:text-gray-300">
                 <span class="font-semibold">Read-only:</span> this view uses stored data and makes no external calls.
@@ -117,68 +43,10 @@
             @endif
         </div>
     @else
-        @php
-            $overallSpec = \App\Support\Badges\BadgeRenderer::spec(
-                \App\Support\Badges\BadgeDomain::VerificationReportOverall,
-                $summary['overall'] ?? null,
-            );
-        @endphp
-
-        <div class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-            <div class="flex flex-wrap items-center gap-2">
-                <x-filament::badge :color="$overallSpec->color" :icon="$overallSpec->icon">
-                    {{ $overallSpec->label }}
-                </x-filament::badge>
-
-                <x-filament::badge color="gray">
-                    {{ (int) ($counts['total'] ?? 0) }} total
-                </x-filament::badge>
-                <x-filament::badge color="success">
-                    {{ (int) ($counts['pass'] ?? 0) }} pass
-                </x-filament::badge>
-                <x-filament::badge color="danger">
-                    {{ (int) ($counts['fail'] ?? 0) }} fail
-                </x-filament::badge>
-                <x-filament::badge color="warning">
-                    {{ (int) ($counts['warn'] ?? 0) }} warn
-                </x-filament::badge>
-                <x-filament::badge color="gray">
-                    {{ (int) ($counts['skip'] ?? 0) }} skip
-                </x-filament::badge>
-                <x-filament::badge color="info">
-                    {{ (int) ($counts['running'] ?? 0) }} running
-                </x-filament::badge>
-
-                @if ($changeIndicator !== null)
-                    @php
-                        $state = $changeIndicator['state'] ?? null;
-                        $state = is_string($state) ? $state : null;
-                    @endphp
-
-                    @if ($state === 'no_changes')
-                        <x-filament::badge color="success">
-                            No changes since previous verification
-                        </x-filament::badge>
-                    @elseif ($state === 'changed')
-                        <x-filament::badge color="warning">
-                            Changed since previous verification
-                        </x-filament::badge>
-                    @endif
-                @endif
-            </div>
-
-            <div class="mt-2 text-xs text-gray-600 dark:text-gray-300">
-                <span class="font-semibold">Read-only:</span> this view uses stored data and makes no external calls.
-            </div>
-
-            @if ($redactionNotes !== [])
-                <div class="mt-3 rounded-lg border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-900 dark:border-amber-500/30 dark:bg-amber-500/10 dark:text-amber-100">
-                    @foreach ($redactionNotes as $note)
-                        <div>{{ $note }}</div>
-                    @endforeach
-                </div>
-            @endif
-        </div>
+        @include('filament.components.verification-report.summary', [
+            'surface' => $surface,
+            'redactionNotes' => $redactionNotes,
+        ])
 
         <div x-data="{ tab: 'issues' }" class="space-y-4">
             <x-filament::tabs label="Verification report tabs">
@@ -196,313 +64,28 @@
                 >
                     Passed
                 </x-filament::tabs.item>
-                <x-filament::tabs.item
-                    :active="false"
-                    alpine-active="tab === 'technical'"
-                    x-on:click="tab = 'technical'"
-                >
-                    Technical details
-                </x-filament::tabs.item>
             </x-filament::tabs>
 
             <div x-show="tab === 'issues'">
-                @if ($blockers === [] && $failures === [] && $warnings === [] && $acknowledgedIssues === [])
-                    <div class="text-sm text-gray-700 dark:text-gray-200">
-                        No issues found in this report.
-                    </div>
-                @else
-                    <div class="space-y-3">
-                        @php
-                            $issueGroups = [
-                                ['label' => 'Blockers', 'checks' => $blockers],
-                                ['label' => 'Failures', 'checks' => $failures],
-                                ['label' => 'Warnings', 'checks' => $warnings],
-                            ];
-                        @endphp
-
-                        @foreach ($issueGroups as $group)
-                            @php
-                                $label = $group['label'];
-                                $groupChecks = $group['checks'];
-                            @endphp
-
-                            @if ($groupChecks !== [])
-                                <div class="space-y-2">
-                                    <div class="text-sm font-semibold text-gray-900 dark:text-white">
-                                        {{ $label }}
-                                    </div>
-
-                                    <div class="space-y-2">
-                                        @foreach ($groupChecks as $check)
-                                            @php
-                                                $check = is_array($check) ? $check : [];
-
-                                                $title = $check['title'] ?? 'Check';
-                                                $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                                $message = $check['message'] ?? null;
-                                                $message = is_string($message) && trim($message) !== '' ? trim($message) : null;
-
-                                                $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                    \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                                    $check['status'] ?? null,
-                                                );
-
-                                                $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                    \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
-                                                    $check['severity'] ?? null,
-                                                );
-
-                                                $nextSteps = $check['next_steps'] ?? [];
-                                                $nextSteps = is_array($nextSteps) ? array_slice($nextSteps, 0, 2) : [];
-
-                                                $blocking = $check['blocking'] ?? false;
-                                                $blocking = is_bool($blocking) ? $blocking : false;
-                                            @endphp
-
-                                            <div class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                                <div class="flex flex-wrap items-start justify-between gap-3">
-                                                    <div class="space-y-1">
-                                                        <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                            {{ $title }}
-                                                        </div>
-                                                        @if ($message)
-                                                            <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                                {{ $message }}
-                                                            </div>
-                                                        @endif
-                                                    </div>
-
-                                                    <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
-                                                        @if ($blocking)
-                                                            <x-filament::badge color="danger" size="sm">
-                                                                Blocker
-                                                            </x-filament::badge>
-                                                        @endif
-
-                                                        <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
-                                                            {{ $severitySpec->label }}
-                                                        </x-filament::badge>
-                                                        <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                            {{ $statusSpec->label }}
-                                                        </x-filament::badge>
-                                                    </div>
-                                                </div>
-
-                                                @if ($nextSteps !== [])
-                                                    <div class="mt-4">
-                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                                            Next steps
-                                                        </div>
-                                                        <ul class="mt-2 space-y-1 text-sm">
-                                                            @foreach ($nextSteps as $step)
-                                                                @php
-                                                                    $step = is_array($step) ? $step : [];
-                                                                    $label = $step['label'] ?? null;
-                                                                    $url = $step['url'] ?? null;
-                                                                    $isExternal = is_string($url) && (str_starts_with($url, 'http://') || str_starts_with($url, 'https://'));
-                                                                @endphp
-
-                                                                @if (is_string($label) && $label !== '' && is_string($url) && $url !== '')
-                                                                    <li>
-                                                                        <a
-                                                                            href="{{ $url }}"
-                                                                            class="text-primary-600 hover:underline dark:text-primary-400"
-                                                                            @if ($isExternal)
-                                                                                target="_blank" rel="noreferrer"
-                                                                            @endif
-                                                                        >
-                                                                            {{ $label }}
-                                                                        </a>
-                                                                    </li>
-                                                                @endif
-                                                            @endforeach
-                                                        </ul>
-                                                    </div>
-                                                @endif
-                                            </div>
-                                        @endforeach
-                                    </div>
-                                </div>
-                            @endif
-                        @endforeach
-
-                        @if ($acknowledgedIssues !== [])
-                            <details class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                <summary class="cursor-pointer text-sm font-semibold text-gray-900 dark:text-white">
-                                    Acknowledged issues
-                                </summary>
-
-                                <div class="mt-4 space-y-2">
-                                    @foreach ($acknowledgedIssues as $check)
-                                        @php
-                                            $check = is_array($check) ? $check : [];
-                                            $checkKey = is_string($check['key'] ?? null) ? trim((string) $check['key']) : '';
-
-                                            $title = $check['title'] ?? 'Check';
-                                            $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                            $message = $check['message'] ?? null;
-                                            $message = is_string($message) && trim($message) !== '' ? trim($message) : null;
-
-                                            $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                                $check['status'] ?? null,
-                                            );
-
-                                            $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
-                                                $check['severity'] ?? null,
-                                            );
-
-                                            $ack = $checkKey !== '' ? ($ackByKey[$checkKey] ?? null) : null;
-                                            $ack = is_array($ack) ? $ack : null;
-
-                                            $ackReason = $ack['ack_reason'] ?? null;
-                                            $ackReason = is_string($ackReason) && trim($ackReason) !== '' ? trim($ackReason) : null;
-
-                                            $ackAt = $ack['acknowledged_at'] ?? null;
-                                            $ackAt = is_string($ackAt) && trim($ackAt) !== '' ? trim($ackAt) : null;
-
-                                            $ackBy = $ack['acknowledged_by'] ?? null;
-                                            $ackBy = is_array($ackBy) ? $ackBy : null;
-
-                                            $ackByName = $ackBy['name'] ?? null;
-                                            $ackByName = is_string($ackByName) && trim($ackByName) !== '' ? trim($ackByName) : null;
-
-                                            $expiresAt = $ack['expires_at'] ?? null;
-                                            $expiresAt = is_string($expiresAt) && trim($expiresAt) !== '' ? trim($expiresAt) : null;
-                                        @endphp
-
-                                        <div class="rounded-lg border border-gray-100 bg-gray-50 p-4 dark:border-gray-800 dark:bg-gray-950">
-                                            <div class="flex flex-wrap items-start justify-between gap-3">
-                                                <div class="space-y-1">
-                                                    <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                        {{ $title }}
-                                                    </div>
-                                                    @if ($message)
-                                                        <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                            {{ $message }}
-                                                        </div>
-                                                    @endif
-                                                </div>
-
-                                                <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
-                                                    <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
-                                                        {{ $severitySpec->label }}
-                                                    </x-filament::badge>
-                                                    <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                        {{ $statusSpec->label }}
-                                                    </x-filament::badge>
-                                                </div>
-                                            </div>
-
-                                            @if ($ackReason || $ackAt || $ackByName || $expiresAt)
-                                                <div class="mt-3 space-y-1 text-sm text-gray-700 dark:text-gray-200">
-                                                    @if ($ackReason)
-                                                        <div>
-                                                            <span class="font-semibold">Reason:</span> {{ $ackReason }}
-                                                        </div>
-                                                    @endif
-                                                    @if ($ackByName || $ackAt)
-                                                        <div>
-                                                            <span class="font-semibold">Acknowledged:</span>
-                                                            @if ($ackByName)
-                                                                {{ $ackByName }}
-                                                            @endif
-                                                            @if ($ackAt)
-                                                                <span class="text-gray-500 dark:text-gray-400">({{ $ackAt }})</span>
-                                                            @endif
-                                                        </div>
-                                                    @endif
-                                                    @if ($expiresAt)
-                                                        <div>
-                                                            <span class="font-semibold">Expires:</span>
-                                                            <span class="text-gray-500 dark:text-gray-400">{{ $expiresAt }}</span>
-                                                        </div>
-                                                    @endif
-                                                </div>
-                                            @endif
-                                        </div>
-                                    @endforeach
-                                </div>
-                            </details>
-                        @endif
-                    </div>
-                @endif
+                @include('filament.components.verification-report.issues', [
+                    'surface' => $surface,
+                    'canAcknowledge' => $canAcknowledge,
+                    'ackAction' => $ackAction,
+                    'showAssist' => $showAssist,
+                    'assistActionName' => $assistActionName,
+                    'linkBehavior' => $linkBehavior,
+                ])
             </div>
 
             <div x-show="tab === 'passed'" style="display: none;">
-                @if ($passed === [])
-                    <div class="text-sm text-gray-600 dark:text-gray-300">
-                        No passing checks recorded.
-                    </div>
-                @else
-                    <div class="space-y-2">
-                        @foreach ($passed as $check)
-                            @php
-                                $check = is_array($check) ? $check : [];
-
-                                $title = $check['title'] ?? 'Check';
-                                $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                    \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                    $check['status'] ?? null,
-                                );
-                            @endphp
-
-                            <div class="flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white p-3 text-sm shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                <div class="font-medium text-gray-900 dark:text-white">
-                                    {{ $title }}
-                                </div>
-                                <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                    {{ $statusSpec->label }}
-                                </x-filament::badge>
-                            </div>
-                        @endforeach
-                    </div>
-                @endif
-            </div>
-
-            <div x-show="tab === 'technical'" style="display: none;">
-                <div class="space-y-4 text-sm text-gray-700 dark:text-gray-200">
-                    <div class="space-y-1">
-                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                            Identifiers
-                        </div>
-                        <div class="flex flex-col gap-1">
-                            @if ($run !== null)
-                                <div>
-                                    <span class="text-gray-500 dark:text-gray-400">Operation ID:</span>
-                                    <span class="font-mono">{{ (int) ($run['id'] ?? 0) }}</span>
-                                </div>
-                                <div>
-                                    <span class="text-gray-500 dark:text-gray-400">Flow:</span>
-                                    <span class="font-mono">{{ (string) ($run['type'] ?? '') }}</span>
-                                </div>
-                            @endif
-                            @if ($fingerprint)
-                                <div>
-                                    <span class="text-gray-500 dark:text-gray-400">Fingerprint:</span>
-                                    <span class="font-mono text-xs break-all">{{ $fingerprint }}</span>
-                                </div>
-                            @endif
-                        </div>
-                    </div>
-
-                    @if ($previousRunUrl !== null)
-                        <div>
-                            <a
-                                href="{{ $previousRunUrl }}"
-                                class="font-medium text-primary-600 hover:underline dark:text-primary-400"
-                            >
-                                Open previous operation
-                            </a>
-                        </div>
-                    @endif
-                </div>
+                @include('filament.components.verification-report.passed', [
+                    'surface' => $surface,
+                ])
             </div>
         </div>
+
+        @include('filament.components.verification-report.diagnostics', [
+            'surface' => $surface,
+        ])
     @endif
 </div>

apps/platform/resources/views/filament/components/verification-report/diagnostics.blade.php

@@ -0,0 +1,45 @@
+@php
+    $diagnostics = is_array($surface['diagnostics'] ?? null) ? $surface['diagnostics'] : [];
+@endphp
+
+<div
+    data-shared-zone="diagnostics"
+    class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900"
+>
+    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+        Diagnostics
+    </div>
+
+    <div class="mt-3 space-y-1 text-sm text-gray-700 dark:text-gray-200">
+        <div>
+            <span class="text-gray-500 dark:text-gray-400">Operation ID:</span>
+            <span class="font-mono">{{ (int) ($diagnostics['operationRunId'] ?? 0) }}</span>
+        </div>
+        <div>
+            <span class="text-gray-500 dark:text-gray-400">Flow:</span>
+            <span class="font-mono">{{ (string) ($diagnostics['flow'] ?? '') }}</span>
+        </div>
+        @if (filled($diagnostics['completedAt'] ?? null))
+            <div>
+                <span class="text-gray-500 dark:text-gray-400">Completed:</span>
+                <span>{{ $diagnostics['completedAt'] }}</span>
+            </div>
+        @endif
+        @if (filled($diagnostics['fingerprint'] ?? null))
+            <div>
+                <span class="text-gray-500 dark:text-gray-400">Fingerprint:</span>
+                <span class="font-mono text-xs break-all">{{ $diagnostics['fingerprint'] }}</span>
+            </div>
+        @endif
+        @if (filled($diagnostics['previousRunUrl'] ?? null))
+            <div>
+                <a
+                    href="{{ $diagnostics['previousRunUrl'] }}"
+                    class="font-medium text-primary-600 hover:underline dark:text-primary-400"
+                >
+                    Open previous operation
+                </a>
+            </div>
+        @endif
+    </div>
+</div>

apps/platform/resources/views/filament/components/verification-report/issues.blade.php

@@ -0,0 +1,226 @@
+@php
+    $issueGroups = collect($surface['issueGroups'] ?? [])
+        ->filter(static fn (mixed $group): bool => is_array($group))
+        ->values();
+    $canAcknowledge = (bool) ($canAcknowledge ?? false);
+    $ackAction = $ackAction ?? null;
+    $showAssist = (bool) ($showAssist ?? false);
+    $assistActionName = is_string($assistActionName ?? null) && trim((string) $assistActionName) !== ''
+        ? trim((string) $assistActionName)
+        : 'wizardVerificationRequiredPermissionsAssist';
+    $linkBehavior = $linkBehavior ?? app(\App\Support\Verification\VerificationLinkBehavior::class);
+@endphp
+
+<div data-shared-zone="issues">
+    @if ($issueGroups->isEmpty())
+        <div class="text-sm text-gray-700 dark:text-gray-200">
+            No issues found in this report.
+        </div>
+    @else
+        <div class="space-y-3">
+            @foreach ($issueGroups as $group)
+                @php
+                    $label = is_string($group['label'] ?? null) ? (string) $group['label'] : 'Issues';
+                    $checks = collect($group['checks'] ?? [])->filter(static fn (mixed $check): bool => is_array($check))->values();
+                    $acknowledged = (bool) ($group['acknowledged'] ?? false);
+                @endphp
+
+                @if ($acknowledged)
+                    <details class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
+                        <summary class="cursor-pointer text-sm font-semibold text-gray-900 dark:text-white">
+                            {{ $label }}
+                        </summary>
+
+                        <div class="mt-4 space-y-2">
+                            @foreach ($checks as $check)
+                                @php
+                                    $title = is_string($check['title'] ?? null) && trim((string) $check['title']) !== '' ? trim((string) $check['title']) : 'Check';
+                                    $message = is_string($check['message'] ?? null) && trim((string) $check['message']) !== '' ? trim((string) $check['message']) : null;
+                                    $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
+                                        \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
+                                        $check['status'] ?? null,
+                                    );
+                                    $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
+                                        \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
+                                        $check['severity'] ?? null,
+                                    );
+                                    $acknowledgement = is_array($check['acknowledgement'] ?? null) ? $check['acknowledgement'] : null;
+                                @endphp
+
+                                <div class="rounded-lg border border-gray-100 bg-gray-50 p-4 dark:border-gray-800 dark:bg-gray-950">
+                                    <div class="flex flex-wrap items-start justify-between gap-3">
+                                        <div class="space-y-1">
+                                            <div class="text-sm font-medium text-gray-900 dark:text-white">
+                                                {{ $title }}
+                                            </div>
+                                            @if ($message)
+                                                <div class="text-sm text-gray-600 dark:text-gray-300">
+                                                    {{ $message }}
+                                                </div>
+                                            @endif
+                                        </div>
+
+                                        <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
+                                            <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
+                                                {{ $severitySpec->label }}
+                                            </x-filament::badge>
+                                            <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
+                                                {{ $statusSpec->label }}
+                                            </x-filament::badge>
+                                        </div>
+                                    </div>
+
+                                    @if ($acknowledgement)
+                                        <div class="mt-3 space-y-1 text-sm text-gray-700 dark:text-gray-200">
+                                            @if (filled($acknowledgement['ack_reason'] ?? null))
+                                                <div>
+                                                    <span class="font-semibold">Reason:</span> {{ $acknowledgement['ack_reason'] }}
+                                                </div>
+                                            @endif
+                                            @if (filled($acknowledgement['acknowledged_by']['name'] ?? null) || filled($acknowledgement['acknowledged_at'] ?? null))
+                                                <div>
+                                                    <span class="font-semibold">Acknowledged:</span>
+                                                    @if (filled($acknowledgement['acknowledged_by']['name'] ?? null))
+                                                        {{ $acknowledgement['acknowledged_by']['name'] }}
+                                                    @endif
+                                                    @if (filled($acknowledgement['acknowledged_at'] ?? null))
+                                                        <span class="text-gray-500 dark:text-gray-400">({{ $acknowledgement['acknowledged_at'] }})</span>
+                                                    @endif
+                                                </div>
+                                            @endif
+                                            @if (filled($acknowledgement['expires_at'] ?? null))
+                                                <div>
+                                                    <span class="font-semibold">Expires:</span>
+                                                    <span class="text-gray-500 dark:text-gray-400">{{ $acknowledgement['expires_at'] }}</span>
+                                                </div>
+                                            @endif
+                                        </div>
+                                    @endif
+                                </div>
+                            @endforeach
+                        </div>
+                    </details>
+                @else
+                    <div class="space-y-2">
+                        <div class="text-sm font-semibold text-gray-900 dark:text-white">
+                            {{ $label }}
+                        </div>
+
+                        <div class="space-y-2">
+                            @foreach ($checks as $check)
+                                @php
+                                    $checkKey = is_string($check['key'] ?? null) ? trim((string) $check['key']) : '';
+                                    $title = is_string($check['title'] ?? null) && trim((string) $check['title']) !== '' ? trim((string) $check['title']) : 'Check';
+                                    $message = is_string($check['message'] ?? null) && trim((string) $check['message']) !== '' ? trim((string) $check['message']) : null;
+                                    $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
+                                        \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
+                                        $check['status'] ?? null,
+                                    );
+                                    $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
+                                        \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
+                                        $check['severity'] ?? null,
+                                    );
+                                    $nextSteps = collect($check['next_steps'] ?? [])->filter(static fn (mixed $step): bool => is_array($step))->take(2)->values();
+                                    $blocking = (bool) ($check['blocking'] ?? false);
+                                    $routeNextStepsThroughAssist = $linkBehavior->shouldRouteThroughAssist($check, $showAssist);
+                                @endphp
+
+                                <div class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
+                                    <div class="flex flex-wrap items-start justify-between gap-3">
+                                        <div class="space-y-1">
+                                            <div class="text-sm font-medium text-gray-900 dark:text-white">
+                                                {{ $title }}
+                                            </div>
+                                            @if ($message)
+                                                <div class="text-sm text-gray-600 dark:text-gray-300">
+                                                    {{ $message }}
+                                                </div>
+                                            @endif
+                                        </div>
+
+                                        <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
+                                            @if ($blocking)
+                                                <x-filament::badge color="danger" size="sm">
+                                                    Blocker
+                                                </x-filament::badge>
+                                            @endif
+
+                                            <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
+                                                {{ $severitySpec->label }}
+                                            </x-filament::badge>
+                                            <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
+                                                {{ $statusSpec->label }}
+                                            </x-filament::badge>
+
+                                            @if ($ackAction !== null && $canAcknowledge && $checkKey !== '')
+                                                {{ ($ackAction)(['check_key' => $checkKey]) }}
+                                            @endif
+                                        </div>
+                                    </div>
+
+                                    @if ($nextSteps->isNotEmpty())
+                                        <div class="mt-4">
+                                            <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                                Next steps
+                                            </div>
+                                            <ul class="mt-2 space-y-1 text-sm">
+                                                @foreach ($nextSteps as $step)
+                                                    @php
+                                                        $label = is_string($step['label'] ?? null) ? trim((string) $step['label']) : '';
+                                                        $url = is_string($step['url'] ?? null) ? trim((string) $step['url']) : '';
+                                                        $testId = $label !== '' ? 'verification-next-step-'.\Illuminate\Support\Str::slug($label) : null;
+                                                        $behavior = $routeNextStepsThroughAssist
+                                                            ? null
+                                                            : $linkBehavior->describe($label, $url);
+                                                    @endphp
+
+                                                    @if ($label !== '' && $url !== '')
+                                                        <li>
+                                                            @if ($routeNextStepsThroughAssist)
+                                                                <button
+                                                                    type="button"
+                                                                    class="inline-flex items-center gap-2 text-primary-600 hover:underline dark:text-primary-400"
+                                                                    wire:click="mountAction('{{ $assistActionName }}')"
+                                                                    @if ($testId)
+                                                                        data-testid="{{ $testId }}"
+                                                                    @endif
+                                                                >
+                                                                    <span>{{ $label }}</span>
+                                                                    <span class="text-xs text-gray-500 dark:text-gray-400">
+                                                                        Open in assist
+                                                                    </span>
+                                                                </button>
+                                                            @else
+                                                                <a
+                                                                    href="{{ $url }}"
+                                                                    class="inline-flex items-center gap-2 text-primary-600 hover:underline dark:text-primary-400"
+                                                                    @if ($testId)
+                                                                        data-testid="{{ $testId }}"
+                                                                    @endif
+                                                                    @if ((bool) ($behavior['opens_in_new_tab'] ?? false))
+                                                                        target="_blank" rel="noopener noreferrer"
+                                                                    @endif
+                                                                >
+                                                                    <span>{{ $label }}</span>
+                                                                    @if ((bool) ($behavior['show_new_tab_hint'] ?? false))
+                                                                        <span class="text-xs text-gray-500 dark:text-gray-400">
+                                                                            Opens in new tab
+                                                                        </span>
+                                                                    @endif
+                                                                </a>
+                                                            @endif
+                                                        </li>
+                                                    @endif
+                                                @endforeach
+                                            </ul>
+                                        </div>
+                                    @endif
+                                </div>
+                            @endforeach
+                        </div>
+                    </div>
+                @endif
+            @endforeach
+        </div>
+    @endif
+</div>

apps/platform/resources/views/filament/components/verification-report/passed.blade.php

@@ -0,0 +1,34 @@
+@php
+    $passedChecks = collect($surface['passedChecks'] ?? [])
+        ->filter(static fn (mixed $check): bool => is_array($check))
+        ->values();
+@endphp
+
+<div data-shared-zone="passed">
+    @if ($passedChecks->isEmpty())
+        <div class="text-sm text-gray-600 dark:text-gray-300">
+            No passing checks recorded.
+        </div>
+    @else
+        <div class="space-y-2">
+            @foreach ($passedChecks as $check)
+                @php
+                    $title = is_string($check['title'] ?? null) && trim((string) $check['title']) !== '' ? trim((string) $check['title']) : 'Check';
+                    $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
+                        \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
+                        $check['status'] ?? null,
+                    );
+                @endphp
+
+                <div class="flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white p-3 text-sm shadow-sm dark:border-gray-800 dark:bg-gray-900">
+                    <div class="font-medium text-gray-900 dark:text-white">
+                        {{ $title }}
+                    </div>
+                    <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
+                        {{ $statusSpec->label }}
+                    </x-filament::badge>
+                </div>
+            @endforeach
+        </div>
+    @endif
+</div>

apps/platform/resources/views/filament/components/verification-report/summary.blade.php

@@ -0,0 +1,64 @@
+@php
+    $summary = is_array($surface['summary'] ?? null) ? $surface['summary'] : [];
+    $counts = is_array($summary['counts'] ?? null) ? $summary['counts'] : [];
+    $overallSpec = \App\Support\Badges\BadgeRenderer::spec(
+        \App\Support\Badges\BadgeDomain::VerificationReportOverall,
+        $summary['overall'] ?? null,
+    );
+    $changeIndicator = is_array($summary['changeIndicator'] ?? null) ? $summary['changeIndicator'] : null;
+    $redactionNotes = is_array($redactionNotes ?? null)
+        ? array_values(array_filter($redactionNotes, 'is_string'))
+        : [];
+@endphp
+
+<div
+    data-shared-zone="summary"
+    class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900"
+>
+    <div class="flex flex-wrap items-center gap-2">
+        <x-filament::badge :color="$overallSpec->color" :icon="$overallSpec->icon">
+            {{ $overallSpec->label }}
+        </x-filament::badge>
+
+        <x-filament::badge color="gray">
+            {{ (int) ($counts['total'] ?? 0) }} total
+        </x-filament::badge>
+        <x-filament::badge color="success">
+            {{ (int) ($counts['pass'] ?? 0) }} pass
+        </x-filament::badge>
+        <x-filament::badge color="danger">
+            {{ (int) ($counts['fail'] ?? 0) }} fail
+        </x-filament::badge>
+        <x-filament::badge color="warning">
+            {{ (int) ($counts['warn'] ?? 0) }} warn
+        </x-filament::badge>
+        <x-filament::badge color="gray">
+            {{ (int) ($counts['skip'] ?? 0) }} skip
+        </x-filament::badge>
+        <x-filament::badge color="info">
+            {{ (int) ($counts['running'] ?? 0) }} running
+        </x-filament::badge>
+
+        @if (($changeIndicator['state'] ?? null) === 'no_changes')
+            <x-filament::badge color="success">
+                No changes since previous verification
+            </x-filament::badge>
+        @elseif (($changeIndicator['state'] ?? null) === 'changed')
+            <x-filament::badge color="warning">
+                Changed since previous verification
+            </x-filament::badge>
+        @endif
+    </div>
+
+    <div class="mt-2 text-xs text-gray-600 dark:text-gray-300">
+        <span class="font-semibold">Read-only:</span> this view uses stored data and makes no external calls.
+    </div>
+
+    @if ($redactionNotes !== [])
+        <div class="mt-3 rounded-lg border border-amber-200 bg-amber-50 px-3 py-2 text-xs text-amber-900 dark:border-amber-500/30 dark:bg-amber-500/10 dark:text-amber-100">
+            @foreach ($redactionNotes as $note)
+                <div>{{ $note }}</div>
+            @endforeach
+        </div>
+    @endif
+</div>

apps/platform/resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php

@@ -1,70 +1,26 @@
 @php
     $fieldWrapperView = $getFieldWrapperView();
-
-    $run = $run ?? null;
-    $run = is_array($run) ? $run : null;
-
-    $runUrl = $runUrl ?? null;
-    $runUrl = is_string($runUrl) && $runUrl !== '' ? $runUrl : null;
-
-    $report = $report ?? null;
-    $report = is_array($report) ? $report : null;
-
-    $fingerprint = $fingerprint ?? null;
-    $fingerprint = is_string($fingerprint) && trim($fingerprint) !== '' ? trim($fingerprint) : null;
-
-    $changeIndicator = $changeIndicator ?? null;
-    $changeIndicator = is_array($changeIndicator) ? $changeIndicator : null;
-
-    $previousRunUrl = $previousRunUrl ?? null;
-    $previousRunUrl = is_string($previousRunUrl) && $previousRunUrl !== '' ? $previousRunUrl : null;
-
-    $advancedRunUrl = $advancedRunUrl ?? null;
-    $advancedRunUrl = is_string($advancedRunUrl) && $advancedRunUrl !== '' ? $advancedRunUrl : null;
-
-    $canAcknowledge = (bool) ($canAcknowledge ?? false);
-
-    $acknowledgements = $acknowledgements ?? [];
-    $acknowledgements = is_array($acknowledgements) ? $acknowledgements : [];
-
-    $assistVisibility = $assistVisibility ?? [];
-    $assistVisibility = is_array($assistVisibility) ? $assistVisibility : [];
-
-    $assistActionName = $assistActionName ?? 'wizardVerificationRequiredPermissionsAssist';
-    $assistActionName = is_string($assistActionName) && trim($assistActionName) !== ''
-        ? trim($assistActionName)
+    $run = is_array($run ?? null) ? $run : null;
+    $runUrl = is_string($runUrl ?? null) && trim((string) $runUrl) !== '' ? trim((string) $runUrl) : null;
+    $surface = is_array($surface ?? null) ? $surface : [];
+    $redactionNotes = is_array($redactionNotes ?? null)
+        ? array_values(array_filter($redactionNotes, 'is_string'))
+        : [];
+    $assistVisibility = is_array($assistVisibility ?? null) ? $assistVisibility : [];
+    $assistActionName = is_string($assistActionName ?? null) && trim((string) $assistActionName) !== ''
+        ? trim((string) $assistActionName)
         : 'wizardVerificationRequiredPermissionsAssist';
-
-    $technicalDetailsActionName = $technicalDetailsActionName ?? 'wizardVerificationTechnicalDetails';
-    $technicalDetailsActionName = is_string($technicalDetailsActionName) && trim($technicalDetailsActionName) !== ''
-        ? trim($technicalDetailsActionName)
+    $technicalDetailsActionName = is_string($technicalDetailsActionName ?? null) && trim((string) $technicalDetailsActionName) !== ''
+        ? trim((string) $technicalDetailsActionName)
         : 'wizardVerificationTechnicalDetails';
-
     $showAssist = (bool) ($assistVisibility['is_visible'] ?? false);
-    $assistReason = $assistVisibility['reason'] ?? 'hidden_irrelevant';
-    $assistReason = is_string($assistReason) ? $assistReason : 'hidden_irrelevant';
-
+    $assistReason = is_string($assistVisibility['reason'] ?? null) ? (string) $assistVisibility['reason'] : 'hidden_irrelevant';
     $assistDescription = match ($assistReason) {
         'permission_blocked' => 'Stored permission diagnostics show blockers. Review them without leaving onboarding.',
         'permission_attention' => 'Stored permission diagnostics need attention before you rerun verification.',
         default => 'Review required permissions without leaving onboarding.',
     };
-
-    $status = $run['status'] ?? null;
-    $status = is_string($status) ? $status : null;
-
-    $outcome = $run['outcome'] ?? null;
-    $outcome = is_string($outcome) ? $outcome : null;
-
-    $targetScope = $run['target_scope'] ?? [];
-    $targetScope = is_array($targetScope) ? $targetScope : [];
-
-    $failures = $run['failures'] ?? [];
-    $failures = is_array($failures) ? $failures : [];
-
-    $completedAt = $run['completed_at'] ?? null;
-    $completedAt = is_string($completedAt) && $completedAt !== '' ? $completedAt : null;
-
+    $completedAt = is_string($run['completed_at'] ?? null) && trim((string) $run['completed_at']) !== '' ? (string) $run['completed_at'] : null;
     $completedAtLabel = null;
 
     if ($completedAt !== null) {
@@ -75,81 +31,15 @@
         }
     }
 
-    $summary = $report['summary'] ?? null;
-    $summary = is_array($summary) ? $summary : null;
+    $status = is_string($run['status'] ?? null) ? (string) $run['status'] : null;
+    $runState = is_string($runState ?? null) ? (string) $runState : null;
 
-    $counts = is_array($summary['counts'] ?? null) ? $summary['counts'] : [];
-
-    $checks = $report['checks'] ?? null;
-    $checks = is_array($checks) ? $checks : [];
-
-    $ackByKey = [];
-
-    foreach ($acknowledgements as $checkKey => $ack) {
-        if (! is_string($checkKey) || $checkKey === '' || ! is_array($ack)) {
-            continue;
-        }
-
-        $ackByKey[$checkKey] = $ack;
+    if (! in_array($runState, ['no_run', 'active', 'completed'], true)) {
+        $runState = $run === null
+            ? 'no_run'
+            : ($status === 'completed' ? 'completed' : 'active');
     }
 
-    $blockers = [];
-    $failures = [];
-    $warnings = [];
-    $acknowledgedIssues = [];
-    $passed = [];
-
-    foreach ($checks as $check) {
-        $check = is_array($check) ? $check : [];
-
-        $key = $check['key'] ?? null;
-        $key = is_string($key) ? trim($key) : '';
-
-        if ($key === '') {
-            continue;
-        }
-
-        $statusValue = $check['status'] ?? null;
-        $statusValue = is_string($statusValue) ? strtolower(trim($statusValue)) : '';
-
-        $blocking = $check['blocking'] ?? false;
-        $blocking = is_bool($blocking) ? $blocking : false;
-
-        if (array_key_exists($key, $ackByKey)) {
-            $acknowledgedIssues[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'pass') {
-            $passed[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'fail' && $blocking) {
-            $blockers[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'fail') {
-            $failures[] = $check;
-            continue;
-        }
-
-        if ($statusValue === 'warn') {
-            $warnings[] = $check;
-        }
-    }
-
-    $sortChecks = static function (array $a, array $b): int {
-        return strcmp((string) ($a['key'] ?? ''), (string) ($b['key'] ?? ''));
-    };
-
-    usort($blockers, $sortChecks);
-    usort($failures, $sortChecks);
-    usort($warnings, $sortChecks);
-    usort($acknowledgedIssues, $sortChecks);
-    usort($passed, $sortChecks);
-
     $ackAction = null;
 
     if (isset($this) && method_exists($this, 'acknowledgeVerificationCheckAction')) {
@@ -157,15 +47,6 @@
     }
 
     $linkBehavior = app(\App\Support\Verification\VerificationLinkBehavior::class);
-
-    $runState = $runState ?? null;
-    $runState = is_string($runState) ? $runState : null;
-
-    if (! in_array($runState, ['no_run', 'active', 'completed'], true)) {
-        $runState = $run === null
-            ? 'no_run'
-            : ($status === 'completed' ? 'completed' : 'active');
-    }
 @endphp
 
 <x-dynamic-component :component="$fieldWrapperView" :field="$field">
@@ -211,65 +92,6 @@
                 </div>
             @else
                 <div class="space-y-4">
-                    <div class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                        @php
-                            $overallSpec = $summary === null
-                                ? null
-                                : \App\Support\Badges\BadgeRenderer::spec(
-                                    \App\Support\Badges\BadgeDomain::VerificationReportOverall,
-                                    $summary['overall'] ?? null,
-                                );
-                        @endphp
-
-                        <div class="flex flex-wrap items-center gap-2">
-                            @if ($overallSpec)
-                                <x-filament::badge :color="$overallSpec->color" :icon="$overallSpec->icon">
-                                    {{ $overallSpec->label }}
-                                </x-filament::badge>
-                            @endif
-
-                            <x-filament::badge color="gray">
-                                {{ (int) ($counts['total'] ?? 0) }} total
-                            </x-filament::badge>
-                            <x-filament::badge color="success">
-                                {{ (int) ($counts['pass'] ?? 0) }} pass
-                            </x-filament::badge>
-                            <x-filament::badge color="danger">
-                                {{ (int) ($counts['fail'] ?? 0) }} fail
-                            </x-filament::badge>
-                            <x-filament::badge color="warning">
-                                {{ (int) ($counts['warn'] ?? 0) }} warn
-                            </x-filament::badge>
-                            <x-filament::badge color="gray">
-                                {{ (int) ($counts['skip'] ?? 0) }} skip
-                            </x-filament::badge>
-                            <x-filament::badge color="info">
-                                {{ (int) ($counts['running'] ?? 0) }} running
-                            </x-filament::badge>
-
-                            @if ($changeIndicator !== null)
-                                @php
-                                    $state = $changeIndicator['state'] ?? null;
-                                    $state = is_string($state) ? $state : null;
-                                @endphp
-
-                                @if ($state === 'no_changes')
-                                    <x-filament::badge color="success">
-                                        No changes since previous verification
-                                    </x-filament::badge>
-                                @elseif ($state === 'changed')
-                                    <x-filament::badge color="warning">
-                                        Changed since previous verification
-                                    </x-filament::badge>
-                                @endif
-                            @endif
-                        </div>
-
-                        <div class="mt-2 text-xs text-gray-600 dark:text-gray-300">
-                            <span class="font-semibold">Read-only:</span> this view uses stored data and makes no external calls.
-                        </div>
-                    </div>
-
                     <div class="flex flex-wrap items-center gap-2">
                         @if ($runUrl)
                             <x-filament::button
@@ -315,338 +137,15 @@
                         </div>
                     @endif
 
-                    @if ($report === null || $summary === null)
-                        <div class="rounded-lg border border-gray-200 bg-white p-4 text-sm text-gray-600 shadow-sm dark:border-gray-800 dark:bg-gray-900 dark:text-gray-300">
-                            <div class="font-medium text-gray-900 dark:text-white">
-                                Verification report unavailable
-                            </div>
-                            <div class="mt-1">
-                                This operation doesn’t have a report yet. If it already completed, start verification again.
-                            </div>
-                        </div>
-                    @else
-                        <div
-                            x-data="{ tab: 'issues' }"
-                            class="space-y-4"
-                        >
-                            <x-filament::tabs label="Verification report tabs">
-                                <x-filament::tabs.item
-                                    :active="true"
-                                    alpine-active="tab === 'issues'"
-                                    x-on:click="tab = 'issues'"
-                                >
-                                    Issues
-                                </x-filament::tabs.item>
-                                <x-filament::tabs.item
-                                    :active="false"
-                                    alpine-active="tab === 'passed'"
-                                    x-on:click="tab = 'passed'"
-                                >
-                                    Passed
-                                </x-filament::tabs.item>
-                            </x-filament::tabs>
-
-                            <div x-show="tab === 'issues'">
-                                @if ($blockers === [] && $failures === [] && $warnings === [] && $acknowledgedIssues === [])
-                                    <div class="text-sm text-gray-700 dark:text-gray-200">
-                                        No issues found in this report.
-                                    </div>
-                                @else
-                                    <div class="space-y-3">
-                                        @php
-                                            $issueGroups = [
-                                                ['label' => 'Blockers', 'checks' => $blockers],
-                                                ['label' => 'Failures', 'checks' => $failures],
-                                                ['label' => 'Warnings', 'checks' => $warnings],
-                                            ];
-                                        @endphp
-
-                                        @foreach ($issueGroups as $group)
-                                            @php
-                                                $label = $group['label'];
-                                                $groupChecks = $group['checks'];
-                                            @endphp
-
-                                            @if ($groupChecks !== [])
-                                                <div class="space-y-2">
-                                                    <div class="text-sm font-semibold text-gray-900 dark:text-white">
-                                                        {{ $label }}
-                                                    </div>
-
-                                                    <div class="space-y-2">
-                                                        @foreach ($groupChecks as $check)
-                                                            @php
-                                                                $check = is_array($check) ? $check : [];
-                                                                $checkKey = is_string($check['key'] ?? null) ? trim((string) $check['key']) : '';
-
-                                                                $title = $check['title'] ?? 'Check';
-                                                                $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                                                $message = $check['message'] ?? null;
-                                                                $message = is_string($message) && trim($message) !== '' ? trim($message) : null;
-
-                                                                $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                                    \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                                                    $check['status'] ?? null,
-                                                                );
-
-                                                                $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                                    \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
-                                                                    $check['severity'] ?? null,
-                                                                );
-
-                                                                $nextSteps = $check['next_steps'] ?? [];
-                                                                $nextSteps = is_array($nextSteps) ? array_slice($nextSteps, 0, 2) : [];
-
-                                                                $blocking = $check['blocking'] ?? false;
-                                                                $blocking = is_bool($blocking) ? $blocking : false;
-                                                                $routeNextStepsThroughAssist = $linkBehavior->shouldRouteThroughAssist($check, $showAssist);
-                                                            @endphp
-
-                                                            <div class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                                                <div class="flex flex-wrap items-start justify-between gap-3">
-                                                                    <div class="space-y-1">
-                                                                        <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                                            {{ $title }}
-                                                                        </div>
-                                                                        @if ($message)
-                                                                            <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                                                {{ $message }}
-                                                                            </div>
-                                                                        @endif
-                                                                    </div>
-
-                                                                    <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
-                                                                        @if ($blocking)
-                                                                            <x-filament::badge color="danger" size="sm">
-                                                                                Blocker
-                                                                            </x-filament::badge>
-                                                                        @endif
-
-                                                                        <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
-                                                                            {{ $severitySpec->label }}
-                                                                        </x-filament::badge>
-                                                                        <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                                            {{ $statusSpec->label }}
-                                                                        </x-filament::badge>
-
-                                                                        @if ($ackAction !== null && $canAcknowledge && $checkKey !== '')
-                                                                            {{ ($ackAction)(['check_key' => $checkKey]) }}
-                                                                        @endif
-                                                                    </div>
-                                                                </div>
-
-                                                                @if ($nextSteps !== [])
-                                                                    <div class="mt-4">
-                                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                                                            Next steps
-                                                                        </div>
-                                                                        <ul class="mt-2 space-y-1 text-sm">
-                                                                                @foreach ($nextSteps as $step)
-                                                                                    @php
-                                                                                        $step = is_array($step) ? $step : [];
-                                                                                        $label = $step['label'] ?? null;
-                                                                                        $url = $step['url'] ?? null;
-                                                                                        $testId = is_string($label) && $label !== ''
-                                                                                            ? 'verification-next-step-'.\Illuminate\Support\Str::slug($label)
-                                                                                            : null;
-                                                                                        $behavior = $routeNextStepsThroughAssist
-                                                                                            ? null
-                                                                                            : $linkBehavior->describe(
-                                                                                                is_string($label) ? $label : null,
-                                                                                                is_string($url) ? $url : null,
-                                                                                            );
-                                                                                        $opensInNewTab = (bool) ($behavior['opens_in_new_tab'] ?? false);
-                                                                                        $showNewTabHint = (bool) ($behavior['show_new_tab_hint'] ?? false);
-                                                                                    @endphp
-
-                                                                                @if (is_string($label) && $label !== '' && is_string($url) && $url !== '')
-                                                                                    <li>
-                                                                                        @if ($routeNextStepsThroughAssist)
-                                                                                            <button
-                                                                                                type="button"
-                                                                                                class="inline-flex items-center gap-2 text-primary-600 hover:underline dark:text-primary-400"
-                                                                                                wire:click="mountAction('{{ $assistActionName }}')"
-                                                                                                @if ($testId)
-                                                                                                    data-testid="{{ $testId }}"
-                                                                                                @endif
-                                                                                            >
-                                                                                                <span>{{ $label }}</span>
-                                                                                                <span class="text-xs text-gray-500 dark:text-gray-400">
-                                                                                                    Open in assist
-                                                                                                </span>
-                                                                                            </button>
-                                                                                        @else
-                                                                                            <a
-                                                                                                href="{{ $url }}"
-                                                                                                class="inline-flex items-center gap-2 text-primary-600 hover:underline dark:text-primary-400"
-                                                                                                @if ($testId)
-                                                                                                    data-testid="{{ $testId }}"
-                                                                                                @endif
-                                                                                                @if ($opensInNewTab)
-                                                                                                    target="_blank" rel="noopener noreferrer"
-                                                                                                @endif
-                                                                                            >
-                                                                                                <span>{{ $label }}</span>
-                                                                                                @if ($showNewTabHint)
-                                                                                                    <span class="text-xs text-gray-500 dark:text-gray-400">
-                                                                                                        Opens in new tab
-                                                                                                    </span>
-                                                                                                @endif
-                                                                                            </a>
-                                                                                        @endif
-                                                                                    </li>
-                                                                                @endif
-                                                                            @endforeach
-                                                                        </ul>
-                                                                    </div>
-                                                                @endif
-                                                            </div>
-                                                        @endforeach
-                                                    </div>
-                                                </div>
-                                            @endif
-                                        @endforeach
-
-                                        @if ($acknowledgedIssues !== [])
-                                            <details class="rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                                <summary class="cursor-pointer text-sm font-semibold text-gray-900 dark:text-white">
-                                                    Acknowledged issues
-                                                </summary>
-
-                                                <div class="mt-4 space-y-2">
-                                                    @foreach ($acknowledgedIssues as $check)
-                                                        @php
-                                                            $check = is_array($check) ? $check : [];
-                                                            $checkKey = is_string($check['key'] ?? null) ? trim((string) $check['key']) : '';
-
-                                                            $title = $check['title'] ?? 'Check';
-                                                            $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                                            $message = $check['message'] ?? null;
-                                                            $message = is_string($message) && trim($message) !== '' ? trim($message) : null;
-
-                                                            $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                                \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                                                $check['status'] ?? null,
-                                                            );
-
-                                                            $severitySpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                                \App\Support\Badges\BadgeDomain::VerificationCheckSeverity,
-                                                                $check['severity'] ?? null,
-                                                            );
-
-                                                            $ack = $checkKey !== '' ? ($ackByKey[$checkKey] ?? null) : null;
-                                                            $ack = is_array($ack) ? $ack : null;
-
-                                                            $ackReason = $ack['ack_reason'] ?? null;
-                                                            $ackReason = is_string($ackReason) && trim($ackReason) !== '' ? trim($ackReason) : null;
-
-                                                            $ackAt = $ack['acknowledged_at'] ?? null;
-                                                            $ackAt = is_string($ackAt) && trim($ackAt) !== '' ? trim($ackAt) : null;
-
-                                                            $ackBy = $ack['acknowledged_by'] ?? null;
-                                                            $ackBy = is_array($ackBy) ? $ackBy : null;
-
-                                                            $ackByName = $ackBy['name'] ?? null;
-                                                            $ackByName = is_string($ackByName) && trim($ackByName) !== '' ? trim($ackByName) : null;
-
-                                                            $expiresAt = $ack['expires_at'] ?? null;
-                                                            $expiresAt = is_string($expiresAt) && trim($expiresAt) !== '' ? trim($expiresAt) : null;
-                                                        @endphp
-
-                                                        <div class="rounded-lg border border-gray-100 bg-gray-50 p-4 dark:border-gray-800 dark:bg-gray-950">
-                                                            <div class="flex flex-wrap items-start justify-between gap-3">
-                                                                <div class="space-y-1">
-                                                                    <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                                        {{ $title }}
-                                                                    </div>
-                                                                    @if ($message)
-                                                                        <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                                            {{ $message }}
-                                                                        </div>
-                                                                    @endif
-                                                                </div>
-
-                                                                <div class="flex shrink-0 flex-wrap items-center justify-end gap-2">
-                                                                    <x-filament::badge :color="$severitySpec->color" :icon="$severitySpec->icon" size="sm">
-                                                                        {{ $severitySpec->label }}
-                                                                    </x-filament::badge>
-                                                                    <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                                        {{ $statusSpec->label }}
-                                                                    </x-filament::badge>
-                                                                </div>
-                                                            </div>
-
-                                                            @if ($ackReason || $ackAt || $ackByName || $expiresAt)
-                                                                <div class="mt-3 space-y-1 text-sm text-gray-700 dark:text-gray-200">
-                                                                    @if ($ackReason)
-                                                                        <div>
-                                                                            <span class="font-semibold">Reason:</span> {{ $ackReason }}
-                                                                        </div>
-                                                                    @endif
-                                                                    @if ($ackByName || $ackAt)
-                                                                        <div>
-                                                                            <span class="font-semibold">Acknowledged:</span>
-                                                                            @if ($ackByName)
-                                                                                {{ $ackByName }}
-                                                                            @endif
-                                                                            @if ($ackAt)
-                                                                                <span class="text-gray-500 dark:text-gray-400">({{ $ackAt }})</span>
-                                                                            @endif
-                                                                        </div>
-                                                                    @endif
-                                                                    @if ($expiresAt)
-                                                                        <div>
-                                                                            <span class="font-semibold">Expires:</span>
-                                                                            <span class="text-gray-500 dark:text-gray-400">{{ $expiresAt }}</span>
-                                                                        </div>
-                                                                    @endif
-                                                                </div>
-                                                            @endif
-                                                        </div>
-                                                    @endforeach
-                                                </div>
-                                            </details>
-                                        @endif
-                                    </div>
-                                @endif
-                            </div>
-
-                            <div x-show="tab === 'passed'" style="display: none;">
-                                @if ($passed === [])
-                                    <div class="text-sm text-gray-600 dark:text-gray-300">
-                                        No passing checks recorded.
-                                    </div>
-                                @else
-                                    <div class="space-y-2">
-                                        @foreach ($passed as $check)
-                                            @php
-                                                $check = is_array($check) ? $check : [];
-
-                                                $title = $check['title'] ?? 'Check';
-                                                $title = is_string($title) && trim($title) !== '' ? trim($title) : 'Check';
-
-                                                $statusSpec = \App\Support\Badges\BadgeRenderer::spec(
-                                                    \App\Support\Badges\BadgeDomain::VerificationCheckStatus,
-                                                    $check['status'] ?? null,
-                                                );
-                                            @endphp
-
-                                            <div class="flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white p-3 text-sm shadow-sm dark:border-gray-800 dark:bg-gray-900">
-                                                <div class="font-medium text-gray-900 dark:text-white">
-                                                    {{ $title }}
-                                                </div>
-                                                <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                    {{ $statusSpec->label }}
-                                                </x-filament::badge>
-                                            </div>
-                                        @endforeach
-                                    </div>
-                                @endif
-                            </div>
-                        </div>
-                    @endif
+                    @include('filament.components.verification-report-viewer', [
+                        'surface' => $surface,
+                        'redactionNotes' => $redactionNotes,
+                        'canAcknowledge' => (bool) ($canAcknowledge ?? false),
+                        'ackAction' => $ackAction,
+                        'showAssist' => $showAssist,
+                        'assistActionName' => $assistActionName,
+                        'linkBehavior' => $linkBehavior,
+                    ])
                 </div>
             @endif
         </x-filament::section>

apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php

@@ -1,787 +1,2 @@
-@php
-    $diff = $getState() ?? ['summary' => [], 'added' => [], 'removed' => [], 'changed' => []];
-    $summary = $diff['summary'] ?? [];
-    $policyType = $diff['policy_type'] ?? null;
-
-    $groupByBlock = static function (array $items): array {
-        $groups = [];
-
-        foreach ($items as $path => $value) {
-            if (! is_string($path) || $path === '') {
-                continue;
-            }
-
-            $parts = explode(' > ', $path, 2);
-
-            if (count($parts) === 2) {
-                [$group, $label] = $parts;
-            } else {
-                $group = 'Other';
-                $label = $path;
-            }
-
-            $groups[$group][$label] = $value;
-        }
-
-        ksort($groups);
-
-        return $groups;
-    };
-
-    $stringify = static function (mixed $value): string {
-        if ($value === null) {
-            return '—';
-        }
-
-        if (is_bool($value)) {
-            return $value ? 'Enabled' : 'Disabled';
-        }
-
-        if (is_scalar($value)) {
-            return (string) $value;
-        }
-
-        return json_encode($value, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) ?: '';
-    };
-
-    $isExpandable = static function (mixed $value): bool {
-        if (is_array($value)) {
-            return true;
-        }
-
-        return is_string($value) && strlen($value) > 160;
-    };
-
-    $isScriptKey = static function (mixed $name): bool {
-        return in_array((string) $name, ['scriptContent', 'detectionScriptContent', 'remediationScriptContent'], true);
-    };
-
-    $canHighlightScripts = static function (?string $policyType): bool {
-        return (bool) config('tenantpilot.display.show_script_content', false)
-            && in_array($policyType, ['deviceManagementScript', 'deviceShellScript', 'deviceHealthScript', 'deviceComplianceScript'], true);
-    };
-
-    $selectGrammar = static function (?string $policyType, string $code): string {
-        if ($policyType === 'deviceShellScript') {
-            $firstLine = strtok($code, "\n") ?: '';
-            $shebang = trim($firstLine);
-
-            if (str_starts_with($shebang, '#!')) {
-                if (str_contains($shebang, 'zsh')) {
-                    return 'zsh';
-                }
-
-                if (str_contains($shebang, 'bash')) {
-                    return 'bash';
-                }
-
-                return 'sh';
-            }
-
-            return 'sh';
-        }
-
-        return 'powershell';
-    };
-
-    $highlight = static function (?string $policyType, string $code, string $fallbackClass = '') use ($selectGrammar): ?string {
-        if (! class_exists(\Torchlight\Engine\Engine::class)) {
-            return null;
-        }
-
-        try {
-            return (new \Torchlight\Engine\Engine())->codeToHtml(
-                code: $code,
-                grammar: $selectGrammar($policyType, $code),
-                theme: [
-                    'light' => 'github-light',
-                    'dark' => 'github-dark',
-                ],
-                withGutter: false,
-                withWrapper: true,
-            );
-        } catch (\Throwable $e) {
-            return null;
-        }
-    };
-
-    $highlightInline = static function (?string $policyType, string $code) use ($selectGrammar): ?string {
-        if (! class_exists(\Torchlight\Engine\Engine::class)) {
-            return null;
-        }
-
-        if ($code === '') {
-            return '';
-        }
-
-        try {
-            $html = (new \Torchlight\Engine\Engine())->codeToHtml(
-                code: $code,
-                grammar: $selectGrammar($policyType, $code),
-                theme: [
-                    'light' => 'github-light',
-                    'dark' => 'github-dark',
-                ],
-                withGutter: false,
-                withWrapper: false,
-            );
-
-            $html = (string) preg_replace('/<!--\s*Syntax highlighted by[^>]*-->/', '', $html);
-
-            if (! preg_match('/<code\b[^>]*>.*?<\\/code>/s', $html, $matches)) {
-                return null;
-            }
-
-            return trim((string) ($matches[0] ?? ''));
-        } catch (\Throwable $e) {
-            return null;
-        }
-    };
-
-    $splitLines = static function (string $text): array {
-        $text = str_replace(["\r\n", "\r"], "\n", $text);
-
-        return $text === '' ? [] : explode("\n", $text);
-    };
-
-    $myersLineDiff = static function (array $a, array $b): array {
-        $n = count($a);
-        $m = count($b);
-        $max = $n + $m;
-
-        $v = [1 => 0];
-        $trace = [];
-
-        for ($d = 0; $d <= $max; $d++) {
-            $trace[$d] = $v;
-
-            for ($k = -$d; $k <= $d; $k += 2) {
-                $kPlus = $v[$k + 1] ?? 0;
-                $kMinus = $v[$k - 1] ?? 0;
-
-                if ($k === -$d || ($k !== $d && $kMinus < $kPlus)) {
-                    $x = $kPlus;
-                } else {
-                    $x = $kMinus + 1;
-                }
-
-                $y = $x - $k;
-
-                while ($x < $n && $y < $m && $a[$x] === $b[$y]) {
-                    $x++;
-                    $y++;
-                }
-
-                $v[$k] = $x;
-
-                if ($x >= $n && $y >= $m) {
-                    break 2;
-                }
-            }
-        }
-
-        $ops = [];
-        $x = $n;
-        $y = $m;
-
-        for ($d = count($trace) - 1; $d >= 0; $d--) {
-            $v = $trace[$d];
-            $k = $x - $y;
-
-            $kPlus = $v[$k + 1] ?? 0;
-            $kMinus = $v[$k - 1] ?? 0;
-
-            if ($k === -$d || ($k !== $d && $kMinus < $kPlus)) {
-                $prevK = $k + 1;
-            } else {
-                $prevK = $k - 1;
-            }
-
-            $prevX = $v[$prevK] ?? 0;
-            $prevY = $prevX - $prevK;
-
-            while ($x > $prevX && $y > $prevY) {
-                $ops[] = ['type' => 'equal', 'line' => $a[$x - 1]];
-                $x--;
-                $y--;
-            }
-
-            if ($d === 0) {
-                break;
-            }
-
-            if ($x === $prevX) {
-                $ops[] = ['type' => 'insert', 'line' => $b[$y - 1] ?? ''];
-                $y--;
-            } else {
-                $ops[] = ['type' => 'delete', 'line' => $a[$x - 1] ?? ''];
-                $x--;
-            }
-        }
-
-        return array_reverse($ops);
-    };
-
-    $scriptLineDiff = static function (string $fromText, string $toText) use ($splitLines, $myersLineDiff): array {
-        return $myersLineDiff($splitLines($fromText), $splitLines($toText));
-    };
-@endphp
-
-<div class="space-y-4">
-    <x-filament::section
-        heading="Normalized diff"
-        :description="$summary['message'] ?? sprintf('%d added, %d removed, %d changed', $summary['added'] ?? 0, $summary['removed'] ?? 0, $summary['changed'] ?? 0)"
-    >
-        <div class="flex flex-wrap gap-2">
-            <x-filament::badge color="success">
-                {{ (int) ($summary['added'] ?? 0) }} added
-            </x-filament::badge>
-            <x-filament::badge color="danger">
-                {{ (int) ($summary['removed'] ?? 0) }} removed
-            </x-filament::badge>
-            <x-filament::badge color="warning">
-                {{ (int) ($summary['changed'] ?? 0) }} changed
-            </x-filament::badge>
-        </div>
-    </x-filament::section>
-
-    @foreach (['changed' => ['label' => 'Changed', 'collapsed' => false], 'added' => ['label' => 'Added', 'collapsed' => true], 'removed' => ['label' => 'Removed', 'collapsed' => true]] as $key => $meta)
-        @php
-            $items = $diff[$key] ?? [];
-            $groups = $groupByBlock(is_array($items) ? $items : []);
-        @endphp
-
-        @if ($groups !== [])
-            <x-filament::section
-                :heading="$meta['label']"
-                collapsible
-                :collapsed="$meta['collapsed']"
-            >
-                <div class="space-y-6">
-                    @foreach ($groups as $group => $groupItems)
-                        <div>
-                            <div class="flex items-center justify-between">
-                                <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                    {{ $group }}
-                                </div>
-                                <x-filament::badge size="sm" color="gray">
-                                    {{ count($groupItems) }}
-                                </x-filament::badge>
-                            </div>
-
-                            <div class="mt-2 divide-y divide-gray-200 rounded-lg border border-gray-200 dark:divide-white/10 dark:border-white/10">
-                                @foreach ($groupItems as $name => $value)
-                                    <div class="px-4 py-3">
-                                        @if ($key === 'changed' && is_array($value) && array_key_exists('from', $value) && array_key_exists('to', $value))
-                                            @php
-                                                $from = $value['from'];
-                                                $to = $value['to'];
-                                                $fromText = $stringify($from);
-                                                $toText = $stringify($to);
-
-                                                $isScriptContent = $canHighlightScripts($policyType) && $isScriptKey($name);
-                                                $ops = $isScriptContent ? $scriptLineDiff((string) $fromText, (string) $toText) : [];
-                                                $useTorchlight = $isScriptContent && class_exists(\Torchlight\Engine\Engine::class);
-
-                                                $rows = [];
-                                                if ($isScriptContent) {
-                                                    $count = count($ops);
-
-                                                    for ($i = 0; $i < $count; $i++) {
-                                                        $op = $ops[$i];
-                                                        $next = $ops[$i + 1] ?? null;
-                                                        $type = $op['type'] ?? null;
-                                                        $line = (string) ($op['line'] ?? '');
-
-                                                        if ($type === 'equal') {
-                                                            $rows[] = [
-                                                                'left' => ['type' => 'equal', 'line' => $line],
-                                                                'right' => ['type' => 'equal', 'line' => $line],
-                                                            ];
-                                                            continue;
-                                                        }
-
-                                                        if ($type === 'delete' && is_array($next) && ($next['type'] ?? null) === 'insert') {
-                                                            $rows[] = [
-                                                                'left' => ['type' => 'delete', 'line' => $line],
-                                                                'right' => ['type' => 'insert', 'line' => (string) ($next['line'] ?? '')],
-                                                            ];
-                                                            $i++;
-                                                            continue;
-                                                        }
-
-                                                        if ($type === 'delete') {
-                                                            $rows[] = [
-                                                                'left' => ['type' => 'delete', 'line' => $line],
-                                                                'right' => ['type' => 'blank', 'line' => ''],
-                                                            ];
-                                                            continue;
-                                                        }
-
-                                                        if ($type === 'insert') {
-                                                            $rows[] = [
-                                                                'left' => ['type' => 'blank', 'line' => ''],
-                                                                'right' => ['type' => 'insert', 'line' => $line],
-                                                            ];
-                                                            continue;
-                                                        }
-                                                    }
-                                                }
-                                            @endphp
-                                            <div class="grid grid-cols-1 gap-2 sm:grid-cols-3">
-                                                <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                    {{ (string) $name }}
-                                                </div>
-
-                                                @if ($isScriptContent)
-                                                    <div class="text-sm text-gray-600 dark:text-gray-300 sm:col-span-2">
-                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Script</span>
-                                                        <details class="mt-1" x-data="{ fullscreenOpen: false }">
-                                                            <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
-                                                                View
-                                                            </summary>
-
-                                                            <div x-data="{ tab: 'diff' }" class="mt-2 space-y-3">
-                                                                <div class="flex flex-wrap items-center gap-2">
-                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'diff'" x-bind:class="tab === 'diff' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                        Diff
-                                                                    </x-filament::button>
-                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'before'" x-bind:class="tab === 'before' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                        Before
-                                                                    </x-filament::button>
-                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'after'" x-bind:class="tab === 'after' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                        After
-                                                                    </x-filament::button>
-
-                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="fullscreenOpen = true">
-                                                                        ⤢ Fullscreen
-                                                                    </x-filament::button>
-                                                                </div>
-
-                                                                <div x-show="tab === 'diff'" x-cloak>
-                                                                    <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
-                                                                        <div>
-                                                                            <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Old</div>
-                                                                            <pre class="mt-1 max-h-96 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">@php
-foreach ($rows as $row) {
-    $left = $row['left'];
-    $leftType = $left['type'];
-    $leftLine = (string) ($left['line'] ?? '');
-
-    $leftHighlighted = $useTorchlight ? $highlightInline($policyType, $leftLine) : null;
-    $leftRendered = (is_string($leftHighlighted) && $leftHighlighted !== '') ? $leftHighlighted : e($leftLine);
-
-    if ($leftType === 'equal') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="tp-script-diff-line">'.$leftRendered."</span>\n";
-        continue;
-    }
-
-    if ($leftType === 'delete') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="block tp-script-diff-line bg-danger-50 text-danger-700 dark:bg-danger-950/40 dark:text-danger-200">- '.$leftRendered."</span>\n";
-        continue;
-    }
-
-    echo "\n";
-}
-@endphp</pre>
-                                                                        </div>
-
-                                                                        <div>
-                                                                            <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">New</div>
-                                                                            <pre class="mt-1 max-h-96 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">@php
-foreach ($rows as $row) {
-    $right = $row['right'];
-    $rightType = $right['type'];
-    $rightLine = (string) ($right['line'] ?? '');
-
-    $rightHighlighted = $useTorchlight ? $highlightInline($policyType, $rightLine) : null;
-    $rightRendered = (is_string($rightHighlighted) && $rightHighlighted !== '') ? $rightHighlighted : e($rightLine);
-
-    if ($rightType === 'equal') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="tp-script-diff-line">'.$rightRendered."</span>\n";
-        continue;
-    }
-
-    if ($rightType === 'insert') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="block tp-script-diff-line bg-success-50 text-success-700 dark:bg-success-950/40 dark:text-success-200">+ '.$rightRendered."</span>\n";
-        continue;
-    }
-
-    echo "\n";
-}
-@endphp</pre>
-                                                                        </div>
-                                                                    </div>
-                                                                </div>
-
-                                                                <div x-show="tab === 'before'" x-cloak>
-                                                                    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Before</div>
-                                                                    @php
-                                                                        $highlightedBefore = $useTorchlight ? $highlight($policyType, (string) $fromText) : null;
-                                                                    @endphp
-
-                                                                    @if (is_string($highlightedBefore) && $highlightedBefore !== '')
-                                                                        @once
-                                                                            @include('filament.partials.torchlight-dark-overrides')
-                                                                        @endonce
-
-                                                                        <div class="mt-1 max-h-96 overflow-auto">{!! $highlightedBefore !!}</div>
-                                                                    @else
-                                                                        <pre class="mt-1 max-h-96 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">{{ (string) $fromText }}</pre>
-                                                                    @endif
-                                                                </div>
-
-                                                                <div x-show="tab === 'after'" x-cloak>
-                                                                    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">After</div>
-                                                                    @php
-                                                                        $highlightedAfter = $useTorchlight ? $highlight($policyType, (string) $toText) : null;
-                                                                    @endphp
-
-                                                                    @if (is_string($highlightedAfter) && $highlightedAfter !== '')
-                                                                        @once
-                                                                            @include('filament.partials.torchlight-dark-overrides')
-                                                                        @endonce
-
-                                                                        <div class="mt-1 max-h-96 overflow-auto">{!! $highlightedAfter !!}</div>
-                                                                    @else
-                                                                        <pre class="mt-1 max-h-96 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">{{ (string) $toText }}</pre>
-                                                                    @endif
-                                                                </div>
-                                                            </div>
-
-                                                            <div
-                                                                x-show="fullscreenOpen"
-                                                                x-cloak
-                                                                x-on:keydown.escape.window="fullscreenOpen = false"
-                                                                class="fixed inset-0 z-50"
-                                                            >
-                                                                <div class="absolute inset-0 bg-gray-950/50"></div>
-                                                                <div class="relative flex h-full w-full flex-col bg-white dark:bg-gray-900">
-                                                                    <div class="flex items-center justify-between gap-3 border-b border-gray-200 px-4 py-3 dark:border-white/10">
-                                                                        <div class="text-sm font-medium text-gray-900 dark:text-white">Script diff</div>
-                                                                        <div class="flex items-center gap-2">
-                                                                            <x-filament::button size="sm" color="gray" type="button" x-on:click="fullscreenOpen = false">
-                                                                                Close
-                                                                            </x-filament::button>
-                                                                        </div>
-                                                                    </div>
-
-                                                                    <div class="flex-1 overflow-hidden p-4">
-                                                                        <div
-                                                                            x-data="{
-                                                                                tab: 'diff',
-                                                                                syncing: false,
-                                                                                syncHorizontal: true,
-                                                                                sync(from, to) {
-                                                                                    if (this.syncing) return;
-                                                                                    this.syncing = true;
-
-                                                                                    to.scrollTop = from.scrollTop;
-
-                                                                                    const bothHorizontal = this.syncHorizontal
-                                                                                        && from.scrollWidth > from.clientWidth
-                                                                                        && to.scrollWidth > to.clientWidth;
-
-                                                                                    if (bothHorizontal) {
-                                                                                        to.scrollLeft = from.scrollLeft;
-                                                                                    }
-
-                                                                                    requestAnimationFrame(() => { this.syncing = false; });
-                                                                                },
-                                                                            }"
-                                                                            x-init="$nextTick(() => {
-                                                                                const left = $refs.left;
-                                                                                const right = $refs.right;
-
-                                                                                if (!left || !right) return;
-
-                                                                                left.addEventListener('scroll', () => sync(left, right), { passive: true });
-                                                                                right.addEventListener('scroll', () => sync(right, left), { passive: true });
-                                                                            })"
-                                                                            class="h-full space-y-3"
-                                                                        >
-                                                                            <div class="flex flex-wrap items-center gap-2">
-                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'diff'" x-bind:class="tab === 'diff' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                                    Diff
-                                                                                </x-filament::button>
-                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'before'" x-bind:class="tab === 'before' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                                    Before
-                                                                                </x-filament::button>
-                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'after'" x-bind:class="tab === 'after' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
-                                                                                    After
-                                                                                </x-filament::button>
-                                                                            </div>
-
-                                                                            <div x-show="tab === 'diff'" x-cloak class="h-[calc(100%-3rem)]">
-                                                                                <div class="grid h-full grid-cols-1 gap-4 lg:grid-cols-2">
-                                                                                    <div class="flex h-full flex-col">
-                                                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Old</div>
-                                                                                        <pre x-ref="left" class="mt-2 flex-1 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">@php
-foreach ($rows as $row) {
-    $left = $row['left'];
-    $leftType = $left['type'];
-    $leftLine = (string) ($left['line'] ?? '');
-
-    $leftHighlighted = $useTorchlight ? $highlightInline($policyType, $leftLine) : null;
-    $leftRendered = (is_string($leftHighlighted) && $leftHighlighted !== '') ? $leftHighlighted : e($leftLine);
-
-    if ($leftType === 'equal') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="tp-script-diff-line">'.$leftRendered."</span>\n";
-        continue;
-    }
-
-    if ($leftType === 'delete') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="block tp-script-diff-line bg-danger-50 text-danger-700 dark:bg-danger-950/40 dark:text-danger-200">- '.$leftRendered."</span>\n";
-        continue;
-    }
-
-    echo "\n";
-}
-@endphp</pre>
-                                                                                    </div>
-
-                                                                                    <div class="flex h-full flex-col">
-                                                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">New</div>
-                                                                                        <pre x-ref="right" class="mt-2 flex-1 overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">@php
-foreach ($rows as $row) {
-    $right = $row['right'];
-    $rightType = $right['type'];
-    $rightLine = (string) ($right['line'] ?? '');
-
-    $rightHighlighted = $useTorchlight ? $highlightInline($policyType, $rightLine) : null;
-    $rightRendered = (is_string($rightHighlighted) && $rightHighlighted !== '') ? $rightHighlighted : e($rightLine);
-
-    if ($rightType === 'equal') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="tp-script-diff-line">'.$rightRendered."</span>\n";
-        continue;
-    }
-
-    if ($rightType === 'insert') {
-        if ($useTorchlight) {
-            @endphp
-            @once
-                @include('filament.partials.torchlight-dark-overrides')
-                <style>
-                    .tp-script-diff-line code.torchlight {
-                        background-color: transparent !important;
-                    }
-                </style>
-            @endonce
-            @php
-        }
-
-        echo '<span class="block tp-script-diff-line bg-success-50 text-success-700 dark:bg-success-950/40 dark:text-success-200">+ '.$rightRendered."</span>\n";
-        continue;
-    }
-
-    echo "\n";
-}
-@endphp</pre>
-                                                                                    </div>
-                                                                                </div>
-                                                                            </div>
-
-                                                                            <div x-show="tab === 'before'" x-cloak class="h-[calc(100%-3rem)]">
-                                                                                <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Before</div>
-                                                                                @php
-                                                                                    $highlightedBeforeFullscreen = $useTorchlight ? $highlight($policyType, (string) $fromText) : null;
-                                                                                @endphp
-
-                                                                                @if (is_string($highlightedBeforeFullscreen) && $highlightedBeforeFullscreen !== '')
-                                                                                    @once
-                                                                                        @include('filament.partials.torchlight-dark-overrides')
-                                                                                    @endonce
-
-                                                                                    <div class="mt-2 h-full overflow-auto">{!! $highlightedBeforeFullscreen !!}</div>
-                                                                                @else
-                                                                                    <pre class="mt-2 h-full overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">{{ (string) $fromText }}</pre>
-                                                                                @endif
-                                                                            </div>
-
-                                                                            <div x-show="tab === 'after'" x-cloak class="h-[calc(100%-3rem)]">
-                                                                                <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">After</div>
-                                                                                @php
-                                                                                    $highlightedAfterFullscreen = $useTorchlight ? $highlight($policyType, (string) $toText) : null;
-                                                                                @endphp
-
-                                                                                @if (is_string($highlightedAfterFullscreen) && $highlightedAfterFullscreen !== '')
-                                                                                    @once
-                                                                                        @include('filament.partials.torchlight-dark-overrides')
-                                                                                    @endonce
-
-                                                                                    <div class="mt-2 h-full overflow-auto">{!! $highlightedAfterFullscreen !!}</div>
-                                                                                @else
-                                                                                    <pre class="mt-2 h-full overflow-auto font-mono text-xs text-gray-800 dark:text-gray-200 whitespace-pre">{{ (string) $toText }}</pre>
-                                                                                @endif
-                                                                            </div>
-                                                                        </div>
-                                                                    </div>
-                                                                </div>
-                                                            </div>
-                                                        </details>
-                                                    </div>
-                                                @else
-                                                    <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">From</span>
-                                                        @if ($isExpandable($from))
-                                                            <details class="mt-1">
-                                                                <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
-                                                                    View
-                                                                </summary>
-                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $fromText }}</pre>
-                                                            </details>
-                                                        @else
-                                                            <div class="mt-1">{{ $fromText }}</div>
-                                                        @endif
-                                                    </div>
-                                                    <div class="text-sm text-gray-600 dark:text-gray-300">
-                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">To</span>
-                                                        @if ($isExpandable($to))
-                                                            <details class="mt-1">
-                                                                <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
-                                                                    View
-                                                                </summary>
-                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $toText }}</pre>
-                                                            </details>
-                                                        @else
-                                                            <div class="mt-1">{{ $toText }}</div>
-                                                        @endif
-                                                    </div>
-                                                @endif
-                                            </div>
-                                        @else
-                                            @php
-                                                $text = $stringify($value);
-                                            @endphp
-                                            <div class="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
-                                                <div class="text-sm font-medium text-gray-900 dark:text-white">
-                                                    {{ (string) $name }}
-                                                </div>
-                                                <div class="text-sm text-gray-700 dark:text-gray-200 sm:max-w-[70%]">
-                                                    @if ($isExpandable($value))
-                                                        <details>
-                                                            <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
-                                                                View
-                                                            </summary>
-                                                            @php
-                                                                $isScriptContent = $canHighlightScripts($policyType) && $isScriptKey($name);
-                                                                $highlighted = $isScriptContent ? $highlight($policyType, (string) $text) : null;
-                                                            @endphp
-
-                                                            @if (is_string($highlighted) && $highlighted !== '')
-                                                                @once
-                                                                    @include('filament.partials.torchlight-dark-overrides')
-                                                                @endonce
-
-                                                                <div class="mt-2 overflow-x-auto">{!! $highlighted !!}</div>
-                                                            @else
-                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $text }}</pre>
-                                                            @endif
-                                                        </details>
-                                                    @else
-                                                        <div class="break-words">{{ $text }}</div>
-                                                    @endif
-                                                </div>
-                                            </div>
-                                        @endif
-                                    </div>
-                                @endforeach
-                            </div>
-                        </div>
-                    @endforeach
-                </div>
-            </x-filament::section>
-        @endif
-    @endforeach
-</div>
+{{-- NormalizedDiffSurface normalized-diff wrapper --}}
+@include('filament.infolists.entries.normalized-diff.wrapper', ['state' => $getState() ?? []])

apps/platform/resources/views/filament/infolists/entries/normalized-diff/empty-state.blade.php

@@ -0,0 +1,18 @@
+@php
+    $emptyState = is_array($emptyState ?? null) ? $emptyState : [];
+    $availabilityState = is_string($availabilityState ?? null) ? (string) $availabilityState : 'available';
+    $toneClasses = match ($availabilityState) {
+        'unavailable' => 'border-danger-200 bg-danger-50 text-danger-900 dark:border-danger-500/30 dark:bg-danger-500/10 dark:text-danger-100',
+        'partial' => 'border-amber-200 bg-amber-50 text-amber-900 dark:border-amber-500/30 dark:bg-amber-500/10 dark:text-amber-100',
+        default => 'border-gray-200 bg-white text-gray-700 dark:border-white/10 dark:bg-gray-900 dark:text-gray-200',
+    };
+@endphp
+
+<div data-shared-zone="empty" class="rounded-lg border px-4 py-3 text-sm {{ $toneClasses }}">
+    <div class="font-medium">
+        {{ $emptyState['title'] ?? 'No normalized changes' }}
+    </div>
+    <div class="mt-1">
+        {{ $emptyState['message'] ?? 'No normalized changes were found.' }}
+    </div>
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-diff/groups.blade.php

@@ -0,0 +1,772 @@
+@php
+    $diff = is_array($surface['raw'] ?? null) ? $surface['raw'] : ['changed' => [], 'added' => [], 'removed' => []];
+    $groupMeta = collect($surface['groups'] ?? [])
+        ->filter(static fn (mixed $group): bool => is_array($group))
+        ->values();
+    $policyType = is_string($surface['scriptRendering']['policyType'] ?? null) ? (string) $surface['scriptRendering']['policyType'] : null;
+
+    $groupByBlock = static function (array $items): array {
+        $groups = [];
+
+        foreach ($items as $path => $value) {
+            if (! is_string($path) || $path === '') {
+                continue;
+            }
+
+            $parts = explode(' > ', $path, 2);
+
+            if (count($parts) === 2) {
+                [$group, $label] = $parts;
+            } else {
+                $group = 'Other';
+                $label = $path;
+            }
+
+            $groups[$group][$label] = $value;
+        }
+
+        ksort($groups);
+
+        return $groups;
+    };
+
+    $stringify = static function (mixed $value): string {
+        if ($value === null) {
+            return '—';
+        }
+
+        if (is_bool($value)) {
+            return $value ? 'Enabled' : 'Disabled';
+        }
+
+        if (is_scalar($value)) {
+            return (string) $value;
+        }
+
+        return json_encode($value, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE) ?: '';
+    };
+
+    $isExpandable = static function (mixed $value): bool {
+        if (is_array($value)) {
+            return true;
+        }
+
+        return is_string($value) && strlen($value) > 160;
+    };
+
+    $isScriptKey = static function (mixed $name): bool {
+        return in_array((string) $name, ['scriptContent', 'detectionScriptContent', 'remediationScriptContent'], true);
+    };
+
+    $canHighlightScripts = static function (?string $policyType): bool {
+        return (bool) config('tenantpilot.display.show_script_content', false)
+            && in_array($policyType, ['deviceManagementScript', 'deviceShellScript', 'deviceHealthScript', 'deviceComplianceScript'], true);
+    };
+
+    $selectGrammar = static function (?string $policyType, string $code): string {
+        if ($policyType === 'deviceShellScript') {
+            $firstLine = strtok($code, "\n") ?: '';
+            $shebang = trim($firstLine);
+
+            if (str_starts_with($shebang, '#!')) {
+                if (str_contains($shebang, 'zsh')) {
+                    return 'zsh';
+                }
+
+                if (str_contains($shebang, 'bash')) {
+                    return 'bash';
+                }
+
+                return 'sh';
+            }
+
+            return 'sh';
+        }
+
+        return 'powershell';
+    };
+
+    $highlight = static function (?string $policyType, string $code) use ($selectGrammar): ?string {
+        if (! class_exists(\Torchlight\Engine\Engine::class)) {
+            return null;
+        }
+
+        try {
+            return (new \Torchlight\Engine\Engine())->codeToHtml(
+                code: $code,
+                grammar: $selectGrammar($policyType, $code),
+                theme: [
+                    'light' => 'github-light',
+                    'dark' => 'github-dark',
+                ],
+                withGutter: false,
+                withWrapper: true,
+            );
+        } catch (\Throwable $e) {
+            return null;
+        }
+    };
+
+    $highlightInline = static function (?string $policyType, string $code) use ($selectGrammar): ?string {
+        if (! class_exists(\Torchlight\Engine\Engine::class)) {
+            return null;
+        }
+
+        if ($code === '') {
+            return '';
+        }
+
+        try {
+            $html = (new \Torchlight\Engine\Engine())->codeToHtml(
+                code: $code,
+                grammar: $selectGrammar($policyType, $code),
+                theme: [
+                    'light' => 'github-light',
+                    'dark' => 'github-dark',
+                ],
+                withGutter: false,
+                withWrapper: false,
+            );
+
+            $html = (string) preg_replace('/<!--\s*Syntax highlighted by[^>]*-->/', '', $html);
+
+            if (! preg_match('/<code\b[^>]*>.*?<\\/code>/s', $html, $matches)) {
+                return null;
+            }
+
+            return trim((string) ($matches[0] ?? ''));
+        } catch (\Throwable $e) {
+            return null;
+        }
+    };
+
+    $splitLines = static function (string $text): array {
+        $text = str_replace(["\r\n", "\r"], "\n", $text);
+
+        return $text === '' ? [] : explode("\n", $text);
+    };
+
+    $myersLineDiff = static function (array $a, array $b): array {
+        $n = count($a);
+        $m = count($b);
+        $max = $n + $m;
+        $v = [1 => 0];
+        $trace = [];
+
+        for ($d = 0; $d <= $max; $d++) {
+            $trace[$d] = $v;
+
+            for ($k = -$d; $k <= $d; $k += 2) {
+                $kPlus = $v[$k + 1] ?? 0;
+                $kMinus = $v[$k - 1] ?? 0;
+
+                if ($k === -$d || ($k !== $d && $kMinus < $kPlus)) {
+                    $x = $kPlus;
+                } else {
+                    $x = $kMinus + 1;
+                }
+
+                $y = $x - $k;
+
+                while ($x < $n && $y < $m && $a[$x] === $b[$y]) {
+                    $x++;
+                    $y++;
+                }
+
+                $v[$k] = $x;
+
+                if ($x >= $n && $y >= $m) {
+                    break 2;
+                }
+            }
+        }
+
+        $ops = [];
+        $x = $n;
+        $y = $m;
+
+        for ($d = count($trace) - 1; $d >= 0; $d--) {
+            $v = $trace[$d];
+            $k = $x - $y;
+
+            $kPlus = $v[$k + 1] ?? 0;
+            $kMinus = $v[$k - 1] ?? 0;
+
+            if ($k === -$d || ($k !== $d && $kMinus < $kPlus)) {
+                $prevK = $k + 1;
+            } else {
+                $prevK = $k - 1;
+            }
+
+            $prevX = $v[$prevK] ?? 0;
+            $prevY = $prevX - $prevK;
+
+            while ($x > $prevX && $y > $prevY) {
+                $ops[] = ['type' => 'equal', 'line' => $a[$x - 1]];
+                $x--;
+                $y--;
+            }
+
+            if ($d === 0) {
+                break;
+            }
+
+            if ($x === $prevX) {
+                $ops[] = ['type' => 'insert', 'line' => $b[$y - 1] ?? ''];
+                $y--;
+            } else {
+                $ops[] = ['type' => 'delete', 'line' => $a[$x - 1] ?? ''];
+                $x--;
+            }
+        }
+
+        return array_reverse($ops);
+    };
+
+    $scriptLineDiff = static function (string $fromText, string $toText) use ($splitLines, $myersLineDiff): array {
+        return $myersLineDiff($splitLines($fromText), $splitLines($toText));
+    };
+@endphp
+
+<div data-shared-zone="groups" class="space-y-4">
+    @foreach ($groupMeta as $group)
+        @php
+            $key = is_string($group['key'] ?? null) ? (string) $group['key'] : 'changed';
+            $label = is_string($group['label'] ?? null) ? (string) $group['label'] : ucfirst($key);
+            $collapsed = (bool) ($group['collapsed'] ?? false);
+            $items = is_array($diff[$key] ?? null) ? $diff[$key] : [];
+            $groups = $groupByBlock($items);
+        @endphp
+
+        @if ($groups !== [])
+            <x-filament::section
+                :heading="$label"
+                collapsible
+                :collapsed="$collapsed"
+            >
+                <div class="space-y-6">
+                    @foreach ($groups as $groupLabel => $groupItems)
+                        <div>
+                            <div class="flex items-center justify-between">
+                                <div class="text-sm font-medium text-gray-900 dark:text-white">
+                                    {{ $groupLabel }}
+                                </div>
+                                <x-filament::badge size="sm" color="gray">
+                                    {{ count($groupItems) }}
+                                </x-filament::badge>
+                            </div>
+
+                            <div class="mt-2 divide-y divide-gray-200 rounded-lg border border-gray-200 dark:divide-white/10 dark:border-white/10">
+                                @foreach ($groupItems as $name => $value)
+                                    <div class="px-4 py-3">
+                                        @if ($key === 'changed' && is_array($value) && array_key_exists('from', $value) && array_key_exists('to', $value))
+                                            @php
+                                                $from = $value['from'];
+                                                $to = $value['to'];
+                                                $fromText = $stringify($from);
+                                                $toText = $stringify($to);
+                                                $isScriptContent = $canHighlightScripts($policyType) && $isScriptKey($name);
+                                                $ops = $isScriptContent ? $scriptLineDiff((string) $fromText, (string) $toText) : [];
+                                                $useTorchlight = $isScriptContent && class_exists(\Torchlight\Engine\Engine::class);
+
+                                                $rows = [];
+                                                if ($isScriptContent) {
+                                                    $count = count($ops);
+
+                                                    for ($i = 0; $i < $count; $i++) {
+                                                        $op = $ops[$i];
+                                                        $next = $ops[$i + 1] ?? null;
+                                                        $type = $op['type'] ?? null;
+                                                        $line = (string) ($op['line'] ?? '');
+
+                                                        if ($type === 'equal') {
+                                                            $rows[] = [
+                                                                'left' => ['type' => 'equal', 'line' => $line],
+                                                                'right' => ['type' => 'equal', 'line' => $line],
+                                                            ];
+                                                            continue;
+                                                        }
+
+                                                        if ($type === 'delete' && is_array($next) && ($next['type'] ?? null) === 'insert') {
+                                                            $rows[] = [
+                                                                'left' => ['type' => 'delete', 'line' => $line],
+                                                                'right' => ['type' => 'insert', 'line' => (string) ($next['line'] ?? '')],
+                                                            ];
+                                                            $i++;
+                                                            continue;
+                                                        }
+
+                                                        if ($type === 'delete') {
+                                                            $rows[] = [
+                                                                'left' => ['type' => 'delete', 'line' => $line],
+                                                                'right' => ['type' => 'blank', 'line' => ''],
+                                                            ];
+                                                            continue;
+                                                        }
+
+                                                        if ($type === 'insert') {
+                                                            $rows[] = [
+                                                                'left' => ['type' => 'blank', 'line' => ''],
+                                                                'right' => ['type' => 'insert', 'line' => $line],
+                                                            ];
+                                                        }
+                                                    }
+                                                }
+                                            @endphp
+
+                                            <div class="grid grid-cols-1 gap-2 sm:grid-cols-3">
+                                                <div class="text-sm font-medium text-gray-900 dark:text-white">
+                                                    {{ (string) $name }}
+                                                </div>
+
+                                                @if ($isScriptContent)
+                                                    <div class="text-sm text-gray-600 dark:text-gray-300 sm:col-span-2">
+                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Script</span>
+                                                        <details class="mt-1" x-data="{ fullscreenOpen: false }">
+                                                            <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
+                                                                View
+                                                            </summary>
+
+                                                            <div x-data="{ tab: 'diff' }" class="mt-2 space-y-3">
+                                                                <div class="flex flex-wrap items-center gap-2">
+                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'diff'" x-bind:class="tab === 'diff' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                        Diff
+                                                                    </x-filament::button>
+                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'before'" x-bind:class="tab === 'before' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                        Before
+                                                                    </x-filament::button>
+                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="tab = 'after'" x-bind:class="tab === 'after' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                        After
+                                                                    </x-filament::button>
+                                                                    <x-filament::button size="xs" color="gray" type="button" x-on:click="fullscreenOpen = true">
+                                                                        ⤢ Fullscreen
+                                                                    </x-filament::button>
+                                                                </div>
+
+                                                                <div x-show="tab === 'diff'" x-cloak>
+                                                                    <div class="grid grid-cols-1 gap-3 sm:grid-cols-2">
+                                                                        <div>
+                                                                            <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Old</div>
+                                                                            <pre class="mt-1 max-h-96 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">@php
+foreach ($rows as $row) {
+    $left = $row['left'];
+    $leftType = $left['type'];
+    $leftLine = (string) ($left['line'] ?? '');
+
+    $leftHighlighted = $useTorchlight ? $highlightInline($policyType, $leftLine) : null;
+    $leftRendered = (is_string($leftHighlighted) && $leftHighlighted !== '') ? $leftHighlighted : e($leftLine);
+
+    if ($leftType === 'equal') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="tp-script-diff-line">'.$leftRendered."</span>\n";
+        continue;
+    }
+
+    if ($leftType === 'delete') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="block tp-script-diff-line bg-danger-50 text-danger-700 dark:bg-danger-950/40 dark:text-danger-200">- '.$leftRendered."</span>\n";
+        continue;
+    }
+
+    echo "\n";
+}
+@endphp</pre>
+                                                                        </div>
+
+                                                                        <div>
+                                                                            <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">New</div>
+                                                                            <pre class="mt-1 max-h-96 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">@php
+foreach ($rows as $row) {
+    $right = $row['right'];
+    $rightType = $right['type'];
+    $rightLine = (string) ($right['line'] ?? '');
+
+    $rightHighlighted = $useTorchlight ? $highlightInline($policyType, $rightLine) : null;
+    $rightRendered = (is_string($rightHighlighted) && $rightHighlighted !== '') ? $rightHighlighted : e($rightLine);
+
+    if ($rightType === 'equal') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="tp-script-diff-line">'.$rightRendered."</span>\n";
+        continue;
+    }
+
+    if ($rightType === 'insert') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="block tp-script-diff-line bg-success-50 text-success-700 dark:bg-success-950/40 dark:text-success-200">+ '.$rightRendered."</span>\n";
+        continue;
+    }
+
+    echo "\n";
+}
+@endphp</pre>
+                                                                        </div>
+                                                                    </div>
+                                                                </div>
+
+                                                                <div x-show="tab === 'before'" x-cloak>
+                                                                    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Before</div>
+                                                                    @php
+                                                                        $highlightedBefore = $useTorchlight ? $highlight($policyType, (string) $fromText) : null;
+                                                                    @endphp
+
+                                                                    @if (is_string($highlightedBefore) && $highlightedBefore !== '')
+                                                                        @once
+                                                                            @include('filament.partials.torchlight-dark-overrides')
+                                                                        @endonce
+
+                                                                        <div class="mt-1 max-h-96 overflow-auto">{!! $highlightedBefore !!}</div>
+                                                                    @else
+                                                                        <pre class="mt-1 max-h-96 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">{{ (string) $fromText }}</pre>
+                                                                    @endif
+                                                                </div>
+
+                                                                <div x-show="tab === 'after'" x-cloak>
+                                                                    <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">After</div>
+                                                                    @php
+                                                                        $highlightedAfter = $useTorchlight ? $highlight($policyType, (string) $toText) : null;
+                                                                    @endphp
+
+                                                                    @if (is_string($highlightedAfter) && $highlightedAfter !== '')
+                                                                        @once
+                                                                            @include('filament.partials.torchlight-dark-overrides')
+                                                                        @endonce
+
+                                                                        <div class="mt-1 max-h-96 overflow-auto">{!! $highlightedAfter !!}</div>
+                                                                    @else
+                                                                        <pre class="mt-1 max-h-96 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">{{ (string) $toText }}</pre>
+                                                                    @endif
+                                                                </div>
+                                                            </div>
+
+                                                            <div
+                                                                x-show="fullscreenOpen"
+                                                                x-cloak
+                                                                x-on:keydown.escape.window="fullscreenOpen = false"
+                                                                class="fixed inset-0 z-50"
+                                                            >
+                                                                <div class="absolute inset-0 bg-gray-950/50"></div>
+                                                                <div class="relative flex h-full w-full flex-col bg-white dark:bg-gray-900">
+                                                                    <div class="flex items-center justify-between gap-3 border-b border-gray-200 px-4 py-3 dark:border-white/10">
+                                                                        <div class="text-sm font-medium text-gray-900 dark:text-white">Script diff</div>
+                                                                        <div class="flex items-center gap-2">
+                                                                            <x-filament::button size="sm" color="gray" type="button" x-on:click="fullscreenOpen = false">
+                                                                                Close
+                                                                            </x-filament::button>
+                                                                        </div>
+                                                                    </div>
+
+                                                                    <div class="flex-1 overflow-hidden p-4">
+                                                                        <div
+                                                                            x-data="{
+                                                                                tab: 'diff',
+                                                                                syncing: false,
+                                                                                syncHorizontal: true,
+                                                                                sync(from, to) {
+                                                                                    if (this.syncing) return;
+                                                                                    this.syncing = true;
+                                                                                    to.scrollTop = from.scrollTop;
+
+                                                                                    const bothHorizontal = this.syncHorizontal
+                                                                                        && from.scrollWidth > from.clientWidth
+                                                                                        && to.scrollWidth > to.clientWidth;
+
+                                                                                    if (bothHorizontal) {
+                                                                                        to.scrollLeft = from.scrollLeft;
+                                                                                    }
+
+                                                                                    requestAnimationFrame(() => { this.syncing = false; });
+                                                                                },
+                                                                            }"
+                                                                            x-init="$nextTick(() => {
+                                                                                const left = $refs.left;
+                                                                                const right = $refs.right;
+
+                                                                                if (! left || ! right) {
+                                                                                    return;
+                                                                                }
+
+                                                                                left.addEventListener('scroll', () => sync(left, right), { passive: true });
+                                                                                right.addEventListener('scroll', () => sync(right, left), { passive: true });
+                                                                            })"
+                                                                            class="h-full space-y-3"
+                                                                        >
+                                                                            <div class="flex flex-wrap items-center gap-2">
+                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'diff'" x-bind:class="tab === 'diff' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                                    Diff
+                                                                                </x-filament::button>
+                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'before'" x-bind:class="tab === 'before' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                                    Before
+                                                                                </x-filament::button>
+                                                                                <x-filament::button size="sm" color="gray" type="button" x-on:click="tab = 'after'" x-bind:class="tab === 'after' ? 'ring-1 ring-gray-300 dark:ring-white/20' : ''">
+                                                                                    After
+                                                                                </x-filament::button>
+                                                                            </div>
+
+                                                                            <div x-show="tab === 'diff'" x-cloak class="h-[calc(100%-3rem)]">
+                                                                                <div class="grid h-full grid-cols-1 gap-4 lg:grid-cols-2">
+                                                                                    <div class="flex h-full flex-col">
+                                                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Old</div>
+                                                                                        <pre x-ref="left" class="mt-2 flex-1 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">@php
+foreach ($rows as $row) {
+    $left = $row['left'];
+    $leftType = $left['type'];
+    $leftLine = (string) ($left['line'] ?? '');
+
+    $leftHighlighted = $useTorchlight ? $highlightInline($policyType, $leftLine) : null;
+    $leftRendered = (is_string($leftHighlighted) && $leftHighlighted !== '') ? $leftHighlighted : e($leftLine);
+
+    if ($leftType === 'equal') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="tp-script-diff-line">'.$leftRendered."</span>\n";
+        continue;
+    }
+
+    if ($leftType === 'delete') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="block tp-script-diff-line bg-danger-50 text-danger-700 dark:bg-danger-950/40 dark:text-danger-200">- '.$leftRendered."</span>\n";
+        continue;
+    }
+
+    echo "\n";
+}
+@endphp</pre>
+                                                                                    </div>
+
+                                                                                    <div class="flex h-full flex-col">
+                                                                                        <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">New</div>
+                                                                                        <pre x-ref="right" class="mt-2 flex-1 overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">@php
+foreach ($rows as $row) {
+    $right = $row['right'];
+    $rightType = $right['type'];
+    $rightLine = (string) ($right['line'] ?? '');
+
+    $rightHighlighted = $useTorchlight ? $highlightInline($policyType, $rightLine) : null;
+    $rightRendered = (is_string($rightHighlighted) && $rightHighlighted !== '') ? $rightHighlighted : e($rightLine);
+
+    if ($rightType === 'equal') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="tp-script-diff-line">'.$rightRendered."</span>\n";
+        continue;
+    }
+
+    if ($rightType === 'insert') {
+        if ($useTorchlight) {
+            @endphp
+            @once
+                @include('filament.partials.torchlight-dark-overrides')
+                <style>
+                    .tp-script-diff-line code.torchlight {
+                        background-color: transparent !important;
+                    }
+                </style>
+            @endonce
+            @php
+        }
+
+        echo '<span class="block tp-script-diff-line bg-success-50 text-success-700 dark:bg-success-950/40 dark:text-success-200">+ '.$rightRendered."</span>\n";
+        continue;
+    }
+
+    echo "\n";
+}
+@endphp</pre>
+                                                                                    </div>
+                                                                                </div>
+                                                                            </div>
+
+                                                                            <div x-show="tab === 'before'" x-cloak class="h-[calc(100%-3rem)]">
+                                                                                <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">Before</div>
+                                                                                @php
+                                                                                    $highlightedBeforeFullscreen = $useTorchlight ? $highlight($policyType, (string) $fromText) : null;
+                                                                                @endphp
+
+                                                                                @if (is_string($highlightedBeforeFullscreen) && $highlightedBeforeFullscreen !== '')
+                                                                                    @once
+                                                                                        @include('filament.partials.torchlight-dark-overrides')
+                                                                                    @endonce
+
+                                                                                    <div class="mt-2 h-full overflow-auto">{!! $highlightedBeforeFullscreen !!}</div>
+                                                                                @else
+                                                                                    <pre class="mt-2 h-full overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">{{ (string) $fromText }}</pre>
+                                                                                @endif
+                                                                            </div>
+
+                                                                            <div x-show="tab === 'after'" x-cloak class="h-[calc(100%-3rem)]">
+                                                                                <div class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">After</div>
+                                                                                @php
+                                                                                    $highlightedAfterFullscreen = $useTorchlight ? $highlight($policyType, (string) $toText) : null;
+                                                                                @endphp
+
+                                                                                @if (is_string($highlightedAfterFullscreen) && $highlightedAfterFullscreen !== '')
+                                                                                    @once
+                                                                                        @include('filament.partials.torchlight-dark-overrides')
+                                                                                    @endonce
+
+                                                                                    <div class="mt-2 h-full overflow-auto">{!! $highlightedAfterFullscreen !!}</div>
+                                                                                @else
+                                                                                    <pre class="mt-2 h-full overflow-auto whitespace-pre font-mono text-xs text-gray-800 dark:text-gray-200">{{ (string) $toText }}</pre>
+                                                                                @endif
+                                                                            </div>
+                                                                        </div>
+                                                                    </div>
+                                                                </div>
+                                                            </div>
+                                                        </details>
+                                                    </div>
+                                                @else
+                                                    <div class="text-sm text-gray-600 dark:text-gray-300">
+                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">From</span>
+                                                        @if ($isExpandable($from))
+                                                            <details class="mt-1">
+                                                                <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
+                                                                    View
+                                                                </summary>
+                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $fromText }}</pre>
+                                                            </details>
+                                                        @else
+                                                            <div class="mt-1">{{ $fromText }}</div>
+                                                        @endif
+                                                    </div>
+                                                    <div class="text-sm text-gray-600 dark:text-gray-300">
+                                                        <span class="text-xs font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">To</span>
+                                                        @if ($isExpandable($to))
+                                                            <details class="mt-1">
+                                                                <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
+                                                                    View
+                                                                </summary>
+                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $toText }}</pre>
+                                                            </details>
+                                                        @else
+                                                            <div class="mt-1">{{ $toText }}</div>
+                                                        @endif
+                                                    </div>
+                                                @endif
+                                            </div>
+                                        @else
+                                            @php
+                                                $text = $stringify($value);
+                                                $isScriptContent = $canHighlightScripts($policyType) && $isScriptKey($name);
+                                                $highlighted = $isScriptContent ? $highlight($policyType, (string) $text) : null;
+                                            @endphp
+
+                                            <div class="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
+                                                <div class="text-sm font-medium text-gray-900 dark:text-white">
+                                                    {{ (string) $name }}
+                                                </div>
+                                                <div class="text-sm text-gray-700 dark:text-gray-200 sm:max-w-[70%]">
+                                                    @if ($isExpandable($value))
+                                                        <details>
+                                                            <summary class="cursor-pointer text-sm text-gray-700 dark:text-gray-200">
+                                                                View
+                                                            </summary>
+
+                                                            @if (is_string($highlighted) && $highlighted !== '')
+                                                                @once
+                                                                    @include('filament.partials.torchlight-dark-overrides')
+                                                                @endonce
+
+                                                                <div class="mt-2 overflow-x-auto">{!! $highlighted !!}</div>
+                                                            @else
+                                                                <pre class="mt-2 overflow-x-auto text-xs text-gray-800 dark:text-gray-200">{{ $text }}</pre>
+                                                            @endif
+                                                        </details>
+                                                    @else
+                                                        <div class="break-words">{{ $text }}</div>
+                                                    @endif
+                                                </div>
+                                            </div>
+                                        @endif
+                                    </div>
+                                @endforeach
+                            </div>
+                        </div>
+                    @endforeach
+                </div>
+            </x-filament::section>
+        @endif
+    @endforeach
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-diff/summary.blade.php

@@ -0,0 +1,30 @@
+@php
+    $summary = is_array($surface['summary'] ?? null) ? $surface['summary'] : [];
+    $availabilityState = is_string($surface['availabilityState'] ?? null) ? (string) $surface['availabilityState'] : 'available';
+@endphp
+
+<div data-shared-zone="summary">
+    <x-filament::section heading="Normalized diff">
+        <div class="flex flex-wrap gap-2">
+            @if ($availabilityState === 'unavailable')
+                <x-filament::badge color="danger">
+                    Unavailable
+                </x-filament::badge>
+            @elseif ($availabilityState === 'partial')
+                <x-filament::badge color="warning">
+                    Partial
+                </x-filament::badge>
+            @endif
+
+            <x-filament::badge color="success">
+                {{ (int) ($summary['added'] ?? 0) }} added
+            </x-filament::badge>
+            <x-filament::badge color="danger">
+                {{ (int) ($summary['removed'] ?? 0) }} removed
+            </x-filament::badge>
+            <x-filament::badge color="warning">
+                {{ (int) ($summary['changed'] ?? 0) }} changed
+            </x-filament::badge>
+        </div>
+    </x-filament::section>
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-diff/wrapper.blade.php

@@ -0,0 +1,47 @@
+@php
+    $state = is_array($state ?? null) ? $state : [];
+
+    $surface = array_key_exists('renderExpectations', $state)
+        ? $state
+        : \App\Filament\Support\NormalizedDiffSurface::build($state, 'unknown');
+
+    $summary = is_array($surface['summary'] ?? null) ? $surface['summary'] : [];
+    $availabilityState = is_string($surface['availabilityState'] ?? null) ? (string) $surface['availabilityState'] : 'available';
+    $emptyState = is_array($surface['emptyState'] ?? null) ? $surface['emptyState'] : null;
+    $hasChanges = ((int) ($summary['added'] ?? 0) + (int) ($summary['removed'] ?? 0) + (int) ($summary['changed'] ?? 0)) > 0;
+
+    if ($emptyState === null && ! $hasChanges && $availabilityState === 'available') {
+        $message = is_string($summary['message'] ?? null) && trim((string) $summary['message']) !== ''
+            ? trim((string) $summary['message'])
+            : 'No normalized changes were found.';
+
+        $emptyState = [
+            'title' => 'No normalized changes',
+            'message' => $message,
+        ];
+    }
+@endphp
+
+<div
+    class="space-y-4"
+    data-shared-detail-family="normalized-diff"
+    data-shared-normalized-diff-host="{{ $surface['hostKind'] ?? 'unknown' }}"
+    data-shared-normalized-diff-state="{{ $availabilityState }}"
+>
+    @include('filament.infolists.entries.normalized-diff.summary', [
+        'surface' => $surface,
+    ])
+
+    @if ($emptyState !== null)
+        @include('filament.infolists.entries.normalized-diff.empty-state', [
+            'emptyState' => $emptyState,
+            'availabilityState' => $availabilityState,
+        ])
+    @endif
+
+    @if ($hasChanges)
+        @include('filament.infolists.entries.normalized-diff.groups', [
+            'surface' => $surface,
+        ])
+    @endif
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-settings.blade.php

@@ -1,233 +1,2 @@
-@php
-    $normalized = $getState() ?? [];
-    $warnings = $normalized['warnings'] ?? [];
-    $settings = $normalized['settings'] ?? [];
-    $settingsTable = $normalized['settings_table'] ?? null;
-    $settingsTableRows = is_array($settingsTable) ? ($settingsTable['rows'] ?? []) : [];
-    $context = $normalized['context'] ?? 'policy';
-    $recordId = $normalized['record_id'] ?? null;
-@endphp
-
-<div class="space-y-3">
-    @if (! empty($warnings))
-        <div class="rounded-md border border-amber-300 bg-amber-50 p-3 text-sm text-amber-800">
-            <div class="font-semibold">Warnings</div>
-            <ul class="mt-1 list-disc space-y-1 pl-5">
-                @foreach ($warnings as $warning)
-                    <li>{{ $warning }}</li>
-                @endforeach
-            </ul>
-        </div>
-    @endif
-
-    @if (empty($settings) && empty($settingsTableRows))
-        <p class="text-sm text-gray-600">No settings available.</p>
-    @endif
-
-    @if (! empty($settingsTableRows))
-        @php
-            $settingsTableTitle = is_array($settingsTable) ? ($settingsTable['title'] ?? null) : null;
-            $shouldShowTitle = is_string($settingsTableTitle)
-                && $settingsTableTitle !== ''
-                && ! ($context === 'policy' && strtolower($settingsTableTitle) === 'settings');
-        @endphp
-
-        <div class="space-y-2">
-            @if ($shouldShowTitle)
-                <div class="text-sm font-semibold text-gray-800">{{ $settingsTableTitle }}</div>
-            @endif
-
-            <livewire:settings-catalog-settings-table
-                :settings-rows="$settingsTableRows"
-                :context="$context"
-                :key="$recordId ? ('sc-settings-'.$context.'-'.$recordId) : ('sc-settings-'.$context)"
-            />
-        </div>
-    @endif
-
-    @foreach ($settings as $block)
-        @php
-            $title = $block['title'] ?? 'Settings';
-            $isGeneral = is_string($title) && strtolower($title) === 'general';
-        @endphp
-
-        @if ($isGeneral)
-            <x-filament::section
-                :heading="$title"
-                collapsible
-                :collapsed="true"
-                data-block="general"
-            >
-                <x-slot name="headerEnd">
-                    <span class="text-sm text-gray-500 dark:text-gray-400">
-                        {{ count($block['entries'] ?? []) }} fields
-                    </span>
-                </x-slot>
-
-                @if (($block['type'] ?? 'keyValue') === 'table')
-                    @php
-                        $columns = $block['columns'] ?? null;
-                        $hasColumns = is_array($columns) && ! empty($columns);
-                        $columnMeta = [
-                            'definitionId' => ['width' => 'w-[35%]', 'style' => 'width: 35%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                            'instanceType' => ['width' => 'w-[20%]', 'style' => 'width: 20%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                            'value' => ['width' => 'w-[25%]', 'style' => 'width: 25%;', 'cell' => 'break-words whitespace-pre-wrap', 'cellStyle' => 'overflow-wrap: anywhere; white-space: pre-wrap;'],
-                            'path' => ['width' => 'w-[20%]', 'style' => 'width: 20%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                        ];
-                    @endphp
-                    <div class="overflow-x-auto rounded-lg border border-gray-200" style="overflow-x: auto;">
-                        <table class="min-w-[900px] w-full table-fixed text-left text-sm" style="table-layout: fixed; width: 100%; min-width: 900px;">
-                            <thead class="bg-gray-50 text-gray-700">
-                                <tr>
-                                    @if ($hasColumns)
-                                        @foreach ($columns as $column)
-                                            @php
-                                                $key = $column['key'] ?? null;
-                                                $meta = is_string($key) ? ($columnMeta[$key] ?? []) : [];
-                                            @endphp
-                                            <th class="px-3 py-2 {{ $meta['width'] ?? '' }}" style="{{ $meta['style'] ?? '' }}">{{ $column['label'] ?? $column['key'] ?? '-' }}</th>
-                                        @endforeach
-                                    @else
-                                        <th class="px-3 py-2">Path</th>
-                                        <th class="px-3 py-2">Value</th>
-                                    @endif
-                                </tr>
-                            </thead>
-                            <tbody class="divide-y divide-gray-100">
-                                @foreach ($block['rows'] ?? [] as $row)
-                                    <tr>
-                                        @if ($hasColumns)
-                                            @foreach ($columns as $column)
-                                                @php
-                                                    $key = $column['key'] ?? null;
-                                                    $cell = is_string($key) ? ($row[$key] ?? null) : null;
-                                                    $meta = is_string($key) ? ($columnMeta[$key] ?? []) : [];
-                                                @endphp
-                                                <td class="px-3 py-2 align-top text-gray-800 {{ $meta['cell'] ?? 'whitespace-pre-wrap' }}" style="{{ $meta['cellStyle'] ?? '' }}">
-                                                    @if (is_array($cell))
-                                                        <pre class="overflow-x-auto text-xs">{{ json_encode($cell, JSON_PRETTY_PRINT) }}</pre>
-                                                    @elseif (is_bool($cell))
-                                                        <span>{{ $cell ? 'true' : 'false' }}</span>
-                                                    @else
-                                                        <span title="{{ is_string($cell) ? $cell : '' }}">{{ $cell ?? '-' }}</span>
-                                                    @endif
-                                                </td>
-                                            @endforeach
-                                        @else
-                                            <td class="px-3 py-2 align-top">
-                                                <div class="font-mono text-xs font-medium text-gray-800 break-all whitespace-normal" style="word-break: break-all; overflow-wrap: anywhere; white-space: normal;">{{ $row['path'] ?? '-' }}</div>
-                                                @if (! empty($row['label']))
-                                                    <div class="text-xs text-gray-600">{{ $row['label'] }}</div>
-                                                @endif
-                                            </td>
-                                            <td class="px-3 py-2 align-top text-gray-800 break-words whitespace-pre-wrap" style="overflow-wrap: anywhere; white-space: pre-wrap;">
-                                                {{ is_array($row['value'] ?? null) ? json_encode($row['value'], JSON_PRETTY_PRINT) : ($row['value'] ?? '-') }}
-                                            </td>
-                                        @endif
-                                    </tr>
-                                @endforeach
-                            </tbody>
-                        </table>
-                    </div>
-                @else
-                    <div class="divide-y divide-gray-200 dark:divide-gray-700">
-                        @foreach ($block['entries'] ?? [] as $entry)
-                            <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
-                                <dt class="text-sm font-medium text-gray-500 dark:text-gray-400">
-                                    {{ $entry['key'] ?? '-' }}
-                                </dt>
-                                <dd class="mt-1 sm:mt-0 sm:col-span-2">
-                                    <span class="text-sm text-gray-900 dark:text-white whitespace-pre-wrap break-words">
-                                        {{ is_array($entry['value'] ?? null) ? json_encode($entry['value'], JSON_PRETTY_PRINT) : ($entry['value'] ?? '-') }}
-                                    </span>
-                                </dd>
-                            </div>
-                        @endforeach
-                    </div>
-                @endif
-            </x-filament::section>
-        @else
-            <div class="space-y-2 rounded-md border border-gray-200 bg-white p-3 shadow-sm">
-                <div class="text-sm font-semibold text-gray-800">{{ $title }}</div>
-
-                @if (($block['type'] ?? 'keyValue') === 'table')
-                    @php
-                        $columns = $block['columns'] ?? null;
-                        $hasColumns = is_array($columns) && ! empty($columns);
-                        $columnMeta = [
-                            'definitionId' => ['width' => 'w-[35%]', 'style' => 'width: 35%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                            'instanceType' => ['width' => 'w-[20%]', 'style' => 'width: 20%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                            'value' => ['width' => 'w-[25%]', 'style' => 'width: 25%;', 'cell' => 'break-words whitespace-pre-wrap', 'cellStyle' => 'overflow-wrap: anywhere; white-space: pre-wrap;'],
-                            'path' => ['width' => 'w-[20%]', 'style' => 'width: 20%;', 'cell' => 'font-mono text-xs break-all whitespace-normal', 'cellStyle' => 'word-break: break-all; overflow-wrap: anywhere; white-space: normal;'],
-                        ];
-                    @endphp
-                    <div class="overflow-x-auto rounded-lg border border-gray-200" style="overflow-x: auto;">
-                        <table class="min-w-[900px] w-full table-fixed text-left text-sm" style="table-layout: fixed; width: 100%; min-width: 900px;">
-                            <thead class="bg-gray-50 text-gray-700">
-                                <tr>
-                                    @if ($hasColumns)
-                                        @foreach ($columns as $column)
-                                            @php
-                                                $key = $column['key'] ?? null;
-                                                $meta = is_string($key) ? ($columnMeta[$key] ?? []) : [];
-                                            @endphp
-                                            <th class="px-3 py-2 {{ $meta['width'] ?? '' }}" style="{{ $meta['style'] ?? '' }}">{{ $column['label'] ?? $column['key'] ?? '-' }}</th>
-                                        @endforeach
-                                    @else
-                                        <th class="px-3 py-2">Path</th>
-                                        <th class="px-3 py-2">Value</th>
-                                    @endif
-                                </tr>
-                            </thead>
-                            <tbody class="divide-y divide-gray-100">
-                                @foreach ($block['rows'] ?? [] as $row)
-                                    <tr>
-                                        @if ($hasColumns)
-                                            @foreach ($columns as $column)
-                                                @php
-                                                    $key = $column['key'] ?? null;
-                                                    $cell = is_string($key) ? ($row[$key] ?? null) : null;
-                                                    $meta = is_string($key) ? ($columnMeta[$key] ?? []) : [];
-                                                @endphp
-                                                <td class="px-3 py-2 align-top text-gray-800 {{ $meta['cell'] ?? 'whitespace-pre-wrap' }}" style="{{ $meta['cellStyle'] ?? '' }}">
-                                                    @if (is_array($cell))
-                                                        <pre class="overflow-x-auto text-xs">{{ json_encode($cell, JSON_PRETTY_PRINT) }}</pre>
-                                                    @elseif (is_bool($cell))
-                                                        <span>{{ $cell ? 'true' : 'false' }}</span>
-                                                    @else
-                                                        <span title="{{ is_string($cell) ? $cell : '' }}">{{ $cell ?? '-' }}</span>
-                                                    @endif
-                                                </td>
-                                            @endforeach
-                                        @else
-                                            <td class="px-3 py-2 align-top">
-                                                <div class="font-mono text-xs font-medium text-gray-800 break-all whitespace-normal" style="word-break: break-all; overflow-wrap: anywhere; white-space: normal;">{{ $row['path'] ?? '-' }}</div>
-                                                @if (! empty($row['label']))
-                                                    <div class="text-xs text-gray-600">{{ $row['label'] }}</div>
-                                                @endif
-                                            </td>
-                                            <td class="px-3 py-2 align-top text-gray-800 break-words whitespace-pre-wrap" style="overflow-wrap: anywhere; white-space: pre-wrap;">
-                                                {{ is_array($row['value'] ?? null) ? json_encode($row['value'], JSON_PRETTY_PRINT) : ($row['value'] ?? '-') }}
-                                            </td>
-                                        @endif
-                                    </tr>
-                                @endforeach
-                            </tbody>
-                        </table>
-                    </div>
-                @else
-                    <dl class="grid grid-cols-1 gap-3 sm:grid-cols-2">
-                        @foreach ($block['entries'] ?? [] as $entry)
-                            <div class="rounded border border-gray-100 bg-gray-50 p-3">
-                                <dt class="text-xs uppercase tracking-wide text-gray-500">{{ $entry['key'] ?? '-' }}</dt>
-                                <dd class="whitespace-pre-wrap text-sm text-gray-800">
-                                    {{ is_array($entry['value'] ?? null) ? json_encode($entry['value'], JSON_PRETTY_PRINT) : ($entry['value'] ?? '-') }}
-                                </dd>
-                            </div>
-                        @endforeach
-                    </dl>
-                @endif
-            </div>
-        @endif
-    @endforeach
-</div>
+{{-- NormalizedSettingsSurface normalized-settings wrapper --}}
+@include('filament.infolists.entries.normalized-settings.wrapper', ['state' => $getState() ?? []])

apps/platform/resources/views/filament/infolists/entries/normalized-settings/catalog-table.blade.php

@@ -0,0 +1,22 @@
+@php
+    $settingsTable = is_array($settingsTable ?? null) ? $settingsTable : null;
+    $settingsTableRows = is_array($settingsTable['rows'] ?? null) ? $settingsTable['rows'] : [];
+    $context = is_string($context ?? null) && $context !== '' ? $context : 'policy';
+    $recordId = is_scalar($recordId ?? null) ? (string) $recordId : null;
+    $settingsTableTitle = is_string($settingsTable['title'] ?? null) ? $settingsTable['title'] : null;
+    $shouldShowTitle = is_string($settingsTableTitle)
+        && $settingsTableTitle !== ''
+        && ! ($context === 'policy' && strtolower($settingsTableTitle) === 'settings');
+@endphp
+
+<div class="space-y-2" data-shared-zone="settings-table">
+    @if ($shouldShowTitle)
+        <div class="text-sm font-semibold text-gray-800 dark:text-gray-200">{{ $settingsTableTitle }}</div>
+    @endif
+
+    <livewire:settings-catalog-settings-table
+        :settings-rows="$settingsTableRows"
+        :context="$context"
+        :key="$recordId ? ('sc-settings-'.$context.'-'.$recordId) : ('sc-settings-'.$context)"
+    />
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-settings/standard-blocks.blade.php

@@ -0,0 +1,273 @@
+@php
+    use App\Support\Badges\BadgeCatalog;
+    use App\Support\Badges\BadgeDomain;
+    use App\Support\Badges\BadgeSpec;
+    use Illuminate\Support\Str;
+
+    $blocks = is_array($blocks ?? null) ? $blocks : [];
+    $policyType = is_string($policyType ?? null) ? $policyType : null;
+
+    $stringifyValue = function (mixed $value): string {
+        if (is_null($value)) {
+            return 'N/A';
+        }
+
+        if (is_bool($value)) {
+            return $value ? 'Enabled' : 'Disabled';
+        }
+
+        if (is_scalar($value)) {
+            return (string) $value;
+        }
+
+        if (is_array($value)) {
+            $encoded = json_encode($value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+            return is_string($encoded) ? $encoded : 'N/A';
+        }
+
+        if (is_object($value)) {
+            if (method_exists($value, '__toString')) {
+                return (string) $value;
+            }
+
+            $encoded = json_encode((array) $value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+
+            return is_string($encoded) ? $encoded : 'N/A';
+        }
+
+        return 'N/A';
+    };
+
+    $shouldRenderBadges = function (mixed $value): bool {
+        if (! is_array($value) || $value === []) {
+            return false;
+        }
+
+        if (! array_is_list($value)) {
+            return false;
+        }
+
+        foreach ($value as $item) {
+            if (! is_scalar($item) && ! is_null($item)) {
+                return false;
+            }
+        }
+
+        return true;
+    };
+
+    $asEnabledDisabledBadgeSpec = function (mixed $value): ?BadgeSpec {
+        $spec = BadgeCatalog::spec(BadgeDomain::BooleanEnabled, $value);
+
+        return $spec->label === 'Unknown' ? null : $spec;
+    };
+@endphp
+
+<div class="space-y-4" data-shared-zone="blocks">
+    @foreach ($blocks as $block)
+        @php
+            $blockType = is_array($block) ? ($block['type'] ?? null) : null;
+        @endphp
+
+        @if ($blockType === 'table')
+            <x-filament::section
+                :heading="$block['title'] ?? 'Settings'"
+                collapsible
+            >
+                <x-slot name="headerEnd">
+                    <span class="text-sm text-gray-500 dark:text-gray-400">
+                        {{ count($block['rows'] ?? []) }} {{ Str::plural('item', count($block['rows'] ?? [])) }}
+                    </span>
+                </x-slot>
+
+                <div class="divide-y divide-gray-200 dark:divide-gray-700">
+                    @foreach ($block['rows'] ?? [] as $row)
+                        <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
+                            <dt class="text-sm font-medium text-gray-500 dark:text-gray-400 break-words">
+                                {{ $row['label'] ?? $row['path'] ?? 'Setting' }}
+
+                                @if (! empty($row['path']) && ($row['label'] ?? null) !== ($row['path'] ?? null))
+                                    <p class="mt-0.5 break-all text-xs font-mono text-gray-400 dark:text-gray-500">
+                                        {{ (string) $row['path'] }}
+                                    </p>
+                                @endif
+
+                                @if (! empty($row['description']))
+                                    <p class="mt-0.5 text-xs text-gray-400">{{ Str::limit($row['description'], 80) }}</p>
+                                @endif
+                            </dt>
+                            <dd class="mt-1 sm:col-span-2 sm:mt-0">
+                                @php
+                                    $badgeSpec = $asEnabledDisabledBadgeSpec($row['value'] ?? null);
+                                @endphp
+
+                                @if ($badgeSpec)
+                                    <x-filament::badge :color="$badgeSpec->color" :icon="$badgeSpec->icon" size="sm">
+                                        {{ $badgeSpec->label }}
+                                    </x-filament::badge>
+                                @elseif (is_numeric($row['value'] ?? null))
+                                    <span class="font-mono text-sm font-semibold text-gray-900 dark:text-white">
+                                        {{ $row['value'] }}
+                                    </span>
+                                @elseif ($shouldRenderBadges($row['value'] ?? null))
+                                    <div class="flex flex-wrap gap-1.5">
+                                        @foreach (($row['value'] ?? []) as $item)
+                                            @php
+                                                $itemSpec = $asEnabledDisabledBadgeSpec($item);
+                                            @endphp
+
+                                            @if ($itemSpec)
+                                                <x-filament::badge :color="$itemSpec->color" :icon="$itemSpec->icon" size="sm">
+                                                    {{ $itemSpec->label }}
+                                                </x-filament::badge>
+                                            @else
+                                                <x-filament::badge color="gray" size="sm">
+                                                    {{ is_null($item) ? '—' : (string) $item }}
+                                                </x-filament::badge>
+                                            @endif
+                                        @endforeach
+                                    </div>
+                                @else
+                                    <span class="break-words text-sm text-gray-900 dark:text-white">
+                                        {{ Str::limit($stringifyValue($row['value'] ?? null), 200) }}
+                                    </span>
+                                @endif
+                            </dd>
+                        </div>
+                    @endforeach
+                </div>
+            </x-filament::section>
+        @elseif ($blockType === 'keyValue')
+            <x-filament::section
+                :heading="$block['title'] ?? 'Settings'"
+                collapsible
+            >
+                <x-slot name="headerEnd">
+                    <span class="text-sm text-gray-500 dark:text-gray-400">
+                        {{ count($block['entries'] ?? []) }} {{ Str::plural('entry', count($block['entries'] ?? [])) }}
+                    </span>
+                </x-slot>
+
+                <div class="divide-y divide-gray-200 dark:divide-gray-700">
+                    @foreach ($block['entries'] ?? [] as $entry)
+                        <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
+                            <dt class="text-sm font-medium text-gray-500 dark:text-gray-400">
+                                {{ $entry['key'] ?? 'Setting' }}
+                            </dt>
+                            <dd class="mt-1 sm:col-span-2 sm:mt-0">
+                                @php
+                                    $rawValue = $entry['value'] ?? null;
+                                    $isScriptContent = in_array($entry['key'] ?? null, ['scriptContent', 'detectionScriptContent', 'remediationScriptContent'], true)
+                                        && (bool) config('tenantpilot.display.show_script_content', false);
+                                    $badgeSpec = $asEnabledDisabledBadgeSpec($rawValue);
+                                @endphp
+
+                                @if ($isScriptContent)
+                                    @php
+                                        $code = is_string($rawValue) ? $rawValue : $stringifyValue($rawValue);
+                                        $firstLine = strtok($code, "\n") ?: '';
+                                        $grammar = 'powershell';
+
+                                        if ($policyType === 'deviceShellScript') {
+                                            $shebang = trim($firstLine);
+
+                                            if (str_starts_with($shebang, '#!')) {
+                                                if (str_contains($shebang, 'zsh')) {
+                                                    $grammar = 'zsh';
+                                                } elseif (str_contains($shebang, 'bash')) {
+                                                    $grammar = 'bash';
+                                                } else {
+                                                    $grammar = 'sh';
+                                                }
+                                            } else {
+                                                $grammar = 'sh';
+                                            }
+                                        } elseif ($policyType === 'deviceManagementScript' || $policyType === 'deviceHealthScript') {
+                                            $grammar = 'powershell';
+                                        }
+
+                                        $highlightedHtml = null;
+
+                                        if (class_exists(\Torchlight\Engine\Engine::class)) {
+                                            try {
+                                                $highlightedHtml = (new \Torchlight\Engine\Engine())->codeToHtml(
+                                                    code: $code,
+                                                    grammar: $grammar,
+                                                    theme: [
+                                                        'light' => 'github-light',
+                                                        'dark' => 'github-dark',
+                                                    ],
+                                                    withGutter: false,
+                                                    withWrapper: true,
+                                                );
+                                            } catch (\Throwable $e) {
+                                                $highlightedHtml = null;
+                                            }
+                                        }
+                                    @endphp
+
+                                    <div x-data="{ open: false }" class="space-y-2">
+                                        <div class="flex items-center gap-2">
+                                            <x-filament::button
+                                                size="xs"
+                                                color="gray"
+                                                type="button"
+                                                x-on:click="open = !open"
+                                            >
+                                                <span x-cloak x-show="!open">Show</span>
+                                                <span x-cloak x-show="open">Hide</span>
+                                            </x-filament::button>
+
+                                            <span class="text-xs text-gray-500 dark:text-gray-400">
+                                                {{ number_format(Str::length($code)) }} chars
+                                            </span>
+                                        </div>
+
+                                        <div x-cloak x-show="open">
+                                            @if (is_string($highlightedHtml) && $highlightedHtml !== '')
+                                                @once
+                                                    @include('filament.partials.torchlight-dark-overrides')
+                                                @endonce
+
+                                                <div class="overflow-x-auto">{!! $highlightedHtml !!}</div>
+                                            @else
+                                                <pre class="whitespace-pre-wrap break-words text-xs font-mono text-gray-900 dark:text-white">{{ $code }}</pre>
+                                            @endif
+                                        </div>
+                                    </div>
+                                @elseif ($shouldRenderBadges($rawValue))
+                                    <div class="flex flex-wrap gap-1.5">
+                                        @foreach (($rawValue ?? []) as $item)
+                                            @php
+                                                $itemSpec = $asEnabledDisabledBadgeSpec($item);
+                                            @endphp
+
+                                            @if ($itemSpec)
+                                                <x-filament::badge :color="$itemSpec->color" :icon="$itemSpec->icon" size="sm">
+                                                    {{ $itemSpec->label }}
+                                                </x-filament::badge>
+                                            @else
+                                                <x-filament::badge color="gray" size="sm">
+                                                    {{ is_null($item) ? '—' : (string) $item }}
+                                                </x-filament::badge>
+                                            @endif
+                                        @endforeach
+                                    </div>
+                                @elseif ($badgeSpec)
+                                    <x-filament::badge :color="$badgeSpec->color" :icon="$badgeSpec->icon" size="sm">
+                                        {{ $badgeSpec->label }}
+                                    </x-filament::badge>
+                                @else
+                                    <span class="break-words text-sm text-gray-900 dark:text-white">
+                                        {{ Str::limit($stringifyValue($rawValue), 200) }}
+                                    </span>
+                                @endif
+                            </dd>
+                        </div>
+                    @endforeach
+                </div>
+            </x-filament::section>
+        @endif
+    @endforeach
+</div>

apps/platform/resources/views/filament/infolists/entries/normalized-settings/wrapper.blade.php

@@ -0,0 +1,56 @@
+@php
+    $state = is_array($state ?? null) ? $state : [];
+
+    $surface = array_key_exists('renderExpectations', $state)
+        ? $state
+        : \App\Filament\Support\NormalizedSettingsSurface::build(
+            $state,
+            ($state['context'] ?? 'policy') === 'policy' ? 'policy' : 'policy_version'
+        );
+
+    $warnings = is_array($surface['warnings'] ?? null) ? $surface['warnings'] : [];
+    $settingsTable = is_array($surface['settingsTable'] ?? null) ? $surface['settingsTable'] : null;
+    $settingsTableRows = is_array($settingsTable['rows'] ?? null) ? $settingsTable['rows'] : [];
+    $blocks = is_array($surface['blocks'] ?? null) ? $surface['blocks'] : [];
+    $emptyState = is_array($surface['emptyState'] ?? null) ? $surface['emptyState'] : null;
+@endphp
+
+<div
+    class="space-y-4"
+    data-shared-detail-family="normalized-settings"
+    data-shared-normalized-settings-host="{{ $surface['hostKind'] ?? 'unknown' }}"
+    data-shared-normalized-settings-variant="{{ $surface['variant'] ?? 'standard_blocks' }}"
+>
+    @if ($warnings !== [])
+        <div class="rounded-md border border-amber-300 bg-amber-50 p-3 text-sm text-amber-800" data-shared-zone="warnings">
+            <div class="font-semibold">Warnings</div>
+            <ul class="mt-1 list-disc space-y-1 pl-5">
+                @foreach ($warnings as $warning)
+                    <li>{{ $warning }}</li>
+                @endforeach
+            </ul>
+        </div>
+    @endif
+
+    @if ($settingsTableRows !== [])
+        @include('filament.infolists.entries.normalized-settings.catalog-table', [
+            'settingsTable' => $settingsTable,
+            'context' => $surface['context'] ?? 'policy',
+            'recordId' => $surface['recordId'] ?? null,
+        ])
+    @endif
+
+    @if ($blocks !== [])
+        @include('filament.infolists.entries.normalized-settings.standard-blocks', [
+            'blocks' => $blocks,
+            'policyType' => $surface['policyType'] ?? null,
+        ])
+    @endif
+
+    @if ($settingsTableRows === [] && $blocks === [] && $emptyState !== null)
+        <div class="rounded-lg border border-dashed border-gray-300 bg-white px-6 py-8 text-center dark:border-white/15 dark:bg-gray-900/40" data-shared-zone="empty">
+            <p class="text-sm font-medium text-gray-900 dark:text-white">{{ $emptyState['title'] ?? 'No settings available.' }}</p>
+            <p class="mt-1 text-sm text-gray-600 dark:text-gray-300">{{ $emptyState['message'] ?? 'No normalized settings payload is available for this host.' }}</p>
+        </div>
+    @endif
+</div>

apps/platform/resources/views/filament/infolists/entries/policy-settings-standard.blade.php

@@ -1,355 +1,2 @@
-@php
-    use App\Support\Badges\BadgeCatalog;
-    use App\Support\Badges\BadgeDomain;
-    use App\Support\Badges\BadgeSpec;
-    use Illuminate\Support\Str;
-
-    // Extract state from Filament ViewEntry
-    $state = $getState();
-    $status = $state['status'] ?? 'success';
-    $warnings = $state['warnings'] ?? [];
-    $settings = $state['settings'] ?? [];
-    $settingsTable = $state['settings_table'] ?? null;
-
-    $policyType = $state['policy_type'] ?? null;
-
-    $stringifyValue = function (mixed $value): string {
-        if (is_null($value)) {
-            return 'N/A';
-        }
-
-        if (is_bool($value)) {
-            return $value ? 'Enabled' : 'Disabled';
-        }
-
-        if (is_scalar($value)) {
-            return (string) $value;
-        }
-
-        if (is_array($value)) {
-            $encoded = json_encode($value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
-
-            return is_string($encoded) ? $encoded : 'N/A';
-        }
-
-        if (is_object($value)) {
-            if (method_exists($value, '__toString')) {
-                return (string) $value;
-            }
-
-            $encoded = json_encode((array) $value, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
-
-            return is_string($encoded) ? $encoded : 'N/A';
-        }
-
-        return 'N/A';
-    };
-
-    $shouldRenderBadges = function (mixed $value): bool {
-        if (! is_array($value) || $value === []) {
-            return false;
-        }
-
-        if (! array_is_list($value)) {
-            return false;
-        }
-
-        foreach ($value as $item) {
-            if (! is_scalar($item) && ! is_null($item)) {
-                return false;
-            }
-        }
-
-        return true;
-    };
-
-    $asEnabledDisabledBadgeSpec = function (mixed $value): ?BadgeSpec {
-        $spec = BadgeCatalog::spec(BadgeDomain::BooleanEnabled, $value);
-
-        return $spec->label === 'Unknown' ? null : $spec;
-    };
-@endphp
-
-<div class="space-y-4">
-    {{-- Warnings --}}
-    @if(!empty($warnings))
-        <x-filament::section>
-            <div class="space-y-2">
-                @foreach($warnings as $warning)
-                    <div class="flex items-start gap-2 text-sm text-warning-600 dark:text-warning-400">
-                        <svg class="w-5 h-5 flex-shrink-0 mt-0.5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                            <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"/>
-                        </svg>
-                        <span>{{ $warning }}</span>
-                    </div>
-                @endforeach
-            </div>
-        </x-filament::section>
-    @endif
-
-    {{-- Settings Table (for Settings Catalog legacy format) --}}
-    @if($settingsTable && !empty($settingsTable['rows']))
-        <x-filament::section
-            :heading="$settingsTable['title'] ?? 'Settings'"
-            :description="$settingsTable['description'] ?? null"
-        >
-            <x-slot name="headerEnd">
-                <span class="text-sm text-gray-500 dark:text-gray-400">
-                    {{ count($settingsTable['rows']) }} {{ Str::plural('setting', count($settingsTable['rows'])) }}
-                </span>
-            </x-slot>
-
-            <div class="divide-y divide-gray-200 dark:divide-gray-700">
-                @foreach($settingsTable['rows'] as $row)
-                    <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
-                        <dt class="text-sm font-medium text-gray-500 dark:text-gray-400">
-                            {{ $row['definition'] ?? $row['label'] ?? $row['path'] ?? 'Setting' }}
-                        </dt>
-                        <dd class="mt-1 sm:mt-0 sm:col-span-2">
-                            <span class="text-sm text-gray-900 dark:text-white">
-                                @php
-                                    $badgeSpec = $asEnabledDisabledBadgeSpec($row['value'] ?? null);
-                                @endphp
-
-                                @if($badgeSpec)
-                                    <x-filament::badge :color="$badgeSpec->color" :icon="$badgeSpec->icon" size="sm">
-                                        {{ $badgeSpec->label }}
-                                    </x-filament::badge>
-                                @elseif(is_numeric($row['value']))
-                                    <span class="font-mono font-semibold">{{ $row['value'] }}</span>
-                                @else
-                                    {{ $row['value'] ?? 'N/A' }}
-                                @endif
-                            </span>
-                        </dd>
-                    </div>
-                @endforeach
-            </div>
-        </x-filament::section>
-    @endif
-
-    {{-- Settings Blocks (for OMA Settings, Key/Value pairs, etc.) --}}
-    @foreach($settings as $block)
-        @php
-            $blockType = is_array($block) ? ($block['type'] ?? null) : null;
-        @endphp
-
-        @if($blockType === 'table')
-            <x-filament::section
-                :heading="$block['title'] ?? 'Settings'"
-                collapsible
-            >
-                <x-slot name="headerEnd">
-                    <span class="text-sm text-gray-500 dark:text-gray-400">
-                        {{ count($block['rows'] ?? []) }} {{ Str::plural('item', count($block['rows'] ?? [])) }}
-                    </span>
-                </x-slot>
-
-                <div class="divide-y divide-gray-200 dark:divide-gray-700">
-                    @foreach($block['rows'] ?? [] as $row)
-                        <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
-                            <dt class="text-sm font-medium text-gray-500 dark:text-gray-400 break-words">
-                                {{ $row['label'] ?? $row['path'] ?? 'Setting' }}
-
-                                @if (! empty($row['path']) && ($row['label'] ?? null) !== ($row['path'] ?? null))
-                                    <p class="mt-0.5 text-xs font-mono text-gray-400 dark:text-gray-500 break-all">
-                                        {{ (string) $row['path'] }}
-                                    </p>
-                                @endif
-                                @if(!empty($row['description']))
-                                    <p class="text-xs text-gray-400 mt-0.5">{{ Str::limit($row['description'], 80) }}</p>
-                                @endif
-                            </dt>
-                            <dd class="mt-1 sm:mt-0 sm:col-span-2">
-                                @php
-                                    $badgeSpec = $asEnabledDisabledBadgeSpec($row['value'] ?? null);
-                                @endphp
-
-                                @if($badgeSpec)
-                                    <x-filament::badge :color="$badgeSpec->color" :icon="$badgeSpec->icon" size="sm">
-                                        {{ $badgeSpec->label }}
-                                    </x-filament::badge>
-                                @elseif(is_numeric($row['value']))
-                                    <span class="font-mono text-sm font-semibold text-gray-900 dark:text-white">
-                                        {{ $row['value'] }}
-                                    </span>
-                                @elseif($shouldRenderBadges($row['value'] ?? null))
-                                    <div class="flex flex-wrap gap-1.5">
-                                        @foreach(($row['value'] ?? []) as $item)
-                                            @php
-                                                $itemSpec = $asEnabledDisabledBadgeSpec($item);
-                                            @endphp
-
-                                            @if($itemSpec)
-                                                <x-filament::badge :color="$itemSpec->color" :icon="$itemSpec->icon" size="sm">
-                                                    {{ $itemSpec->label }}
-                                                </x-filament::badge>
-                                            @else
-                                                <x-filament::badge color="gray" size="sm">
-                                                    {{ is_null($item) ? '—' : (string) $item }}
-                                                </x-filament::badge>
-                                            @endif
-                                        @endforeach
-                                    </div>
-                                @else
-                                    <span class="text-sm text-gray-900 dark:text-white break-words">
-                                        {{ Str::limit($stringifyValue($row['value'] ?? null), 200) }}
-                                    </span>
-                                @endif
-                            </dd>
-                        </div>
-                    @endforeach
-                </div>
-            </x-filament::section>
-
-        @elseif($blockType === 'keyValue')
-            <x-filament::section
-                :heading="$block['title'] ?? 'Settings'"
-                collapsible
-            >
-                <x-slot name="headerEnd">
-                    <span class="text-sm text-gray-500 dark:text-gray-400">
-                        {{ count($block['entries'] ?? []) }} {{ Str::plural('entry', count($block['entries'] ?? [])) }}
-                    </span>
-                </x-slot>
-
-                <div class="divide-y divide-gray-200 dark:divide-gray-700">
-                    @foreach($block['entries'] ?? [] as $entry)
-                        <div class="py-3 sm:grid sm:grid-cols-3 sm:gap-4">
-                            <dt class="text-sm font-medium text-gray-500 dark:text-gray-400">
-                                {{ $entry['key'] }}
-                            </dt>
-                            <dd class="mt-1 sm:mt-0 sm:col-span-2">
-                                @php
-                                    $rawValue = $entry['value'] ?? null;
-
-                                    $isScriptContent = in_array($entry['key'] ?? null, ['scriptContent', 'detectionScriptContent', 'remediationScriptContent'], true)
-                                        && (bool) config('tenantpilot.display.show_script_content', false);
-
-                                    $badgeSpec = $asEnabledDisabledBadgeSpec($rawValue);
-                                @endphp
-
-                                @if($isScriptContent)
-                                    @php
-                                        $code = is_string($rawValue) ? $rawValue : $stringifyValue($rawValue);
-                                        $firstLine = strtok($code, "\n") ?: '';
-
-                                        $grammar = 'powershell';
-
-                                        if ($policyType === 'deviceShellScript') {
-                                            $shebang = trim($firstLine);
-
-                                            if (str_starts_with($shebang, '#!')) {
-                                                if (str_contains($shebang, 'zsh')) {
-                                                    $grammar = 'zsh';
-                                                } elseif (str_contains($shebang, 'bash')) {
-                                                    $grammar = 'bash';
-                                                } else {
-                                                    $grammar = 'sh';
-                                                }
-                                            } else {
-                                                $grammar = 'sh';
-                                            }
-                                        } elseif ($policyType === 'deviceManagementScript' || $policyType === 'deviceHealthScript') {
-                                            $grammar = 'powershell';
-                                        }
-
-                                        $highlightedHtml = null;
-
-                                        if (class_exists(\Torchlight\Engine\Engine::class)) {
-                                            try {
-                                                $highlightedHtml = (new \Torchlight\Engine\Engine())->codeToHtml(
-                                                    code: $code,
-                                                    grammar: $grammar,
-                                                    theme: [
-                                                        'light' => 'github-light',
-                                                        'dark' => 'github-dark',
-                                                    ],
-                                                    withGutter: false,
-                                                    withWrapper: true,
-                                                );
-                                            } catch (\Throwable $e) {
-                                                $highlightedHtml = null;
-                                            }
-                                        }
-                                    @endphp
-
-                                    <div x-data="{ open: false }" class="space-y-2">
-                                        <div class="flex items-center gap-2">
-                                            <x-filament::button
-                                                size="xs"
-                                                color="gray"
-                                                type="button"
-                                                x-on:click="open = !open"
-                                            >
-                                                <span x-show="!open" x-cloak>Show</span>
-                                                <span x-show="open" x-cloak>Hide</span>
-                                            </x-filament::button>
-
-                                            <span class="text-xs text-gray-500 dark:text-gray-400">
-                                                {{ number_format(Str::length($code)) }} chars
-                                            </span>
-                                        </div>
-
-                                        <div x-show="open" x-cloak>
-                                            @if (is_string($highlightedHtml) && $highlightedHtml !== '')
-                                                @once
-                                                    @include('filament.partials.torchlight-dark-overrides')
-                                                @endonce
-
-                                                <div class="overflow-x-auto">{!! $highlightedHtml !!}</div>
-                                            @else
-                                                <pre class="text-xs font-mono text-gray-900 dark:text-white whitespace-pre-wrap break-words">{{ $code }}</pre>
-                                            @endif
-                                        </div>
-                                    </div>
-                                @elseif($shouldRenderBadges($rawValue))
-                                    <div class="flex flex-wrap gap-1.5">
-                                        @foreach(($rawValue ?? []) as $item)
-                                            @php
-                                                $itemSpec = $asEnabledDisabledBadgeSpec($item);
-                                            @endphp
-
-                                            @if($itemSpec)
-                                                <x-filament::badge :color="$itemSpec->color" :icon="$itemSpec->icon" size="sm">
-                                                    {{ $itemSpec->label }}
-                                                </x-filament::badge>
-                                            @else
-                                                <x-filament::badge color="gray" size="sm">
-                                                    {{ is_null($item) ? '—' : (string) $item }}
-                                                </x-filament::badge>
-                                            @endif
-                                        @endforeach
-                                    </div>
-                                @elseif($badgeSpec)
-                                    <x-filament::badge :color="$badgeSpec->color" :icon="$badgeSpec->icon" size="sm">
-                                        {{ $badgeSpec->label }}
-                                    </x-filament::badge>
-                                @else
-                                    <span class="text-sm text-gray-900 dark:text-white break-words">
-                                        {{ Str::limit($stringifyValue($rawValue), 200) }}
-                                    </span>
-                                @endif
-                            </dd>
-                        </div>
-                    @endforeach
-                </div>
-            </x-filament::section>
-        @endif
-    @endforeach
-
-    {{-- Empty state --}}
-    @if(empty($settings) && (!$settingsTable || empty($settingsTable['rows'])))
-        <div class="text-center py-12">
-            <svg class="mx-auto h-12 w-12 text-gray-400" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-                <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"/>
-            </svg>
-            <p class="mt-4 text-sm text-gray-500 dark:text-gray-400">
-                No settings data available
-            </p>
-            <p class="mt-1 text-xs text-gray-400 dark:text-gray-500">
-                This policy may not contain settings, or they are in an unsupported format
-            </p>
-        </div>
-    @endif
-</div>
+{{-- NormalizedSettingsSurface policy-settings-standard compatibility wrapper --}}
+@include('filament.infolists.entries.normalized-settings.wrapper', ['state' => $getState() ?? []])

apps/platform/resources/views/filament/pages/monitoring/evidence-overview.blade.php

@@ -1,59 +1,5 @@
 <x-filament-panels::page>
     <div class="space-y-6">
-        @if ($rows === [])
-            <div class="rounded-xl border border-dashed border-gray-300 bg-white p-8 text-center shadow-sm">
-                <h2 class="text-lg font-semibold text-gray-950">No evidence snapshots in this scope</h2>
-                <p class="mt-2 text-sm text-gray-600">Adjust filters or create a tenant snapshot to populate the workspace overview.</p>
-                <div class="mt-4">
-                    <a href="{{ route('admin.evidence.overview') }}" class="inline-flex items-center rounded-lg bg-gray-900 px-4 py-2 text-sm font-medium text-white">
-                        Clear filters
-                    </a>
-                </div>
-            </div>
-        @else
-            <div class="overflow-hidden rounded-xl border border-gray-200 bg-white shadow-sm">
-                <table class="min-w-full divide-y divide-gray-200 text-sm">
-                    <thead class="bg-gray-50 text-left text-gray-600">
-                        <tr>
-                            <th class="px-4 py-3 font-medium">Tenant</th>
-                            <th class="px-4 py-3 font-medium">Artifact truth</th>
-                            <th class="px-4 py-3 font-medium">Freshness</th>
-                            <th class="px-4 py-3 font-medium">Generated</th>
-                            <th class="px-4 py-3 font-medium">Not collected yet</th>
-                            <th class="px-4 py-3 font-medium">Refresh recommended</th>
-                            <th class="px-4 py-3 font-medium">Next step</th>
-                            <th class="px-4 py-3 font-medium">Action</th>
-                        </tr>
-                    </thead>
-                    <tbody class="divide-y divide-gray-100 bg-white text-gray-900">
-                        @foreach ($rows as $row)
-                            <tr>
-                                <td class="px-4 py-3">{{ $row['tenant_name'] }}</td>
-                                <td class="px-4 py-3">
-                                    <x-filament::badge :color="data_get($row, 'artifact_truth.color', 'gray')" :icon="data_get($row, 'artifact_truth.icon')" size="sm">
-                                        {{ data_get($row, 'artifact_truth.label', 'Unknown') }}
-                                    </x-filament::badge>
-                                    @if (is_string(data_get($row, 'artifact_truth.explanation')) && trim((string) data_get($row, 'artifact_truth.explanation')) !== '')
-                                        <div class="mt-1 text-xs text-gray-500">{{ data_get($row, 'artifact_truth.explanation') }}</div>
-                                    @endif
-                                </td>
-                                <td class="px-4 py-3">
-                                    <x-filament::badge :color="data_get($row, 'freshness.color', 'gray')" :icon="data_get($row, 'freshness.icon')" size="sm">
-                                        {{ data_get($row, 'freshness.label', 'Unknown') }}
-                                    </x-filament::badge>
-                                </td>
-                                <td class="px-4 py-3">{{ $row['generated_at'] ?? '—' }}</td>
-                                <td class="px-4 py-3">{{ $row['missing_dimensions'] }}</td>
-                                <td class="px-4 py-3">{{ $row['stale_dimensions'] }}</td>
-                                <td class="px-4 py-3">{{ $row['next_step'] ?? 'No action needed' }}</td>
-                                <td class="px-4 py-3">
-                                    <a href="{{ $row['view_url'] }}" class="text-primary-600 hover:text-primary-500">View tenant evidence</a>
-                                </td>
-                            </tr>
-                        @endforeach
-                    </tbody>
-                </table>
-            </div>
-        @endif
+        {{ $this->table }}
     </div>
 </x-filament-panels::page>

apps/platform/resources/views/filament/pages/tenant-required-permissions.blade.php

@@ -6,7 +6,7 @@
 
     $tenant = $this->currentTenant();
 
-    $vm = is_array($viewModel ?? null) ? $viewModel : [];
+    $vm = $this->viewModel();
     $overview = is_array($vm['overview'] ?? null) ? $vm['overview'] : [];
     $counts = is_array($overview['counts'] ?? null) ? $overview['counts'] : [];
     $featureImpacts = is_array($overview['feature_impacts'] ?? null) ? $overview['feature_impacts'] : [];
@@ -14,20 +14,6 @@
 
     $filters = is_array($vm['filters'] ?? null) ? $vm['filters'] : [];
     $selectedFeatures = is_array($filters['features'] ?? null) ? $filters['features'] : [];
-    $selectedStatus = (string) ($filters['status'] ?? 'missing');
-    $selectedType = (string) ($filters['type'] ?? 'all');
-    $searchTerm = (string) ($filters['search'] ?? '');
-
-    $featureOptions = collect($featureImpacts)
-        ->filter(fn (mixed $impact): bool => is_array($impact) && is_string($impact['feature'] ?? null))
-        ->map(fn (array $impact): string => (string) $impact['feature'])
-        ->filter()
-        ->unique()
-        ->sort()
-        ->values()
-        ->all();
-
-    $permissions = is_array($vm['permissions'] ?? null) ? $vm['permissions'] : [];
 
     $overall = $overview['overall'] ?? null;
     $overallSpec = $overall !== null ? BadgeRenderer::spec(BadgeDomain::VerificationReportOverall, $overall) : null;
@@ -226,10 +212,8 @@ class="text-primary-600 hover:underline dark:text-primary-400"
                                 $selected = in_array($featureKey, $selectedFeatures, true);
                             @endphp
 
-                            <button
-                                type="button"
-                                wire:click="applyFeatureFilter(@js($featureKey))"
-                                class="rounded-xl border p-4 text-left transition hover:bg-gray-50 dark:hover:bg-gray-900/40 {{ $selected ? 'border-primary-300 bg-primary-50 dark:border-primary-700 dark:bg-primary-950/40' : 'border-gray-200 bg-white dark:border-gray-800 dark:bg-gray-900' }}"
+                            <div
+                                class="rounded-xl border p-4 text-left {{ $selected ? 'border-primary-300 bg-primary-50 dark:border-primary-700 dark:bg-primary-950/40' : 'border-gray-200 bg-white dark:border-gray-800 dark:bg-gray-900' }}"
                             >
                                 <div class="flex items-start justify-between gap-3">
                                     <div class="min-w-0">
@@ -245,17 +229,9 @@ class="rounded-xl border p-4 text-left transition hover:bg-gray-50 dark:hover:bg
                                         {{ $isBlocked ? 'Blocked' : ($missingCount > 0 ? 'At risk' : 'OK') }}
                                     </x-filament::badge>
                                 </div>
-                            </button>
+                            </div>
                         @endforeach
                     </div>
-
-                    @if ($selectedFeatures !== [])
-                        <div>
-                            <x-filament::button color="gray" size="sm" wire:click="clearFeatureFilter">
-                                Clear feature filter
-                            </x-filament::button>
-                        </div>
-                    @endif
                 @endif
 
                 <div
@@ -475,182 +451,14 @@ class="group rounded-xl border border-gray-200 bg-white p-4 dark:border-gray-800
                 </div>
             @else
                 <div class="space-y-6">
-                    <div class="rounded-xl border border-gray-200 bg-white p-4 dark:border-gray-800 dark:bg-gray-900">
-                        <div class="flex flex-wrap items-start justify-between gap-3">
-                            <div>
-                                <div class="text-sm font-semibold text-gray-950 dark:text-white">Filters</div>
-                                <div class="mt-1 text-xs text-gray-600 dark:text-gray-300">
-                                    Search doesn’t affect copy actions. Feature filters do.
-                                </div>
-                            </div>
-
-                            <x-filament::button color="gray" size="sm" wire:click="resetFilters">
-                                Reset
-                            </x-filament::button>
-                        </div>
-
-                        <div class="mt-4 grid gap-3 sm:grid-cols-4">
-                            <div class="space-y-1">
-                                <label class="text-xs font-medium text-gray-600 dark:text-gray-300">Status</label>
-                                <select wire:model.live="status" class="fi-input fi-select w-full">
-                                    <option value="missing">Missing</option>
-                                    <option value="present">Present</option>
-                                    <option value="all">All</option>
-                                </select>
-                            </div>
-
-                            <div class="space-y-1">
-                                <label class="text-xs font-medium text-gray-600 dark:text-gray-300">Type</label>
-                                <select wire:model.live="type" class="fi-input fi-select w-full">
-                                    <option value="all">All</option>
-                                    <option value="application">Application</option>
-                                    <option value="delegated">Delegated</option>
-                                </select>
-                            </div>
-
-                            <div class="space-y-1 sm:col-span-2">
-                                <label class="text-xs font-medium text-gray-600 dark:text-gray-300">Search</label>
-                                <input
-                                    type="search"
-                                    wire:model.live.debounce.500ms="search"
-                                    class="fi-input w-full"
-                                    placeholder="Search permission key or description…"
-                                />
-                            </div>
-
-                            @if ($featureOptions !== [])
-                                <div class="space-y-1 sm:col-span-4">
-                                    <label class="text-xs font-medium text-gray-600 dark:text-gray-300">Features</label>
-                                    <select wire:model.live="features" class="fi-input fi-select w-full" multiple>
-                                        @foreach ($featureOptions as $feature)
-                                            <option value="{{ $feature }}">{{ $feature }}</option>
-                                        @endforeach
-                                    </select>
-                                </div>
-                            @endif
+                    <div class="rounded-xl border border-gray-200 bg-white p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
+                        <div class="font-semibold text-gray-950 dark:text-white">Native permission matrix</div>
+                        <div class="mt-1 text-xs text-gray-600 dark:text-gray-300">
+                            Search doesn’t affect copy actions. Feature filters do.
                         </div>
                     </div>
 
-                    @if ($requiredTotal === 0)
-                        <div class="rounded-xl border border-gray-200 bg-white p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
-                            <div class="font-semibold text-gray-950 dark:text-white">No permissions configured</div>
-                            <div class="mt-1">
-                                No required permissions are currently configured in <code class="font-mono text-xs">config/intune_permissions.php</code>.
-                            </div>
-                        </div>
-                    @elseif ($permissions === [])
-                        <div class="rounded-xl border border-gray-200 bg-white p-4 text-sm text-gray-700 dark:border-gray-800 dark:bg-gray-900 dark:text-gray-200">
-                            @if ($selectedStatus === 'missing' && $missingTotal === 0 && $selectedType === 'all' && $selectedFeatures === [] && trim($searchTerm) === '')
-                                <div class="font-semibold text-gray-950 dark:text-white">All required permissions are present</div>
-                                <div class="mt-1">
-                                    Switch Status to “All” if you want to review the full matrix.
-                                </div>
-                            @else
-                                <div class="font-semibold text-gray-950 dark:text-white">No matches</div>
-                                <div class="mt-1">
-                                    No permissions match the current filters.
-                                </div>
-                            @endif
-                        </div>
-                    @else
-                    @php
-                        $featuresToRender = $featureImpacts;
-
-                        if ($selectedFeatures !== []) {
-                            $featuresToRender = collect($featureImpacts)
-                                ->filter(fn ($impact) => is_array($impact) && in_array((string) ($impact['feature'] ?? ''), $selectedFeatures, true))
-                                ->values()
-                                ->all();
-                        }
-                    @endphp
-
-                    @foreach ($featuresToRender as $impact)
-                        @php
-                            $featureKey = is_array($impact) ? ($impact['feature'] ?? null) : null;
-                            $featureKey = is_string($featureKey) ? $featureKey : null;
-
-                            if ($featureKey === null) {
-                                continue;
-                            }
-
-                            $rows = collect($permissions)
-                                ->filter(fn ($row) => is_array($row) && in_array($featureKey, (array) ($row['features'] ?? []), true))
-                                ->values()
-                                ->all();
-
-                            if ($rows === []) {
-                                continue;
-                            }
-                        @endphp
-
-                        <div class="space-y-3">
-                            <div class="flex items-center justify-between gap-4">
-                                <div class="text-sm font-semibold text-gray-950 dark:text-white">
-                                    {{ $featureKey }}
-                                </div>
-                            </div>
-
-                            <div class="overflow-hidden rounded-xl border border-gray-200 dark:border-gray-800">
-                                <table class="min-w-full divide-y divide-gray-200 dark:divide-gray-800">
-                                    <thead class="bg-gray-50 dark:bg-gray-900">
-                                        <tr>
-                                            <th class="px-4 py-2 text-left text-xs font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                                                Permission
-                                            </th>
-                                            <th class="px-4 py-2 text-left text-xs font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                                                Type
-                                            </th>
-                                            <th class="px-4 py-2 text-left text-xs font-semibold uppercase tracking-wide text-gray-600 dark:text-gray-300">
-                                                Status
-                                            </th>
-                                        </tr>
-                                    </thead>
-                                    <tbody class="divide-y divide-gray-200 bg-white dark:divide-gray-800 dark:bg-gray-950">
-                                        @foreach ($rows as $row)
-                                            @php
-                                                $key = is_array($row) ? (string) ($row['key'] ?? '') : '';
-                                                $type = is_array($row) ? (string) ($row['type'] ?? '') : '';
-                                                $status = is_array($row) ? (string) ($row['status'] ?? '') : '';
-                                                $description = is_array($row) ? ($row['description'] ?? null) : null;
-                                                $description = is_string($description) ? $description : null;
-
-                                                $statusSpec = BadgeRenderer::spec(BadgeDomain::TenantPermissionStatus, $status);
-                                            @endphp
-
-                                            <tr
-                                                class="align-top"
-                                                data-permission-key="{{ $key }}"
-                                                data-permission-type="{{ $type }}"
-                                                data-permission-status="{{ $status }}"
-                                            >
-                                                <td class="px-4 py-3">
-                                                    <div class="text-sm font-medium text-gray-950 dark:text-white">
-                                                        {{ $key }}
-                                                    </div>
-                                                    @if ($description)
-                                                        <div class="mt-1 text-xs text-gray-600 dark:text-gray-300">
-                                                            {{ $description }}
-                                                        </div>
-                                                    @endif
-                                                </td>
-                                                <td class="px-4 py-3">
-                                                    <x-filament::badge color="gray" size="sm">
-                                                        {{ $type === 'delegated' ? 'Delegated' : 'Application' }}
-                                                    </x-filament::badge>
-                                                </td>
-                                                <td class="px-4 py-3">
-                                                    <x-filament::badge :color="$statusSpec->color" :icon="$statusSpec->icon" size="sm">
-                                                        {{ $statusSpec->label }}
-                                                    </x-filament::badge>
-                                                </td>
-                                            </tr>
-                                        @endforeach
-                                    </tbody>
-                                </table>
-                            </div>
-                        </div>
-                    @endforeach
-                    @endif
+                    {{ $this->table }}
                 </div>
             @endif
                 </div>

apps/platform/resources/views/filament/widgets/tenant/tenant-verification-report.blade.php

@@ -94,8 +94,7 @@
             @endif
         @else
             @include('filament.components.verification-report-viewer', [
-                'run' => $runData,
-                'report' => $report,
+                'surface' => $surface ?? [],
                 'redactionNotes' => $redactionNotes ?? [],
             ])
 

apps/platform/resources/views/livewire/inventory-item-dependency-edges-table.blade.php

@@ -0,0 +1,3 @@
+<div>
+    {{ $this->table }}
+</div>

apps/platform/tests/Feature/Drift/DriftFindingDetailShowsSettingsDiffTest.php

@@ -86,7 +86,7 @@
         'display_name' => 'My Policy 123',
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->get(FindingResource::getUrl('view', ['record' => $finding], tenant: $tenant))
         ->assertOk()
         ->assertSee('Normalized diff')
@@ -96,4 +96,10 @@
         ->assertSee('To')
         ->assertSee('Old value')
         ->assertSee('New value');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="groups"');
 });

apps/platform/tests/Feature/Drift/DriftFindingDiffUnavailableTest.php

@@ -37,7 +37,7 @@
         ],
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->get(route('filament.tenant.resources.findings.view', array_merge(
             filamentTenantRouteParams($tenant),
             ['record' => $finding],
@@ -45,6 +45,11 @@
         ->assertOk()
         ->assertSee('Diff unavailable')
         ->assertDontSee('No normalized changes were found');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"')
+        ->toContain('data-shared-normalized-diff-state="unavailable"');
 });
 
 it('renders a diff against an empty baseline for unexpected_policy findings with a current policy version reference', function (): void {
@@ -101,7 +106,7 @@
         ],
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->get(route('filament.tenant.resources.findings.view', array_merge(
             filamentTenantRouteParams($tenant),
             ['record' => $finding],
@@ -110,6 +115,11 @@
         ->assertDontSee('Diff unavailable')
         ->assertSee('1 added')
         ->assertSee('Password required');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"')
+        ->toContain('data-shared-normalized-diff-state="available"');
 });
 
 it('renders a diff against an empty current side for missing_policy findings with a baseline policy version reference', function (): void {
@@ -166,7 +176,7 @@
         ],
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->get(route('filament.tenant.resources.findings.view', array_merge(
             filamentTenantRouteParams($tenant),
             ['record' => $finding],
@@ -175,4 +185,9 @@
         ->assertDontSee('Diff unavailable')
         ->assertSee('1 removed')
         ->assertSee('Password required');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"')
+        ->toContain('data-shared-normalized-diff-state="available"');
 });

apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php

@@ -2,6 +2,7 @@
 
 declare(strict_types=1);
 
+use App\Filament\Pages\Monitoring\EvidenceOverview;
 use App\Filament\Resources\EvidenceSnapshotResource;
 use App\Models\EvidenceSnapshot;
 use App\Models\Tenant;
@@ -10,6 +11,7 @@
 use App\Support\Workspaces\WorkspaceContext;
 use Filament\Facades\Filament;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
 use Tests\Feature\Concerns\BuildsGovernanceArtifactTruthFixtures;
 
 uses(RefreshDatabase::class, BuildsGovernanceArtifactTruthFixtures::class);
@@ -122,3 +124,56 @@
         ->assertSee(EvidenceSnapshotResource::getUrl('view', ['record' => $staleSnapshot], tenant: $staleTenant), false)
         ->assertSee(EvidenceSnapshotResource::getUrl('view', ['record' => $freshSnapshot], tenant: $freshTenant), false);
 });
+
+it('seeds the native entitled-tenant prefilter once and clears it through the page action', function (): void {
+    $tenantA = Tenant::factory()->create();
+    [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');
+
+    $tenantB = Tenant::factory()->create([
+        'workspace_id' => (int) $tenantA->workspace_id,
+    ]);
+    createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');
+
+    $snapshotA = EvidenceSnapshot::query()->create([
+        'tenant_id' => (int) $tenantA->getKey(),
+        'workspace_id' => (int) $tenantA->workspace_id,
+        'status' => EvidenceSnapshotStatus::Active->value,
+        'completeness_state' => EvidenceCompletenessState::Complete->value,
+        'summary' => ['missing_dimensions' => 0, 'stale_dimensions' => 0],
+        'generated_at' => now(),
+    ]);
+
+    $snapshotB = EvidenceSnapshot::query()->create([
+        'tenant_id' => (int) $tenantB->getKey(),
+        'workspace_id' => (int) $tenantB->workspace_id,
+        'status' => EvidenceSnapshotStatus::Active->value,
+        'completeness_state' => EvidenceCompletenessState::Partial->value,
+        'summary' => ['missing_dimensions' => 1, 'stale_dimensions' => 0],
+        'generated_at' => now(),
+    ]);
+
+    $this->actingAs($user);
+    setAdminPanelContext();
+    Filament::setTenant(null, true);
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenantA->workspace_id);
+
+    $component = Livewire::withQueryParams([
+        'tenant_id' => (string) $tenantB->getKey(),
+        'search' => $tenantB->name,
+    ])->test(EvidenceOverview::class);
+
+    $component
+        ->assertSet('tableFilters.tenant_id.value', (string) $tenantB->getKey())
+        ->assertSet('tableSearch', $tenantB->name)
+        ->assertCanSeeTableRecords([(string) $snapshotB->getKey()])
+        ->assertCanNotSeeTableRecords([(string) $snapshotA->getKey()]);
+
+    $component
+        ->callAction('clear_filters')
+        ->assertSet('tableFilters.tenant_id.value', null)
+        ->assertSet('tableSearch', '')
+        ->assertCanSeeTableRecords([
+            (string) $snapshotA->getKey(),
+            (string) $snapshotB->getKey(),
+        ]);
+});

apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php

@@ -40,6 +40,8 @@
 
     Livewire::actingAs($user)
         ->test(EvidenceOverview::class)
+        ->assertCountTableRecords(1)
+        ->assertCanSeeTableRecords([(string) $snapshot->getKey()])
         ->assertSee($tenant->name)
         ->assertSee('Artifact truth');
 

apps/platform/tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php

@@ -1,6 +1,14 @@
 <?php
 
+use App\Filament\Resources\PolicyVersionResource;
+use App\Models\Policy;
+use App\Models\PolicyVersion;
+use App\Models\Tenant;
 use App\Services\Intune\PolicyNormalizer;
+use Carbon\CarbonImmutable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
 
 test('group policy configuration normalized diff keys use definition display names', function () {
     $flat = app(PolicyNormalizer::class)->flattenForDiff(
@@ -27,3 +35,77 @@
     expect($keys)->toContain('Administrative Template settings > Windows Components\\Security Options > Block legacy auth (def-1)');
     expect(implode("\n", $keys))->not->toContain('graph.microsoft.com');
 });
+
+test('group policy configuration policy-version detail renders the shared normalized diff family', function () {
+    $tenant = Tenant::factory()->create([
+        'status' => 'active',
+    ]);
+
+    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');
+
+    $policy = Policy::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'external_id' => 'gpo-policy-1',
+        'policy_type' => 'groupPolicyConfiguration',
+        'display_name' => 'Admin Templates Alpha',
+        'platform' => 'windows',
+    ]);
+
+    PolicyVersion::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'policy_id' => (int) $policy->getKey(),
+        'version_number' => 1,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now()->subMinute(),
+        'snapshot' => [
+            'id' => 'gpo-1',
+            'displayName' => 'Admin Templates Alpha',
+            '@odata.type' => '#microsoft.graph.groupPolicyConfiguration',
+            'definitionValues' => [
+                [
+                    'enabled' => false,
+                    'definition@odata.bind' => 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions(\'def-1\')',
+                    '#Definition_Id' => 'def-1',
+                    '#Definition_displayName' => 'Block legacy auth',
+                    '#Definition_categoryPath' => 'Windows Components\\Security Options',
+                ],
+            ],
+        ],
+    ]);
+
+    $version = PolicyVersion::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'policy_id' => (int) $policy->getKey(),
+        'version_number' => 2,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            'id' => 'gpo-1',
+            'displayName' => 'Admin Templates Alpha',
+            '@odata.type' => '#microsoft.graph.groupPolicyConfiguration',
+            'definitionValues' => [
+                [
+                    'enabled' => true,
+                    'definition@odata.bind' => 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions(\'def-1\')',
+                    '#Definition_Id' => 'def-1',
+                    '#Definition_displayName' => 'Block legacy auth',
+                    '#Definition_categoryPath' => 'Windows Components\\Security Options',
+                ],
+            ],
+        ],
+    ]);
+
+    $response = $this->actingAs($user)
+        ->get(PolicyVersionResource::getUrl('view', ['record' => $version], tenant: $tenant));
+
+    $response->assertSuccessful()->assertSee('Block legacy auth');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="policy_version"')
+        ->toContain('data-shared-zone="groups"');
+});

apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php

@@ -0,0 +1,131 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Livewire\InventoryItemDependencyEdgesTable;
+use App\Models\InventoryItem;
+use App\Models\InventoryLink;
+use App\Models\Tenant;
+use App\Models\User;
+use Filament\Facades\Filament;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function dependencyEdgesTableComponent(User $user, Tenant $tenant, InventoryItem $item)
+{
+    $tenant->makeCurrent();
+    Filament::setTenant($tenant, true);
+
+    test()->actingAs($user);
+
+    return Livewire::actingAs($user)->test(InventoryItemDependencyEdgesTable::class, [
+        'inventoryItemId' => (int) $item->getKey(),
+    ]);
+}
+
+it('renders dependency rows through native table filters and preserves missing-target hints', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $item = InventoryItem::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'external_id' => (string) Str::uuid(),
+    ]);
+
+    $assigned = InventoryLink::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'source_type' => 'inventory_item',
+        'source_id' => $item->external_id,
+        'target_type' => 'missing',
+        'target_id' => null,
+        'relationship_type' => 'assigned_to',
+        'metadata' => [
+            'last_known_name' => 'Assigned Target',
+            'raw_ref' => ['example' => 'assigned'],
+        ],
+    ]);
+
+    $scoped = InventoryLink::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'source_type' => 'inventory_item',
+        'source_id' => $item->external_id,
+        'target_type' => 'missing',
+        'target_id' => null,
+        'relationship_type' => 'scoped_by',
+        'metadata' => [
+            'last_known_name' => 'Scoped Target',
+            'raw_ref' => ['example' => 'scoped'],
+        ],
+    ]);
+
+    $inbound = InventoryLink::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'source_type' => 'inventory_item',
+        'source_id' => (string) Str::uuid(),
+        'target_type' => 'inventory_item',
+        'target_id' => $item->external_id,
+        'relationship_type' => 'depends_on',
+    ]);
+
+    $component = dependencyEdgesTableComponent($user, $tenant, $item)
+        ->assertTableFilterExists('direction')
+        ->assertTableFilterExists('relationship_type')
+        ->assertCanSeeTableRecords([
+            (string) $assigned->getKey(),
+            (string) $scoped->getKey(),
+            (string) $inbound->getKey(),
+        ])
+        ->assertSee('Assigned Target')
+        ->assertSee('Scoped Target')
+        ->assertSee('Missing');
+
+    $component
+        ->filterTable('direction', 'outbound')
+        ->assertCanSeeTableRecords([
+            (string) $assigned->getKey(),
+            (string) $scoped->getKey(),
+        ])
+        ->assertCanNotSeeTableRecords([(string) $inbound->getKey()])
+        ->removeTableFilters()
+        ->filterTable('direction', 'inbound')
+        ->assertCanSeeTableRecords([(string) $inbound->getKey()])
+        ->assertCanNotSeeTableRecords([
+            (string) $assigned->getKey(),
+            (string) $scoped->getKey(),
+        ])
+        ->removeTableFilters()
+        ->filterTable('relationship_type', 'scoped_by')
+        ->assertCanSeeTableRecords([(string) $scoped->getKey()])
+        ->assertCanNotSeeTableRecords([
+            (string) $assigned->getKey(),
+            (string) $inbound->getKey(),
+        ])
+        ->removeTableFilters()
+        ->filterTable('direction', 'outbound')
+        ->filterTable('relationship_type', 'depends_on')
+        ->assertCountTableRecords(0)
+        ->assertSee('No dependencies found');
+});
+
+it('returns deny-as-not-found when mounted for an item outside the current tenant scope', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $foreignItem = InventoryItem::factory()->create([
+        'tenant_id' => (int) Tenant::factory()->create()->getKey(),
+        'external_id' => (string) Str::uuid(),
+    ]);
+
+    $tenant->makeCurrent();
+    Filament::setTenant($tenant, true);
+    $this->actingAs($user);
+
+    $component = Livewire::actingAs($user)->test(InventoryItemDependencyEdgesTable::class, [
+        'inventoryItemId' => (int) $foreignItem->getKey(),
+    ]);
+
+    $component->assertSee('Not Found');
+
+    expect($component->instance())->toBeNull();
+});

apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php

@@ -0,0 +1,172 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Resources\FindingResource;
+use App\Filament\Resources\PolicyResource;
+use App\Filament\Resources\PolicyVersionResource;
+use App\Models\Finding;
+use App\Models\InventoryItem;
+use App\Models\Policy;
+use App\Models\PolicyVersion;
+use Carbon\CarbonImmutable;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('renders shared normalized settings and diff families on policy and policy-version detail hosts', function (): void {
+    $tenant = \App\Models\Tenant::factory()->create([
+        'name' => 'Tenant One',
+        'status' => 'active',
+    ]);
+
+    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');
+
+    $policy = Policy::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'external_id' => 'policy-1',
+        'policy_type' => 'deviceConfiguration',
+        'display_name' => 'Policy A',
+        'platform' => 'windows',
+    ]);
+
+    PolicyVersion::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'policy_id' => $policy->getKey(),
+        'version_number' => 1,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now()->subMinute(),
+        'snapshot' => [
+            'displayName' => 'Policy A',
+            'settings' => [
+                ['displayName' => 'Enable feature', 'value' => ['value' => 'off']],
+            ],
+        ],
+    ]);
+
+    $version = PolicyVersion::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'policy_id' => $policy->getKey(),
+        'version_number' => 2,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            'displayName' => 'Policy A',
+            'settings' => [
+                ['displayName' => 'Enable feature', 'value' => ['value' => 'on']],
+            ],
+        ],
+    ]);
+
+    $policyResponse = $this->actingAs($user)
+        ->get(PolicyResource::getUrl('view', ['record' => $policy], tenant: $tenant));
+
+    $policyResponse->assertSuccessful()->assertSee('Enable feature');
+
+    expect($policyResponse->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy"');
+
+    $versionResponse = $this->actingAs($user)
+        ->get(PolicyVersionResource::getUrl('view', ['record' => $version], tenant: $tenant));
+
+    $versionResponse->assertSuccessful()->assertSee('Normalized diff');
+
+    expect($versionResponse->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy_version"')
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="policy_version"');
+});
+
+it('renders the shared normalized diff family on finding detail hosts', function (): void {
+    bindFailHardGraphClient();
+
+    [$user, $tenant] = createUserWithTenant(role: 'manager');
+
+    $baseline = createInventorySyncOperationRun($tenant, [
+        'selection_hash' => hash('sha256', 'shared-detail-contract'),
+        'status' => 'success',
+        'finished_at' => now()->subDays(2),
+    ]);
+
+    $current = createInventorySyncOperationRun($tenant, [
+        'selection_hash' => $baseline->selection_hash,
+        'status' => 'success',
+        'finished_at' => now()->subDay(),
+    ]);
+
+    $policy = Policy::factory()->for($tenant)->create([
+        'external_id' => 'policy-123',
+        'policy_type' => 'deviceConfiguration',
+        'platform' => 'windows10',
+    ]);
+
+    $baselineVersion = PolicyVersion::factory()->for($tenant)->create([
+        'policy_id' => $policy->getKey(),
+        'version_number' => 1,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'captured_at' => $baseline->finished_at->copy()->subHour(),
+        'snapshot' => [
+            'displayName' => 'My Policy',
+            'customSettingFoo' => 'Old value',
+        ],
+    ]);
+
+    $currentVersion = PolicyVersion::factory()->for($tenant)->create([
+        'policy_id' => $policy->getKey(),
+        'version_number' => 2,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'captured_at' => $current->finished_at->copy()->subHour(),
+        'snapshot' => [
+            'displayName' => 'My Policy',
+            'customSettingFoo' => 'New value',
+        ],
+    ]);
+
+    $finding = Finding::factory()->for($tenant)->create([
+        'finding_type' => Finding::FINDING_TYPE_DRIFT,
+        'scope_key' => (string) $current->selection_hash,
+        'baseline_operation_run_id' => $baseline->getKey(),
+        'current_operation_run_id' => $current->getKey(),
+        'subject_type' => 'policy',
+        'subject_external_id' => $policy->external_id,
+        'evidence_jsonb' => [
+            'change_type' => 'modified',
+            'summary' => [
+                'kind' => 'policy_snapshot',
+                'changed_fields' => ['snapshot_hash'],
+            ],
+            'baseline' => [
+                'policy_id' => $policy->external_id,
+                'policy_version_id' => $baselineVersion->getKey(),
+                'snapshot_hash' => 'baseline-hash',
+            ],
+            'current' => [
+                'policy_id' => $policy->external_id,
+                'policy_version_id' => $currentVersion->getKey(),
+                'snapshot_hash' => 'current-hash',
+            ],
+        ],
+    ]);
+
+    InventoryItem::factory()->for($tenant)->create([
+        'external_id' => $finding->subject_external_id,
+        'display_name' => 'My Policy 123',
+    ]);
+
+    $response = $this->actingAs($user)
+        ->get(FindingResource::getUrl('view', ['record' => $finding], tenant: $tenant));
+
+    $response->assertSuccessful()->assertSee('Normalized diff');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"');
+});

apps/platform/tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php

@@ -4,8 +4,10 @@
 
 use App\Filament\Resources\PolicyResource\Pages\ListPolicies;
 use App\Models\Policy;
+use App\Models\PolicyVersion;
 use App\Models\Tenant;
 use App\Support\Workspaces\WorkspaceContext;
+use Carbon\CarbonImmutable;
 use Filament\Facades\Filament;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
@@ -35,3 +37,68 @@
         ->assertCanSeeTableRecords([$policyA])
         ->assertCanNotSeeTableRecords([$policyB]);
 });
+
+it('renders remembered canonical tenant policy detail with shared normalized settings markers', function (): void {
+    $tenantA = Tenant::factory()->create();
+    [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');
+    $tenantB = Tenant::factory()->create(['workspace_id' => (int) $tenantA->workspace_id]);
+    createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');
+
+    $policyA = Policy::factory()->for($tenantA)->create(['display_name' => 'Remembered tenant policy']);
+    $policyB = Policy::factory()->for($tenantB)->create(['display_name' => 'Other tenant policy']);
+
+    PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
+        'version_number' => 1,
+        'policy_type' => $policyA->policy_type,
+        'platform' => $policyA->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            '@odata.type' => '#microsoft.graph.windows10CustomConfiguration',
+            'omaSettings' => [
+                [
+                    'displayName' => 'Setting A',
+                    'omaUri' => './Vendor/MSFT/SettingA',
+                    'value' => 'Enabled',
+                ],
+            ],
+        ],
+    ]);
+
+    PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
+        'version_number' => 1,
+        'policy_type' => $policyB->policy_type,
+        'platform' => $policyB->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            '@odata.type' => '#microsoft.graph.windows10CustomConfiguration',
+            'omaSettings' => [],
+        ],
+    ]);
+
+    $this->actingAs($user);
+    Filament::setCurrentPanel('admin');
+    Filament::setTenant(null, true);
+    Filament::bootCurrentPanel();
+
+    $session = [
+        WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id,
+        WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY => [
+            (string) $tenantA->workspace_id => (int) $tenantA->getKey(),
+        ],
+    ];
+
+    $response = $this->withSession($session)
+        ->get(\App\Filament\Resources\PolicyResource::getUrl('view', ['record' => $policyA], panel: 'admin'));
+
+    $response->assertSuccessful()->assertSee('Setting A');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy"');
+
+    $this->withSession($session)
+        ->get(\App\Filament\Resources\PolicyResource::getUrl('view', ['record' => $policyB], panel: 'admin'))
+        ->assertNotFound();
+});

apps/platform/tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php

@@ -8,6 +8,7 @@
 use App\Models\PolicyVersion;
 use App\Models\Tenant;
 use App\Support\Workspaces\WorkspaceContext;
+use Carbon\CarbonImmutable;
 use Filament\Facades\Filament;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
@@ -73,3 +74,78 @@
         ->get(PolicyVersionResource::getUrl('view', ['record' => $versionB], panel: 'admin'))
         ->assertNotFound();
 });
+
+it('renders remembered canonical tenant policy-version detail with shared normalized detail markers', function (): void {
+    $tenantA = Tenant::factory()->create();
+    [$user, $tenantA] = createUserWithTenant(tenant: $tenantA, role: 'owner');
+    $tenantB = Tenant::factory()->create(['workspace_id' => (int) $tenantA->workspace_id]);
+    createUserWithTenant(tenant: $tenantB, user: $user, role: 'owner');
+
+    $policyA = Policy::factory()->for($tenantA)->create(['display_name' => 'Remembered policy']);
+    $policyB = Policy::factory()->for($tenantB)->create(['display_name' => 'Other policy']);
+
+    PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
+        'version_number' => 1,
+        'policy_type' => $policyA->policy_type,
+        'platform' => $policyA->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now()->subMinute(),
+        'snapshot' => [
+            'displayName' => 'Remembered policy',
+            'settings' => [
+                ['displayName' => 'Enable feature', 'value' => ['value' => 'off']],
+            ],
+        ],
+    ]);
+
+    $versionA = PolicyVersion::factory()->for($tenantA)->for($policyA)->create([
+        'version_number' => 2,
+        'policy_type' => $policyA->policy_type,
+        'platform' => $policyA->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            'displayName' => 'Remembered policy',
+            'settings' => [
+                ['displayName' => 'Enable feature', 'value' => ['value' => 'on']],
+            ],
+        ],
+    ]);
+
+    PolicyVersion::factory()->for($tenantB)->for($policyB)->create([
+        'version_number' => 1,
+        'policy_type' => $policyB->policy_type,
+        'platform' => $policyB->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            'displayName' => 'Other policy',
+            'settings' => [
+                ['displayName' => 'Enable feature', 'value' => ['value' => 'off']],
+            ],
+        ],
+    ]);
+
+    $this->actingAs($user);
+    Filament::setCurrentPanel('admin');
+    Filament::setTenant(null, true);
+    Filament::bootCurrentPanel();
+
+    $session = [
+        WorkspaceContext::SESSION_KEY => (int) $tenantA->workspace_id,
+        WorkspaceContext::LAST_TENANT_IDS_SESSION_KEY => [
+            (string) $tenantA->workspace_id => (int) $tenantA->getKey(),
+        ],
+    ];
+
+    $response = $this->withSession($session)
+        ->get(PolicyVersionResource::getUrl('view', ['record' => $versionA], panel: 'admin'));
+
+    $response->assertSuccessful()->assertSee('Enable feature');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy_version"')
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="policy_version"');
+});

apps/platform/tests/Feature/Filament/PolicyVersionSettingsTest.php

@@ -50,6 +50,12 @@
     $response->assertSee('Normalized settings');
     $response->assertSee('Enable feature');
     $response->assertSee('Normalized diff');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy_version"')
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="policy_version"');
 });
 
 test('policy version detail shows enrollment notification template settings', function () {
@@ -139,4 +145,8 @@
     $response->assertSee('Push Subject');
     $response->assertSee('Push (en-us) Message');
     $response->assertSee('Push Body');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy_version"');
 });

apps/platform/tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php

@@ -1,8 +1,13 @@
 <?php
 
+use App\Filament\Resources\PolicyVersionResource;
+use App\Models\Policy;
+use App\Models\PolicyVersion;
 use App\Models\SettingsCatalogCategory;
 use App\Models\SettingsCatalogDefinition;
+use App\Models\Tenant;
 use App\Services\Intune\PolicyNormalizer;
+use Carbon\CarbonImmutable;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 
 uses(RefreshDatabase::class);
@@ -53,3 +58,69 @@
     expect($keys)->toContain('Settings > Account Management > Deletion Policy');
     expect(implode("\n", $keys))->not->toContain('device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy');
 });
+
+test('settings catalog policy version detail renders the shared normalized settings family', function () {
+    SettingsCatalogCategory::create([
+        'category_id' => 'cat-1',
+        'display_name' => 'Account Management',
+        'description' => null,
+    ]);
+
+    SettingsCatalogDefinition::create([
+        'definition_id' => 'device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy',
+        'display_name' => 'Deletion Policy',
+        'description' => null,
+        'help_text' => null,
+        'category_id' => 'cat-1',
+        'ux_behavior' => null,
+        'raw' => [],
+    ]);
+
+    $tenant = Tenant::factory()->create([
+        'status' => 'active',
+    ]);
+
+    [$user, $tenant] = createUserWithTenant(tenant: $tenant, role: 'owner');
+
+    $policy = Policy::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'external_id' => 'settings-catalog-policy-1',
+        'policy_type' => 'settingsCatalogPolicy',
+        'display_name' => 'Settings Catalog Policy',
+        'platform' => 'windows',
+    ]);
+
+    $version = PolicyVersion::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'policy_id' => (int) $policy->getKey(),
+        'version_number' => 1,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'created_by' => 'tester@example.com',
+        'captured_at' => CarbonImmutable::now(),
+        'snapshot' => [
+            '@odata.type' => '#microsoft.graph.deviceManagementConfigurationPolicy',
+            'settings' => [
+                [
+                    'id' => 's1',
+                    'settingInstance' => [
+                        '@odata.type' => '#microsoft.graph.deviceManagementConfigurationChoiceSettingInstance',
+                        'settingDefinitionId' => 'device_vendor_msft_accountmanagement_userprofilemanagement_deletionpolicy',
+                        'choiceSettingValue' => [
+                            'value' => 'enabled',
+                        ],
+                    ],
+                ],
+            ],
+        ],
+    ]);
+
+    $response = $this->actingAs($user)
+        ->get(PolicyVersionResource::getUrl('view', ['record' => $version], tenant: $tenant));
+
+    $response->assertSuccessful()->assertSee('Deletion Policy');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-settings"')
+        ->toContain('data-shared-normalized-settings-host="policy_version"');
+});

apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php

@@ -0,0 +1,188 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Widgets\Tenant\TenantVerificationReport;
+use App\Models\OperationRun;
+use App\Models\ProviderConnection;
+use App\Models\Tenant;
+use App\Models\TenantOnboardingSession;
+use App\Models\User;
+use App\Models\Workspace;
+use App\Models\WorkspaceMembership;
+use App\Support\Verification\VerificationReportWriter;
+use App\Support\Workspaces\WorkspaceContext;
+use Filament\Facades\Filament;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+it('renders the shared verification family on central operation detail', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $report = VerificationReportWriter::build('provider.connection.check', [
+        [
+            'key' => 'provider_connection',
+            'title' => 'Provider connection preflight',
+            'status' => 'fail',
+            'severity' => 'critical',
+            'blocking' => true,
+            'reason_code' => 'provider_connection_missing',
+            'message' => 'No provider connection configured.',
+            'evidence' => [],
+            'next_steps' => [],
+        ],
+    ]);
+
+    $run = OperationRun::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'workspace_id' => (int) $tenant->workspace_id,
+        'user_id' => (int) $user->getKey(),
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'blocked',
+        'context' => [
+            'verification_report' => $report,
+        ],
+    ]);
+
+    Filament::setTenant(null, true);
+
+    $response = $this->actingAs($user)
+        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id])
+        ->get(route('admin.operations.view', ['run' => (int) $run->getKey()]));
+
+    $response->assertSuccessful()->assertSee('Verification report');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="operation_run_detail"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="issues"')
+        ->toContain('data-shared-zone="diagnostics"');
+});
+
+it('renders the shared verification family on onboarding verification', function (): void {
+    $workspace = Workspace::factory()->create();
+    $user = User::factory()->create();
+
+    WorkspaceMembership::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'user_id' => (int) $user->getKey(),
+        'role' => 'owner',
+    ]);
+
+    $tenant = Tenant::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'status' => Tenant::STATUS_ONBOARDING,
+    ]);
+
+    $user->tenants()->syncWithoutDetaching([
+        $tenant->getKey() => ['role' => 'owner'],
+    ]);
+
+    $connection = ProviderConnection::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'is_default' => true,
+    ]);
+
+    $report = VerificationReportWriter::build('provider.connection.check', [
+        [
+            'key' => 'onboarding_permissions',
+            'title' => 'Graph permissions',
+            'status' => 'fail',
+            'severity' => 'high',
+            'blocking' => false,
+            'reason_code' => 'permission_denied',
+            'message' => 'Missing required Graph permissions.',
+            'evidence' => [],
+            'next_steps' => [],
+        ],
+    ]);
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'blocked',
+        'context' => [
+            'provider_connection_id' => (int) $connection->getKey(),
+            'verification_report' => $report,
+        ],
+    ]);
+
+    TenantOnboardingSession::query()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'entra_tenant_id' => (string) $tenant->tenant_id,
+        'current_step' => 'verify',
+        'state' => [
+            'provider_connection_id' => (int) $connection->getKey(),
+            'verification_operation_run_id' => (int) $run->getKey(),
+        ],
+        'started_by_user_id' => (int) $user->getKey(),
+        'updated_by_user_id' => (int) $user->getKey(),
+    ]);
+
+    $response = $this->actingAs($user)
+        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
+        ->followingRedirects()
+        ->get('/admin/onboarding');
+
+    $response->assertSuccessful()->assertSee('Graph permissions');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="onboarding_wizard"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="issues"')
+        ->toContain('data-shared-zone="diagnostics"');
+});
+
+it('renders the shared verification family on the tenant widget host', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'readonly');
+
+    Filament::setTenant($tenant, true);
+
+    $report = VerificationReportWriter::build('provider.connection.check', [
+        [
+            'key' => 'tenant_widget_report',
+            'title' => 'Tenant widget verification',
+            'status' => 'fail',
+            'severity' => 'high',
+            'blocking' => false,
+            'reason_code' => 'provider_permission_denied',
+            'message' => 'Insufficient permission — ask a tenant Owner.',
+            'evidence' => [],
+            'next_steps' => [],
+        ],
+    ]);
+
+    OperationRun::factory()->create([
+        'workspace_id' => (int) $tenant->workspace_id,
+        'tenant_id' => (int) $tenant->getKey(),
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'blocked',
+        'context' => [
+            'target_scope' => [
+                'entra_tenant_id' => (string) $tenant->tenant_id,
+            ],
+            'verification_report' => $report,
+        ],
+    ]);
+
+    $component = Livewire::actingAs($user)
+        ->test(TenantVerificationReport::class, ['record' => $tenant])
+        ->assertSee('Tenant widget verification');
+
+    expect($component->html())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="tenant_widget"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="issues"')
+        ->toContain('data-shared-zone="diagnostics"');
+});

apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php

@@ -0,0 +1,126 @@
+<?php
+
+declare(strict_types=1);
+
+use App\Filament\Pages\TenantRequiredPermissions;
+use App\Models\Tenant;
+use App\Models\TenantPermission;
+use App\Models\User;
+use App\Support\Workspaces\WorkspaceContext;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+function seedTenantRequiredPermissionsFixture(Tenant $tenant): void
+{
+    config()->set('intune_permissions.permissions', [
+        [
+            'key' => 'DeviceManagementApps.Read.All',
+            'type' => 'application',
+            'description' => 'Backup application permission',
+            'features' => ['backup'],
+        ],
+        [
+            'key' => 'Group.Read.All',
+            'type' => 'delegated',
+            'description' => 'Backup delegated permission',
+            'features' => ['backup'],
+        ],
+        [
+            'key' => 'Reports.Read.All',
+            'type' => 'application',
+            'description' => 'Reporting permission',
+            'features' => ['reporting'],
+        ],
+    ]);
+    config()->set('entra_permissions.permissions', []);
+
+    TenantPermission::query()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'permission_key' => 'Group.Read.All',
+        'status' => 'missing',
+        'details' => ['source' => 'fixture'],
+        'last_checked_at' => now(),
+    ]);
+
+    TenantPermission::query()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'permission_key' => 'Reports.Read.All',
+        'status' => 'granted',
+        'details' => ['source' => 'fixture'],
+        'last_checked_at' => now(),
+    ]);
+}
+
+function tenantRequiredPermissionsComponent(User $user, Tenant $tenant, array $query = [])
+{
+    test()->actingAs($user);
+    setAdminPanelContext();
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);
+
+    $query = array_merge([
+        'tenant' => (string) $tenant->external_id,
+    ], $query);
+
+    return Livewire::withQueryParams($query)->test(TenantRequiredPermissions::class);
+}
+
+it('uses native table filters and search while keeping summary state aligned with visible rows', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'readonly');
+    seedTenantRequiredPermissionsFixture($tenant);
+
+    $component = tenantRequiredPermissionsComponent($user, $tenant)
+        ->assertTableFilterExists('status')
+        ->assertTableFilterExists('type')
+        ->assertTableFilterExists('features')
+        ->assertCanSeeTableRecords([
+            'DeviceManagementApps.Read.All',
+            'Group.Read.All',
+        ])
+        ->assertCanNotSeeTableRecords(['Reports.Read.All'])
+        ->assertSee('Missing application permissions')
+        ->assertSee('Guidance');
+
+    $component
+        ->filterTable('status', 'present')
+        ->filterTable('type', 'application')
+        ->searchTable('Reports')
+        ->assertCountTableRecords(1)
+        ->assertCanSeeTableRecords(['Reports.Read.All'])
+        ->assertCanNotSeeTableRecords([
+            'DeviceManagementApps.Read.All',
+            'Group.Read.All',
+        ]);
+
+    $viewModel = $component->instance()->viewModel();
+
+    expect($viewModel['overview']['counts'])->toBe([
+        'missing_application' => 0,
+        'missing_delegated' => 0,
+        'present' => 1,
+        'error' => 0,
+    ])
+        ->and(array_column($viewModel['permissions'], 'key'))->toBe(['Reports.Read.All'])
+        ->and($viewModel['copy']['application'])->toBe('DeviceManagementApps.Read.All');
+});
+
+it('keeps copy payloads feature-scoped and shows the native no-matches state', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'readonly');
+    seedTenantRequiredPermissionsFixture($tenant);
+
+    $component = tenantRequiredPermissionsComponent($user, $tenant)
+        ->set('tableFilters.features.values', ['backup'])
+        ->assertSet('tableFilters.features.values', ['backup']);
+
+    $viewModel = $component->instance()->viewModel();
+
+    expect($viewModel['copy']['application'])->toBe('DeviceManagementApps.Read.All')
+        ->and($viewModel['copy']['delegated'])->toBe('Group.Read.All');
+
+    $component
+        ->searchTable('no-such-permission')
+        ->assertCountTableRecords(0)
+        ->assertSee('No matches')
+        ->assertTableEmptyStateActionsExistInOrder(['clear_filters']);
+});

apps/platform/tests/Feature/Filament/TenantVerificationReportWidgetTest.php

@@ -108,7 +108,7 @@
     bindFailHardGraphClient();
 
     assertNoOutboundHttp(function () use ($user): void {
-        Livewire::actingAs($user)
+        $component = Livewire::actingAs($user)
             ->test(TenantVerificationReport::class)
             ->assertSee('Provider connection preflight')
             ->assertSee(OperationRunLinks::openLabel())
@@ -116,6 +116,13 @@
             ->assertSee(OperationRunLinks::identifierLabel().':')
             ->assertSee('Read-only:')
             ->assertSee('Insufficient permission — ask a tenant Owner.');
+
+        expect($component->html())
+            ->toContain('data-shared-detail-family="verification-report"')
+            ->toContain('data-host-kind="tenant_widget"')
+            ->toContain('data-shared-zone="summary"')
+            ->toContain('data-shared-zone="issues"')
+            ->toContain('data-shared-zone="diagnostics"');
     });
 });
 

apps/platform/tests/Feature/Findings/FindingRbacTest.php

@@ -5,6 +5,9 @@
 use App\Filament\Resources\FindingResource;
 use App\Filament\Resources\FindingResource\Pages\ListFindings;
 use App\Models\Finding;
+use App\Models\InventoryItem;
+use App\Models\Policy;
+use App\Models\PolicyVersion;
 use App\Services\Findings\FindingWorkflowService;
 use App\Support\Workspaces\WorkspaceContext;
 use Filament\Facades\Filament;
@@ -116,3 +119,89 @@
         expect($exception->status())->toBe(404);
     }
 });
+
+it('renders finding detail with shared normalized diff markers for entitled members', function (): void {
+    bindFailHardGraphClient();
+
+    [$user, $tenant] = createUserWithTenant(role: 'owner');
+
+    $baseline = createInventorySyncOperationRun($tenant, [
+        'selection_hash' => hash('sha256', 'finding-rbac-shared-diff'),
+        'status' => 'success',
+        'finished_at' => now()->subDays(2),
+    ]);
+
+    $current = createInventorySyncOperationRun($tenant, [
+        'selection_hash' => $baseline->selection_hash,
+        'status' => 'success',
+        'finished_at' => now()->subDay(),
+    ]);
+
+    $policy = Policy::factory()->for($tenant)->create([
+        'external_id' => 'policy-finding-rbac',
+        'policy_type' => 'deviceConfiguration',
+        'platform' => 'windows10',
+    ]);
+
+    $baselineVersion = PolicyVersion::factory()->for($tenant)->create([
+        'policy_id' => $policy->getKey(),
+        'version_number' => 1,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'snapshot' => [
+            'displayName' => 'RBAC Policy',
+            'customSettingFoo' => 'Old value',
+        ],
+    ]);
+
+    $currentVersion = PolicyVersion::factory()->for($tenant)->create([
+        'policy_id' => $policy->getKey(),
+        'version_number' => 2,
+        'policy_type' => $policy->policy_type,
+        'platform' => $policy->platform,
+        'snapshot' => [
+            'displayName' => 'RBAC Policy',
+            'customSettingFoo' => 'New value',
+        ],
+    ]);
+
+    $finding = Finding::factory()->for($tenant)->create([
+        'finding_type' => Finding::FINDING_TYPE_DRIFT,
+        'scope_key' => (string) $current->selection_hash,
+        'baseline_operation_run_id' => $baseline->getKey(),
+        'current_operation_run_id' => $current->getKey(),
+        'subject_type' => 'policy',
+        'subject_external_id' => $policy->external_id,
+        'evidence_jsonb' => [
+            'change_type' => 'modified',
+            'summary' => [
+                'kind' => 'policy_snapshot',
+                'changed_fields' => ['snapshot_hash'],
+            ],
+            'baseline' => [
+                'policy_id' => $policy->external_id,
+                'policy_version_id' => $baselineVersion->getKey(),
+                'snapshot_hash' => 'baseline-hash',
+            ],
+            'current' => [
+                'policy_id' => $policy->external_id,
+                'policy_version_id' => $currentVersion->getKey(),
+                'snapshot_hash' => 'current-hash',
+            ],
+        ],
+    ]);
+
+    InventoryItem::factory()->for($tenant)->create([
+        'external_id' => $finding->subject_external_id,
+        'display_name' => 'RBAC Policy',
+    ]);
+
+    $response = $this->actingAs($user)
+        ->get(FindingResource::getUrl('view', ['record' => $finding], tenant: $tenant));
+
+    $response->assertSuccessful()->assertSee('Normalized diff');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="normalized-diff"')
+        ->toContain('data-shared-normalized-diff-host="finding"');
+});

apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php

@@ -29,7 +29,9 @@
         'app/Filament/Resources/BackupSetResource/RelationManagers/BackupItemsRelationManager.php',
         'app/Filament/Resources/PolicyResource/RelationManagers/VersionsRelationManager.php',
         'app/Filament/Resources/BackupScheduleResource/RelationManagers/BackupScheduleOperationRunsRelationManager.php',
+        'app/Filament/Pages/TenantRequiredPermissions.php',
         'app/Filament/Pages/InventoryCoverage.php',
+        'app/Filament/Pages/Monitoring/EvidenceOverview.php',
         'app/Filament/System/Pages/Directory/Tenants.php',
         'app/Filament/System/Pages/Directory/Workspaces.php',
         'app/Filament/System/Pages/Ops/Runs.php',
@@ -39,6 +41,7 @@
         'app/Filament/System/Pages/RepairWorkspaceOwners.php',
         'app/Filament/Widgets/Dashboard/RecentDriftFindings.php',
         'app/Filament/Widgets/Dashboard/RecentOperations.php',
+        'app/Livewire/InventoryItemDependencyEdgesTable.php',
         'app/Livewire/BackupSetPolicyPickerTable.php',
         'app/Livewire/EntraGroupCachePickerTable.php',
         'app/Livewire/SettingsCatalogSettingsTable.php',
@@ -81,7 +84,9 @@
         'app/Filament/Resources/BackupSetResource/RelationManagers/BackupItemsRelationManager.php' => ['->emptyStateHeading('],
         'app/Filament/Resources/PolicyResource/RelationManagers/VersionsRelationManager.php' => ['->emptyStateHeading('],
         'app/Filament/Resources/BackupScheduleResource/RelationManagers/BackupScheduleOperationRunsRelationManager.php' => ['->emptyStateHeading('],
+        'app/Filament/Pages/TenantRequiredPermissions.php' => ['->emptyStateHeading('],
         'app/Filament/Pages/InventoryCoverage.php' => ['->emptyStateHeading('],
+        'app/Filament/Pages/Monitoring/EvidenceOverview.php' => ['->emptyStateHeading('],
         'app/Filament/System/Pages/Directory/Tenants.php' => ['->emptyStateHeading('],
         'app/Filament/System/Pages/Directory/Workspaces.php' => ['->emptyStateHeading('],
         'app/Filament/System/Pages/Ops/Runs.php' => ['->emptyStateHeading('],
@@ -91,6 +96,7 @@
         'app/Filament/System/Pages/RepairWorkspaceOwners.php' => ['->emptyStateHeading('],
         'app/Filament/Widgets/Dashboard/RecentDriftFindings.php' => ['->emptyStateHeading('],
         'app/Filament/Widgets/Dashboard/RecentOperations.php' => ['->emptyStateHeading('],
+        'app/Livewire/InventoryItemDependencyEdgesTable.php' => ['->emptyStateHeading('],
         'app/Livewire/BackupSetPolicyPickerTable.php' => ['->emptyStateHeading('],
         'app/Livewire/EntraGroupCachePickerTable.php' => ['->emptyStateHeading('],
         'app/Livewire/SettingsCatalogSettingsTable.php' => ['->emptyStateHeading('],
@@ -134,6 +140,8 @@
         'app/Filament/Resources/EntraGroupResource.php',
         'app/Filament/Resources/OperationRunResource.php',
         'app/Filament/Resources/BaselineSnapshotResource.php',
+        'app/Filament/Pages/TenantRequiredPermissions.php',
+        'app/Filament/Pages/Monitoring/EvidenceOverview.php',
         'app/Filament/Resources/BackupSetResource/RelationManagers/BackupItemsRelationManager.php',
     ];
 
@@ -310,7 +318,9 @@
         'app/Filament/Resources/BackupSetResource/RelationManagers/BackupItemsRelationManager.php',
         'app/Filament/Resources/PolicyResource/RelationManagers/VersionsRelationManager.php',
         'app/Filament/Resources/BackupScheduleResource/RelationManagers/BackupScheduleOperationRunsRelationManager.php',
+        'app/Filament/Pages/TenantRequiredPermissions.php',
         'app/Filament/Pages/InventoryCoverage.php',
+        'app/Filament/Pages/Monitoring/EvidenceOverview.php',
         'app/Filament/System/Pages/Directory/Tenants.php',
         'app/Filament/System/Pages/Directory/Workspaces.php',
         'app/Filament/System/Pages/Ops/Runs.php',
@@ -320,6 +330,7 @@
         'app/Filament/System/Pages/RepairWorkspaceOwners.php',
         'app/Filament/Widgets/Dashboard/RecentDriftFindings.php',
         'app/Filament/Widgets/Dashboard/RecentOperations.php',
+        'app/Livewire/InventoryItemDependencyEdgesTable.php',
         'app/Livewire/BackupSetPolicyPickerTable.php',
         'app/Livewire/EntraGroupCachePickerTable.php',
         'app/Livewire/SettingsCatalogSettingsTable.php',
@@ -337,6 +348,85 @@
     expect($missing)->toBeEmpty('Missing pagination profile helper usage: '.implode(', ', $missing));
 });
 
+    it('keeps spec 196 surfaces on native table contracts without faux controls or hand-built primary tables', function (): void {
+        $requiredPatterns = [
+            'app/Filament/Pages/TenantRequiredPermissions.php' => [
+                'implements HasTable',
+                'InteractsWithTable',
+            ],
+            'app/Filament/Pages/Monitoring/EvidenceOverview.php' => [
+                'implements HasTable',
+                'InteractsWithTable',
+            ],
+            'app/Livewire/InventoryItemDependencyEdgesTable.php' => [
+                'extends TableComponent',
+            ],
+            'resources/views/filament/components/dependency-edges.blade.php' => [
+                'inventory-item-dependency-edges-table',
+            ],
+            'resources/views/filament/pages/tenant-required-permissions.blade.php' => [
+                '$this->table',
+                'data-testid="technical-details"',
+            ],
+            'resources/views/filament/pages/monitoring/evidence-overview.blade.php' => [
+                '$this->table',
+            ],
+        ];
+
+        $forbiddenPatterns = [
+            'resources/views/filament/components/dependency-edges.blade.php' => [
+                '<form method="GET"',
+                'request(',
+            ],
+            'resources/views/filament/pages/tenant-required-permissions.blade.php' => [
+                'wire:model.live="status"',
+                'wire:model.live="type"',
+                'wire:model.live="features"',
+                'wire:model.live.debounce.500ms="search"',
+                '<table class="min-w-full divide-y divide-gray-200 dark:divide-gray-800">',
+            ],
+            'resources/views/filament/pages/monitoring/evidence-overview.blade.php' => [
+                '<table class="min-w-full divide-y divide-gray-200 text-sm">',
+            ],
+        ];
+
+        $missing = [];
+        $unexpected = [];
+
+        foreach ($requiredPatterns as $relativePath => $patterns) {
+            $contents = file_get_contents(base_path($relativePath));
+
+            if (! is_string($contents)) {
+                $missing[] = $relativePath;
+
+                continue;
+            }
+
+            foreach ($patterns as $pattern) {
+                if (! str_contains($contents, $pattern)) {
+                    $missing[] = "{$relativePath} ({$pattern})";
+                }
+            }
+        }
+
+        foreach ($forbiddenPatterns as $relativePath => $patterns) {
+            $contents = file_get_contents(base_path($relativePath));
+
+            if (! is_string($contents)) {
+                continue;
+            }
+
+            foreach ($patterns as $pattern) {
+                if (str_contains($contents, $pattern)) {
+                    $unexpected[] = "{$relativePath} ({$pattern})";
+                }
+            }
+        }
+
+        expect($missing)->toBeEmpty('Missing native table contract patterns: '.implode(', ', $missing))
+            ->and($unexpected)->toBeEmpty('Unexpected faux-control or hand-built table patterns remain: '.implode(', ', $unexpected));
+    });
+
 it('keeps tenant-registry recovery triage columns, filters, and query hydration explicit', function (): void {
     $patternByPath = [
         'app/Filament/Resources/TenantResource.php' => [

apps/platform/tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php

@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Support\Facades\File;
+
+it('keeps verification tab ownership inside the shared viewer', function (): void {
+    $sharedViewer = (string) file_get_contents(resource_path('views/filament/components/verification-report-viewer.blade.php'));
+
+    expect($sharedViewer)
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('Verification report tabs');
+
+    $hostViews = [
+        resource_path('views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php'),
+        resource_path('views/filament/widgets/tenant/tenant-verification-report.blade.php'),
+    ];
+
+    foreach ($hostViews as $path) {
+        expect((string) file_get_contents($path))->not->toContain('Verification report tabs');
+    }
+});
+
+it('keeps policy-settings-standard as a compatibility wrapper only', function (): void {
+    $compatibilityView = (string) file_get_contents(resource_path('views/filament/infolists/entries/policy-settings-standard.blade.php'));
+
+    expect($compatibilityView)->toContain('normalized-settings.wrapper');
+
+    $directUsages = collect(File::allFiles(resource_path('views/filament')))
+        ->reject(static fn (\SplFileInfo $file): bool => $file->getPathname() === resource_path('views/filament/infolists/entries/policy-settings-standard.blade.php'))
+        ->filter(static fn (\SplFileInfo $file): bool => str_contains((string) file_get_contents($file->getPathname()), 'policy-settings-standard'))
+        ->map(static fn (\SplFileInfo $file): string => str_replace(resource_path('views/'), '', $file->getPathname()))
+        ->values()
+        ->all();
+
+    expect($directUsages)->toBe([]);
+});

apps/platform/tests/Feature/InventoryItemDependenciesTest.php

@@ -41,7 +41,7 @@
         ->assertSee('Last known: Ghost Target');
 });
 
-it('direction filter limits to outbound or inbound', function () {
+it('renders native dependency controls in place instead of a GET apply workflow', function () {
     [$user, $tenant] = createUserWithTenant();
     $this->actingAs($user);
 
@@ -51,34 +51,48 @@
         'external_id' => (string) Str::uuid(),
     ]);
 
+    $inboundSource = InventoryItem::factory()->create([
+        'tenant_id' => $tenant->getKey(),
+        'external_id' => (string) Str::uuid(),
+        'display_name' => 'Inbound Source',
+    ]);
+
     // Outbound only
     InventoryLink::factory()->create([
         'tenant_id' => $tenant->getKey(),
         'source_type' => 'inventory_item',
         'source_id' => $item->external_id,
-        'target_type' => 'foundation_object',
-        'target_id' => (string) Str::uuid(),
+        'target_type' => 'missing',
+        'target_id' => null,
         'relationship_type' => 'assigned_to',
+        'metadata' => [
+            'last_known_name' => 'Assigned Target',
+        ],
     ]);
 
     // Inbound only
     InventoryLink::factory()->create([
         'tenant_id' => $tenant->getKey(),
         'source_type' => 'inventory_item',
-        'source_id' => (string) Str::uuid(),
+        'source_id' => $inboundSource->external_id,
         'target_type' => 'inventory_item',
         'target_id' => $item->external_id,
         'relationship_type' => 'depends_on',
     ]);
 
-    $urlOutbound = InventoryItemResource::getUrl('view', ['record' => $item], panel: 'admin').'?tenant='.(string) $tenant->external_id.'&direction=outbound';
-    $this->get($urlOutbound)->assertOk()->assertDontSee('No dependencies found');
+    $url = InventoryItemResource::getUrl('view', ['record' => $item], panel: 'admin').'?tenant='.(string) $tenant->external_id.'&direction=outbound';
 
-    $urlInbound = InventoryItemResource::getUrl('view', ['record' => $item], panel: 'admin').'?tenant='.(string) $tenant->external_id.'&direction=inbound';
-    $this->get($urlInbound)->assertOk()->assertDontSee('No dependencies found');
+    $this->get($url)
+        ->assertOk()
+        ->assertSee('Direction')
+        ->assertSee('Inbound')
+        ->assertSee('Outbound')
+        ->assertSee('Relationship')
+        ->assertSee('Assigned Target')
+        ->assertDontSee('No dependencies found');
 });
 
-it('relationship filter limits edges by type', function () {
+it('ignores legacy relationship query state while preserving visible target safety', function () {
     [$user, $tenant] = createUserWithTenant();
     $this->actingAs($user);
 
@@ -115,7 +129,7 @@
     $this->get($url)
         ->assertOk()
         ->assertSee('Scoped Target')
-        ->assertDontSee('Assigned Target');
+        ->assertSee('Assigned Target');
 });
 
 it('does not show edges from other tenants (tenant isolation)', function () {

apps/platform/tests/Feature/MonitoringOperationsTest.php

@@ -6,6 +6,7 @@
 use App\Models\Tenant;
 use App\Models\User;
 use App\Services\Graph\GraphClientInterface;
+use App\Support\Verification\VerificationReportWriter;
 use App\Support\Workspaces\WorkspaceContext;
 use Filament\Facades\Filament;
 
@@ -142,3 +143,45 @@
         ->get(route('admin.operations.view', ['run' => (int) $run->getKey()]))
         ->assertNotFound();
 });
+
+it('renders shared verification family markers on monitoring operation detail for workspace members', function (): void {
+    $tenant = Tenant::factory()->create();
+    [$user, $tenant] = createUserWithTenant($tenant, role: 'owner');
+
+    $run = OperationRun::factory()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'workspace_id' => (int) $tenant->workspace_id,
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'blocked',
+        'initiator_name' => 'System',
+        'run_identity_hash' => 'hash123',
+        'context' => [
+            'verification_report' => VerificationReportWriter::build('provider.connection.check', [
+                [
+                    'key' => 'provider_connection',
+                    'title' => 'Provider connection preflight',
+                    'status' => 'fail',
+                    'severity' => 'critical',
+                    'blocking' => true,
+                    'reason_code' => 'provider_connection_missing',
+                    'message' => 'No provider connection configured.',
+                    'evidence' => [],
+                    'next_steps' => [],
+                ],
+            ]),
+        ],
+    ]);
+
+    Filament::setTenant(null, true);
+
+    $response = $this->actingAs($user)
+        ->withSession([WorkspaceContext::SESSION_KEY => (int) $tenant->workspace_id])
+        ->get(route('admin.operations.view', ['run' => (int) $run->getKey()]));
+
+    $response->assertSuccessful()->assertSee('Provider connection preflight');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="operation_run_detail"');
+});

apps/platform/tests/Feature/Onboarding/OnboardingDraftAccessTest.php

@@ -3,11 +3,13 @@
 declare(strict_types=1);
 
 use App\Filament\Pages\Workspaces\ManagedTenantOnboardingWizard;
+use App\Models\OperationRun;
 use App\Models\ProviderConnection;
 use App\Models\Tenant;
 use App\Models\User;
 use App\Models\Workspace;
 use App\Models\WorkspaceMembership;
+use App\Support\Verification\VerificationReportWriter;
 use App\Support\Workspaces\WorkspaceContext;
 use Livewire\Livewire;
 
@@ -148,6 +150,81 @@
         ->assertForbidden();
 });
 
+it('renders shared verification family markers for an entitled requested verify draft', function (): void {
+    $workspace = Workspace::factory()->create();
+    $tenant = Tenant::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'status' => Tenant::STATUS_ONBOARDING,
+    ]);
+    $user = User::factory()->create();
+
+    createUserWithTenant(
+        tenant: $tenant,
+        user: $user,
+        role: 'owner',
+        workspaceRole: 'owner',
+        ensureDefaultMicrosoftProviderConnection: false,
+    );
+
+    $connection = ProviderConnection::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'provider' => 'microsoft',
+        'entra_tenant_id' => (string) $tenant->tenant_id,
+        'display_name' => 'Requested verify connection',
+        'is_default' => true,
+    ]);
+
+    $run = OperationRun::factory()->create([
+        'workspace_id' => (int) $workspace->getKey(),
+        'tenant_id' => (int) $tenant->getKey(),
+        'type' => 'provider.connection.check',
+        'status' => 'completed',
+        'outcome' => 'blocked',
+        'context' => [
+            'provider_connection_id' => (int) $connection->getKey(),
+            'verification_report' => VerificationReportWriter::build('provider.connection.check', [
+                [
+                    'key' => 'requested_verify_draft',
+                    'title' => 'Requested verify draft check',
+                    'status' => 'fail',
+                    'severity' => 'high',
+                    'blocking' => false,
+                    'reason_code' => 'missing_configuration',
+                    'message' => 'Draft needs attention.',
+                    'evidence' => [],
+                    'next_steps' => [],
+                ],
+            ]),
+        ],
+    ]);
+
+    $draft = createOnboardingDraft([
+        'workspace' => $workspace,
+        'tenant' => $tenant,
+        'started_by' => $user,
+        'updated_by' => $user,
+        'current_step' => 'verify',
+        'state' => [
+            'entra_tenant_id' => (string) $tenant->tenant_id,
+            'tenant_name' => (string) $tenant->name,
+            'provider_connection_id' => (int) $connection->getKey(),
+            'verification_operation_run_id' => (int) $run->getKey(),
+        ],
+    ]);
+
+    $response = $this->actingAs($user)
+        ->withSession([WorkspaceContext::SESSION_KEY => (int) $workspace->getKey()])
+        ->followingRedirects()
+        ->get(route('admin.onboarding.draft', ['onboardingDraft' => $draft->getKey()]));
+
+    $response->assertSuccessful()->assertSee('Requested verify draft check');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="onboarding_wizard"');
+});
+
 it('mounts the requested draft with canonical persisted continuity state even when other drafts exist', function (): void {
     $workspace = Workspace::factory()->create();
     $tenant = Tenant::factory()->create([

apps/platform/tests/Feature/Onboarding/OnboardingVerificationTest.php

@@ -319,7 +319,7 @@
         'updated_by_user_id' => (int) $user->getKey(),
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->followingRedirects()
         ->get('/admin/onboarding')
         ->assertSuccessful()
@@ -331,6 +331,13 @@
         ->assertSee('Missing required Graph permissions.')
         ->assertSee('Graph permissions')
         ->assertSee($entraTenantId);
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="onboarding_wizard"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="issues"')
+        ->toContain('data-shared-zone="diagnostics"');
 });
 
 it('keeps one onboarding verification path per state while leaving workflow actions on the wizard step', function (): void {

apps/platform/tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php

@@ -246,7 +246,7 @@
         'updated_by_user_id' => (int) $user->getKey(),
     ]);
 
-    $this->actingAs($user)
+    $response = $this->actingAs($user)
         ->followingRedirects()
         ->get('/admin/onboarding')
         ->assertSuccessful()
@@ -262,4 +262,11 @@
         ->assertSee('First step')
         ->assertSee('Second step')
         ->assertDontSee('Third step');
+
+    expect($response->getContent())
+        ->toContain('data-shared-detail-family="verification-report"')
+        ->toContain('data-host-kind="onboarding_wizard"')
+        ->toContain('data-shared-zone="summary"')
+        ->toContain('data-shared-zone="issues"')
+        ->toContain('data-shared-zone="diagnostics"');
 });

apps/platform/tests/Feature/PolicySettingsStandardViewTest.php

@@ -26,5 +26,6 @@
 
     expect($html)->toContain('Enabled')
         ->and($html)->toContain('Disabled')
-        ->and($html)->toContain('fi-badge');
+        ->and($html)->toContain('fi-badge')
+        ->and($html)->toContain('data-shared-detail-family="normalized-settings"');
 });

apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php

@@ -2,12 +2,14 @@
 
 declare(strict_types=1);
 
+use App\Filament\Pages\TenantRequiredPermissions;
 use App\Models\Tenant;
 use App\Models\TenantPermission;
 use App\Models\User;
 use App\Models\Workspace;
 use App\Models\WorkspaceMembership;
 use App\Support\Workspaces\WorkspaceContext;
+use Livewire\Livewire;
 
 it('keeps the route tenant authoritative when tenant-like query values are present', function (): void {
     [$user, $tenant] = createUserWithTenant(role: 'readonly');
@@ -54,7 +56,7 @@
 
     $response
         ->assertSee($tenant->getFilamentName())
-        ->assertSee('data-permission-key="Tenant.Read.All"', false);
+        ->assertSee('Tenant.Read.All');
 });
 
 it('returns 404 when the current workspace no longer matches the tenant route scope', function (): void {
@@ -86,3 +88,52 @@
         ->get('/admin/tenants/'.$tenant->external_id.'/required-permissions')
         ->assertNotFound();
 });
+
+it('seeds native table state from deeplink filters without letting query values redefine the route tenant', function (): void {
+    [$user, $tenant] = createUserWithTenant(role: 'readonly');
+
+    $otherTenant = Tenant::factory()->create([
+        'workspace_id' => (int) $tenant->workspace_id,
+        'name' => 'Ignored Query Tenant',
+        'external_id' => 'ignored-query-tenant',
+    ]);
+
+    config()->set('intune_permissions.permissions', [
+        [
+            'key' => 'Tenant.Read.All',
+            'type' => 'application',
+            'description' => 'Tenant read permission',
+            'features' => ['backup'],
+        ],
+    ]);
+    config()->set('entra_permissions.permissions', []);
+
+    TenantPermission::query()->create([
+        'tenant_id' => (int) $tenant->getKey(),
+        'permission_key' => 'Tenant.Read.All',
+        'status' => 'granted',
+        'details' => ['source' => 'db'],
+        'last_checked_at' => now(),
+    ]);
+
+    $this->actingAs($user);
+    setAdminPanelContext();
+    session()->put(WorkspaceContext::SESSION_KEY, (int) $tenant->workspace_id);
+
+    $component = Livewire::withQueryParams([
+        'tenant' => $tenant->external_id,
+        'tenant_id' => (string) $otherTenant->getKey(),
+        'status' => 'present',
+        'type' => 'application',
+        'features' => ['backup'],
+        'search' => 'Tenant',
+    ])->test(TenantRequiredPermissions::class);
+
+    $component
+        ->assertSet('tableFilters.status.value', 'present')
+        ->assertSet('tableFilters.type.value', 'application')
+        ->assertSet('tableFilters.features.values', ['backup'])
+        ->assertSet('tableSearch', 'Tenant');
+
+    expect($component->instance()->currentTenant()?->is($tenant))->toBeTrue();
+});

apps/platform/tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php

@@ -9,6 +9,7 @@
 use App\Models\Workspace;
 use App\Support\OperationRunOutcome;
 use App\Support\OperationRunStatus;
+use App\Support\Verification\VerificationReportWriter;
 use App\Support\Workspaces\WorkspaceContext;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Http;
@@ -39,6 +40,21 @@
         'type' => 'provider.connection.check',
         'status' => OperationRunStatus::Queued->value,
         'outcome' => OperationRunOutcome::Pending->value,
+        'context' => [
+            'verification_report' => VerificationReportWriter::build('provider.connection.check', [
+                [
+                    'key' => 'provider_connection',
+                    'title' => 'Provider connection preflight',
+                    'status' => 'fail',
+                    'severity' => 'critical',
+                    'blocking' => true,
+                    'reason_code' => 'provider_connection_missing',
+                    'message' => 'No provider connection configured.',
+                    'evidence' => [],
+                    'next_steps' => [],
+                ],
+            ]),
+        ],
     ]);
 
     $this->actingAs($user)

apps/platform/tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php

@@ -50,6 +50,13 @@
             ->assertSee('Blocked')
             ->assertSee('Token acquisition works');
 
+        expect($component->html())
+            ->toContain('data-shared-detail-family="verification-report"')
+            ->toContain('data-host-kind="operation_run_detail"')
+            ->toContain('data-shared-zone="summary"')
+            ->toContain('data-shared-zone="issues"')
+            ->toContain('data-shared-zone="diagnostics"');
+
         $component
             ->call('$refresh')
             ->assertSee('Token acquisition works');
@@ -184,11 +191,18 @@
     ]);
 
     assertNoOutboundHttp(function () use ($user): void {
-        $this->actingAs($user)
+        $response = $this->actingAs($user)
             ->followingRedirects()
             ->get('/admin/onboarding')
             ->assertSuccessful()
             ->assertSee('Onboarding check');
+
+        expect($response->getContent())
+            ->toContain('data-shared-detail-family="verification-report"')
+            ->toContain('data-host-kind="onboarding_wizard"')
+            ->toContain('data-shared-zone="summary"')
+            ->toContain('data-shared-zone="issues"')
+            ->toContain('data-shared-zone="diagnostics"');
     });
 
     Bus::assertNothingDispatched();

specs/196-hard-filament-nativity-cleanup/contracts/filament-nativity-cleanup.logical.openapi.yaml

@@ -377,11 +377,18 @@ x-spec-196-notes:
     - route tenant stays authoritative on required-permissions
     - evidence overview only exposes entitled tenant rows
     - dependency rendering remains tenant-isolated and DB-only
+    - cleaned surfaces remain read-only and introduce no new remote runtime calls at render time
+    - native Filament or Livewire state remains the primary contract, with no new wrapper or presenter layer introduced only to translate pseudo-native state
+    - required-permissions summary counts, freshness, guidance visibility, and copy payload remain derived from the same normalized filter state as the visible rows
+    - evidence overview preserves a meaningful empty state, clear-filter affordance when scoped, and one workspace-safe inspect path per authorized row
     - query values may seed initial state but not stay the primary contract
   nonGoals:
     - runtime API exposure
     - new persistence
+    - new polling behavior
     - new provider or route families
+    - new global or on-demand asset requirements
+    - shared wrapper or presenter framework
     - global context shell redesign
     - monitoring page-state architecture rewrite
     - audit log selected-record or inspect duality cleanup

specs/196-hard-filament-nativity-cleanup/plan.md

@@ -64,7 +64,7 @@ ## Phase 0 Research
 - Keep `TenantRequiredPermissions` and `EvidenceOverview` on derived data and current services instead of adding new projections, tables, or materialized helper models.
 - Replace inventory dependency GET-form controls with an embedded Livewire `TableComponent` because the surface is detail-context and not a true relation manager or a standalone page.
 - Treat query parameters as one-time seed or deeplink inputs only; after mount, native page or component state owns filter interaction.
-- No additional low-risk same-class hit is confirmed in planning; default implementation scope stays at the three named core surfaces unless implementation audit finds one trivial match that does not widen scope.
+- No additional same-class extra hit is confirmed in planning; default implementation scope stays fixed at the three named core surfaces unless the setup audit records a candidate that passes every FR-196-015 admission check without widening architecture or adding new persistence, routes, or shared abstractions.
 - Extend existing focused tests and the current Filament table guard where possible instead of introducing a new browser-only verification layer.
 
 ## Phase 1 Design
@@ -169,7 +169,8 @@ ### Phase 0.5 - Establish shared test and guard scaffolding
 Changes:
 
 - Create the new focused test entry points for the dependency table component and required-permissions page table.
-- Extend shared guard coverage for new native page-table expectations and faux-control regressions.
+- Record the pre-implementation scope gate: unless the setup audit documents an FR-196-015 pass, scope is frozen to the three named core surfaces and no optional extra hit may begin.
+- Extend shared guard coverage for new native page-table expectations, faux-control regressions, and no-new-wrapper drift.
 - Add shared regression coverage for mount-only query seeding versus authoritative scope on required permissions and evidence overview.
 
 Tests:
@@ -245,6 +246,7 @@ ### Phase D - Verification, guard alignment, and explicit scope stop
 - Run focused Sail verification for the modified feature, RBAC, and guard tests.
 - Record the release close-out in `specs/196-hard-filament-nativity-cleanup/quickstart.md`, including cleaned surfaces, deferred themes, optional extra hits, and touched follow-up specs.
 - Document any optional additional same-class hit only if it was truly included; otherwise record that no extra candidate was confirmed.
+- Verify the final implementation still satisfies the non-functional constraints: DB-only rendering, no new remote calls, no new persistence, and no asset or provider drift.
 - Stop immediately if implementation reaches shared micro-UI family, monitoring-state, or shell-context architecture.
 
 Tests:
@@ -293,4 +295,4 @@ ## Implementation Order Recommendation
 2. Replace inventory dependencies second, with the focused story tests landing before the implementation changes.
 3. Convert `TenantRequiredPermissions` third, again extending the story tests before code changes.
 4. Convert `EvidenceOverview` fourth, with its focused page and derived-state tests updated before the refactor lands.
-5. Run the final focused verification pack, formatting, and release close-out last, and only then consider whether any optional same-class extra hit truly qualifies.
+5. Run the final focused verification pack, formatting, and release close-out last, and record whether the setup audit admitted any optional same-class extra hit. No new optional extra hit may enter scope after implementation has started.

specs/196-hard-filament-nativity-cleanup/quickstart.md

@@ -19,6 +19,7 @@ ### 1. Prepare shared test and guard scaffolding
 Do:
 
 - create the new focused surface-test entry points before story implementation starts
+- perform the setup audit that decides whether any optional same-class extra hit passes every FR-196-015 admission check before any extra hit begins; otherwise lock scope to the three named surfaces
 - add the shared guard expectations for new native page-table and faux-control regressions
 - add the shared mount-only query-seeding regression coverage that later story work depends on
 
@@ -124,7 +125,7 @@ ### 7. Record the release close-out in this quickstart
 When implementation is complete, update this file with a short close-out note that records:
 
 - which surfaces were actually cleaned
-- whether any optional same-class extra hit was included or explicitly rejected
+- whether any optional same-class extra hit was included or explicitly rejected, and if included, which FR-196-015 admission checks it satisfied
 - which related themes stayed out of scope and were deferred
 - which follow-up specs or artifacts were touched
 
@@ -151,15 +152,26 @@ ## Suggested Test Pack
 
 ## Manual Smoke Checklist
 
-1. Open an inventory item detail page and confirm dependency direction and relationship changes happen without a foreign apply-and-reload workflow.
-2. Open tenant required permissions and confirm the filter surface feels native, while summary counts, guidance, and copy flows remain correct.
-3. Open evidence overview and confirm the table behaves like a native Filament report with clear empty state and row inspect behavior.
-4. Confirm no cleaned surface leaks scope through query manipulation.
-5. Confirm no implementation expanded into monitoring-state, shell, or shared micro-UI redesign work.
+1. Open an inventory item detail page and confirm current record context stays visible, dependency direction and relationship changes happen in place without a foreign apply-and-reload workflow, missing-target markers remain visible where applicable, and empty-state copy still explains the no-results case.
+2. Open tenant required permissions and confirm current tenant scope and active filter state remain visible, the filter surface feels native, summary counts and freshness stay consistent with the visible rows, guidance remains available, and copy flows still use the same filtered state.
+3. Open evidence overview and confirm workspace scope and any active entitled-tenant filter remain visible, the table behaves like a native Filament report, artifact truth, freshness, and next-step context remain visible by default, `Clear filters` behaves correctly, and each authorized row still has one workspace-safe inspect path.
+4. Confirm no cleaned surface leaks scope, rows, counts, or drilldown targets through query manipulation.
+5. Confirm no implementation expanded into monitoring-state, shell, shared micro-UI redesign work, new wrapper layers, or new persistence created only to support the native controls.
 
 ## Deployment Notes
 
 - No migration is expected.
+- No polling change is expected.
 - No provider registration change is expected.
 - No new assets are expected.
-- Existing `cd apps/platform && php artisan filament:assets` deployment handling remains sufficient and unchanged.
+- Existing `cd apps/platform && php artisan filament:assets` deployment handling remains sufficient and unchanged.
+
+## Release Close-Out
+
+- Cleaned surfaces: inventory item dependency edges now run through the embedded `InventoryItemDependencyEdgesTable` component; tenant required permissions now uses one page-owned native table contract; evidence overview now uses one page-owned native workspace table.
+- Optional same-class extra hit decision: rejected. No additional nativity-bypass candidate passed every FR-196-015 admission check during setup, so scope remained frozen to the three named surfaces.
+- Deferred themes kept out of scope: monitoring page-state architecture, global shell or context redesign, shared micro-UI or wrapper abstractions, verification viewer families, and any new persistence or asset work.
+- Follow-up artifacts touched: this quickstart note, the Spec 196 task ledger, and the existing logical contract remained aligned without widening consumer scope.
+- Focused Sail verification pack: passed on 2026-04-14 with 45 tests and 177 assertions across the Spec 196 feature, guard, and unit coverage set.
+- Integrated-browser smoke sign-off: passed on `http://localhost` against tenant `19000000-0000-4000-8000-000000000191`, including an inventory detail fixture (`inventory-items/383`) and evidence fixture (`evidence/20`). Verified in-place dependency filters with visible active filter chips and missing-target hints, native required-permissions search plus technical-details matrix continuity, and evidence overview tenant prefilter plus `Clear filters` behavior with workspace-safe drilldown links.
+- Browser-log note: the integrated-browser session still contains old historical 419 and aborted-request noise from prior sessions, but no new Spec 196 surface-specific JavaScript failure blocked the smoke flow above.

specs/196-hard-filament-nativity-cleanup/spec.md

@@ -177,12 +177,19 @@ ### Functional Requirements
 - **FR-196-012**: Evidence overview MUST provide one consistent inspect or open model for authorized rows and MUST preserve the current workspace-safe drilldown into tenant evidence.
 - **FR-196-013**: Evidence overview MUST remove manual page-body query and Blade wiring that exists only because the report table is hand-built, while preserving entitled tenant prefilter behavior.
 - **FR-196-014**: Evidence overview MUST preserve workspace boundary enforcement, entitled-tenant filtering, and deny-as-not-found behavior for users outside the workspace boundary.
-- **FR-196-015**: Any additional cleanup hit included under this spec MUST share the same unnecessary nativity bypass, remain low to medium complexity, add no new product semantics, and avoid shared-family, shell, monitoring-state, and special-visualization work.
+- **FR-196-015**: Any additional cleanup hit included under this spec MUST pass all of the following admission checks before implementation starts on that hit: it removes the same confirmed nativity-bypass problem class as the three core surfaces (primary GET-form controls, request-driven page-body state, or a hand-built primary table imitating native Filament behavior); it stays read-only and preserves current scope semantics; it can be completed by modifying existing files only, or by adding at most one narrow sibling view or component file with no new route, persistence, enum, or shared abstraction; it does not enter shared-family, shell, monitoring-state, diff, verification-report, or special-visualization work; and it is explicitly recorded in release close-out. If any admission check fails, the candidate is out of scope.
 - **FR-196-016**: Any discovered related surface that crosses into shared detail micro-UI, monitoring state, context shell, verification report, diff or settings viewer, restore preview or result layouts, or other declared non-goal families MUST be documented and deferred instead of partially refactored here.
-- **FR-196-017**: This cleanup MUST NOT introduce a new wrapper microframework, presenter layer, or cross-page UI abstraction whose main purpose is to hide the same non-native contract.
-- **FR-196-018**: Each cleaned surface MUST remain operatorically at least as clear as before, with no loss of empty-state meaning, next-step clarity, scope signals, or inspect navigation.
+- **FR-196-017**: This cleanup MUST NOT introduce a new wrapper microframework, presenter layer, cross-page UI abstraction, or service whose main purpose is to translate bespoke pseudo-native page state into native Filament primitives. If native Filament or Livewire page state can express the behavior directly, direct state wins.
+- **FR-196-018**: Each cleaned surface MUST remain operatorically at least as clear as before. This requirement is satisfied only when the cleaned surface preserves all of the following, in the same primary surface where the operator is already working: inventory dependencies still shows current record context, direction and relationship scope labels, missing-target markers, meaningful empty-state copy, and safe inspect links; tenant required permissions still shows current tenant scope, active filter state, overall counts, freshness, guidance visibility, and copy payload behavior derived from the same normalized filter state; evidence overview still shows workspace scope, active entitled-tenant filter state, artifact truth, freshness, next-step context, clear-filter affordance, and one workspace-safe inspect path for authorized rows.
 - **FR-196-019**: Release close-out MUST list which surfaces were actually cleaned, which optional same-class low-risk hits were included, which related themes remained out of scope, and which follow-up specs were touched.
 
+### Non-Functional Requirements
+
+- **NFR-196-001**: Render-time behavior for inventory dependencies, tenant required permissions, and evidence overview MUST remain DB-only and MUST NOT introduce new Microsoft Graph calls, external HTTP requests, or other remote runtime dependencies.
+- **NFR-196-002**: This cleanup MUST NOT add new persistence artifacts, including tables, persisted UI-state mirrors, materialized helper projections, or helper models whose only purpose is to support the new native controls.
+- **NFR-196-003**: This cleanup MUST NOT add polling, provider registration changes, or new global or on-demand asset requirements. Existing `bootstrap/providers.php` registration and current `filament:assets` deployment handling remain unchanged.
+- **NFR-196-004**: Implementation MUST stay inside the current Filament v5 and Livewire v4 page layer and current derived services unless a touched existing service needs a narrow adapter to keep one authoritative normalized filter state.
+
 ## UI Action Matrix *(mandatory when Filament is changed)*
 
 | Surface | Location | Header Actions | Inspect Affordance (List/Table) | Row Actions (max 2 visible) | Bulk Actions (grouped) | Empty-State CTA(s) | View Header Actions | Create/Edit Save+Cancel | Audit log? | Notes / Exemptions |
@@ -208,6 +215,9 @@ ### Measurable Outcomes
 - **SC-196-004**: Release validation finds zero primary plain HTML control surfaces on the three core pages whose only purpose is to imitate native admin controls.
 - **SC-196-005**: Deeplink and prefilter behaviors continue to work for the targeted routes without allowing unauthorized tenant scope changes or cross-tenant row leakage.
 - **SC-196-006**: Final close-out documentation explicitly records completed surfaces, deferred related themes, and any optional extra hits that were admitted under the shared rule.
+- **SC-196-007**: Inventory dependencies preserves current-record context, direction and relationship labels, missing-target markers, safe inspect links, and meaningful empty-state copy after native state adoption.
+- **SC-196-008**: Tenant required permissions preserves visible active filter state, counts, freshness, guidance, and copy payload behavior that stay internally consistent for the same tenant and the same normalized filter state.
+- **SC-196-009**: Evidence overview preserves visible workspace scope signals, entitled-tenant clear-filter behavior, artifact truth, freshness, next-step context, and one workspace-safe inspect path for every authorized row.
 
 ## Assumptions
 

specs/196-hard-filament-nativity-cleanup/tasks.md

@@ -7,7 +7,7 @@ # Tasks: Hard Filament Nativity Cleanup
 **Input**: Design documents from `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/specs/196-hard-filament-nativity-cleanup/`
 **Prerequisites**: `plan.md`, `spec.md`, `research.md`, `data-model.md`, `quickstart.md`, `contracts/filament-nativity-cleanup.logical.openapi.yaml`
 
-**Tests**: Runtime behavior changes on existing Filament v5 / Livewire v4 operator surfaces require Pest feature, Livewire, RBAC, unit, and guard coverage. This task list adds or extends only the focused tests needed for the three in-scope surfaces.
+**Tests**: Runtime behavior changes on existing Filament v5 / Livewire v4 operator surfaces require Pest feature, Livewire, RBAC, unit, and guard coverage. This task list adds or extends only the focused tests needed for the three in-scope surfaces and their DB-only, no-wrapper, and scope-safety constraints.
 **Operations**: This cleanup does not introduce new queued work or `OperationRun` flows. Existing linked follow-up paths remain unchanged.
 **RBAC**: Tenant-context, route-tenant, workspace-membership, and entitled-tenant boundaries remain authoritative. Non-members stay `404`, and no new destructive action is added.
 **UI Naming**: Keep existing operator terms stable: `Dependencies`, `Direction`, `Relationship`, `Required permissions`, `Status`, `Type`, `Search`, `Evidence overview`, `Artifact truth`, `Freshness`, and `Next step`.
@@ -18,8 +18,8 @@ ## Phase 1: Setup (Shared Review Inputs)
 
 **Purpose**: Confirm the exact implementation entry points, native reference patterns, and focused regression baselines before editing the three in-scope surfaces.
 
-- [ ] T001 Audit the current nativity-bypass entry points and native reference implementations in `apps/platform/app/Filament/Resources/InventoryItemResource.php`, `apps/platform/resources/views/filament/components/dependency-edges.blade.php`, `apps/platform/app/Filament/Pages/TenantRequiredPermissions.php`, `apps/platform/resources/views/filament/pages/tenant-required-permissions.blade.php`, `apps/platform/app/Filament/Pages/Monitoring/EvidenceOverview.php`, `apps/platform/resources/views/filament/pages/monitoring/evidence-overview.blade.php`, `apps/platform/app/Filament/Pages/Reviews/ReviewRegister.php`, `apps/platform/app/Filament/Pages/InventoryCoverage.php`, and `apps/platform/app/Livewire/BackupSetPolicyPickerTable.php`
-- [ ] T002 [P] Audit the focused regression baselines in `apps/platform/tests/Feature/InventoryItemDependenciesTest.php`, `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php`, `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`, `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`, and `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`
+- [X] T001 Audit the current nativity-bypass entry points and native reference implementations in `apps/platform/app/Filament/Resources/InventoryItemResource.php`, `apps/platform/resources/views/filament/components/dependency-edges.blade.php`, `apps/platform/app/Filament/Pages/TenantRequiredPermissions.php`, `apps/platform/resources/views/filament/pages/tenant-required-permissions.blade.php`, `apps/platform/app/Filament/Pages/Monitoring/EvidenceOverview.php`, `apps/platform/resources/views/filament/pages/monitoring/evidence-overview.blade.php`, `apps/platform/app/Filament/Pages/Reviews/ReviewRegister.php`, `apps/platform/app/Filament/Pages/InventoryCoverage.php`, and `apps/platform/app/Livewire/BackupSetPolicyPickerTable.php`, and record whether any optional extra candidate passes every FR-196-015 admission check; otherwise freeze scope to the three named surfaces
+- [X] T002 [P] Audit the focused regression baselines in `apps/platform/tests/Feature/InventoryItemDependenciesTest.php`, `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php`, `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`, `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`, and `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`
 
 ---
 
@@ -29,11 +29,11 @@ ## Phase 2: Foundational (Blocking Prerequisites)
 
 **CRITICAL**: No user story work should begin until this phase is complete.
 
-- [ ] T003 [P] Create the new Spec 196 surface-test entry points in `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php` and `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php`
-- [ ] T004 [P] Review and, if newly applicable, extend shared native-table guard coverage for Spec 196 page-owned tables and faux-control regressions in `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`
-- [ ] T005 [P] Add shared regression coverage for mount-only query seeding versus authoritative scope in `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php` and `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`
+- [X] T003 [P] Create the new Spec 196 surface-test entry points in `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php` and `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php`
+- [X] T004 [P] Review and, if newly applicable, extend shared native-table guard coverage for Spec 196 page-owned tables, faux-control regressions, and no-new-wrapper drift in `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`
+- [X] T005 [P] Add shared regression coverage for mount-only query seeding versus authoritative scope in `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php` and `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`
 
-**Checkpoint**: The shared Spec 196 test harness is in place, and later surface work can prove native state ownership without reopening scope or guard assumptions.
+**Checkpoint**: The shared Spec 196 test harness and scope gate are in place, and later surface work can prove native state ownership without reopening scope or guard assumptions.
 
 ---
 
@@ -47,13 +47,13 @@ ### Tests for User Story 1
 
 > **NOTE**: Write these tests first and confirm they fail before implementation.
 
-- [ ] T006 [P] [US1] Extend `apps/platform/tests/Feature/InventoryItemDependenciesTest.php` with native component-state expectations for direction changes, relationship narrowing, empty states, and preserved target safety
-- [ ] T007 [P] [US1] Add Livewire table-component coverage in `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php` for mount state, filter updates, missing-target rendering, and tenant isolation
+- [X] T006 [P] [US1] Extend `apps/platform/tests/Feature/InventoryItemDependenciesTest.php` with native component-state expectations for direction changes, relationship narrowing, empty states, and preserved target safety
+- [X] T007 [P] [US1] Add Livewire table-component coverage in `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php` for mount state, filter updates, missing-target rendering, and tenant isolation
 
 ### Implementation for User Story 1
 
-- [ ] T008 [US1] Create `apps/platform/app/Livewire/InventoryItemDependencyEdgesTable.php` as an embedded Filament `TableComponent` that owns direction and relationship state and queries rows through the current dependency services
-- [ ] T009 [US1] Update `apps/platform/app/Filament/Resources/InventoryItemResource.php` and `apps/platform/resources/views/filament/components/dependency-edges.blade.php` to mount the embedded table component and remove the GET-form / `request()`-driven control contract while preserving target links, badges, and missing-target hints
+- [X] T008 [US1] Create `apps/platform/app/Livewire/InventoryItemDependencyEdgesTable.php` as an embedded Filament `TableComponent` that owns direction and relationship state and queries rows through the current dependency services
+- [X] T009 [US1] Update `apps/platform/app/Filament/Resources/InventoryItemResource.php` and `apps/platform/resources/views/filament/components/dependency-edges.blade.php` to mount the embedded table component and remove the GET-form / `request()`-driven control contract while preserving target links, badges, and missing-target hints
 
 **Checkpoint**: User Story 1 is complete when inventory detail keeps the same dependency meaning and target safety without switching operators into a foreign apply-and-reload workflow.
 
@@ -69,14 +69,14 @@ ### Tests for User Story 2
 
 > **NOTE**: Write these tests first and confirm they fail before implementation.
 
-- [ ] T010 [P] [US2] Extend `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php` for route-tenant authority, query-seeded status/type/search/features state, and ignored foreign-tenant query values
-- [ ] T011 [P] [US2] Add native page-table coverage in `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php` for filter updates, search, summary consistency, guidance visibility, copy payload continuity, and no-results states
-- [ ] T012 [P] [US2] Keep filter-normalization, overall-status, feature-impact, freshness, and copy-payload invariants aligned in `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, and `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`
+- [X] T010 [P] [US2] Extend `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php` for route-tenant authority, query-seeded status/type/search/features state, and ignored foreign-tenant query values
+- [X] T011 [P] [US2] Add native page-table coverage in `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php` for filter updates, search, summary consistency, guidance visibility, copy payload continuity, and no-results states
+- [X] T012 [P] [US2] Keep filter-normalization, overall-status, feature-impact, freshness, and copy-payload invariants aligned in `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, and `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`
 
 ### Implementation for User Story 2
 
-- [ ] T013 [US2] Convert `apps/platform/app/Filament/Pages/TenantRequiredPermissions.php` to `HasTable` / `InteractsWithTable` with native filters, native search, and mount-only query seeding
-- [ ] T014 [US2] Align `apps/platform/resources/views/filament/pages/tenant-required-permissions.blade.php` and, if needed, `apps/platform/app/Services/Intune/TenantRequiredPermissionsViewModelBuilder.php` so summary counts, freshness, feature impacts, guidance, and copy payloads are derived from the same normalized native table state
+- [X] T013 [US2] Convert `apps/platform/app/Filament/Pages/TenantRequiredPermissions.php` to `HasTable` / `InteractsWithTable` with native filters, native search, and mount-only query seeding
+- [X] T014 [US2] Align `apps/platform/resources/views/filament/pages/tenant-required-permissions.blade.php` and, if needed, `apps/platform/app/Services/Intune/TenantRequiredPermissionsViewModelBuilder.php` so summary counts, freshness, feature impacts, guidance, and copy payloads are derived from the same normalized native table state
 
 **Checkpoint**: User Story 2 is complete when required permissions behaves like one native Filament page without losing tenant authority, summary clarity, or follow-up guidance.
 
@@ -92,13 +92,13 @@ ### Tests for User Story 3
 
 > **NOTE**: Write these tests first and confirm they fail before implementation.
 
-- [ ] T015 [P] [US3] Extend `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php` for native table rendering, native search behavior, entitled-tenant seed and clear behavior, workspace-safe row drilldown, empty states, and deny-as-not-found enforcement
-- [ ] T016 [P] [US3] Extend `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php` and, if newly applicable, `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php` for DB-only derived-row rendering and the new page-owned native table contract
+- [X] T015 [P] [US3] Extend `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php` for native table rendering, native search behavior, visible workspace scope and active entitled-tenant filter state, artifact-truth and freshness and next-step row fields, entitled-tenant seed and clear behavior, workspace-safe row drilldown, clear-filter behavior, empty states, and deny-as-not-found enforcement
+- [X] T016 [P] [US3] Extend `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php` and, if newly applicable, `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php` for DB-only derived-row rendering and the new page-owned native table contract
 
 ### Implementation for User Story 3
 
-- [ ] T017 [US3] Convert `apps/platform/app/Filament/Pages/Monitoring/EvidenceOverview.php` to `HasTable` / `InteractsWithTable` with derived row callbacks, native filter and search state, entitled-tenant query seeding, and one inspect model
-- [ ] T018 [US3] Replace the hand-built report table in `apps/platform/resources/views/filament/pages/monitoring/evidence-overview.blade.php` with a native table wrapper that preserves the clear-filter affordance and current drilldown copy
+- [X] T017 [US3] Convert `apps/platform/app/Filament/Pages/Monitoring/EvidenceOverview.php` to `HasTable` / `InteractsWithTable` with derived row callbacks that preserve visible workspace scope, active entitled-tenant filter state, artifact-truth, freshness, and next-step row context, native filter and search state, entitled-tenant query seeding, clear-filter behavior, and one inspect model
+- [X] T018 [US3] Replace the hand-built report table in `apps/platform/resources/views/filament/pages/monitoring/evidence-overview.blade.php` with a native table wrapper that preserves the clear-filter affordance and current drilldown copy
 
 **Checkpoint**: User Story 3 is complete when evidence overview reads like one native workspace review table without leaking unauthorized tenant scope or losing the current drilldown path.
 
@@ -108,11 +108,11 @@ ## Phase 6: Polish & Cross-Cutting Verification
 
 **Purpose**: Run the focused verification pack, format the touched files, and record the final bounded scope outcome for Spec 196.
 
-- [ ] T019 Run the focused Spec 196 Sail verification pack from `specs/196-hard-filament-nativity-cleanup/quickstart.md` against `apps/platform/tests/Feature/InventoryItemDependenciesTest.php`, `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php`, `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php`, `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php`, `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`, `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php`, `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, and `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`
-- [ ] T020 Run `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` and resolve formatting issues in the changed files under `apps/platform/app/`, `apps/platform/resources/views/filament/`, and `apps/platform/tests/`
-- [ ] T021 Execute the manual smoke checklist in `specs/196-hard-filament-nativity-cleanup/quickstart.md` across the three cleaned surfaces and capture any sign-off notes needed for release close-out
-- [ ] T022 Record the Spec 196 release close-out in `specs/196-hard-filament-nativity-cleanup/quickstart.md` with the final cleaned surfaces, any optional same-class extra hit decision, deferred themes, and touched follow-up specs
-- [ ] T023 Verify the final close-out note in `specs/196-hard-filament-nativity-cleanup/quickstart.md` and the contract-modeled consumers, invariants, and non-goals in `specs/196-hard-filament-nativity-cleanup/contracts/filament-nativity-cleanup.logical.openapi.yaml` remain aligned with the implemented scope
+- [X] T019 Run the focused Spec 196 Sail verification pack from `specs/196-hard-filament-nativity-cleanup/quickstart.md` against `apps/platform/tests/Feature/InventoryItemDependenciesTest.php`, `apps/platform/tests/Feature/Filament/InventoryItemDependencyEdgesTableTest.php`, `apps/platform/tests/Feature/Rbac/TenantRequiredPermissionsTrustedStateTest.php`, `apps/platform/tests/Feature/Filament/TenantRequiredPermissionsPageTest.php`, `apps/platform/tests/Feature/Evidence/EvidenceOverviewPageTest.php`, `apps/platform/tests/Feature/Filament/EvidenceOverviewDerivedStateMemoizationTest.php`, `apps/platform/tests/Feature/Guards/FilamentTableStandardsGuardTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFilteringTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsOverallStatusTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFeatureImpactTest.php`, `apps/platform/tests/Unit/TenantRequiredPermissionsFreshnessTest.php`, and `apps/platform/tests/Unit/TenantRequiredPermissionsCopyPayloadTest.php`, and confirm the pack still proves DB-only rendering, no-wrapper drift protection, and scope-safety invariants
+- [X] T020 Run `cd apps/platform && ./vendor/bin/sail bin pint --dirty --format agent` and resolve formatting issues in the changed files under `apps/platform/app/`, `apps/platform/resources/views/filament/`, and `apps/platform/tests/`
+- [X] T021 Execute the manual smoke checklist in `specs/196-hard-filament-nativity-cleanup/quickstart.md` across the three cleaned surfaces, explicitly verifying current-context visibility, active filter or scope signals, empty-state meaning, guidance or next-step clarity, and inspect navigation, and capture any sign-off notes needed for release close-out
+- [X] T022 Record the Spec 196 release close-out in `specs/196-hard-filament-nativity-cleanup/quickstart.md` with the final cleaned surfaces, any optional same-class extra hit decision, deferred themes, and touched follow-up specs
+- [X] T023 Verify the final close-out note in `specs/196-hard-filament-nativity-cleanup/quickstart.md` and the contract-modeled consumers, invariants, non-goals, and non-functional constraints in `specs/196-hard-filament-nativity-cleanup/contracts/filament-nativity-cleanup.logical.openapi.yaml` remain aligned with the implemented scope
 
 ---
 

specs/197-shared-detail-contract/checklists/requirements.md

@@ -0,0 +1,36 @@
+# Specification Quality Checklist: Shared Detail Micro-UI Contract
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning  
+**Created**: 2026-04-15  
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Validation completed in one pass.
+- The spec stays bounded to two already proven shared detail families and explicitly excludes shell, monitoring-state, and broad custom-view consolidation themes.
+- Repository truth from current host usage informed the in-scope family definitions without embedding file-level implementation detail into the spec body.

specs/197-shared-detail-contract/contracts/normalized-detail-family.openapi.yaml

@@ -0,0 +1,299 @@
+openapi: 3.1.0
+info:
+  title: Normalized Detail Family Internal Surface Contract
+  version: 0.1.0
+  summary: Internal logical contract for shared normalized settings and normalized diff families
+  description: |
+    This contract is an internal planning artifact for Spec 197. It documents the
+    family-owned normalized settings and normalized diff surfaces used across
+    policy, policy version, and finding detail hosts. Rendered routes still
+    return HTML. The structured schemas below describe the internal surface
+    contract and approved host-variation boundaries. This does not add a public
+    HTTP API.
+servers:
+  - url: /internal
+x-family-consumers:
+  - surface: policy_settings
+    source: normalized_settings_surface
+    accessPattern: infolist_safe
+    guardScope:
+      - apps/platform/app/Filament/Resources/PolicyResource.php
+      - apps/platform/resources/views/filament/infolists/entries/normalized-settings.blade.php
+    requiredMarkers:
+      - NormalizedSettingsSurface::build
+      - data-shared-detail-family="normalized-settings"
+      - data-shared-normalized-settings-host="policy"
+  - surface: policy_version_settings
+    source: normalized_settings_surface
+    accessPattern: infolist_safe
+    guardScope:
+      - apps/platform/app/Filament/Resources/PolicyVersionResource.php
+      - apps/platform/resources/views/filament/infolists/entries/normalized-settings.blade.php
+    requiredMarkers:
+      - NormalizedSettingsSurface::build
+      - data-shared-detail-family="normalized-settings"
+      - data-shared-normalized-settings-host="policy_version"
+    x-forbiddenMarkers:
+      - needle: "->view('filament.infolists.entries.policy-settings-standard')"
+        max: 0
+  - surface: policy_version_diff
+    source: normalized_diff_surface
+    accessPattern: infolist_safe
+    guardScope:
+      - apps/platform/app/Filament/Resources/PolicyVersionResource.php
+      - apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php
+    requiredMarkers:
+      - NormalizedDiffSurface::build
+      - data-shared-detail-family="normalized-diff"
+      - data-shared-normalized-diff-host="policy_version"
+      - data-shared-zone="summary"
+      - data-shared-zone="groups"
+  - surface: finding_diff
+    source: normalized_diff_surface
+    accessPattern: infolist_safe
+    guardScope:
+      - apps/platform/app/Filament/Resources/FindingResource.php
+      - apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php
+    requiredMarkers:
+      - NormalizedDiffSurface::build
+      - data-shared-detail-family="normalized-diff"
+      - data-shared-normalized-diff-host="finding"
+      - data-shared-normalized-diff-state
+      - data-shared-zone="summary"
+paths:
+  /ui-contracts/normalized-settings/resolve:
+    get:
+      summary: Resolve the shared normalized settings family contract for one host
+      operationId: resolveNormalizedSettingsSurface
+      parameters:
+        - name: host
+          in: query
+          required: true
+          schema:
+            $ref: '#/components/schemas/NormalizedSettingsHostKind'
+      responses:
+        '200':
+          description: Shared normalized settings family contract resolved for the current host context
+          content:
+            application/vnd.tenantpilot.normalized-settings-surface+json:
+              schema:
+                $ref: '#/components/schemas/NormalizedSettingsSurfaceContract'
+        '403':
+          description: Actor is in scope but lacks the capability required to view the host
+        '404':
+          description: Host or tenant scope is not visible in the current workspace or tenant context
+  /ui-contracts/normalized-diff/resolve:
+    get:
+      summary: Resolve the shared normalized diff family contract for one host
+      operationId: resolveNormalizedDiffSurface
+      parameters:
+        - name: host
+          in: query
+          required: true
+          schema:
+            $ref: '#/components/schemas/NormalizedDiffHostKind'
+      responses:
+        '200':
+          description: Shared normalized diff family contract resolved for the current host context
+          content:
+            application/vnd.tenantpilot.normalized-diff-surface+json:
+              schema:
+                $ref: '#/components/schemas/NormalizedDiffSurfaceContract'
+        '403':
+          description: Actor is in scope but lacks the capability required to view the host
+        '404':
+          description: Host or tenant scope is not visible in the current workspace or tenant context
+components:
+  schemas:
+    NormalizedSettingsHostKind:
+      type: string
+      enum:
+        - policy
+        - policy_version
+    NormalizedDiffHostKind:
+      type: string
+      enum:
+        - policy_version
+        - finding
+    NormalizedSettingsVariant:
+      type: string
+      enum:
+        - settings_catalog_table
+        - standard_blocks
+    AvailabilityState:
+      type: string
+      enum:
+        - available
+        - unavailable
+        - partial
+    NormalizedSettingsSectionBehavior:
+      type: object
+      additionalProperties: false
+      required:
+        - preservesSectionOrder
+        - supportsExpansion
+        - ownsEmptyState
+      properties:
+        preservesSectionOrder:
+          type: boolean
+        supportsExpansion:
+          type: boolean
+        ownsEmptyState:
+          type: boolean
+    NormalizedSettingsRenderExpectations:
+      type: object
+      additionalProperties: false
+      required:
+        - ownsWarningsInWrapper
+        - ownsSubtypeDelegation
+        - keepsHostFramingOutsideCore
+      properties:
+        ownsWarningsInWrapper:
+          type: boolean
+        ownsSubtypeDelegation:
+          type: boolean
+        keepsHostFramingOutsideCore:
+          type: boolean
+    NormalizedDiffViewMode:
+      type: object
+      additionalProperties: false
+      required:
+        - key
+        - label
+        - default
+      properties:
+        key:
+          type: string
+        label:
+          type: string
+        default:
+          type: boolean
+    NormalizedDiffSectionBehavior:
+      type: object
+      additionalProperties: false
+      required:
+        - preservesGroupOrder
+        - supportsExpansion
+        - supportsFullscreen
+      properties:
+        preservesGroupOrder:
+          type: boolean
+        supportsExpansion:
+          type: boolean
+        supportsFullscreen:
+          type: boolean
+    NormalizedDiffRenderExpectations:
+      type: object
+      additionalProperties: false
+      required:
+        - ownsAvailabilityState
+        - ownsZeroDiffMessaging
+        - keepsHostFramingOutsideCore
+      properties:
+        ownsAvailabilityState:
+          type: boolean
+        ownsZeroDiffMessaging:
+          type: boolean
+        keepsHostFramingOutsideCore:
+          type: boolean
+    NormalizedSettingsSurfaceContract:
+      type: object
+      additionalProperties: false
+      required:
+        - hostKind
+        - context
+        - variant
+        - sectionBehavior
+        - renderExpectations
+        - titlePolicy
+      properties:
+        hostKind:
+          $ref: '#/components/schemas/NormalizedSettingsHostKind'
+        context:
+          type: string
+          enum:
+            - policy
+            - version
+        variant:
+          $ref: '#/components/schemas/NormalizedSettingsVariant'
+        warnings:
+          type: array
+          items:
+            type: string
+        settingsTable:
+          type:
+            - object
+            - 'null'
+        blocks:
+          type: array
+          items:
+            type: object
+        sectionBehavior:
+          $ref: '#/components/schemas/NormalizedSettingsSectionBehavior'
+        renderExpectations:
+          $ref: '#/components/schemas/NormalizedSettingsRenderExpectations'
+        emptyState:
+          type:
+            - object
+            - 'null'
+        titlePolicy:
+          type: object
+          additionalProperties: false
+          required:
+            - showWrapperTitle
+          properties:
+            showWrapperTitle:
+              type: boolean
+    NormalizedDiffSurfaceContract:
+      type: object
+      additionalProperties: false
+      required:
+        - hostKind
+        - availabilityState
+        - summary
+        - viewModes
+        - sectionBehavior
+        - renderExpectations
+      properties:
+        hostKind:
+          $ref: '#/components/schemas/NormalizedDiffHostKind'
+        availabilityState:
+          $ref: '#/components/schemas/AvailabilityState'
+        summary:
+          type: object
+          additionalProperties: false
+          required:
+            - added
+            - removed
+            - changed
+          properties:
+            added:
+              type: integer
+            removed:
+              type: integer
+            changed:
+              type: integer
+            message:
+              type:
+                - string
+                - 'null'
+        viewModes:
+          type: array
+          items:
+            $ref: '#/components/schemas/NormalizedDiffViewMode'
+        sectionBehavior:
+          $ref: '#/components/schemas/NormalizedDiffSectionBehavior'
+        renderExpectations:
+          $ref: '#/components/schemas/NormalizedDiffRenderExpectations'
+        groups:
+          type: array
+          items:
+            type: object
+        scriptRendering:
+          type:
+            - object
+            - 'null'
+        emptyState:
+          type:
+            - object
+            - 'null'

specs/197-shared-detail-contract/contracts/verification-report-family.openapi.yaml

@@ -0,0 +1,304 @@
+openapi: 3.1.0
+info:
+  title: Verification Report Family Internal Surface Contract
+  version: 0.1.0
+  summary: Internal logical contract for the shared Verification Report family
+  description: |
+    This contract is an internal planning artifact for Spec 197. It documents the
+    family-owned verification surface used across operation detail, onboarding,
+    and tenant verification widget hosts. Rendered routes still return HTML.
+    The structured schemas below describe the internal surface contract and the
+    allowed host-variation boundaries. This does not add a public HTTP API.
+servers:
+  - url: /internal
+x-family-consumers:
+  - surface: operation_run_detail
+    source: verification_report_surface
+    accessPattern: detail_safe
+    guardScope:
+      - apps/platform/app/Filament/Resources/OperationRunResource.php
+      - apps/platform/resources/views/filament/components/verification-report-viewer.blade.php
+    requiredMarkers:
+      - VerificationReportViewer::surface
+      - data-shared-detail-family="verification-report"
+      - data-host-kind="operation_run_detail"
+      - data-shared-zone="summary"
+      - data-shared-zone="diagnostics"
+  - surface: onboarding_verification_step
+    source: verification_report_surface
+    accessPattern: form_embedded_safe
+    guardScope:
+      - apps/platform/app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+      - apps/platform/resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php
+    requiredMarkers:
+      - VerificationReportViewer::surface
+      - data-shared-detail-family="verification-report"
+      - data-host-kind="onboarding_wizard"
+      - assistActionName
+      - technicalDetailsActionName
+    x-forbiddenMarkers:
+      - needle: "x-data=\"{ tab: 'issues' }\""
+        max: 0
+  - surface: tenant_verification_widget
+    source: verification_report_surface
+    accessPattern: widget_safe
+    guardScope:
+      - apps/platform/app/Filament/Widgets/Tenant/TenantVerificationReport.php
+      - apps/platform/resources/views/filament/widgets/tenant/tenant-verification-report.blade.php
+    requiredMarkers:
+      - VerificationReportViewer::surface
+      - data-shared-detail-family="verification-report"
+      - data-host-kind="tenant_widget"
+      - data-shared-zone="summary"
+      - data-shared-zone="diagnostics"
+paths:
+  /ui-contracts/verification-report/resolve:
+    get:
+      summary: Resolve the shared Verification Report family contract for one host
+      operationId: resolveVerificationReportSurface
+      parameters:
+        - name: host
+          in: query
+          required: true
+          schema:
+            $ref: '#/components/schemas/VerificationHostKind'
+        - name: runId
+          in: query
+          required: false
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: Shared Verification Report surface contract resolved for the current host context
+          content:
+            application/vnd.tenantpilot.verification-report-surface+json:
+              schema:
+                $ref: '#/components/schemas/VerificationReportSurfaceContract'
+        '403':
+          description: Actor is in scope but lacks the capability required for host-owned actions
+        '404':
+          description: Run or tenant scope is not visible in the current workspace or tenant context
+  /admin/onboarding:
+    get:
+      summary: Onboarding verification host using the shared Verification Report family
+      operationId: viewOnboardingVerificationHost
+      responses:
+        '200':
+          description: Rendered onboarding verification step with shared verification family core
+          content:
+            text/html:
+              schema:
+                type: string
+  /admin/t/{tenant}:
+    get:
+      summary: Tenant verification widget host using the shared Verification Report family
+      operationId: viewTenantVerificationWidgetHost
+      parameters:
+        - name: tenant
+          in: path
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: Rendered tenant detail page containing the shared verification family widget
+          content:
+            text/html:
+              schema:
+                type: string
+components:
+  schemas:
+    VerificationHostKind:
+      type: string
+      enum:
+        - operation_run_detail
+        - onboarding_wizard
+        - tenant_widget
+    VerificationCoreState:
+      type: string
+      enum:
+        - unavailable
+        - completed
+    VerificationActionKind:
+      type: string
+      enum:
+        - navigation
+        - assist
+        - acknowledge
+        - refresh
+        - technical_details
+    VerificationHostVariation:
+      type: object
+      additionalProperties: false
+      required:
+        - ownsNoRunState
+        - ownsActiveState
+        - supportsAssist
+        - supportsAcknowledge
+        - supportsTechnicalDetailsTrigger
+      properties:
+        ownsNoRunState:
+          type: boolean
+        ownsActiveState:
+          type: boolean
+        supportsAssist:
+          type: boolean
+        supportsAcknowledge:
+          type: boolean
+        supportsTechnicalDetailsTrigger:
+          type: boolean
+    VerificationAction:
+      type: object
+      additionalProperties: false
+      required:
+        - kind
+        - label
+        - ownedByHost
+      properties:
+        kind:
+          $ref: '#/components/schemas/VerificationActionKind'
+        label:
+          type: string
+        ownedByHost:
+          type: boolean
+    VerificationViewZone:
+      type: object
+      additionalProperties: false
+      required:
+        - key
+        - label
+        - defaultVisible
+      properties:
+        key:
+          type: string
+        label:
+          type: string
+        defaultVisible:
+          type: boolean
+        optional:
+          type: boolean
+    VerificationNextStepPlacement:
+      type: string
+      enum:
+        - shared_zone
+        - host_action_zone
+    VerificationNextStep:
+      type: object
+      additionalProperties: false
+      required:
+        - label
+        - placement
+        - ownedByHost
+      properties:
+        label:
+          type: string
+        placement:
+          $ref: '#/components/schemas/VerificationNextStepPlacement'
+        ownedByHost:
+          type: boolean
+        actionKind:
+          oneOf:
+            - $ref: '#/components/schemas/VerificationActionKind'
+            - type: 'null'
+    VerificationOptionalZone:
+      type: string
+      enum:
+        - technical_details
+        - change_indicator
+        - previous_run_context
+    VerificationIssueGroup:
+      type: object
+      additionalProperties: false
+      required:
+        - label
+        - checks
+      properties:
+        label:
+          type: string
+        checks:
+          type: array
+          items:
+            type: object
+    VerificationDiagnostics:
+      type: object
+      additionalProperties: false
+      required:
+        - hasTechnicalZone
+      properties:
+        hasTechnicalZone:
+          type: boolean
+        fingerprint:
+          type:
+            - string
+            - 'null'
+        previousRunUrl:
+          type:
+            - string
+            - 'null'
+        operationRunId:
+          type:
+            - integer
+            - 'null'
+    VerificationReportSurfaceContract:
+      type: object
+      additionalProperties: false
+      required:
+        - hostKind
+        - coreState
+        - summary
+        - issueGroups
+        - passedChecks
+        - diagnostics
+        - viewZones
+        - nextSteps
+        - hostVariation
+      properties:
+        hostKind:
+          $ref: '#/components/schemas/VerificationHostKind'
+        coreState:
+          $ref: '#/components/schemas/VerificationCoreState'
+        summary:
+          type: object
+          additionalProperties: false
+          required:
+            - overallLabel
+            - counts
+          properties:
+            overallLabel:
+              type: string
+            counts:
+              type: object
+              additionalProperties:
+                type: integer
+        issueGroups:
+          type: array
+          items:
+            $ref: '#/components/schemas/VerificationIssueGroup'
+        passedChecks:
+          type: array
+          items:
+            type: object
+        diagnostics:
+          $ref: '#/components/schemas/VerificationDiagnostics'
+        viewZones:
+          type: array
+          items:
+            $ref: '#/components/schemas/VerificationViewZone'
+        nextSteps:
+          type: array
+          items:
+            $ref: '#/components/schemas/VerificationNextStep'
+        hostActions:
+          type: array
+          items:
+            $ref: '#/components/schemas/VerificationAction'
+        hostVariation:
+          $ref: '#/components/schemas/VerificationHostVariation'
+        optionalZones:
+          type: array
+          items:
+            $ref: '#/components/schemas/VerificationOptionalZone'
+        emptyState:
+          type:
+            - object
+            - 'null'

specs/197-shared-detail-contract/data-model.md

@@ -0,0 +1,232 @@
+# Phase 1 Data Model: Shared Detail Micro-UI Contract
+
+## Overview
+
+This feature adds no database table, no persisted UI artifact, and no new state family. It formalizes two existing shared detail families as runtime contracts with explicit host-variation boundaries.
+
+## Persistent Source Truths
+
+### OperationRun
+
+**Purpose**: Supplies stored verification status, timing, target scope, failure summary, and the raw verification report payload already used by the current verification hosts.
+
+**Key fields**:
+
+- `id`
+- `workspace_id`
+- `tenant_id`
+- `type`
+- `status`
+- `outcome`
+- `started_at`
+- `completed_at`
+- `context.verification_report`
+- `context.target_scope`
+- `failure_summary`
+
+**Validation rules**:
+
+- Verification family rendering remains DB-only and derives only from stored run data.
+- No host may introduce a second source of verification truth outside the run payload and existing support helpers.
+
+### Policy and PolicyVersion snapshot truth
+
+**Purpose**: Supplies the source payloads for normalized settings and version-to-version diffs.
+
+**Key fields**:
+
+- `policies.id`
+- `policies.tenant_id`
+- `policies.policy_type`
+- `policies.platform`
+- `policy_versions.id`
+- `policy_versions.policy_id`
+- `policy_versions.snapshot`
+- `policy_versions.policy_type`
+- `policy_versions.platform`
+
+**Validation rules**:
+
+- The settings and diff families remain derived from current normalized snapshot truth.
+- No new persisted “surface state” may be added to remember tabs, expanded sections, or unavailable-state decisions.
+
+### Finding drift evidence
+
+**Purpose**: Supplies the source references and availability reasons for diff rendering on drift findings.
+
+**Key fields**:
+
+- `findings.id`
+- `findings.tenant_id`
+- `findings.finding_type`
+- `findings.evidence_jsonb.summary.kind`
+- `findings.evidence_jsonb.baseline.policy_version_id`
+- `findings.evidence_jsonb.current.policy_version_id`
+
+**Validation rules**:
+
+- Diff availability remains derived from referenced versions and current tenant context.
+- The shared diff family must express unavailable or partial state from these sources instead of letting each host improvise new rules.
+
+## Existing Runtime Source Objects
+
+### VerificationReportViewer
+
+**Purpose**: Existing support seam that extracts and validates the verification report, computes fingerprints, and resolves previous runs.
+
+**Current responsibilities already present**:
+
+- `report()`
+- `fingerprint()`
+- `previousRun()`
+- `shouldRenderForRun()`
+- `redactionNotes()`
+
+**Relationship to this feature**:
+
+- It becomes the narrow verification-family contract seam rather than being replaced.
+- It should grow family-owned shaping helpers instead of remaining only a payload extractor.
+
+### PolicyNormalizer, VersionDiff, and DriftFindingDiffBuilder
+
+**Purpose**: Existing domain truth builders that already normalize settings and derive diffs.
+
+**Relationship to this feature**:
+
+- They remain the domain truth source.
+- The new family contracts sit after these builders and before host rendering.
+- The feature must not create a second normalization pipeline.
+
+### SettingsCatalogSettingsTable
+
+**Purpose**: Existing Livewire renderer for the settings-catalog table subtype.
+
+**Relationship to this feature**:
+
+- It remains the renderer for one settings subtype.
+- The settings family wrapper decides when it appears and with what shared wrapper semantics.
+
+## New Derived Runtime Contracts
+
+### VerificationReportSurfaceContract
+
+**Purpose**: One runtime contract that defines the verification family’s shared zones and allowed host variations.
+
+#### Fields
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `host_kind` | enum(`operation_run_detail`,`onboarding_wizard`,`tenant_widget`) | yes | Current host family consumer |
+| `core_state` | enum(`unavailable`,`completed`) | yes | Shared family core state after host-owned no-run or in-progress framing |
+| `summary` | object | yes | Overall badge, counts, and change-indicator data |
+| `issue_groups` | array | yes | Grouped blockers, failures, warnings, and acknowledged issues |
+| `passed_checks` | array | yes | Checks rendered under the passed zone |
+| `diagnostics` | object | yes | Fingerprint, run identity, previous-run link, and related technical details |
+| `view_zones` | array | yes | Ordered family view or tab definitions |
+| `next_steps` | array | yes | Shared next-step items derived from report checks |
+| `host_actions` | array | no | Host-owned actions such as assist, acknowledge, refresh, or open operation |
+| `optional_zones` | array | no | Family-recognized zones that may be absent, such as technical details |
+| `empty_state` | object nullable | no | Family-owned unavailable-state explanation when no valid report payload exists |
+
+#### Validation rules
+
+- The contract must own one tab or view model across all completed or unavailable verification surfaces.
+- Hosts may append actions and framing, but may not redefine issue grouping, passed-check grouping, or diagnostics ownership.
+- Host actions must declare whether they are shared navigation, host assist, or host mutation.
+
+### VerificationReportHostVariation
+
+**Purpose**: Declares the bounded host-owned differences for a verification-family consumer.
+
+#### Fields
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `owns_no_run_state` | bool | yes | Whether the host frames its own pre-run state |
+| `owns_active_state` | bool | yes | Whether the host frames its own in-progress state |
+| `supports_acknowledge` | bool | yes | Whether the host may surface acknowledgement mutations |
+| `supports_assist` | bool | yes | Whether the host may route next steps through assist actions |
+| `supports_technical_details_trigger` | bool | yes | Whether the host exposes a dedicated technical-details trigger outside the family core |
+
+#### Validation rules
+
+- Host variation may extend actions and framing only.
+- Host variation must never add a second structural tab system or redefine the diagnostics contract.
+
+### NormalizedSettingsSurfaceContract
+
+**Purpose**: One runtime contract that defines the normalized settings family’s wrapper ownership, subtype selection, warnings, and empty-state behavior.
+
+#### Fields
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `host_kind` | enum(`policy`,`policy_version`) | yes | Host context for the settings family |
+| `context` | enum(`policy`,`version`) | yes | Existing context string used for table query-string isolation and titles |
+| `variant` | enum(`settings_catalog_table`,`standard_blocks`) | yes | Explicit subtype used by the shared family |
+| `warnings` | array | no | Warning list displayed by the family wrapper |
+| `settings_table` | object nullable | no | Table subtype payload when the settings-catalog subtype is active |
+| `blocks` | array | no | Standard block payload for general, table, or key-value sections |
+| `section_behavior` | object | yes | Shared section-order, expansion, and empty-state ownership rules for the settings family |
+| `render_expectations` | object | yes | Explicit wrapper expectations for warnings, subtype delegation, and host-framing boundaries |
+| `empty_state` | object nullable | no | Family-owned empty or unavailable message when no settings payload exists |
+| `title_policy` | object | yes | Rules for whether wrapper or subtype titles are shown |
+
+#### Validation rules
+
+- Hosts may not choose sibling top-level settings blades once the family contract exists.
+- Subtypes must be explicit family variations, not host-selected main variants.
+- Warning and empty-state behavior must come from the family wrapper, not from host-specific text entries.
+- Section order, expansion behavior, and wrapper expectations must be explicit so hosts do not silently redefine how the family reads.
+
+### NormalizedDiffSurfaceContract
+
+**Purpose**: One runtime contract that defines normalized diff summary, grouped rendering, unavailable behavior, and zero-diff messaging.
+
+#### Fields
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `host_kind` | enum(`policy_version`,`finding`) | yes | Host context for the diff family |
+| `availability_state` | enum(`available`,`unavailable`,`partial`) | yes | Family-owned availability state |
+| `summary` | object | yes | Added, removed, changed counts and summary message |
+| `view_modes` | array | yes | Explicit diff-family modes or views that the host may expose without redefining the family |
+| `section_behavior` | object | yes | Shared grouped-section order, expansion, and fullscreen rules |
+| `render_expectations` | object | yes | Explicit ownership of availability, zero-diff messaging, and host-framing boundaries |
+| `groups` | array | no | Changed, added, and removed groups with ordered row payloads |
+| `script_rendering` | object | no | Script-highlighting flags and grammar hints |
+| `empty_state` | object nullable | no | Family-owned zero-diff or unavailable-state explanation |
+
+#### Validation rules
+
+- Hosts may not prepend separate unavailable-state entries for the same normalized diff concept.
+- The family must own both true unavailable and zero-diff informational states.
+- Rich script rendering remains allowed, but it must live inside the family contract.
+- View modes, grouped-section behavior, and render expectations must be explicit so a policy-version diff and a finding diff cannot drift into separate interaction models.
+
+## Consumer Mapping
+
+| Consumer | Family | Shared-family responsibility | Local host responsibility |
+|---|---|---|---|
+| `OperationRunResource` verification section | Verification report | Completed and unavailable verification core, tab contract, diagnostics, grouped issues | Section placement inside enterprise detail, record authorization, no new mutation behavior |
+| `ManagedTenantOnboardingWizard` verify step | Verification report | Completed and unavailable verification core, grouped issues, diagnostics, shared view zones | No-run and active-state framing, assist routing, acknowledge action, verify-step workflow actions |
+| `TenantVerificationReport` widget | Verification report | Completed and unavailable verification core | Widget no-run and active-state framing, start-verification CTA, tenant operability copy |
+| `PolicyResource` settings tab or fallback section | Normalized settings | Warnings, empty state, subtype ownership, wrapper structure | Tab framing, route context, surrounding policy detail layout |
+| `PolicyVersionResource` normalized settings tab | Normalized settings | Same settings family contract as policy detail | Tab framing and version-specific surrounding detail layout |
+| `PolicyVersionResource` diff tab | Normalized diff | Summary, grouped diff rendering, zero-diff and unavailable semantics | Tab framing and raw diff sidecar JSON |
+| `FindingResource` diff section | Normalized diff | Same diff family contract as policy-version diff | Surrounding drift-specific sections, version resolution, and domain-specific sibling diff viewers kept out of scope |
+
+## Derived Lifecycle
+
+1. A host resolves current domain truth using existing run, normalization, or diff builders.
+2. The host passes that truth through the appropriate shared family contract seam.
+3. The family contract shapes shared zones, states, and subtype markers.
+4. The host renders the shared family core and attaches only its allowed host-owned variations.
+5. Tests assert that a new host cannot redefine family structure outside those variations.
+
+## Migration Notes
+
+- No database migration is required.
+- `policy-settings-standard.blade.php` must stop acting as a sibling top-level host choice and become an internal subtype or be absorbed.
+- Existing verification DB-only and tenant widget tests remain the primary regression base for the verification family.
+- Existing policy-version and drift-diff tests remain the primary regression base for normalized detail families.

specs/197-shared-detail-contract/migration-note.md

@@ -0,0 +1,46 @@
+# Closing Migration Note: Shared Detail Micro-UI Contract
+
+This file is the release-acceptance artifact for Spec 197. Update it as implementation closes so FR-197-015 and D-197-004 are satisfied without overloading `quickstart.md`.
+
+## Migrated Hosts
+
+### Verification Report family
+
+- `OperationRunResource` verification detail surface via `VerificationReportViewer::surface(...)` and shared summary, issues, passed, diagnostics, and unavailable zones
+- `ManagedTenantOnboardingWizard` verification step surface via the same shared verification-family core with onboarding-only assist, acknowledge, and technical-detail variations layered around it
+- `TenantVerificationReport` widget surface via the same completed-state verification-family core while preserving widget-owned no-run and in-progress framing
+
+### Normalized Settings family
+
+- `PolicyResource` normalized settings surface via `NormalizedSettingsSurface::build(...)`
+- `PolicyVersionResource` normalized settings surface via `NormalizedSettingsSurface::build(...)`
+- `policy-settings-standard.blade.php` retained only as an include-only compatibility shim into the normalized-settings family wrapper
+- `SettingsCatalogSettingsTable` retained as the settings-catalog subtype renderer inside the normalized-settings family
+
+### Normalized Diff family
+
+- `PolicyVersionResource` normalized diff surface via `NormalizedDiffSurface::build(...)` and the shared summary, grouped-rendering, and empty-state wrapper
+- `FindingResource` normalized diff surface via `NormalizedDiffSurface::build(...)` for available, unavailable, and zero-diff states
+
+## Intentionally Allowed Remaining Variations
+
+- Onboarding-specific assist, acknowledge, and technical-details actions remain host-scoped variations.
+- No-run and in-progress framing remain host-owned where the host genuinely owns that lifecycle state.
+- `SettingsCatalogSettingsTable` remains the settings-catalog subtype renderer inside the normalized-settings family.
+- Drift-specific surrounding context remains host-owned in `FindingResource` as long as the normalized diff family core stays shared.
+- The compatibility view `policy-settings-standard.blade.php` remains as a thin include-only shim so existing callers/tests do not become a new fork point.
+
+## Manual Smoke Evidence
+
+- Reviewer: GitHub Copilot via the local integrated browser using the local smoke-login flow
+- Review date: 2026-04-15
+- SC-197-003 result: Pass. Operation detail `Operation #6655`, the onboarding verify-step host, and the tenant verification widget all exposed the same verification-family core with recognizable summary, issues, passed, diagnostics, and read-only zones. Onboarding kept its bounded host-owned assist and technical-detail behavior, while the tenant widget kept its widget-specific framing on the tenant management detail page.
+- SC-197-004 result: Pass. Policy detail `Policy #233`, policy-version detail `Policy Version #270`, drift finding `#79`, and a temporary local-only unavailable drift finding clone all rendered family-consistent normalized settings or diff behavior. The available diff surface matched the policy-version grouped diff contract, and the unavailable diff surface rendered the same family-owned unavailable-state treatment instead of a host-local message.
+- Notes: Local browser smoke used `/admin/local/smoke-login` against Phoenicon in workspace `wp`. The tenant verification widget evidence came from the tenant management detail page rather than the tenant dashboard, which is the current widget host. The local dev dataset did not include a resumable verify-step onboarding draft or a natural missing-version drift finding for this tenant family, so temporary local-only fixture records were created, exercised, and deleted after verification. `./vendor/bin/sail bin pint --dirty --format agent` and the focused Sail regression pack had already passed in this feature session.
+
+## Out-of-Scope Follow-Ups
+
+- Local dev seed data still lacks a reusable resumable verify-step onboarding draft and a natural missing-version drift finding for this tenant family; future smoke work will need either richer seed data or the same kind of ephemeral local fixtures.
+- Shell-level refactors discovered during implementation remain intentionally out of scope.
+- Monitoring page-state topics discovered during implementation remain intentionally out of scope.
+- Any future shared-detail framework discussion beyond the two proven families remains intentionally out of scope.

specs/197-shared-detail-contract/plan.md

@@ -0,0 +1,269 @@
+# Implementation Plan: Shared Detail Micro-UI Contract
+
+**Branch**: `197-shared-detail-contract` | **Date**: 2026-04-15 | **Spec**: `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/specs/197-shared-detail-contract/spec.md`
+**Input**: Feature specification from `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/specs/197-shared-detail-contract/spec.md`
+
+**Note**: This template is filled in by the `/speckit.plan` command. See `.specify/scripts/` for helper scripts.
+
+## Summary
+
+Standardize two already real shared detail families without introducing a generic UI framework. The first slice extends the existing verification support seam so `OperationRunResource`, `ManagedTenantOnboardingWizard`, and `TenantVerificationReport` render the same family-owned verification surface with one tab contract, one diagnostics contract, and explicit host-owned variation slots for assist, acknowledge, and host framing. The second slice standardizes normalized settings and normalized diff around family-owned wrappers that make subtype handling, unavailable states, section structure, and view behavior explicit across `PolicyResource`, `PolicyVersionResource`, and `FindingResource`, while preserving the existing Livewire settings table and rich diff rendering where the domain still needs it. The implementation stays derived-only, keeps Filament v5 + Livewire v4 semantics, adds no new assets or persistence, and protects the result with cross-host parity tests plus a small guard against reintroducing ad hoc host forks.
+
+## Technical Context
+
+**Language/Version**: PHP 8.4.15  
+**Primary Dependencies**: Laravel 12, Filament v5, Livewire v4, Pest v4, Tailwind CSS v4, existing `VerificationReportViewer`, `VerificationReportChangeIndicator`, `PolicyNormalizer`, `VersionDiff`, `DriftFindingDiffBuilder`, and `SettingsCatalogSettingsTable`  
+**Storage**: PostgreSQL unchanged; no new persistence, cache store, or durable UI artifact  
+**Testing**: Pest 4 unit and feature tests, including Livewire component coverage for widgets/pages and focused guard tests, run through Laravel Sail  
+**Target Platform**: Laravel monolith web application in Sail locally and containerized Linux deployment for staging and production  
+**Project Type**: web application  
+**Performance Goals**: Keep verification viewers DB-only at render time, avoid any new outbound HTTP or queued work, preserve current diff and settings render responsiveness, and prevent repeated host-local surface logic from re-normalizing or re-shaping the same data differently  
+**Constraints**: No new persisted truth, no new Graph call path, no new panel/provider registration change, no hidden shell or monitoring-state refactor, no generic component framework, and no new destructive actions in the shared family core  
+**Scale/Scope**: Two shared families across seven concrete host surfaces: verification in operation detail, onboarding wizard, and tenant widget; normalized settings or diff in policy detail, policy-version detail, and finding detail, plus the existing standard-settings sibling view that must be absorbed or demoted into an explicit subtype
+
+## Constitution Check
+
+*GATE: Passed before Phase 0 research. Re-checked after Phase 1 design and still passing.*
+
+| Principle | Pre-Research | Post-Design | Notes |
+|-----------|--------------|-------------|-------|
+| Inventory-first / snapshots-second | PASS | PASS | Both families remain pure renderers of already stored `OperationRun`, policy snapshot, and finding evidence truth. No new snapshot or inventory semantics are added. |
+| Read/write separation | PASS | PASS | The shared-family contracts are read-only. Existing host actions such as start verification, refresh, assist, or acknowledge remain host-owned and keep their current mutation semantics. |
+| Graph contract path | N/A | N/A | No Graph calls or `config/graph_contracts.php` changes are introduced. |
+| Deterministic capabilities | PASS | PASS | No new capability family is introduced. Existing host authorization and capability registries remain authoritative. |
+| Workspace + tenant isolation | PASS | PASS | Every host continues to resolve data inside existing workspace and tenant scope. Tenantless operation detail remains subject to existing entitlement checks before rendering tenant-owned verification data. |
+| RBAC-UX authorization semantics | PASS | PASS | No 404/403 rules change. Non-members remain not found, in-scope capability denial stays forbidden where host actions already enforce it. |
+| Run observability / Ops-UX | PASS | PASS | No new `OperationRun` type, lifecycle, or notification path is added. Existing operation links remain navigation-only. |
+| Data minimization | PASS | PASS | Contracts stay runtime-only and derive from existing stored payloads without new mirrors or caches. |
+| Proportionality / no premature abstraction | PASS WITH JUSTIFIED ABSTRACTION | PASS WITH JUSTIFIED ABSTRACTION | One narrow contract seam per family is justified because both families already exist across multiple concrete hosts. The design explicitly rejects a cross-domain shared-detail framework. |
+| Persisted truth / behavioral state | PASS | PASS | No new tables, persisted UI artifacts, or new state families are introduced. |
+| UI semantics / few layers | PASS | PASS | The plan replaces duplicated host ownership with family-owned contracts. It does not add a new presenter stack or badge taxonomy. |
+| Badge semantics (BADGE-001) | PASS | PASS | Existing badge domains remain authoritative. Shared-family work reuses them rather than introducing host-local mappings. |
+| Filament-native UI / Action Surface Contract | PASS | PASS | Family surfaces remain embedded detail/evidence surfaces inside existing Filament pages and widgets. No new row or bulk action hierarchy is introduced. |
+| Filament UX-001 | PASS | PASS | The plan changes detail-family ownership only. Existing view-style layouts remain in place and must stay operator-first. |
+| Filament v5 / Livewire v4 compliance | PASS | PASS | The implementation remains within Filament v5 and Livewire v4 only. No legacy Filament or Livewire v3 APIs are introduced. |
+| Provider registration location | PASS | PASS | No panel or provider registration change is required. Laravel 11+ provider registration remains in `bootstrap/providers.php`. |
+| Global search hard rule | PASS | PASS | No global-search behavior changes are planned. The touched resources already render viewable detail pages, so the Filament global-search requirement remains satisfied. |
+| Destructive action safety | PASS | PASS | No new destructive actions are added inside either shared family. Any host mutation remains outside the family core and keeps existing confirmation and authorization rules. |
+| Asset strategy | PASS | PASS | No new JS or CSS assets are planned. No `filament:assets` deployment change is required. |
+| Testing truth (TEST-TRUTH-001) | PASS | PASS | The test plan focuses on cross-host parity, DB-only rendering, unavailable-state consistency, and guard coverage against re-forking, instead of thin indirection-only tests. |
+
+## Phase 0 Research
+
+Research outcomes are captured in `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/specs/197-shared-detail-contract/research.md`.
+
+Key decisions:
+
+- Standardize the Verification Report family by extending the existing `VerificationReportViewer` seam and one family-owned Blade root instead of creating a new Livewire component or a custom entry type that only solves one host class.
+- Treat onboarding-specific assist and acknowledge behavior as explicit host-owned variation slots of the verification family rather than a parallel report UI.
+- Converge `normalized-settings.blade.php` and `policy-settings-standard.blade.php` under one family-owned settings wrapper with explicit subtypes, instead of continuing host-level view switching.
+- Move normalized diff unavailable and partial-state behavior into the family contract so `FindingResource` and `PolicyVersionResource` stop expressing different availability semantics for the same concept.
+- Keep `SettingsCatalogSettingsTable` as the existing Livewire subtype used by the settings family, since it already provides search, sort, pagination, and context-safe query-string isolation.
+- Protect the family contracts with parity tests and a small fork guard, not with a generic UI meta-framework or a screenshot-heavy suite.
+
+## Phase 1 Design
+
+Design artifacts are created under `/Users/ahmeddarrazi/Documents/projects/TenantAtlas/specs/197-shared-detail-contract/`:
+
+- `data-model.md`: runtime contracts, host variation model, and source-truth boundaries for both shared families
+- `contracts/verification-report-family.openapi.yaml`: internal logical contract for the verification family and its approved hosts
+- `contracts/normalized-detail-family.openapi.yaml`: internal logical contract for normalized settings and normalized diff families and their approved hosts
+- `quickstart.md`: focused implementation, verification, and smoke workflow
+
+Release-acceptance artifact maintained during implementation:
+
+- `migration-note.md`: closing migrated-host inventory, bounded allowed variations, manual smoke evidence, and out-of-scope follow-ups required for release acceptance
+
+Design decisions:
+
+- Extend the existing `VerificationReportViewer` support seam instead of replacing it.
+- Add narrow normalized-detail support builders under existing Filament support paths rather than creating a new base framework.
+- Keep subtype richness for settings catalog tables, standard key-value settings, script content rendering, and diff block rendering, but move wrapper ownership and unavailable-state ownership into one family contract.
+- Keep host no-run and in-progress framing local where the host genuinely owns that state, while making the completed or unavailable family core the same surface everywhere.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/197-shared-detail-contract/
+├── spec.md
+├── plan.md
+├── research.md
+├── data-model.md
+├── migration-note.md
+├── quickstart.md
+├── contracts/
+│   ├── normalized-detail-family.openapi.yaml
+│   └── verification-report-family.openapi.yaml
+├── checklists/
+│   └── requirements.md
+└── tasks.md
+```
+
+### Source Code (repository root)
+
+```text
+apps/platform/
+├── app/
+│   ├── Filament/
+│   │   ├── Pages/
+│   │   │   └── Workspaces/
+│   │   │       └── ManagedTenantOnboardingWizard.php
+│   │   ├── Resources/
+│   │   │   ├── FindingResource.php
+│   │   │   ├── OperationRunResource.php
+│   │   │   ├── PolicyResource.php
+│   │   │   └── PolicyVersionResource.php
+│   │   ├── Support/
+│   │   │   ├── VerificationReportChangeIndicator.php
+│   │   │   ├── VerificationReportViewer.php
+│   │   │   ├── NormalizedSettingsSurface.php
+│   │   │   └── NormalizedDiffSurface.php
+│   │   └── Widgets/
+│   │       └── Tenant/
+│   │           └── TenantVerificationReport.php
+│   └── Livewire/
+│       └── SettingsCatalogSettingsTable.php
+├── resources/
+│   └── views/
+│       └── filament/
+│           ├── components/
+│           │   ├── verification-report-viewer.blade.php
+│           │   └── verification-report/
+│           ├── forms/
+│           │   └── components/
+│           │       └── managed-tenant-onboarding-verification-report.blade.php
+│           ├── infolists/
+│           │   └── entries/
+│           │       ├── normalized-diff.blade.php
+│           │       ├── normalized-settings.blade.php
+│           │       └── policy-settings-standard.blade.php
+│           └── widgets/
+│               └── tenant/
+│                   └── tenant-verification-report.blade.php
+└── tests/
+    ├── Feature/
+    │   ├── Drift/
+    │   ├── Filament/
+    │   ├── Onboarding/
+    │   ├── Verification/
+    │   └── Guards/
+    └── Unit/
+```
+
+**Structure Decision**: Keep the existing Laravel monolith layout and current Filament resource/widget/view directories. Add only narrow support builders under `app/Filament/Support` and family-owned partials under existing `resources/views/filament/...` paths. Do not add a new shared UI framework directory or new base package.
+
+## Implementation Strategy
+
+### Phase A — Cut the Verification Report Family Contract
+
+**Goal**: Make one family-owned verification surface the semantic owner of completed and unavailable report rendering across the covered hosts.
+
+| Step | File | Change |
+|------|------|--------|
+| A.1 | `apps/platform/app/Filament/Support/VerificationReportViewer.php` | Extend the existing seam so it can build the shared verification surface contract, not only extract sanitized report payloads. |
+| A.2 | `apps/platform/resources/views/filament/components/verification-report-viewer.blade.php` and new family-owned partials under `apps/platform/resources/views/filament/components/verification-report/` | Move summary, issues, passed, diagnostics, and optional action-zone ownership into one shared Blade root with one tab or view contract. |
+| A.3 | `apps/platform/resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php` | Remove local verification-family tab ownership and local structural duplication; render the same family core with explicit onboarding-only variation slots for assist, acknowledge, and technical details. |
+| A.4 | `apps/platform/app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php`, `apps/platform/app/Filament/Resources/OperationRunResource.php`, `apps/platform/app/Filament/Widgets/Tenant/TenantVerificationReport.php`, and `apps/platform/resources/views/filament/widgets/tenant/tenant-verification-report.blade.php` | Pass only explicit host context and host-owned actions into the verification family contract while keeping no-run or in-progress framing local where appropriate. |
+
+### Phase B — Standardize the Normalized Settings Family
+
+**Goal**: Make one family-owned settings wrapper the contract owner for warnings, empty state, subtype selection, and section behavior.
+
+| Step | File | Change |
+|------|------|--------|
+| B.1 | `apps/platform/app/Filament/Support/NormalizedSettingsSurface.php` | Add a narrow runtime builder that shapes normalized settings state into one explicit family contract with subtype markers and render expectations. |
+| B.2 | `apps/platform/resources/views/filament/infolists/entries/normalized-settings.blade.php` and subtype partials under `apps/platform/resources/views/filament/infolists/entries/normalized-settings/` | Own warnings, empty-state behavior, wrapper headings, and subtype delegation inside one family surface instead of splitting ownership between sibling host-selected blades. |
+| B.3 | `apps/platform/resources/views/filament/infolists/entries/policy-settings-standard.blade.php` | Absorb this blade into the normalized-settings family as an internal subtype partial or retire it as a direct host-facing sibling view. |
+| B.4 | `apps/platform/app/Filament/Resources/PolicyResource.php` and `apps/platform/app/Filament/Resources/PolicyVersionResource.php` | Stop choosing between sibling settings views at the host level and always pass family contract state to the normalized settings surface. |
+| B.5 | `apps/platform/app/Livewire/SettingsCatalogSettingsTable.php` | Keep the existing table component as the settings-catalog subtype renderer while ensuring the shared family contract owns when and how it is shown. |
+
+### Phase C — Standardize the Normalized Diff Family
+
+**Goal**: Make one family-owned diff wrapper the contract owner for summary, unavailable state, zero-diff messaging, and grouped detail rendering.
+
+| Step | File | Change |
+|------|------|--------|
+| C.1 | `apps/platform/app/Filament/Support/NormalizedDiffSurface.php` | Add a narrow runtime builder that shapes diff state, availability state, and zero-change semantics into one explicit family contract. |
+| C.2 | `apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php` and family-owned partials under `apps/platform/resources/views/filament/infolists/entries/normalized-diff/` | Move unavailable, partial, summary, and grouped-render ownership into the shared diff family. Preserve script highlighting and grouped row rendering as explicit subzones of that family. |
+| C.3 | `apps/platform/app/Filament/Resources/FindingResource.php` | Replace host-owned diff-unavailable `TextEntry` behavior with family-owned unavailable state input so drift detail uses the same contract as other normalized diff hosts. |
+| C.4 | `apps/platform/app/Filament/Resources/PolicyVersionResource.php` | Route normalized diff state through the shared diff builder so policy-version diff and finding diff expose the same family semantics for available and unavailable paths. |
+
+### Phase D — Protect the Family Boundaries
+
+**Goal**: Make future host changes extend the family contracts instead of silently re-forking them.
+
+| Step | File | Change |
+|------|------|--------|
+| D.1 | `apps/platform/tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php` | Add a focused guard that blocks new ad hoc host forks, such as host-selected `policy-settings-standard` references or duplicated verification-family tab ownership outside the shared core. |
+| D.2 | `apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php` and `apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php` | Add cross-host parity tests that assert the same family zones, unavailable semantics, and allowed host-variation boundaries. |
+| D.3 | `apps/platform/tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php`, `apps/platform/tests/Feature/Filament/TenantVerificationReportWidgetTest.php`, `apps/platform/tests/Feature/Onboarding/OnboardingVerificationTest.php`, `apps/platform/tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php`, `apps/platform/tests/Feature/MonitoringOperationsTest.php`, `apps/platform/tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php`, `apps/platform/tests/Feature/Onboarding/OnboardingDraftAccessTest.php`, `apps/platform/tests/Feature/Filament/PolicyVersionSettingsTest.php`, `apps/platform/tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php`, `apps/platform/tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php`, `apps/platform/tests/Feature/Drift/DriftFindingDiffUnavailableTest.php`, `apps/platform/tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php`, `apps/platform/tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php`, and `apps/platform/tests/Feature/Findings/FindingRbacTest.php` | Extend existing feature coverage so it asserts the new family contracts without losing current DB-only, RBAC-safe, deny-as-not-found, capability-safe, and domain-rich behavior. |
+
+### Phase E — Close the Migration and Verify Operator Sameness
+
+**Goal**: Finish the feature with an explicit migrated-host inventory and a manual smoke path that matches the spec’s acceptance model.
+
+| Step | File | Change |
+|------|------|--------|
+| E.1 | `specs/197-shared-detail-contract/tasks.md` | Break implementation into dependency-ordered tasks across verification family, normalized settings family, normalized diff family, tests, and migration notes. |
+| E.2 | `specs/197-shared-detail-contract/migration-note.md` | Record migrated hosts, consciously allowed remaining variations, smoke-review evidence, and out-of-scope follow-ups required by release acceptance. |
+| E.3 | `specs/197-shared-detail-contract/quickstart.md` | Use the verification order and smoke path below to prove operator sameness across hosts and feed the result into the migration note. |
+
+## Key Design Decisions
+
+### D-001 — Verification Report remains one Blade-rooted family because its hosts are heterogeneous
+
+The verification family already spans an infolist-style detail section, a form `ViewField`, and a widget include. A new custom infolist entry or a new Livewire component would only solve one host class and would risk over-abstracting the rest. The narrowest path is to extend the existing `VerificationReportViewer` seam and let one family-owned Blade root own structure.
+
+### D-002 — Onboarding keeps host-owned actions but loses structural ownership
+
+The onboarding wizard legitimately owns verify-step actions, assist routing, and acknowledge mutations. It does not need to own the report’s tab system or its core diagnostics structure. The plan therefore keeps these actions as explicit host slots, not as a second verification UI.
+
+### D-003 — `policy-settings-standard` becomes a subtype, not a peer family
+
+The repo already exposes two sibling settings surfaces for the same conceptual family. The plan explicitly keeps settings-catalog and standard-settings richness, but moves them under one family wrapper so hosts stop selecting unrelated siblings at the top level.
+
+### D-004 — Unavailable-state ownership belongs inside normalized diff
+
+`FindingResource` currently owns unavailable messaging outside the diff family, while other diff hosts do not. The family contract should own availability, partial-state, and zero-diff semantics so the same content concept cannot drift at the host boundary.
+
+### D-005 — The test strategy protects family sameness, not only helper output
+
+The plan prefers cross-host parity tests, DB-only safety tests, and one small fork guard. It explicitly avoids a new UI meta-test framework or broad screenshot infrastructure because the product need is bounded and already well represented by existing feature tests.
+
+## Risk Assessment
+
+| Risk | Impact | Likelihood | Mitigation |
+|------|--------|------------|------------|
+| Verification onboarding loses assist or acknowledge power while removing its fork | High | Medium | Keep assist and acknowledge as host-owned variation slots and extend onboarding tests before removing duplicated structural markup. |
+| Standardizing settings removes useful subtype richness | High | Medium | Keep explicit subtypes for settings-catalog tables, standard blocks, and script-heavy content; standardize the wrapper, not the domain richness away. |
+| Diff unavailable semantics collapse distinct host cases | Medium | Medium | Make unavailable and partial states explicit contract inputs and cover missing-version and empty-side finding scenarios in feature tests. |
+| The feature grows into a generic shared-detail framework | High | Low | Limit support additions to one existing verification seam plus one settings builder and one diff builder under current Filament support paths. No cross-domain base class or registry is introduced. |
+| New hosts later reintroduce ad hoc forks | Medium | Medium | Add one focused fork guard and internal contract YAMLs that document approved consumers and forbidden host-level patterns. |
+
+## Test Strategy
+
+- Extend verification-family feature coverage so `OperationRunResource`, onboarding verification, and the tenant verification widget all assert the same family-owned summary, issues, passed, diagnostics, and unavailable semantics for equivalent report data.
+- Keep `VerificationReportViewerDbOnlyTest` and `TenantVerificationReportWidgetTest` as truth guards that the standardized family remains DB-only and does not introduce outbound work.
+- Extend onboarding verification tests to prove host-specific assist and acknowledge actions survive as bounded variations of the same family.
+- Extend normalized settings and diff coverage in `PolicyVersionSettingsTest`, `SettingsCatalogPolicyNormalizedDiffTest`, `GroupPolicyConfigurationNormalizedDiffTest`, and `DriftFindingDiffUnavailableTest` so they assert family-level structure and unavailable behavior instead of only content presence.
+- Add one new parity test per family and one focused guard test that blocks direct host fork patterns.
+- Use Livewire component tests for widgets and pages, and do not try to mount non-Livewire resource classes directly. This follows Filament v5 testing guidance.
+- Run the smallest Sail verification pack plus `pint --dirty --format agent` before implementation completion.
+
+## Complexity Tracking
+
+| Violation | Why Needed | Simpler Alternative Rejected Because |
+|-----------|------------|-------------------------------------|
+| One new normalized-settings builder and one new normalized-diff builder | The repo already has multiple concrete hosts for each family, but no existing support seam analogous to `VerificationReportViewer` for normalized detail families | Leaving host files to shape state ad hoc would preserve the exact drift this spec is meant to remove |
+| One focused fork guard | The feature’s long-term value depends on preventing new host forks after the first cleanup | Relying only on reviewer memory or prose documentation would not reliably stop drift from returning |
+
+## Proportionality Review
+
+- **Current operator problem**: Operators encounter the same verification or normalized detail concept in multiple hosts, but the structure, next-step zone, diagnostics placement, and unavailable behavior vary enough to slow recognition and trust.
+- **Existing structure is insufficient because**: Shared Blade reuse exists, but shared contract ownership does not. Hosts still decide core structure and availability semantics themselves, which is why drift already exists.
+- **Narrowest correct implementation**: Extend the existing verification support seam, add two narrow normalized-detail support builders, and move family wrapper ownership into current Blade paths. Do not add persistence, a new framework, or a cross-domain taxonomy.
+- **Ownership cost created**: Three narrow support seams in current Filament support paths, a handful of family-owned partials, two internal contract YAMLs, and focused parity or guard tests.
+- **Alternative intentionally rejected**: Continue local host cleanups or invent a full shared-detail framework. Local cleanup would not stop drift, and a framework would import much more permanent complexity than this feature needs.
+- **Release truth**: Current-release truth. The affected families and host drift already exist in shipped operator surfaces.

specs/197-shared-detail-contract/quickstart.md

@@ -0,0 +1,110 @@
+# Quickstart: Shared Detail Micro-UI Contract
+
+## Goal
+
+Validate that the same verification and normalized detail concepts now render through family-owned contracts across their covered hosts, without adding persistence, Graph calls, or a generic UI framework.
+
+## Prerequisites
+
+1. Start Sail.
+2. Ensure you have a tenant with at least one completed verification run and one onboarding session that can resume on the verify step.
+3. Ensure you have policy and policy-version data that exercises both settings-catalog and standard-settings rendering.
+4. Ensure you have at least one drift finding with an available normalized diff and one drift finding with missing version references.
+5. Ensure the current user can open the covered hosts in tenant and workspace-safe contexts.
+
+## Implementation Validation Order
+
+### 1. Run verification-family regression coverage
+
+```bash
+export PATH="/bin:/usr/bin:/usr/local/bin:$PATH"
+cd /Users/ahmeddarrazi/Documents/projects/TenantAtlas/apps/platform
+./vendor/bin/sail artisan test --compact tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/TenantVerificationReportWidgetTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Onboarding/OnboardingVerificationTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/MonitoringOperationsTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Onboarding/OnboardingDraftAccessTest.php
+./vendor/bin/sail artisan test --compact --filter=SharedVerificationReportFamilyContract
+```
+
+Expected outcome:
+
+- Operation detail, onboarding, and tenant widget all expose the same verification-family core.
+- Verification rendering stays DB-only and does not dispatch outbound work.
+- Onboarding-only assist and acknowledge actions remain available as bounded host variations.
+- Workspace-context and tenant-context verification hosts keep deny-as-not-found and capability-safe behavior after the shared viewer refactor.
+
+### 2. Run normalized detail-family regression coverage
+
+```bash
+export PATH="/bin:/usr/bin:/usr/local/bin:$PATH"
+cd /Users/ahmeddarrazi/Documents/projects/TenantAtlas/apps/platform
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/PolicyVersionSettingsTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Drift/DriftFindingDiffUnavailableTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php
+./vendor/bin/sail artisan test --compact tests/Feature/Findings/FindingRbacTest.php
+./vendor/bin/sail artisan test --compact --filter=NormalizedDetailFamilyContract
+```
+
+Expected outcome:
+
+- Policy and policy-version settings use the same family-owned wrapper with explicit subtype behavior.
+- Policy-version diff and finding diff use the same normalized diff family semantics for available, unavailable, and zero-diff cases.
+- No host still relies on a sibling top-level settings view or a host-only diff unavailable message for the same concept.
+- Tenant-scoped policy, policy-version, and finding detail hosts preserve existing deny-as-not-found and capability semantics.
+
+### 3. Run the fork guard and targeted parity checks
+
+```bash
+export PATH="/bin:/usr/bin:/usr/local/bin:$PATH"
+cd /Users/ahmeddarrazi/Documents/projects/TenantAtlas/apps/platform
+./vendor/bin/sail artisan test --compact tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php
+./vendor/bin/sail artisan test --compact --filter=FamilyContract
+```
+
+Expected outcome:
+
+- Guard coverage blocks reintroduction of direct host forks.
+- Parity tests prove the same family zones and the same unavailable-state semantics across hosts.
+
+### 4. Format touched files
+
+```bash
+export PATH="/bin:/usr/bin:/usr/local/bin:$PATH"
+cd /Users/ahmeddarrazi/Documents/projects/TenantAtlas/apps/platform
+./vendor/bin/sail bin pint --dirty --format agent
+```
+
+Expected outcome:
+
+- All touched PHP files conform to the repo’s Pint rules.
+
+## Manual Smoke Check
+
+1. Open the operation run detail that shows a verification report and confirm you can immediately identify summary, issues, passed, and technical details zones.
+2. Open the onboarding wizard verify step for the same or equivalent verification payload and confirm the same core verification surface appears, with onboarding-only assist or acknowledge behavior layered on top instead of a different tab model.
+3. Open the tenant verification widget and confirm the completed-state core matches the other verification hosts while no-run and in-progress framing stays widget-specific.
+4. Open a policy-version detail view and a policy detail view that both show normalized settings and confirm warnings, empty-state behavior, and subtype structure feel like one family.
+5. Open a policy-version detail view that shows normalized diff and confirm summary, grouped sections, and availability messaging match the same shared diff-family contract used elsewhere.
+6. Open a drift finding with missing referenced versions and confirm the diff area uses a family-consistent unavailable state.
+7. Open a drift finding with an available normalized diff and confirm the grouped diff surface feels like the same family as policy-version diff, not a new host-specific micro-app.
+
+## Release Acceptance Recording
+
+1. Update `specs/197-shared-detail-contract/migration-note.md` with the migrated hosts actually touched by the implementation.
+2. Record the consciously allowed remaining variations that still differ by host.
+3. Capture reviewer, review date, and pass or fail notes for SC-197-003 and SC-197-004 in the migration note.
+4. Record any shell, monitoring-state, or other intentionally out-of-scope follow-ups in the migration note instead of expanding this feature silently.
+
+## Non-Goals For This Slice
+
+- No database migration.
+- No new public API.
+- No new Graph call path or `OperationRun` lifecycle change.
+- No new Filament asset registration or `filament:assets` deployment change.
+- No shell, workspace context bar, or monitoring page-state refactor.

specs/197-shared-detail-contract/research.md

@@ -0,0 +1,74 @@
+# Phase 0 Research: Shared Detail Micro-UI Contract
+
+## Research Inputs
+
+- Repository truth from current hosts and tests for `verification-report-viewer`, onboarding verification, tenant verification widget, `normalized-settings`, `policy-settings-standard`, and `normalized-diff`
+- Filament v5 notes in `docs/research/filament-v5-notes.md`
+- Version-specific Filament documentation for custom fields, custom infolist entries, render hooks, and testing
+
+## Decision 1 — Verification Report should stay Blade-rooted and support-backed
+
+**Decision**: Standardize the Verification Report family by extending the existing `VerificationReportViewer` support seam and one shared Blade root, instead of introducing a new Livewire component or a custom Filament entry class.
+
+**Rationale**: The family already spans three host classes: an infolist-style run detail, a form `ViewField` inside onboarding, and a widget include. Filament custom entries are reusable, but they are still infolist-specific. Filament custom fields are form-specific. A new Livewire component would impose a heavier lifecycle and more new surface area than this feature needs. The existing support seam already owns report extraction, fingerprinting, and previous-run lookup, which is the right narrow base.
+
+**Alternatives considered**:
+
+- Create a custom infolist entry for verification: rejected because onboarding and widget hosts would still need separate structural ownership.
+- Create a dedicated Livewire verification viewer: rejected because it imports new lifecycle complexity for a mostly read-only, DB-only surface.
+- Keep the onboarding fork and only restyle it: rejected because the drift is structural, not cosmetic.
+
+## Decision 2 — Onboarding-specific assist and acknowledge behavior must remain host-owned slots
+
+**Decision**: Treat assist, acknowledge, refresh, and technical-details triggers in onboarding as explicit host-owned variations of the verification family, not as a second verification UI contract.
+
+**Rationale**: The onboarding wizard legitimately owns interactive workflow actions and different no-run or in-progress framing. The shared family should own summary, tabs or view zones, issues, passed checks, diagnostics, and unavailable behavior. This respects the spec’s rule that hosts may extend actions and placement without redefining the family core.
+
+**Alternatives considered**:
+
+- Move assist and acknowledge logic into the shared core: rejected because those actions are wizard-specific and would leak workflow behavior into unrelated hosts.
+- Leave onboarding fully separate: rejected because it preserves the existing duplicate tab contract and duplicated grouping logic.
+
+## Decision 3 — Normalized settings must converge under one family wrapper with explicit subtypes
+
+**Decision**: Standardize normalized settings through one family-owned wrapper that explicitly supports at least two subtypes: settings-catalog table rendering and standard block or key-value rendering.
+
+**Rationale**: `PolicyResource` and `PolicyVersionResource` currently choose between `normalized-settings` and `policy-settings-standard` at the host level. That means the host, not the family, owns warnings, wrapper titles, empty state, and subtype selection. The repo already proves the two subtypes are real. The narrowest fix is not to flatten them, but to put both behind one family wrapper.
+
+**Alternatives considered**:
+
+- Keep both views and only document when to use each: rejected because the host-level fork remains the same.
+- Force every settings subtype into one totally uniform table: rejected because the domain richness and script-oriented rendering would be weakened.
+
+## Decision 4 — Normalized diff must own unavailable and partial-state semantics
+
+**Decision**: Move unavailable, partial, and zero-diff behavior into the normalized diff family contract instead of leaving those semantics to individual hosts.
+
+**Rationale**: `FindingResource` currently shows a host-owned unavailable text entry before the shared diff view, while `PolicyVersionResource` simply renders the diff view. This is the clearest current evidence that the same content concept does not yet own its own availability rules. The family should own these states so equivalent cases feel consistent across hosts.
+
+**Alternatives considered**:
+
+- Keep host-owned unavailable messages and only align wording: rejected because ownership would still be split.
+- Force all hosts to pre-normalize everything into “available only” and hide gaps: rejected because it would reduce diagnostic honesty.
+
+## Decision 5 — The existing Livewire settings table remains the settings-catalog subtype renderer
+
+**Decision**: Keep `SettingsCatalogSettingsTable` as the renderer for the settings-catalog subtype inside the normalized settings family.
+
+**Rationale**: The table already provides search, sort, pagination, query-string isolation by context, and a details action. Replacing it would add risk and produce little user benefit. The problem is not that the table exists; the problem is that the host, rather than the family, currently decides when the table belongs to the surface.
+
+**Alternatives considered**:
+
+- Replace the table with static Blade markup: rejected because it would lose established usability and re-implement behavior already present.
+- Split settings-catalog into its own separate family: rejected because the operator still experiences it as a settings detail subtype, not a separate product surface.
+
+## Decision 6 — Testing should prove cross-host sameness and DB-only behavior, then add a small fork guard
+
+**Decision**: Reuse and extend the current feature tests for widgets, onboarding, verification DB-only behavior, policy-version settings, and finding diffs, then add one parity test per family and one focused guard against re-forking.
+
+**Rationale**: The repo already has strong tests around verification and normalized detail content. The missing coverage is family-level sameness across hosts and explicit protection against new host forks. A small guard gives lasting value without forcing a generic UI compliance framework.
+
+**Alternatives considered**:
+
+- Rely only on manual smoke checks: rejected because the spec explicitly wants drift prevention.
+- Add a large screenshot or browser-regression suite: rejected because it would be expensive relative to the bounded scope and existing feature-level coverage.

specs/197-shared-detail-contract/spec.md

@@ -0,0 +1,245 @@
+# Feature Specification: Shared Detail Micro-UI Contract
+
+**Feature Branch**: `197-shared-detail-contract`  
+**Created**: 2026-04-15  
+**Status**: Proposed  
+**Input**: User description: "Spec 197 — Shared Detail Micro-UI Contract"
+
+## Spec Candidate Check *(mandatory — SPEC-GATE-001)*
+
+- **Problem**: Wiederverwendete Detail-Micro-UIs für dieselben fachlichen Objekte leben heute als leicht unterschiedliche Host-Varianten, sodass Operatoren dieselbe Surface je nach Host neu lesen und neu erlernen müssen.
+- **Today's failure**: Dieselbe fachliche Surface zeigt je nach Host andere Tabs, anders platzierte Next Steps, anders platzierte technische Details oder lokale Zusatzlogik. Dadurch entstehen inkonsistente Operator-Erwartungen, Drift bei Weiterentwicklungen und unnötiger Test- sowie Pflegeaufwand.
+- **User-visible improvement**: Operatoren erleben dieselbe Verification-Report- oder Diff-/Settings-Surface hostübergreifend als dieselbe fachliche Surface mit denselben Kernzonen, denselben erwartbaren Interaktionsmustern und klar begrenzten Host-Unterschieden.
+- **Smallest enterprise-capable version**: Nur zwei bereits real belegte Shared-Familien werden standardisiert: die Verification-Report-Familie sowie die Normalized Diff / Normalized Settings-Familie. Der Spec führt keinen generischen UI-Baukasten ein und modelliert keine weiteren Custom-Surfaces ohne nachgewiesene Familienwiederholung.
+- **Explicit non-goals**: Kein Shell- oder Monitoring-Page-State-Refactor, keine Vereinheitlichung aller Custom-Detailansichten, kein generisches internes Komponenten-Framework, keine Table-/CRUD-/Badge-Konsistenzkampagne außerhalb der belegten Shared-Familien.
+- **Permanent complexity imported**: Zwei explizite Shared-Family-Verträge, dokumentierte Pflicht-/Optional-/Host-Zonen, begrenzte Host-Variationsregeln, family-orientierte Regressionsabdeckung, eine kleine Abschlussdokumentation zu migrierten Hosts und erlaubten Restvarianten.
+- **Why now**: Beide Familien sind bereits in mehreren Hosts sichtbar und zeigen belegte Drift. Jeder weitere Host erhöht die Wahrscheinlichkeit, dass dieselbe Surface erneut als lokale Mini-App eingebaut wird.
+- **Why not local**: Lokale Bereinigungen pro Host beseitigen die Wiederholung nicht. Das Problem liegt in fehlendem gemeinsamen Vertrag für dieselbe Surface-Familie, nicht in einem einzelnen Host.
+- **Approval class**: Cleanup
+- **Red flags triggered**: Eine rote Flagge: Shared-Cross-Surface-Contract kann in ein zu breites UI-Framework kippen, wenn der Scope über die zwei belegten Familien hinaus wächst.
+- **Score**: Nutzen: 2 | Dringlichkeit: 2 | Scope: 2 | Komplexität: 1 | Produktnähe: 2 | Wiederverwendung: 2 | **Gesamt: 11/12**
+- **Decision**: approve
+
+## Spec Scope Fields *(mandatory)*
+
+- **Scope**: canonical-view
+- **Primary Routes**:
+  - Monitoring- beziehungsweise Operations-Detailflächen, die Verification Reports als eingebettete Detail-Surface zeigen
+  - Tenant-onboarding- und tenantbezogene Verifikationsflächen, die denselben Verification Report in Wizard-, Widget- oder Inline-Kontext rendern
+  - Tenantbezogene Policy-, Policy-Version- und Finding-Detailflächen, die Normalized Settings oder Normalized Diff als Detail-Surface zeigen
+- **Data Ownership**:
+  - Tenant-owned: verifikationsbezogene Detaildaten, Policy-, Policy-Version- und Finding-Daten, die innerhalb der Shared-Familien dargestellt werden
+  - Workspace-context / canonical-view owned: die hostseitige Einbettung in kanonische Monitoring- oder Operations-Detailflächen
+  - Dieser Spec führt keine neue persistierte UI- oder Vertrags-Entität ein; die Shared-Family-Verträge bleiben rein darstellungs- und verhaltensbezogen
+- **RBAC**:
+  - Bestehende Workspace-Mitgliedschaft und Tenant-Entitlement bleiben die Zugangsvoraussetzung für alle Hosts, die diese Shared-Familien rendern
+  - Bestehende View-/Inspect-Berechtigungen der Hosts bleiben maßgeblich; der Spec führt keine neue Capability und keinen neuen Autorisierungsweg ein
+  - Host-spezifische Aktionen innerhalb oder neben der Shared-Family bleiben weiter an die bereits vorhandenen Capability-Regeln des Hosts gebunden
+
+For canonical-view specs, the spec MUST define:
+
+- **Default filter behavior when tenant-context is active**: Wenn Tenant-Kontext aktiv ist, rendern Shared-Familien ausschließlich Daten aus dem aktuell aktiven Tenant-Kontext des Hosts. Ein Host darf keine Shared-Family tenantübergreifend oder tenantlos auf tenant-owned Daten erweitern.
+- **Explicit entitlement checks preventing cross-tenant leakage**: Jeder Host bleibt dafür verantwortlich, nur bereits autorisierte Records oder Reports an die Shared-Family zu übergeben. Tenantlose kanonische Hosts dürfen tenant-owned Inhalte nur nach bestehender Entitlement-Prüfung sichtbar machen; Nicht-Mitglieder bleiben deny-as-not-found.
+
+## Decision-First Surface Role *(mandatory when operator-facing surfaces are changed)*
+
+| Surface | Decision Role | Human-in-the-loop Moment | Immediately Visible for First Decision | On-Demand Detail / Evidence | Why This Is Primary or Why Not | Workflow Alignment | Attention-load Reduction |
+|---|---|---|---|---|---|---|---|
+| Verification Report family | Secondary Context Surface | Operator prüft, warum ein Verify- oder Onboarding-Schritt bereit, blockiert oder nacharbeitspflichtig ist | Ergebnisstatus, Blocker oder Warnungen, zentrale Next Steps, klarer Host-Kontext | Technische Details, Run-Identität, tiefere Diagnose, Host-spezifische Assist-Einstiege | Nicht primär, weil die eigentliche Entscheidung im Host-Workflow liegt; diese Surface liefert die entscheidungsrelevante Begründung | Unterstützt Verify-, Onboarding- und Tenant-Follow-up-Workflows, ohne selbst eine separate Prozessfläche zu werden | Gleiche Grundstruktur in mehreren Hosts reduziert erneutes Uminterpretieren derselben Report-Aussage |
+| Normalized Diff / Settings family | Tertiary Evidence / Diagnostics Surface | Operator prüft, was sich fachlich geändert hat oder welche Settings inhaltlich gelten | Klar gegliederte Abschnitte, aktiver View-Modus, wichtigste Diff- oder Settings-Inhalte | Zusätzliche Abschnitte, tiefere technische Darstellung, volle Detailtiefe, optionale Expand-/Fullscreen-Zonen | Nicht primär, weil die Entscheidung meist von einer übergeordneten Policy-, Version- oder Finding-Detailfläche ausgelöst wird | Unterstützt Review-, Diagnose- und Vergleichsarbeit innerhalb bestehender Detail-Workflows | Konsistente View-Zonen und Zustände reduzieren Vergleichsaufwand zwischen Policy-, Version- und Finding-Hosts |
+
+## UI/UX Surface Classification *(mandatory when operator-facing surfaces are changed)*
+
+| Surface | Action Surface Class | Surface Type | Likely Next Operator Action | Primary Inspect/Open Model | Row Click | Secondary Actions Placement | Destructive Actions Placement | Canonical Collection Route | Canonical Detail Route | Scope Signals | Canonical Noun | Critical Truth Visible by Default | Exception Type / Justification |
+|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
+| Verification Report family | Detail / Embedded Review | Shared detail micro-UI | Read blockers, follow next step, open related operation or assist path | Host-owned embedded detail surface | forbidden | Innerhalb der gemeinsamen Action-/Assist-Zone oder hostseitig unmittelbar angrenzend, klar getrennt von Kernstatus und Diagnose | Keine destruktiven Aktionen im Shared Core; hostseitige Mutationen bleiben außerhalb des Core-Vertrags und confirmation-gated | Host-owned verification entry surfaces | Host-owned verification detail contexts in operations, onboarding, or tenant review flows | Aktiver Tenant- oder Workspace-Kontext des Hosts, Report-Status, Ergebnis-/Readiness-Signale | Verification report | Readiness, blockers or warnings, and next action intent | Embedded shared family; kein eigenständiges list-first oder standalone resource detail |
+| Normalized Diff / Settings family | Detail / Evidence | Shared detail micro-UI | Inspect sections, switch view mode, expand detail, compare meaningfully | Host-owned embedded detail surface | forbidden | Innerhalb der gemeinsamen View-/Action-Zone der Surface; hostseitige Navigation bleibt außerhalb der Kern-Interaktion | Keine destruktiven Aktionen innerhalb der Shared-Family | Host-owned policy, policy version, or finding detail entries | Host-owned policy, version, and finding detail contexts | Aktiver Tenant-Kontext des Hosts, Inhaltstyp, verfügbarer Detailmodus, Empty/Unavailable-Signale | Normalized settings / Normalized diff | Die aktuell relevante fachliche Detailaussage des Settings- oder Diff-Inhalts | Embedded evidence family; kein eigenständiges CRUD- oder queue-first surface |
+
+## Operator Surface Contract *(mandatory when operator-facing surfaces are changed)*
+
+| Surface | Primary Persona | Decision / Operator Action Supported | Surface Type | Primary Operator Question | Default-visible Information | Diagnostics-only Information | Status Dimensions Used | Mutation Scope | Primary Actions | Dangerous Actions |
+|---|---|---|---|---|---|---|---|---|---|---|
+| Verification Report family | Tenant operator, workspace operator, onboarding operator | Verstehen, ob ein Verify- oder Onboarding-Schritt bereit ist, was blockiert, und was als Nächstes zu tun ist | Embedded report detail | Why is this verification ready, blocked, or cautionary, and what should I do next? | Summary oder header zone, outcome or readiness status, issues or passes overview, next-step or assist entry points | Technical details, operation identity, deeper diagnostics, host-specific helper content | readiness, outcome, severity of issues, data completeness | Shared core is read-only; host-owned acknowledge or assist mutations remain explicitly bounded | Review issues, switch view zone, follow next step, open technical detail or related run | None in shared core |
+| Normalized Diff / Settings family | Tenant operator, reviewer, diagnostician | Verstehen, welche Inhalte gelten oder was sich fachlich geändert hat | Embedded evidence detail | What changed or what settings are in force, and where should I inspect next? | Shared section structure, active view or tab, visible content blocks, empty or unavailable explanation | Secondary sections, deeper technical content, larger expansions, raw or diagnostic follow-up hosted elsewhere | content availability, comparison completeness, section context | Read-only | Switch view or tab, expand relevant detail, inspect targeted sections | None |
+
+## Proportionality Review *(mandatory when structural complexity is introduced)*
+
+- **New source of truth?**: No
+- **New persisted entity/table/artifact?**: No
+- **New abstraction?**: Yes
+- **New enum/state/reason family?**: No
+- **New cross-domain UI framework/taxonomy?**: No
+- **Current operator problem**: Dieselbe fachliche Detail-Surface wirkt in verschiedenen Hosts wie verschiedene kleine Anwendungen. Das erschwert sichere Wiedererkennung, verlangsamt Folgeschritte und erhöht die Wahrscheinlichkeit, dass Weiterentwicklungen inkonsistent erfolgen.
+- **Existing structure is insufficient because**: Reines Fragment-Sharing auf View-Ebene verhindert keine Drift bei Tabs, Assist-Zonen, Diagnostics-Zonen, lokalen Zuständen oder Action-Platzierung. Ohne expliziten Familienvertrag bleibt jeder Host faktisch Mitbesitzer der Surface-Logik.
+- **Narrowest correct implementation**: Definiere nur für die zwei bereits belegten Shared-Familien einen gemeinsamen Detailvertrag mit expliziten Pflicht-, Optional- und Host-Variationszonen; keine generische Plattform, kein globales UI-System, keine neue Persistenz.
+- **Ownership cost**: Dauerhaft entstehen begrenzte zusätzliche Vertragsdokumentation, cross-host Regressionstests und ein klarer Review-Maßstab für künftige Host-Einbindungen. Im Gegenzug sinken parallele View-Logik, Drift-Risiko und Teststreuung.
+- **Alternative intentionally rejected**: Einzelne Hosts lokal aufzuräumen oder weitere Blade-Sharing-Fixes einzubauen wurde verworfen, weil das die gemeinsame Kernlogik nicht schützt. Ein generisches internes UI-Framework wurde ebenfalls verworfen, weil nur zwei reale Familien standardisiert werden müssen.
+- **Release truth**: Current-release truth
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Recognize the same verification surface everywhere (Priority: P1)
+
+As an operator, I want verification results to use the same recognizable structure in operation detail, onboarding, and tenant verification hosts, so that I can immediately see the same core meaning, next steps, and diagnostics without relearning the surface.
+
+**Why this priority**: The most visible current drift is inside the Verification Report family, where the same report meaning is rendered with host-specific structure and local state.
+
+**Independent Test**: Can be fully tested by rendering each covered verification host with equivalent verification data and confirming that the same core zones, same status meaning, and same next-step intent are visible in each host while allowed host variations remain bounded.
+
+**Acceptance Scenarios**:
+
+1. **Given** the same verification outcome is rendered in an operations detail host and an onboarding host, **When** the operator opens each host, **Then** the same core summary, issue/pass structure, and diagnostics contract are recognizable.
+2. **Given** a verification host offers host-specific assist or acknowledge behavior, **When** the operator uses that host, **Then** the host-specific behavior appears as an explicit variation of the same shared verification contract rather than as a different report UI.
+3. **Given** a verification report has no technical detail payload available, **When** it is rendered in any covered host, **Then** the absence is communicated through the same contractually defined unavailable or optional zone behavior rather than host-specific omission rules.
+
+---
+
+### User Story 2 - Inspect normalized settings and diffs consistently (Priority: P1)
+
+As an operator reviewing policy, version, or finding detail, I want normalized settings and normalized diff surfaces to behave like one family, so that tabs, view modes, sections, and unavailable states do not feel reinvented per host.
+
+**Why this priority**: The diff/settings family already appears across multiple detail hosts and contains subtle host-specific drift around visibility, context handling, and section behavior.
+
+**Independent Test**: Can be fully tested by rendering representative policy, policy-version, and finding hosts and verifying that the same family-level structure, same core view behavior, and same empty or unavailable semantics apply wherever the same content concept is shown.
+
+**Acceptance Scenarios**:
+
+1. **Given** a normalized diff is available in more than one covered host, **When** the operator opens each host, **Then** the same family-level view structure and section logic are recognizable.
+2. **Given** a normalized settings surface renders different content subtypes, **When** those subtypes are shown in covered hosts, **Then** subtype differences remain explicit and do not appear as ad hoc host forks.
+3. **Given** a host cannot show a diff or settings payload, **When** the operator reaches that area, **Then** the surface shows a family-consistent unavailable or partial state rather than a host-specific gap.
+
+---
+
+### User Story 3 - Add or update a host without re-forking the family (Priority: P2)
+
+As a developer or reviewer, I want a clear shared-family contract for repeated detail surfaces, so that a new host or host change can extend the family through known variation points instead of quietly re-forking the whole micro-UI.
+
+**Why this priority**: The product gain only lasts if later host work cannot easily recreate drift.
+
+**Independent Test**: Can be fully tested by reviewing a changed or newly added host against the family contract and verifying that only allowed host-driven inputs, zones, and actions differ.
+
+**Acceptance Scenarios**:
+
+1. **Given** a developer introduces a new host for an existing shared family, **When** the host is reviewed and tested, **Then** the host declares or uses only the family's allowed variation points.
+2. **Given** an existing host needs a unique action or assist entry, **When** that difference is added, **Then** the difference remains visibly host-scoped and does not redefine the family core structure.
+3. **Given** a future host tries to introduce a different tab or view contract for the same family without domain justification, **When** the change is reviewed, **Then** it is rejected as out of contract.
+
+### Edge Cases
+
+- A covered host lacks one optional zone, such as technical details, but still must preserve the same family-level structure and optional-state behavior.
+- A host needs an assist or acknowledge action that no other host needs; the action must remain an explicit host variation and not become a hidden structural fork.
+- The same family appears in both tenant-context and workspace-context hosts; tenant scope must stay explicit and inaccessible data must remain not found.
+- A diff or settings payload is partially available, unavailable, or subtype-specific; the surface must communicate this consistently without silently dropping the zone.
+- A family contains local state, such as view selection or expansion state; that state must be owned once at the family level rather than recreated differently in each host.
+
+## Requirements *(mandatory)*
+
+**Constitution alignment (required):** This feature introduces no new Microsoft Graph calls, no new long-running or queued work, and no new write workflow. It standardizes repeated operator-facing detail surfaces that already exist and must remain derived from the host's current domain truth.
+
+**Constitution alignment (PROP-001 / ABSTR-001 / PERSIST-001 / STATE-001 / BLOAT-001):** This feature introduces one narrow kind of abstraction: an explicit shared detail-family contract for two already proven families. It does not introduce new persistence, new state families, or a cross-domain UI framework. The purpose is to replace duplicate cross-host ownership, not to layer a new semantic system on top of existing truth.
+
+**Constitution alignment (OPS-UX):** No new `OperationRun` type or execution path is introduced. Existing links to operations remain navigation only and continue to rely on the current operations contract.
+
+**Constitution alignment (RBAC-UX):** The feature does not change authorization behavior. Existing workspace and tenant entitlement rules continue to govern every host. Non-members remain deny-as-not-found, members without capability remain forbidden where host-owned actions already enforce capability, and no shared family may bypass host authorization.
+
+**Constitution alignment (OPS-EX-AUTH-001):** Not applicable.
+
+**Constitution alignment (BADGE-001):** Existing centralized status, severity, readiness, and availability semantics remain the source of truth. This feature must not create host-local badge or tone vocabularies for the same shared family.
+
+**Constitution alignment (UI-FIL-001):** Existing native detail containers, shared status primitives, and current custom viewer bodies remain the basis. The work must consolidate contract ownership and avoid new host-local replacement markup for status, assist, or action zones. Exception: the core bodies of the two shared families remain domain-specific rich viewers rather than being flattened into generic primitives.
+
+**Constitution alignment (UI-NAMING-001):** Shared family vocabulary must stay stable across hosts. Operators should continue to see the same canonical nouns, such as verification report, technical details, next steps, normalized settings, and diff, instead of host-specific synonyms for the same concept.
+
+**Constitution alignment (DECIDE-001):** Verification Report surfaces remain secondary context surfaces, and Normalized Diff / Settings surfaces remain tertiary evidence surfaces. Each host must still make the first decision possible without forcing the operator to decode different family structures for the same concept.
+
+**Constitution alignment (UI-CONST-001 / UI-SURF-001 / ACTSURF-001 / UI-HARD-001 / UI-EX-001 / UI-REVIEW-001 / HDR-001):** The feature standardizes embedded detail and evidence surfaces. Each family keeps exactly one primary inspect model per host: the host opens the record, and the family provides the repeated inner surface. Pure navigation remains host-owned or within the family's secondary action zone. Destructive behavior is outside the shared core and remains governed by host rules.
+
+**Constitution alignment (ACTSURF-001 - action hierarchy):** Shared-family actions are limited to navigation, inspection, view switching, assist entry, and other low-risk context actions. Any mutating or destructive host action remains clearly separated from the shared-family core and may not compete with the family's primary evidence or review function.
+
+**Constitution alignment (OPSURF-001):** Default-visible content stays operator-first. Shared-family surfaces must show the core meaning, next step, or relevant content first, while deeper diagnostics remain secondary and intentionally revealed. Host context remains visible so operators understand scope.
+
+**Constitution alignment (UI-SEM-001 / LAYER-001 / TEST-TRUTH-001):** Direct host-by-host mapping is currently insufficient because it has already produced duplicate ownership and drift. This feature must replace that duplicate ownership with one shared contract per family rather than adding extra presenter layers. Regression tests must assert the business-visible consequences of sameness across hosts.
+
+**Constitution alignment (Filament Action Surfaces):** The Action Surface Contract remains satisfied. These are embedded read-heavy detail families, not new standalone CRUD resources. Each host continues to own its one primary inspect/open model, no redundant View action is introduced by the family work, and destructive actions stay outside the shared core. UI-FIL-001 is satisfied with the documented exception that family-specific detail viewers remain custom where the domain requires it.
+
+**Constitution alignment (UX-001 — Layout & Information Architecture):** The feature does not add create or edit screens. Existing detail hosts must continue to use appropriate detail layouts, clear sectioning, explicit empty or unavailable states, and operator-first information ordering. Where a host already uses a view-style detail surface, the shared family must strengthen rather than weaken that clarity.
+
+### Functional Requirements
+
+- **FR-197-001**: The system MUST define a shared detail contract for the Verification Report family that covers every currently in-scope host where the same verification surface appears.
+- **FR-197-002**: The Verification Report contract MUST identify which zones are mandatory, optional, host-extendable, and host-governed, including summary or header, outcome or readiness, view or tab zone, next-step or assist zone, technical-details or diagnostics zone, and empty or unavailable state handling.
+- **FR-197-003**: Covered Verification Report hosts MUST use the same family-level core structure and MUST NOT redefine the family through incompatible local tab, view, or zone contracts.
+- **FR-197-004**: Host-specific Verification Report differences MAY vary action availability, host placement, or assist entry behavior, but MUST NOT change the family's core structure, diagnostics contract, or next-step contract without explicit domain justification.
+- **FR-197-005**: The Verification Report family MUST remain at least functionally equivalent to the pre-standardized state, preserving current information value, current operator usefulness, and current diagnosis depth.
+- **FR-197-006**: The system MUST define a shared detail contract for the Normalized Diff / Normalized Settings family across every currently in-scope host that presents the same content concept.
+- **FR-197-007**: The Normalized Diff / Settings contract MUST standardize family-level view zones, section behavior, empty or unavailable states, partial states, and any supported expand or fullscreen semantics where those behaviors are part of the family.
+- **FR-197-008**: If the Normalized Diff / Settings family contains meaningful subtypes, those subtypes MUST be explicit variations of the same family contract and MUST NOT exist only as accidental host forks.
+- **FR-197-009**: Covered hosts for the Normalized Diff / Settings family MAY vary host framing or surrounding context, but MUST preserve recognizable family-level interaction patterns for view switching, section reading, and detail inspection.
+- **FR-197-010**: For each in-scope shared family, the required inputs, supported states, and render expectations MUST be explicit enough that a host does not need hidden local assumptions to render the family correctly.
+- **FR-197-011**: If a shared family requires local UI state, that state MUST be owned once at the family level and MUST NOT be recreated differently in each host.
+- **FR-197-012**: New or updated hosts using an in-scope shared family MUST extend the family only through the contract's documented variation points and MUST NOT introduce new ad hoc Blade-level main variants for the same surface.
+- **FR-197-013**: Domain-specific viewers that are similar in shape but intentionally separate from the two in-scope families MAY remain outside this spec, but they MUST stay explicitly out of scope rather than becoming accidental exceptions inside the standardized families.
+- **FR-197-014**: Regression coverage MUST prove that multiple hosts for each in-scope shared family use the same family-level contract and that any remaining differences are explicit, bounded host variations.
+- **FR-197-015**: Release acceptance for this spec MUST include a closing inventory of migrated hosts, intentionally allowed remaining variations, and follow-up topics that were found to be shell, monitoring-state, or other out-of-scope concerns.
+
+## UI Action Matrix *(mandatory when Filament is changed)*
+
+| Surface | Location | Header Actions | Inspect Affordance (List/Table) | Row Actions (max 2 visible) | Bulk Actions (grouped) | Empty-State CTA(s) | View Header Actions | Create/Edit Save+Cancel | Audit log? | Notes / Exemptions |
+|---|---|---|---|---|---|---|---|---|---|---|
+| Verification Report family | Embedded inside operations detail, onboarding verification, and tenant verification hosts | Host-owned header actions; shared family may expose low-risk report actions such as open related operation, open technical details, or follow next step | Host-owned detail inspection; not a list/table surface | None at family level; any host-specific per-item action stays explicitly host-scoped | None | Family-consistent empty, unavailable, or assist CTA where relevant | N/A | N/A | No new audit path introduced | Action Surface Contract satisfied. Shared core is read-heavy; host-owned acknowledge or assist mutations remain outside the core contract and retain existing authorization and confirmation rules. |
+| Normalized Diff / Settings family | Embedded inside policy, policy version, and finding detail hosts | Host-owned detail header actions only | Host-owned detail inspection; not a list/table surface | None | None | Family-consistent unavailable or partial-state explanation; CTA only if the host already owns a follow-up path | N/A | N/A | No | Action Surface Contract satisfied. Read-only evidence family; no new mutation or destructive affordance is introduced. |
+
+### Key Entities *(include if feature involves data)*
+
+- **Shared detail family**: A repeated domain detail surface that appears in more than one host and should read as the same surface wherever it appears.
+- **Family contract**: The explicit definition of a shared family's inputs, supported states, mandatory zones, optional zones, and allowed host variations.
+- **Host variation**: A deliberately bounded host-specific difference, such as action availability, placement, or assist entry, that does not redefine the family core.
+- **Verification report detail**: The domain report surface that communicates verification readiness, blockers, passes, next steps, and deeper diagnostics.
+- **Normalized detail surface**: The domain evidence surface that communicates structured settings content or structured diff content through one recognizable family.
+
+## Deliverables
+
+- **D-197-001**: A standardized Verification Report shared-family contract covering the currently in-scope hosts.
+- **D-197-002**: A standardized Normalized Diff / Normalized Settings shared-family contract covering the currently in-scope hosts.
+- **D-197-003**: Documented variation rules per family that state what is shared core, what hosts may extend, and what hosts must not re-invent.
+- **D-197-004**: A closing migration note listing migrated hosts, consciously allowed remaining differences, and related topics that were intentionally left out of scope.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-197-001**: In regression coverage, every currently in-scope host for the Verification Report family passes the shared-family contract assertions with zero unexplained core-structure differences.
+- **SC-197-002**: In regression coverage, every currently in-scope host for the Normalized Diff / Settings family passes the shared-family contract assertions with zero unexplained view-structure differences.
+- **SC-197-003**: In operator smoke review, a reviewer can identify summary, next-step or assist placement, and diagnostics placement within 10 seconds on each covered Verification Report host.
+- **SC-197-004**: In operator smoke review, covered diff/settings hosts are recognized as the same family for view modes, section behavior, and unavailable-state behavior in 100% of reviewed scenarios.
+- **SC-197-005**: The release contains no remaining unbounded host-only main variant for either in-scope shared family.
+
+## Assumptions
+
+- The current repository already contains the two in-scope shared families in enough hosts to justify a family-level contract now.
+- Existing host authorization, route structure, and domain truth remain correct; this spec changes shared UI contract ownership, not host entitlement logic.
+- Rich domain-specific detail rendering remains necessary; only the family contract is being standardized, not the domain detail richness itself.
+
+## Non-Goals
+
+- Standardizing every custom detail surface in the repository
+- Refactoring the global shell, workspace context bar, or monitoring page-state behavior
+- Reworking Evidence Overview, baseline compare matrix, or generic table surfaces
+- Eliminating every custom view body in favor of a generic component system
+- Pulling unrelated domain-specific diff viewers into scope without proving that they are the same shared family
+
+## Dependencies
+
+- Existing operations detail hosts, tenant verification hosts, and onboarding verification hosts that already render Verification Report content
+- Existing policy, policy version, and finding detail hosts that already render Normalized Settings or Normalized Diff content
+- Existing host-level authorization, detail routing, and status semantics that the shared-family contracts must preserve rather than replace
+
+## Definition of Done
+
+Spec 197 is complete when:
+
+- both confirmed in-scope shared families use explicit family contracts,
+- the main hosts for each family no longer behave like loosely drifted mini-app variants of the same surface,
+- remaining host differences are explicitly documented as bounded variations,
+- regression and smoke verification prove operator sameness and preserved usefulness,
+- and no shell-, monitoring-state-, or other out-of-scope topic has been silently absorbed into this work.

specs/197-shared-detail-contract/tasks.md

@@ -0,0 +1,229 @@
+# Tasks: Shared Detail Micro-UI Contract
+
+**Input**: Design documents from `/specs/197-shared-detail-contract/`
+**Prerequisites**: plan.md, spec.md, research.md, data-model.md, contracts/, quickstart.md
+
+**Tests**: Tests are REQUIRED for this feature. Use Pest feature coverage and Livewire-safe Filament tests via Laravel Sail.
+**Operations**: No new `OperationRun`, queue, scheduler, or notification lifecycle is introduced by this feature.
+**RBAC**: No new capability or authorization plane is introduced; all hosts must preserve existing deny-as-not-found and capability enforcement behavior.
+**Release Artifact**: `specs/197-shared-detail-contract/migration-note.md` records migrated hosts, bounded variations, manual smoke evidence, and out-of-scope follow-ups.
+
+**Organization**: Tasks are grouped by user story so each family can be implemented and verified independently.
+
+## Phase 1: Setup (Shared Scaffolding)
+
+**Purpose**: Create the new support, view, and test entry points that later phases will fill.
+
+- [X] T001 [P] Create shared-detail support class skeletons in apps/platform/app/Filament/Support/NormalizedSettingsSurface.php and apps/platform/app/Filament/Support/NormalizedDiffSurface.php
+- [X] T002 [P] Create family partial entry points in apps/platform/resources/views/filament/components/verification-report/summary.blade.php, apps/platform/resources/views/filament/components/verification-report/issues.blade.php, apps/platform/resources/views/filament/infolists/entries/normalized-settings/wrapper.blade.php, and apps/platform/resources/views/filament/infolists/entries/normalized-diff/wrapper.blade.php
+- [X] T003 [P] Create focused contract-test shells in apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php, apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php, and apps/platform/tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php
+
+**Checkpoint**: The new files and entry points exist so the implementation can proceed without inventing paths mid-stream.
+
+---
+
+## Phase 2: Foundational (Blocking Contract Seams)
+
+**Purpose**: Establish the shared support builders that every story relies on.
+
+**⚠️ CRITICAL**: No user story work should start before these support seams exist.
+
+- [X] T004 [P] Extend apps/platform/app/Filament/Support/VerificationReportViewer.php to build an explicit verification surface contract with shared zones and host-variation metadata
+- [X] T005 [P] Implement normalized settings contract shaping in apps/platform/app/Filament/Support/NormalizedSettingsSurface.php for subtype, warning, and empty-state ownership
+- [X] T006 [P] Implement normalized diff contract shaping in apps/platform/app/Filament/Support/NormalizedDiffSurface.php for availability, zero-diff, partial-state, and grouped-render ownership
+
+**Checkpoint**: Verification, normalized settings, and normalized diff each have a single contract seam that hosts can consume.
+
+---
+
+## Phase 3: User Story 1 - Recognize The Same Verification Surface Everywhere (Priority: P1) 🎯 MVP
+
+**Goal**: Make operation detail, onboarding, and tenant verification render the same verification-family core while keeping only bounded host-specific actions and framing.
+
+**Independent Test**: Render equivalent verification data through the operation detail, onboarding, and tenant widget hosts and confirm the same summary, issue/pass grouping, diagnostics contract, unavailable semantics, and authorization boundaries are recognizable everywhere.
+
+### Tests for User Story 1
+
+- [X] T007 [P] [US1] Add cross-host parity assertions in apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php for operation detail, onboarding, and tenant widget verification hosts
+- [X] T008 [P] [US1] Extend DB-only and widget regressions in apps/platform/tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php and apps/platform/tests/Feature/Filament/TenantVerificationReportWidgetTest.php
+- [X] T009 [P] [US1] Extend onboarding verification regressions in apps/platform/tests/Feature/Onboarding/OnboardingVerificationTest.php and apps/platform/tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php
+- [X] T010 [P] [US1] Extend workspace-context and onboarding entitlement regressions in apps/platform/tests/Feature/MonitoringOperationsTest.php, apps/platform/tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php, and apps/platform/tests/Feature/Onboarding/OnboardingDraftAccessTest.php so the verification-family refactor preserves 404-for-non-members and 403-for-in-scope-capability-denial behavior
+
+### Implementation for User Story 1
+
+- [X] T011 [US1] Refactor apps/platform/resources/views/filament/components/verification-report-viewer.blade.php and the partials under apps/platform/resources/views/filament/components/verification-report/ to own the shared summary, issues, passed, diagnostics, next-step, and unavailable zones
+- [X] T012 [US1] Rebuild apps/platform/resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php around the shared verification-family core while keeping assist, acknowledge, and technical-details controls host-scoped
+- [X] T013 [US1] Route operation-detail and onboarding host context through the verification contract in apps/platform/app/Filament/Resources/OperationRunResource.php and apps/platform/app/Filament/Pages/Workspaces/ManagedTenantOnboardingWizard.php
+- [X] T014 [US1] Route tenant-widget host context through the verification contract in apps/platform/app/Filament/Widgets/Tenant/TenantVerificationReport.php and apps/platform/resources/views/filament/widgets/tenant/tenant-verification-report.blade.php
+
+**Checkpoint**: Verification-family hosts share one recognizable micro-UI contract and remain DB-only, host-authorized, and operator-first.
+
+---
+
+## Phase 4: User Story 2 - Inspect Normalized Settings And Diffs Consistently (Priority: P1)
+
+**Goal**: Make policy, policy-version, and finding detail surfaces use one normalized settings family and one normalized diff family with explicit subtype and availability semantics.
+
+**Independent Test**: Render representative policy, policy-version, and finding hosts and confirm that normalized settings and normalized diff use consistent family-owned wrappers, view behavior, subtype handling, unavailable-state semantics, and existing tenant-scope authorization behavior.
+
+### Tests for User Story 2
+
+- [X] T015 [P] [US2] Add family parity assertions in apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php for policy settings, policy-version settings, policy-version diff, and finding diff hosts
+- [X] T016 [P] [US2] Extend normalized settings regressions in apps/platform/tests/Feature/Filament/PolicyVersionSettingsTest.php and apps/platform/tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php
+- [X] T017 [P] [US2] Extend normalized diff availability regressions in apps/platform/tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php and apps/platform/tests/Feature/Drift/DriftFindingDiffUnavailableTest.php
+- [X] T018 [P] [US2] Extend tenant-scope authorization regressions in apps/platform/tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php, apps/platform/tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php, and apps/platform/tests/Feature/Findings/FindingRbacTest.php so normalized-detail hosts preserve deny-as-not-found and capability-safe behavior after family wiring
+
+### Implementation for User Story 2
+
+- [X] T019 [US2] Refactor apps/platform/resources/views/filament/infolists/entries/normalized-settings.blade.php and subtype partials under apps/platform/resources/views/filament/infolists/entries/normalized-settings/ to own warnings, wrapper structure, subtype selection, and empty-state behavior
+- [X] T020 [US2] Absorb or retire apps/platform/resources/views/filament/infolists/entries/policy-settings-standard.blade.php as a direct host-facing sibling so standard settings render only as a normalized-settings subtype
+- [X] T021 [US2] Route policy and policy-version settings hosts through NormalizedSettingsSurface in apps/platform/app/Filament/Resources/PolicyResource.php and apps/platform/app/Filament/Resources/PolicyVersionResource.php
+- [X] T022 [P] [US2] Adapt apps/platform/app/Livewire/SettingsCatalogSettingsTable.php so the settings-catalog table stays a subtype renderer under the normalized-settings family wrapper
+- [X] T023 [US2] Refactor apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php and the partials under apps/platform/resources/views/filament/infolists/entries/normalized-diff/ to own summary, grouped rendering, and unavailable or zero-diff states
+- [X] T024 [US2] Route policy-version and finding diff hosts through NormalizedDiffSurface in apps/platform/app/Filament/Resources/PolicyVersionResource.php and apps/platform/app/Filament/Resources/FindingResource.php
+
+**Checkpoint**: Normalized settings and diff surfaces read as one family across policy, policy-version, and finding detail hosts.
+
+---
+
+## Phase 5: User Story 3 - Add Or Update A Host Without Re-Forking The Family (Priority: P2)
+
+**Goal**: Make future host work extend the documented family variation points instead of silently reintroducing host-local forks.
+
+**Independent Test**: Run the guard suite and verify it fails on forbidden verification tab ownership or direct top-level `policy-settings-standard` host usage while the contract docs enumerate the approved consumers and allowed variations.
+
+### Tests for User Story 3
+
+- [X] T025 [P] [US3] Implement fork-guard coverage in apps/platform/tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php for forbidden verification tab ownership and direct host-level policy-settings-standard usage
+
+### Implementation for User Story 3
+
+- [X] T026 [US3] Sync approved consumers, required markers, and forbidden host patterns in specs/197-shared-detail-contract/contracts/verification-report-family.openapi.yaml and specs/197-shared-detail-contract/contracts/normalized-detail-family.openapi.yaml
+- [X] T027 [US3] Record the migrated host inventory, bounded variations, smoke-review evidence, and out-of-scope follow-ups in specs/197-shared-detail-contract/migration-note.md
+
+**Checkpoint**: Reviewers and future implementers have an executable guard and a written inventory that block ad hoc family forks.
+
+---
+
+## Phase 6: Polish & Cross-Cutting Concerns
+
+**Purpose**: Validate the full feature slice and record release acceptance evidence.
+
+- [X] T028 [P] Run formatting for touched PHP files including apps/platform/app/Filament/Support/VerificationReportViewer.php, apps/platform/app/Filament/Support/NormalizedSettingsSurface.php, and apps/platform/app/Filament/Support/NormalizedDiffSurface.php with `./vendor/bin/sail bin pint --dirty --format agent`
+- [X] T029 Run the focused Sail validation pack from specs/197-shared-detail-contract/quickstart.md against apps/platform/tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php, apps/platform/tests/Feature/Filament/TenantVerificationReportWidgetTest.php, apps/platform/tests/Feature/Onboarding/OnboardingVerificationTest.php, apps/platform/tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php, apps/platform/tests/Feature/MonitoringOperationsTest.php, apps/platform/tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php, apps/platform/tests/Feature/Onboarding/OnboardingDraftAccessTest.php, apps/platform/tests/Feature/Filament/PolicyVersionSettingsTest.php, apps/platform/tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php, apps/platform/tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php, apps/platform/tests/Feature/Drift/DriftFindingDiffUnavailableTest.php, apps/platform/tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php, apps/platform/tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php, apps/platform/tests/Feature/Findings/FindingRbacTest.php, apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php, apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php, and apps/platform/tests/Feature/Guards/SharedDetailFamilyContractGuardTest.php
+- [X] T030 Execute the Manual Smoke Check in specs/197-shared-detail-contract/quickstart.md and capture SC-197-003 and SC-197-004 evidence in specs/197-shared-detail-contract/migration-note.md
+
+---
+
+## Dependencies & Execution Order
+
+### Phase Dependencies
+
+- **Setup (Phase 1)**: No dependencies; can start immediately.
+- **Foundational (Phase 2)**: Depends on Setup completion; blocks all user story implementation.
+- **User Story 1 (Phase 3)**: Depends on Foundational completion.
+- **User Story 2 (Phase 4)**: Depends on Foundational completion.
+- **User Story 3 (Phase 5)**: Depends on User Story 1 and User Story 2 completion because the guard and inventory must reflect the final family boundaries.
+- **Polish (Phase 6)**: Depends on all targeted user stories being complete.
+
+### User Story Dependencies
+
+- **US1**: Independent after Phase 2; no dependency on US2.
+- **US2**: Independent after Phase 2; no dependency on US1.
+- **US3**: Depends on US1 and US2 because it locks the final approved host patterns for both families.
+
+### Within Each User Story
+
+- Write or extend the listed tests before finishing implementation.
+- Complete support or wrapper ownership before wiring host files to the new family contracts.
+- Keep host framing and host-owned actions bounded to the variation points defined in the contracts.
+- Validate each story independently before moving to the next story or polish phase.
+
+### Parallel Opportunities
+
+- T001, T002, and T003 can run in parallel.
+- T004, T005, and T006 can run in parallel.
+- After Phase 2, US1 and US2 can proceed in parallel if separate implementers avoid the shared `PolicyVersionResource.php` touchpoint.
+- Within US1, T007, T008, T009, and T010 can run in parallel.
+- Within US2, T015, T016, T017, and T018 can run in parallel.
+- Within US3, T026 and T027 can run in parallel after T025 is in place.
+
+---
+
+## Parallel Example: User Story 1
+
+```bash
+# Start the verification-family test extensions together:
+Task: "T007 Add cross-host parity assertions in apps/platform/tests/Feature/Filament/SharedVerificationReportFamilyContractTest.php"
+Task: "T008 Extend DB-only and widget regressions in apps/platform/tests/Feature/Verification/VerificationReportViewerDbOnlyTest.php and apps/platform/tests/Feature/Filament/TenantVerificationReportWidgetTest.php"
+Task: "T009 Extend onboarding verification regressions in apps/platform/tests/Feature/Onboarding/OnboardingVerificationTest.php and apps/platform/tests/Feature/Onboarding/OnboardingVerificationV1_5UxTest.php"
+Task: "T010 Extend workspace-context and onboarding entitlement regressions in apps/platform/tests/Feature/MonitoringOperationsTest.php, apps/platform/tests/Feature/Spec085/DenyAsNotFoundSemanticsTest.php, and apps/platform/tests/Feature/Onboarding/OnboardingDraftAccessTest.php"
+
+# After the shared verification wrapper is in place, these can proceed side by side:
+Task: "T012 Rebuild apps/platform/resources/views/filament/forms/components/managed-tenant-onboarding-verification-report.blade.php"
+Task: "T014 Route tenant-widget host context through the verification contract in apps/platform/app/Filament/Widgets/Tenant/TenantVerificationReport.php and apps/platform/resources/views/filament/widgets/tenant/tenant-verification-report.blade.php"
+```
+
+---
+
+## Parallel Example: User Story 2
+
+```bash
+# Start the normalized-detail test extensions together:
+Task: "T015 Add family parity assertions in apps/platform/tests/Feature/Filament/NormalizedDetailFamilyContractTest.php"
+Task: "T016 Extend normalized settings regressions in apps/platform/tests/Feature/Filament/PolicyVersionSettingsTest.php and apps/platform/tests/Feature/Filament/SettingsCatalogPolicyNormalizedDiffTest.php"
+Task: "T017 Extend normalized diff availability regressions in apps/platform/tests/Feature/Filament/GroupPolicyConfigurationNormalizedDiffTest.php and apps/platform/tests/Feature/Drift/DriftFindingDiffUnavailableTest.php"
+Task: "T018 Extend tenant-scope authorization regressions in apps/platform/tests/Feature/Filament/PolicyResourceAdminTenantParityTest.php, apps/platform/tests/Feature/Filament/PolicyVersionAdminTenantParityTest.php, and apps/platform/tests/Feature/Findings/FindingRbacTest.php"
+
+# Once the family builders exist, these can proceed in parallel without touching the same files:
+Task: "T022 Adapt apps/platform/app/Livewire/SettingsCatalogSettingsTable.php"
+Task: "T023 Refactor apps/platform/resources/views/filament/infolists/entries/normalized-diff.blade.php and partials under apps/platform/resources/views/filament/infolists/entries/normalized-diff/"
+```
+
+---
+
+## Parallel Example: User Story 3
+
+```bash
+# After the guard exists, finish the enforcement artifacts together:
+Task: "T026 Sync approved consumers and forbidden host patterns in specs/197-shared-detail-contract/contracts/verification-report-family.openapi.yaml and specs/197-shared-detail-contract/contracts/normalized-detail-family.openapi.yaml"
+Task: "T027 Record the migrated host inventory and bounded variations in specs/197-shared-detail-contract/migration-note.md"
+```
+
+---
+
+## Implementation Strategy
+
+### MVP First (User Story 1 Only)
+
+1. Complete Phase 1: Setup.
+2. Complete Phase 2: Foundational.
+3. Complete Phase 3: User Story 1.
+4. Validate the verification family independently across operation detail, onboarding, and tenant widget hosts.
+5. Demo or merge the MVP slice if the repo strategy allows partial delivery.
+
+### Incremental Delivery
+
+1. Finish Setup + Foundational once.
+2. Deliver US1 and validate verification-family sameness.
+3. Deliver US2 and validate normalized-detail sameness.
+4. Deliver US3 to lock the boundaries with a guard and final inventory.
+5. Finish with polish, the focused Sail pack from quickstart.md, and the manual smoke evidence recorded in migration-note.md.
+
+### Parallel Team Strategy
+
+1. One implementer completes Phase 1 and Phase 2.
+2. After that, one implementer can take US1 while another takes US2.
+3. US3 starts once both family implementations settle.
+4. Finish with one shared cleanup and validation pass.
+
+---
+
+## Notes
+
+- `[P]` means the task can run in parallel because it touches different files and has no dependency on incomplete work.
+- `[US1]`, `[US2]`, and `[US3]` map each task back to the spec’s user stories.
+- This feature must stay inside Filament v5 + Livewire v4; no provider registration change is required because `bootstrap/providers.php` remains unchanged.
+- No globally searchable resource is added or removed by this feature; existing host resources continue to own their Edit or View surfaces.
+- No destructive action is introduced inside either shared family; any existing host mutation remains host-owned and must keep existing confirmation and authorization behavior.
+- No new assets are introduced, so no `filament:assets` deployment step changes are needed.