Foundations settle the surfaces and the rules. Elements define what a state looks like. Components assemble them into the things the SME touches. Report Design carries the same semantics across the white-label boundary.
The screens are not a menu, they are a path with gates on it — and three loops, because that is where the churn lives. Nothing scans until the sample is frozen, nothing becomes a version until every page completes, and nothing exports until the generated file passes its own suite. The interesting parts are the three return paths — review to diff, ticket to recheck, version to version — because that is where authority gets decided.
Frozen means the list of pages in this audit is now fixed. Before the freeze you can add and remove pages freely. After it, the sample is what the report claims was examined — and by omission, what was not — so changing it needs an unfreeze, a written reason, and an entry in the audit trail. Nothing can scan until a sample is frozen, because a scan of a moving target is not comparable to anything.
Advisory means useful but not binding. A developer closing a ticket, or a recheck of one element, tells you something worth knowing — but neither looked at the whole page, so neither may change a finding's status. Advisory information is always dated and always drawn dashed. Only a full scan or the SME writes status.
Two people use the tool. The consultant sets up audits, runs scans and assembles reports. The SME does the judging: reviewing findings, walking the manual criteria, and deciding what is real. Where a screen says SME, that is a person making a call, not a role in a permissions table.
Two people never touch it. The client's developers see only Jira tickets, and the business client sees only the exported report. Both are downstream of everything here, which is why the boundary between what we record and what we merely observe has to be visible on every screen.
Reading the diff sends you back into review: something moved, so it needs judging again. Intel hangs off review as a mode rather than a stage — you drop into it to measure one element, then come straight back out. Both are drawn as returns to review because that is where the decision gets made.
A ticket goes out, the client fixes it, a recheck comes back dated — dashed all the way round, because it looked at one element. Then the wider one: export, wait, scan the same frozen sample again. Only that pass may call something fixed or came-back, because only that pass looked at everything.
Stated here because they govern every part. Their full treatment, with specimens, is in Foundations.
Signal Amber means the ground moved since you last looked — regression, drift, live-differs, a stalled poll. It is not the severity scale. Severity is a measurement; regression is an alarm.
Every severity, status, staleness and confidence encoding carries a glyph or shape and a text label. Color is the third channel, never the first. The tool that audits color dependence cannot depend on color.
A solid border means the value is written to the version record. A dashed border means advisory. The border tells you what has authority.
Status is drawn from an open set. Two reserved slots (needs-review, accepted-risk) are specified now so Theme E lands without a redesign.