From 629ff79a6a1e10da083aaf7c61ab88a8e2063194 Mon Sep 17 00:00:00 2001
From: Jeff Larson <thejefflarson@gmail.com>
Date: Sun, 28 Jun 2026 21:44:20 -0700
Subject: [PATCH 1/3] docs: dashboard v3 design brief (light theme) +
 STYLEGUIDE

Recover the synthesized design brief onto the build branch, switch the visual register
to a LIGHT theme, and author docs/STYLEGUIDE.md as a light-theme token system
(tokens + component->token map + the test-enforced accessibility gate).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
---
 docs/STYLEGUIDE.md          | 108 +++++++++++++++++++++++
 docs/dashboard-v3-design.md | 171 ++++++++++++++++++++++++++++++++++++
 2 files changed, 279 insertions(+)
 create mode 100644 docs/STYLEGUIDE.md
 create mode 100644 docs/dashboard-v3-design.md

diff --git a/docs/STYLEGUIDE.md b/docs/STYLEGUIDE.md
new file mode 100644
index 0000000..5f4544e
--- /dev/null
+++ b/docs/STYLEGUIDE.md
@@ -0,0 +1,108 @@
+# Protector dashboard — style guide
+
+The dashboard is an operator's **situation board**, not a marketing page. This is the source
+of truth for its visual system: the design tokens, the component→token map, and the
+accessibility gate the tests assert. Pairs with [`dashboard-v3-design.md`](dashboard-v3-design.md)
+(the IA/UX). **Light theme:** a clean, high-contrast light surface with dark ink — dense and
+calm by default, loud only on a real breach.
+
+## Principles
+
+1. **Honesty over reassurance.** Green/calm is shown ONLY while the model is judging; unknown
+   and awaiting are never green. (Test-enforced — see the gate.)
+2. **Posture ≠ severity.** The model's verdict is the loud channel; CVE severity is a cooler,
+   subordinate channel. A wall of critical CVEs must never look like a wall of breaches.
+3. **Meaning never by colour alone.** Every status carries colour **+ glyph + word**.
+4. **Density with discipline.** Monospace/tabular for all machine data so columns align; one
+   restrained type scale and a small palette so density never becomes noise.
+5. **Calm by default, loud on breach.** Saturated colour is a scarce resource on the light
+   surface — spent only on a real breach.
+
+## Design tokens
+
+### Colour — surfaces & ink (light)
+| Token | Value | Use |
+|---|---|---|
+| `--bg` | `#FCFCFD` | page background |
+| `--surface` | `#FFFFFF` | cards, table |
+| `--surface-raised` | `#F4F6F8` | expanded row, header strip |
+| `--surface-hover` | `#F0F2F5` | row hover |
+| `--border` | `#E2E6EB` | hairlines, grid |
+| `--ink-1` | `#1A1F26` | primary text (≈15:1 on `--surface`) |
+| `--ink-2` | `#5A6473` | secondary text (≈6:1) |
+| `--ink-3` | `#6B7280` | tertiary / muted (≈4.6:1) |
+
+### Colour — posture (the model's `Verdict`; the loud channel)
+| Token | Value | Glyph | Word | Rail |
+|---|---|---|---|---|
+| `--posture-breach` | `#D92D20` | ● filled | BREACH / EXPLOITABLE | 3px solid |
+| `--posture-cleared` | `#067647` | ○ open | not exploitable | 2px solid |
+| `--posture-uncertain` | `#B54708` | ◐ half | uncertain | 2px **dashed** |
+| `--posture-awaiting` | `#667085` | ◌ dotted | awaiting judgement | 2px **dotted** |
+
+Uncertain & awaiting are amber-brown / slate — **never** the cleared green. Dashed/dotted
+rails make "not decided" texturally distinct even in greyscale.
+
+### Colour — severity (CVE/`ScanFinding`; subordinate, muted)
+| Token | Value | Cue |
+|---|---|---|
+| `--sev-critical` | `#B42318` | ▲▲ `CRIT` |
+| `--sev-high` | `#B54708` | ▲ `HIGH` |
+| `--sev-medium` | `#854A0E` | ◆ `MED` |
+| `--sev-low` | `#6B7280` | · `LOW` |
+| `--kev` | `#D92D20` (filled badge) | `KEV` — the one severity-side signal allowed to be loud |
+
+### Colour — recency Δ, coverage, mode
+| Token | Value | | Token | Value |
+|---|---|---|---|---|
+| `--delta-new` | `#1570EF` | | `--cov-present` | `#067647` |
+| `--delta-up` | `#D92D20` | | `--cov-degraded` | `#B54708` |
+| `--delta-down` | `#067647` | | `--cov-absent` | `#6B7280` |
+| `--delta-restored` | `#6B7280` | | `--mode-shadow` | `#667085` |
+| | | | `--mode-enforce` | `#1570EF` |
+
+### Space (4px base)
+`--space-1:4 · --space-2:8 · --space-3:12 · --space-4:16 · --space-6:24 · --space-8:32`
+
+### Type
+```
+--font-ui:   Inter, system-ui, sans-serif      /* chrome, prose, labels */
+--font-data: "JetBrains Mono", ui-monospace, monospace  /* ALL data: keys, CVEs, paths, counts */
+--text-display: 22/28 600   --text-h2: 16/24 600   --text-body: 14/20 400
+--text-data:    13/18 400   --text-data-strong: 13/18 600
+--text-micro:   11/16 500   /* uppercase, tracked: column headers, chip text */
+```
+Two weights only (400/600). Emphasis via weight + ink value, not a third weight.
+
+### Geometry
+`--row-h:36 · --radius-chip:3 · --radius-panel:6 · --rail-strong:3px · --rail-soft:2px · --focus-ring:2px solid #1570EF`
+
+## Component → token map
+| Component | Tokens |
+|---|---|
+| Page / app frame | `--bg`, `--font-ui` |
+| Status strip | `--surface-raised`; posture-* count chips; honest banner uses `--posture-uncertain`/`--posture-awaiting`, **never** `--posture-cleared` |
+| Finding row | `--surface`, `--row-h`, `--border` grid; entry/path `--font-data` `--text-data` |
+| Posture cell | `--posture-*` (rail style: solid=decisive, dashed=uncertain, dotted=awaiting) + glyph + word |
+| Severity chip | `--sev-*` border (muted); KEV → `--kev` fill |
+| Δ cell | `--delta-*` glyph, or `--ink-3` age text for `Unchanged` |
+| Detail panel | `--surface-raised`, `--space-4`; verdict prose `--text-body`, posture left-rule |
+| CVE table | `--font-data` `--text-micro`, right-aligned numerics |
+| Coverage row | `--cov-*` dot + glyph + label; `weakens_decisions` + absent → amber keyline |
+| Reversion log | `--posture-cleared` toned (a self-revert is the system working) |
+| Empty states | `--ink-2`; posture-coloured only when honestly earned (model judging) |
+
+## Accessibility gate (test-enforced)
+1. **Contrast:** body/status text ≥ **4.5:1** on its surface; chips/rails/glyphs ≥ **3:1**.
+2. **Meaning not by colour alone:** every posture / severity / Δ / coverage state renders a
+   non-empty **glyph + text label** in addition to colour. (Assert each enum→(glyph,label).)
+3. **Honest-calm invariant:** `model_judging == false` OR `warming_up` ⇒ the status strip
+   never resolves to `--posture-cleared`/green and the honest banner renders. `Verdict::Uncertain`
+   and awaiting (`None`) never map to the cleared/green token.
+4. **No implied-absent blanks:** any empty evidence/coverage field renders explicit
+   "none"/"unknown".
+5. **Escaping:** all untrusted free-text (verdict prose, CVE/finding titles, model prompts,
+   node keys) is HTML-escaped at render (maud auto-escape; no `PreEscaped` outside an audited
+   allowlist).
+6. **Keyboard/semantics:** findings are a real `<table>`; row expanders are `<button>`s with
+   `aria-expanded`; focus order = visual order; focus ring always visible.
diff --git a/docs/dashboard-v3-design.md b/docs/dashboard-v3-design.md
new file mode 100644
index 0000000..1b0e032
--- /dev/null
+++ b/docs/dashboard-v3-design.md
@@ -0,0 +1,171 @@
+# Dashboard v3 — design report
+
+**Status:** agreed design, pre-build. This is the source of truth the v3 rebuild implements.
+
+## Provenance
+
+This is not one person's sketch. It is the **synthesis of nine independent design
+passes** — three roles (Information Architect, UX, visual Designer) run three times each,
+in a *clean room*: each pass read only the engine's domain code (`engine/src/engine/state/`,
+`graph/`, `reason/`, `policy_log.rs`) and the ADRs, with **no access to any prior dashboard,
+ADR, or style guide** (those were deleted first, and the read-sets were verified). Across
+all nine passes the design **converged on the same shape** — strong evidence the IA is
+*dictated by the engine's data model*, not copied from a prior UI. What follows is that
+convergent design.
+
+The prior dashboards failed because the information architecture was wrong, and editing an
+IA doesn't fix it. The two specific failures this design exists to prevent:
+1. **Burying "why."** The model's verdict is the product; it must be one glance + one click away, never a separate destination.
+2. **Calm-when-blind.** A quiet green screen while the model is down/warming reads as "safe" when it means "we haven't looked." This is the cardinal sin and the design's #1 guard.
+
+---
+
+## 1. The operator and the one job
+
+A **solo (or very small team) platform/security engineer** running a small-to-mid Kubernetes
+cluster. They are *not* staring at a SOC console; they check in periodically (or get paged
+by the notifier). The engine is autonomous and **shadow-by-default** — it proposes, it never
+acts until armed. So the dashboard is a **decision-support view, never a control panel**
+(ADR-0016: presentation is a view, never a gate). The operator's real jobs:
+
+1. **Trust calibration** — is the engine's judgement sound enough to *arm* an action class?
+2. **Triage** — which judged breaches are real and need a human fix?
+3. **Coverage** — is the engine actually equipped to decide well right now (model up, feeds loaded)?
+
+## 2. Core operator questions (ranked)
+
+| # | Question | Backed by |
+|---|----------|-----------|
+| Q1 | **Is anything a breach right now, and would/did it cut?** | `Finding` (breach-relevant) + typed `Verdict` + `disposition` + `corroborated` + `cut` + recency Δ |
+| Q2 | **Why — can I trust this specific call?** | per-finding `path`, `EntryEvidence` (CVE/KEV/EPSS/secrets/runtime), and the raw `Judgement` (prompt + reply) |
+| Q3 | **Is the engine equipped to decide, or is "quiet" really "blind"?** | `Readiness` / `model_judging` / `warming_up` |
+| Q4 | **If I armed it, what would it have done — how noisy?** | `Report` (`would_act`, `short_lived`, `coverage_gap`, `left_alone`) |
+| Q5 | **What did it actually do, and did it undo it?** | `ReversionLog` + applied cuts |
+
+Q2 is inseparable from Q1 — it's Q1's drill-down, never a separate page.
+
+## 3. The honesty model (the load-bearing principle)
+
+Three **orthogonal axes** that must never collapse into one signal:
+
+- **breach vs safe** — the model's `Verdict`.
+- **decided vs awaiting** — has the model judged this entry yet?
+- **covered vs blind** — is the model up and are the feeds loaded?
+
+**Green/calm is only honest when `model_judging == true`.** If `warming_up` or
+`!model_judging`, exposed paths are *unjudged, not cleared*, and the UI says so. `Uncertain`
+and `Awaiting` are **never** green. This is enforced by tests, not just convention.
+
+## 4. Information architecture
+
+**A primary view + secondary views, with one persistent status strip — not a single page**
+(one page recreates the unreadable monolith), **and not flat peers** (Q1 dominates).
+
+| Surface | Question | Unit | Priority |
+|---|---|---|---|
+| **Status strip** (persistent, every view) | Q3 + freshness | the cluster | always-on |
+| **Findings** (primary / landing) | Q1 + Q2 | an exposed `Finding` (entry→objective) | P0 |
+| **Trust** (would-have-acted) | Q4 | a `WouldActEntry` / `LeftAloneEntry` | P1 |
+| **Readiness** (coverage detail) | Q3 | a decision input (`ReadinessRow`) | P1 |
+| **Activity** (audit) | Q5 | a `ReversionRecord` / `Judgement` | P2 |
+
+Navigation: persistent status strip + a 4-tab bar, default **Findings**. Findings drill
+**in place** (row → detail panel); "show the model's prompt" deep-links into Activity. Never
+deeper than two levels. **Admission/policy** decisions fold in as a peer surface.
+
+```
+┌─ protector ▸ prod-east ───────────────────────  [ SHADOW · proposes, never acts ] ─┐
+│ ● model judging · KEV ✓ · EPSS ✓ · agent quiet · last pass 12s ago     ← status strip│
+│ [ Findings ]  Trust  Readiness  Activity                                ← tab nav     │
+├──────────────────────────────────────────────────────────────────────────────────────┤
+│  1 BREACH · 2 awaiting · 14 cleared          ▲1 escalated since last pass             │
+├──┬──────────┬───────────────────────┬──────────────────────┬─────────┬──────┬────────┤
+│ Δ│ POSTURE  │ ENTRY → OBJECTIVE      │ PATH                 │ EVIDENCE│ DISP │ live?  │
+│ ▲│●EXPLOIT  │ web → db-creds (T1552) │ web ─reach→ db ✂→ ●  │⚡KEV cvss│auto  │ judged │
+│   └▼ verdict (verbatim) · path · evidence · cut+revert · [show model prompt]          │
+│ ＋│◌AWAITING │ argo → ×120 secrets    │ …                    │  —      │ ctx  │  —     │  ← unjudged ≠ green
+└──────────────────────────────────────────────────────────────────────────────────────┘
+```
+
+## 5. Findings view (primary — built first)
+
+- One row per **breach-relevant** `Finding`. Non-breach-relevant (internal assume-breach)
+  chains are **not** findings — they're context behind a filter, never alarms.
+- **Default sort = urgency, NOT severity** (ADR-0016): corroborated-live → model-promoted
+  (`Exploitable`) → escalations (`Delta::Escalated`) → awaiting → cleared (collapsed group).
+  A critical CVE on an unreachable workload is low-urgency; CVE severity is evidence in the
+  drawer, never the headline sort.
+- **Row:** posture rail+chip (Breach/Cleared/Uncertain/Awaiting — distinct colour **and**
+  glyph **and** word; Uncertain & Awaiting are not green) · entry (node-kind glyph, 🌐 for
+  internet foothold) · objective (ATT&CK tactic) · Δ glyph or age (steady shows age, not an
+  alarm) · evidence cluster (CVE count + KEV + runtime + exposed-secret glyphs; empty →
+  "no evidence", never blank) · disposition · a **live** (`Confirmed`) / **judged**
+  (`Exploitable`) sub-tag.
+- **Expands in place** to the "why": verbatim `Verdict::summary()` first → proven **path** as
+  a text hop-list (`entry ─relation→ … → objective`, structural hops muted, the cut point
+  marked) → **evidence** (CVE table id/sev/CVSS/KEV/EPSS/reachability/fix; runtime split
+  corroborating-vs-context; exposed secrets redacted; misconfig/RBAC) → the proposed/applied
+  **cut + its self-revert condition** → a "show model prompt" disclosure to the raw
+  `Judgement` prompt + reply.
+- **Fan-out** (argocd reaching ~120 objectives): collapse to `→ ×N secrets` with drill-in,
+  framed as reachable-but-cleared, never alarm.
+
+## 6. Secondary views (phase 2)
+
+- **Trust (would-have-acted)** — the arm/don't-arm evidence from `Report`: *Would have cut*
+  (`would_act`, sustained-first; `short_lived` = likely FP; `coverage_gap` = affirmed with no
+  CVE backing → scrutinise first; `open` = still standing) vs *Left alone* (`left_alone` —
+  proven paths the model cleared; the trust half). Honest empty: `journal_empty` vs
+  "none-in-window".
+- **Readiness (coverage)** — one row per input (model / KEV / EPSS / Falco / eBPF / journal /
+  arm-state): state (Present/Absent/Degraded) · live detail · why it matters · the env var to
+  enable it. Inputs that `weakens_decisions` when absent float up. A quiet feed reads
+  "no signals (quiet, or sensor down)" — the ambiguity preserved, not falsely resolved.
+- **Activity (audit)** — `ReversionLog` (self-reverted cuts + reason + age — the safety story,
+  kept visible) + the `Judgement` ring (prompt/reply per judgement, for debugging the model).
+- **Admission/policy** — the webhook floor: `DecisionTallies` header (admitted/audited/denied,
+  so a healthy view is never blank) + deduped decision rows (signature/mesh/decision + the
+  "if enforced" what-if).
+
+## 7. Interaction & states
+
+- **Server-rendered** (maud), zero-egress. Drill = inline `<details>` accordion (keeps list
+  context); deep links via URL fragment. Filter/sort via query params (shareable,
+  back-button-correct). Live refresh polls the `/fragment` keyed on `last_pass`, **preserving
+  scroll/expansion/filter**, and re-pulls readiness so a model that just went down flips the
+  banner immediately.
+- **Every state designed honestly:** cold-start/warming, model-absent, model-degraded
+  (timeout), proven-but-awaiting, judged-breach (corroborated vs promoted), judged-safe
+  (`Refuted`) vs `Uncertain` (not safe), genuinely-empty (only "all clear" when
+  `model_judging`), stale, and dashboard-can't-reach-engine (distinct from blind). No state
+  may render in a way that implies safety the engine can't back.
+
+## 8. Visual system
+
+- **Register:** a dense, **light-theme** information console (think Linear / GitHub / a clean
+  admin data table) — a white/near-white surface with dark ink, monospace/tabular for all
+  machine data so columns align. **Calm by default, loud only on a real breach** — saturated
+  colour is a scarce resource on the light surface, reserved for a real breach.
+- **Two separate channels:** *posture* (the model's verdict — the loud channel) and *severity*
+  (CVE — a cooler, subordinate channel). A wall of critical CVEs must never look like a wall
+  of breaches.
+- **Meaning never by colour alone** — every status carries colour **+ glyph + word**.
+- Full token set (colour/space/type), the component→token map, and the accessibility gate
+  live in **`docs/STYLEGUIDE.md`** — a **light-theme** token system.
+
+## 9. Invariants (test-enforced)
+
+1. `!model_judging` or `warming_up` ⇒ the status strip never renders the green/all-clear path; the honest banner renders.
+2. `Verdict::Uncertain` and awaiting (`None`) never map to the cleared/green token.
+3. Empty evidence/coverage renders explicit "none"/"unknown", never a blank.
+4. Components import no `engine::`/`state::` domain type (the view_model/component boundary).
+5. No inline `<style>`/`style=`.
+6. All untrusted text (verdict prose, CVE/finding titles, model prompts, node keys) is escaped at render.
+7. No source file exceeds 1,000 lines.
+
+## 10. Product decisions (defaults taken — change freely)
+
+- Argo fan-out → collapse to `→ ×N secrets` with drill-in.
+- `Confirmed` (live-corroborated) gets a **live** sub-tag; `Exploitable` (model-only) a **judged** sub-tag.
+- Serving = server-rendered maud (not Grafana-over-OTLP).
+- **Theme = light** — a clean light surface with dark ink (not a dark console); see `docs/STYLEGUIDE.md`.

From 34f1e865652457953c1ed3296c0e0be037ce2ece Mon Sep 17 00:00:00 2001
From: Jeff Larson <thejefflarson@gmail.com>
Date: Sun, 28 Jun 2026 22:00:37 -0700
Subject: [PATCH 2/3] feat(dashboard): v3 foundation + Findings view (light,
 clean-room rebuild)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Build Phase 1 of the v3 operator dashboard from docs/dashboard-v3-design.md and
docs/STYLEGUIDE.md: the server-rendered presentation platform, the shared
components, the Findings view end-to-end, and the honesty-invariant guards.

Architecture (ADR-0019), engine/src/engine/dashboard/:
- view_model/ shapes state:: domain state into plain Props (the only layer that
  touches engine::/state::); posture/recency honesty mapping + the urgency sort
  live here in one tested place.
- components/ are pure maud Props->Markup renderers importing no domain type
  (guard-tested); status strip, finding row + expand-in-place "why" panel,
  evidence tables, findings view with honest empty/awaiting/blind states, nav.
- page.rs composes the persistent status strip + 4-tab nav shell + /fragment
  live region.
- mod.rs wires axum routes (/, /fragment, /assets/dashboard.css,
  /assets/dashboard.js) + DashboardState, and re-adds serve_dashboard, wired
  into run_loop behind PROTECTOR_DASHBOARD_ADDR (reads the same Arc state handles
  the engine holds; read-only, zero-egress). Every file < 1000 lines.

Assets generated from the STYLEGUIDE light tokens: web/dist/dashboard.css
(served same-origin via include_str!, no third-party CSS) and dashboard.js
(zero-dep <details> expansion persistence + /fragment polling preserving
scroll/expansion).

Findings view (brief §5): urgency sort (not severity); posture rail+chip with
Uncertain/Awaiting never green; entry/objective/Δ/evidence-cluster/disposition/
live-vs-judged; expand to verbatim verdict -> text hop-list with cut point ->
evidence tables -> cut + self-revert -> show-model-prompt; argo fan-out collapse;
honest empty/awaiting/blind states. Trust/Readiness/Activity stubbed as phase-2.

Guard tests (brief §9): honest-calm (#1), uncertain/awaiting-not-green (#2),
no-blank-evidence (#3), component-no-domain-imports (#4), no-inline-style (#5),
untrusted-text-escaped (#6) — render + source guards; file-size cap (#7) already
guarded.

Helm: dashboard ClusterIP service + container port + PROTECTOR_DASHBOARD_ADDR /
PROTECTOR_CLUSTER_LABEL env behind engine.dashboard.* values.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
---
 charts/protector/templates/deployment.yaml    |  14 +
 .../protector/templates/engine-services.yaml  |  21 +
 charts/protector/values.yaml                  |   9 +
 ...-dashboard-v3-presentation-architecture.md | 108 +++++
 docs/adr/README.md                            |   1 +
 .../engine/dashboard/components/evidence.rs   | 134 ++++++
 .../dashboard/components/finding_detail.rs    | 120 ++++++
 .../dashboard/components/finding_row.rs       | 138 +++++++
 .../dashboard/components/findings_view.rs     |  93 +++++
 engine/src/engine/dashboard/components/mod.rs |  18 +
 engine/src/engine/dashboard/components/nav.rs |  42 ++
 .../dashboard/components/status_strip.rs      | 138 +++++++
 engine/src/engine/dashboard/mod.rs            | 196 +++++++++
 engine/src/engine/dashboard/page.rs           |  67 +++
 engine/src/engine/dashboard/tests.rs          | 237 +++++++++++
 .../engine/dashboard/view_model/findings.rs   | 247 ++++++++++++
 .../dashboard/view_model/findings/tests.rs    | 176 ++++++++
 engine/src/engine/dashboard/view_model/mod.rs |  64 +++
 .../engine/dashboard/view_model/posture.rs    | 116 ++++++
 .../src/engine/dashboard/view_model/props.rs  | 349 ++++++++++++++++
 .../src/engine/dashboard/view_model/strip.rs  | 142 +++++++
 engine/src/engine/mod.rs                      |   4 +
 engine/src/engine/run_loop.rs                 |  28 +-
 engine/src/engine/state/mod.rs                |   5 +-
 engine/tests/dashboard_guards.rs              | 169 ++++++++
 engine/web/dist/dashboard.css                 | 381 ++++++++++++++++++
 engine/web/dist/dashboard.js                  | 117 ++++++
 27 files changed, 3132 insertions(+), 2 deletions(-)
 create mode 100644 docs/adr/0019-dashboard-v3-presentation-architecture.md
 create mode 100644 engine/src/engine/dashboard/components/evidence.rs
 create mode 100644 engine/src/engine/dashboard/components/finding_detail.rs
 create mode 100644 engine/src/engine/dashboard/components/finding_row.rs
 create mode 100644 engine/src/engine/dashboard/components/findings_view.rs
 create mode 100644 engine/src/engine/dashboard/components/mod.rs
 create mode 100644 engine/src/engine/dashboard/components/nav.rs
 create mode 100644 engine/src/engine/dashboard/components/status_strip.rs
 create mode 100644 engine/src/engine/dashboard/mod.rs
 create mode 100644 engine/src/engine/dashboard/page.rs
 create mode 100644 engine/src/engine/dashboard/tests.rs
 create mode 100644 engine/src/engine/dashboard/view_model/findings.rs
 create mode 100644 engine/src/engine/dashboard/view_model/findings/tests.rs
 create mode 100644 engine/src/engine/dashboard/view_model/mod.rs
 create mode 100644 engine/src/engine/dashboard/view_model/posture.rs
 create mode 100644 engine/src/engine/dashboard/view_model/props.rs
 create mode 100644 engine/src/engine/dashboard/view_model/strip.rs
 create mode 100644 engine/tests/dashboard_guards.rs
 create mode 100644 engine/web/dist/dashboard.css
 create mode 100644 engine/web/dist/dashboard.js

diff --git a/charts/protector/templates/deployment.yaml b/charts/protector/templates/deployment.yaml
index 9aac79c..0fe3bfc 100644
--- a/charts/protector/templates/deployment.yaml
+++ b/charts/protector/templates/deployment.yaml
@@ -183,6 +183,11 @@ spec:
               containerPort: {{ .Values.engine.falco.port }}
               protocol: TCP
             {{- end }}
+            {{- if and .Values.engine.enabled .Values.engine.dashboard.enabled }}
+            - name: dashboard
+              containerPort: {{ .Values.engine.dashboard.port }}
+              protocol: TCP
+            {{- end }}
           {{- with .Values.livenessProbe }}
           livenessProbe:
             {{- toYaml . | nindent 12 }}
@@ -274,6 +279,15 @@ spec:
             - name: PROTECTOR_FALCO_ADDR
               value: "0.0.0.0:{{ .Values.engine.falco.port }}"
             {{- end }}
+            {{- if .Values.engine.dashboard.enabled }}
+            # The read-only operator dashboard (ADR-0019). Zero-egress, in-cluster only —
+            # reads the engine's output state and serves a server-rendered view. Reach it
+            # through the cluster's own ingress/mesh; it terminates no TLS of its own.
+            - name: PROTECTOR_DASHBOARD_ADDR
+              value: "0.0.0.0:{{ .Values.engine.dashboard.port }}"
+            - name: PROTECTOR_CLUSTER_LABEL
+              value: {{ .Values.engine.dashboard.clusterLabel | quote }}
+            {{- end }}
             {{- if $feeds }}
             # KEV catalogue file the feed-fetcher sidecar writes into the shared emptyDir
             # (JEF-238). FULL CISA KEV JSON — KevCatalog parses the canonical
diff --git a/charts/protector/templates/engine-services.yaml b/charts/protector/templates/engine-services.yaml
index 7819d59..71ebe2a 100644
--- a/charts/protector/templates/engine-services.yaml
+++ b/charts/protector/templates/engine-services.yaml
@@ -18,3 +18,24 @@ spec:
       targetPort: falco-ingest
       protocol: TCP
 {{- end }}
+{{- if and .Values.engine.enabled .Values.engine.dashboard.enabled }}
+---
+# The read-only operator dashboard (ADR-0019). ClusterIP only — a server-rendered,
+# zero-egress view of the engine's output state. It terminates no TLS of its own; reach it
+# through the cluster's own ingress/mesh (a NetworkPolicy / mesh authorization is the floor).
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "protector.fullname" . }}-dashboard
+  labels:
+    {{- include "protector.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  selector:
+    {{- include "protector.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: dashboard
+      port: {{ .Values.engine.dashboard.port }}
+      targetPort: dashboard
+      protocol: TCP
+{{- end }}
diff --git a/charts/protector/values.yaml b/charts/protector/values.yaml
index 5351677..fa2a95c 100644
--- a/charts/protector/values.yaml
+++ b/charts/protector/values.yaml
@@ -283,6 +283,15 @@ engine:
   falco:
     enabled: true
     port: 9999
+  # Read-only operator dashboard (ADR-0019). A server-rendered, zero-egress view of the
+  # engine's output state (findings, verdicts, coverage). It reads only state the engine
+  # already holds and NEVER mutates it, so it is strictly observational. It terminates no
+  # TLS of its own — expose it through the cluster's ingress/mesh. ClusterIP service below.
+  dashboard:
+    enabled: true
+    port: 8080
+    # The cluster label shown in the dashboard's status strip.
+    clusterLabel: cluster
   # Two exploitation-intel feeds drive the engine's exploit intel + model reasoning
   # (ADR-0015): the CISA KEV catalogue (actively-exploited CVEs, known NOW) and the FIRST.org
   # EPSS scores (the PREDICTIVE per-CVE exploitation probability — JEF-243). The engine NEVER
diff --git a/docs/adr/0019-dashboard-v3-presentation-architecture.md b/docs/adr/0019-dashboard-v3-presentation-architecture.md
new file mode 100644
index 0000000..3c00fa2
--- /dev/null
+++ b/docs/adr/0019-dashboard-v3-presentation-architecture.md
@@ -0,0 +1,108 @@
+# ADR-0019 — Dashboard v3: the presentation architecture (view_model / component / page split, honesty invariants, light theme)
+
+**Status:** Accepted
+
+## Context
+
+The engine is autonomous and **shadow-by-default**: it proposes, it never acts until armed
+(ADR-0016 — presentation is a view, never a gate). The operator is a solo (or very small team)
+platform/security engineer who checks in periodically. They have three real jobs: **trust
+calibration** (is the engine's judgement sound enough to arm a class?), **triage** (which judged
+breaches are real?), and **coverage** (is the engine actually equipped to decide right now?).
+
+Two prior dashboards failed for the same root reason — the *information architecture* was wrong,
+and editing an IA doesn't fix it. The specific failures this design exists to prevent:
+
+1. **Burying "why."** The model's verdict is the product; it must be one glance + one click
+   away, never a separate destination.
+2. **Calm-when-blind.** A quiet green screen while the model is down or warming reads as "safe"
+   when it actually means "we haven't looked." This is the cardinal sin.
+
+The agreed v3 design (`docs/dashboard-v3-design.md`) is the synthesis of nine independent
+clean-room design passes that converged on the same shape — strong evidence the IA is dictated
+by the engine's data model (`engine/src/engine/state/`), not copied from a prior UI. The visual
+system (`docs/STYLEGUIDE.md`) is a **light-theme** token system. This ADR records the
+architectural decisions that realize them.
+
+## Decision
+
+### 1. Server-rendered, zero-egress, light theme
+
+The dashboard is server-rendered with **maud**, served same-origin from the engine process.
+The security graph and evidence never leave the cluster (the zero-egress invariant): the CSS and
+JS are bundled via `include_str!` (no third-party CDN), and the only client-side network call is
+a poll to the same-origin `/fragment`. The theme is **light** — a clean, high-contrast light
+surface with dark ink; calm by default, loud only on a real breach. It terminates no TLS of its
+own (it is reached through the cluster's ingress/mesh) and is **read-only**: it snapshots the
+engine's output state and never mutates it, so a bad render can never affect the engine.
+
+### 2. The React-like split (view_model → components → page → routes)
+
+The module `engine/src/engine/dashboard/` follows the repo's canonical UI pattern:
+
+- **`view_model/`** shapes `engine::`/`state::` domain state into plain `Props` (owned strings,
+  numbers, small presentation enums). It is the **only** layer that touches domain types.
+- **`components/`** are pure `maud` renderers (`Props -> Markup`). A component imports **only**
+  `maud` and `view_model::props` — never a domain type. This boundary is guard-tested.
+- **`page.rs`** composes components into full pages and the `/fragment` live region, and owns
+  the persistent status strip + the 4-tab nav shell.
+- **`mod.rs`** wires the axum routes (`/`, `/fragment`, `/assets/dashboard.css`,
+  `/assets/dashboard.js`), holds `DashboardState` (the shared read-only `Arc` handles), and
+  serves it (`serve_dashboard`) behind `PROTECTOR_DASHBOARD_ADDR`, wired from the watch loop.
+
+The split keeps the honesty rules in one tested place (the view_model mapping), lets the
+presentation be compiled and tested without the engine, and prevents the monolith regrowth that
+sank the prior dashboards. Every file stays under the 1,000-line cap (CLAUDE.md).
+
+### 3. The information architecture
+
+A **primary view + secondary views, with one persistent status strip** — not a single page (one
+page recreates the unreadable monolith), and not flat peers (the Findings question dominates):
+
+| Surface | Question | Priority |
+|---|---|---|
+| **Status strip** (persistent, every view) | Is "quiet" really "blind"? + freshness | always-on |
+| **Findings** (primary / landing) | Is anything a breach, and can I trust the call? | P0 — built |
+| **Trust** (would-have-acted) | If I armed it, what would it have done? | P1 — phase 2 |
+| **Readiness** (coverage detail) | Is the engine equipped to decide? | P1 — phase 2 |
+| **Activity** (audit) | What did it actually do, and did it undo it? | P2 — phase 2 |
+
+Findings drill **in place** (row → `<details>` detail panel), keyed by URL fragment; the live
+poll preserves scroll/expansion. The **default sort is urgency, not severity** (ADR-0016):
+corroborated-live → model-promoted → escalations → awaiting → cleared (collapsed tail). A
+critical CVE on an unreachable workload is low-urgency; CVE severity is evidence in the drawer,
+never the headline sort.
+
+### 4. The honesty model — three orthogonal axes
+
+The status strip carries three axes that must **never collapse into one signal**:
+**breach vs safe** (the verdict), **decided vs awaiting** (has the model judged this?), and
+**covered vs blind** (is the model up and are the feeds loaded?). **Green/calm is honest only
+while `model_judging == true`.** When the model is warming or not answering, exposed paths are
+*unjudged, not cleared*, and the UI says so in the matching non-green register. `Uncertain` and
+`Awaiting` are never green.
+
+## Invariants (test-enforced)
+
+1. `!model_judging` or `warming_up` ⇒ the status strip never renders the green/all-clear path;
+   the honest banner renders instead. (Render tests.)
+2. `Verdict::Uncertain` and awaiting (`None`) never map to the cleared/green token. (View_model
+   + render tests.)
+3. Empty evidence/coverage renders an explicit "none"/"unknown", never a blank.
+4. Components import no `engine::`/`state::` domain type (the view_model/component boundary).
+   (Source guard.)
+5. No inline `<style>`/`style=` — every visual is a class mapped to a STYLEGUIDE token. (Source
+   guard.)
+6. All untrusted free-text (verdict prose, CVE/finding titles, model prompts, node keys) is
+   HTML-escaped at render (maud auto-escape). (Render test.)
+7. No source file exceeds 1,000 lines. (`file_size_guard`.)
+
+## Consequences
+
+- The presentation can be unit-tested at the props boundary and the render boundary with no
+  engine and no HTTP — fast, deterministic honesty guards.
+- New UI work composes small components against props; it cannot regrow a monolith or smuggle a
+  domain type into the render layer (the guards fail the build).
+- Phase 1 ships the platform + shared components + the **Findings** view end-to-end; the Trust /
+  Readiness / Activity tabs are labelled phase-2 placeholders so the nav exists and is honest
+  about what is coming. The data for all four already lives in `state::`.
diff --git a/docs/adr/README.md b/docs/adr/README.md
index a4b89bc..829143f 100644
--- a/docs/adr/README.md
+++ b/docs/adr/README.md
@@ -26,5 +26,6 @@ Copy [`0000-template.md`](0000-template.md) to start one.
 | [0016](0016-severity-vs-urgency.md) | The breach model: prove chains, enrich them, the model decides and isolates until clear | Accepted (amended by 0017) |
 | [0017](0017-isolation-persists-on-the-breach-condition.md) | Isolation persists on the breach condition: chain ∧ enrichment fingerprint (revert keys on `entry_fingerprint`) | Accepted |
 | [0018](0018-operator-configured-redacted-breach-notifier.md) | The breach notifier is the one sanctioned outbound path: operator-configured, off by default, redacted by default | Accepted |
+| [0019](0019-dashboard-v3-presentation-architecture.md) | Dashboard v3: server-rendered (maud), zero-egress, light-theme presentation — the view_model/component/page split + the honesty invariants | Accepted |
 
 See also [`../VISION.md`](../VISION.md) for the longer-form narrative this ADR realizes.
diff --git a/engine/src/engine/dashboard/components/evidence.rs b/engine/src/engine/dashboard/components/evidence.rs
new file mode 100644
index 0000000..0077ab5
--- /dev/null
+++ b/engine/src/engine/dashboard/components/evidence.rs
@@ -0,0 +1,134 @@
+//! The evidence tables for a finding's detail panel (brief §5): the CVE table
+//! (id/sev/CVSS/KEV/EPSS/reachability/fix), the runtime split (corroborating vs context),
+//! the exposed-secrets / misconfig / RBAC tables. Severity is the COOLER, subordinate channel
+//! (style guide principle 2) — never as loud as posture. Empty blocks render an explicit "none"
+//! (invariant #3). Pure component; no domain types; all free-text auto-escaped.
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::{
+    BehaviorProps, CveProps, EvidenceProps, ScanProps,
+};
+
+/// Render all evidence tables for a finding. The whole-empty case is the honest "no evidence",
+/// never a blank.
+pub(super) fn evidence_tables(ev: &EvidenceProps) -> Markup {
+    html! {
+        section.detail-section.evidence-block {
+            h3.detail-h { "evidence" }
+            @if ev.is_empty() {
+                p.evidence-none { "no evidence on this entry \u{2014} no CVEs, runtime signals, or scanner findings" }
+            } @else {
+                (cve_table(&ev.cves))
+                (runtime_block(&ev.corroborating, &ev.context))
+                (scan_table("exposed secrets", "exposed-secrets", &ev.exposed_secrets))
+                (scan_table("misconfigurations", "misconfigs", &ev.misconfigs))
+                (scan_table("RBAC findings", "rbac", &ev.rbac_findings))
+            }
+        }
+    }
+}
+
+/// The CVE table — the subordinate severity channel, numerics right-aligned.
+fn cve_table(cves: &[CveProps]) -> Markup {
+    if cves.is_empty() {
+        return html! {};
+    }
+    html! {
+        div.ev-group {
+            h4.detail-h { "CVEs" }
+            table.ev-table {
+                thead {
+                    tr {
+                        th { "id" } th { "sev" } th.num { "cvss" } th { "kev" }
+                        th.num { "epss" } th { "reachability" } th { "fix" }
+                    }
+                }
+                tbody {
+                    @for c in cves {
+                        tr {
+                            td.mono { (c.id) }
+                            td { span class={ "sev sev-" (c.severity) } { (c.severity) } }
+                            td.num { (c.score.as_deref().unwrap_or("\u{2014}")) }
+                            td {
+                                @if c.kev { span.ev.ev-kev { "KEV" } } @else { span.muted { "\u{2014}" } }
+                            }
+                            td.num { (c.epss.as_deref().unwrap_or("\u{2014}")) }
+                            td.mono { (c.reachability) }
+                            td { (c.fix) }
+                        }
+                        @if let Some(title) = &c.title {
+                            tr.ev-subrow { td colspan="7" { span.muted { (title) } } }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// The runtime block: corroborating (alert) behaviors first, then context behaviors. Each is
+/// labelled so a corroboration is distinguished from mere context (ADR-0016).
+fn runtime_block(corroborating: &[BehaviorProps], context: &[BehaviorProps]) -> Markup {
+    if corroborating.is_empty() && context.is_empty() {
+        return html! {};
+    }
+    html! {
+        div.ev-group {
+            h4.detail-h { "runtime" }
+            @if !corroborating.is_empty() {
+                p.ev-sublabel { "corroborating (live)" }
+                ul.behavior-list {
+                    @for b in corroborating { (behavior_item(b)) }
+                }
+            }
+            @if !context.is_empty() {
+                p.ev-sublabel.muted { "context" }
+                ul.behavior-list {
+                    @for b in context { (behavior_item(b)) }
+                }
+            }
+        }
+    }
+}
+
+/// One runtime behavior line. The variant token + the (untrusted) summary.
+fn behavior_item(b: &BehaviorProps) -> Markup {
+    let cls = if b.corroborating {
+        "behavior behavior-alert"
+    } else {
+        "behavior"
+    };
+    html! {
+        li class=(cls) {
+            span class={ "behavior-variant var-" (b.variant) } { (b.variant) }
+            span.behavior-summary { (b.summary) }
+        }
+    }
+}
+
+/// A generic scanner-findings table (exposed secrets / misconfigs / RBAC). Empty groups render
+/// nothing here (the whole-empty case is handled by the parent's "no evidence").
+fn scan_table(title: &str, css: &str, findings: &[ScanProps]) -> Markup {
+    if findings.is_empty() {
+        return html! {};
+    }
+    html! {
+        div class={ "ev-group ev-" (css) } {
+            h4.detail-h { (title) }
+            table.ev-table {
+                thead { tr { th { "id" } th { "sev" } th { "category" } th { "detail" } } }
+                tbody {
+                    @for s in findings {
+                        tr {
+                            td.mono { (s.id) }
+                            td { span class={ "sev sev-" (s.severity) } { (s.severity) } }
+                            td { (s.category.as_deref().unwrap_or("\u{2014}")) }
+                            td { (s.title.as_deref().unwrap_or("\u{2014}")) }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/engine/src/engine/dashboard/components/finding_detail.rs b/engine/src/engine/dashboard/components/finding_detail.rs
new file mode 100644
index 0000000..a384fea
--- /dev/null
+++ b/engine/src/engine/dashboard/components/finding_detail.rs
@@ -0,0 +1,120 @@
+//! The expand-in-place "why" panel for a finding (brief §5): the verbatim verdict → the proven
+//! path as a text hop-list (structural hops muted, the cut point marked) → the evidence tables
+//! → the proposed/applied cut + its self-revert condition → the "show model prompt" disclosure
+//! to the raw judgement. Pure component; no domain types; all free-text auto-escaped.
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::{FindingProps, HopProps, JudgementProps};
+
+use super::evidence::evidence_tables;
+
+/// Render the full detail panel for a finding.
+pub(super) fn detail_panel(f: &FindingProps) -> Markup {
+    html! {
+        div class={ "detail rail-" (f.posture.token()) } {
+            (verdict_block(f))
+            (path_block(&f.path))
+            (evidence_tables(&f.evidence))
+            (cut_block(f))
+            (model_prompt(&f.judgement))
+        }
+    }
+}
+
+/// The verbatim model verdict — the model's own words first (brief: "why" is one click away).
+fn verdict_block(f: &FindingProps) -> Markup {
+    html! {
+        section.detail-section.verdict-block {
+            h3.detail-h { "verdict" }
+            @match &f.verdict_summary {
+                Some(v) => p.verdict-prose { (v) }
+                None => p.verdict-prose.muted { "awaiting judgement \u{2014} the model has not judged this entry yet" }
+            }
+        }
+    }
+}
+
+/// The proven path as a text hop-list: `entry ─relation→ … → objective`. Structural hops are
+/// muted; the cut point is marked.
+fn path_block(path: &[HopProps]) -> Markup {
+    html! {
+        section.detail-section.path-block {
+            h3.detail-h { "proven path" }
+            @if path.is_empty() {
+                p.muted { "no path recorded" }
+            } @else {
+                ol.hop-list {
+                    @for hop in path {
+                        (hop_item(hop))
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// One hop in the list. A structural (substrate) hop is muted; the cut hop carries the scissors.
+fn hop_item(hop: &HopProps) -> Markup {
+    let cls = if hop.structural {
+        "hop hop-structural"
+    } else {
+        "hop"
+    };
+    html! {
+        li class=(cls) {
+            span.hop-from { (hop.from) }
+            span.hop-rel { " \u{2500}[" (hop.relation) "]\u{2192} " }
+            span.hop-to { (hop.to) }
+            @if hop.is_cut {
+                span.hop-cut title="minimal cut severs here" { " \u{2702} cut" }
+            }
+        }
+    }
+}
+
+/// The proposed/applied cut + its self-revert condition (the safety story). When there is no
+/// single-edge cut, that is stated honestly rather than left blank.
+fn cut_block(f: &FindingProps) -> Markup {
+    html! {
+        section.detail-section.cut-block {
+            h3.detail-h { "proposed cut" }
+            @match &f.cut {
+                Some(cut) => {
+                    p.cut-sig { code { (cut) } }
+                    p.cut-revert.muted {
+                        "self-reverts when the breach condition clears \u{2014} the cut persists "
+                        "only while the chain \u{2227} its enrichment fingerprint hold (ADR-0017)."
+                    }
+                }
+                None => p.muted { "no single-edge cut \u{2014} this chain is not severable by one network edge" }
+            }
+        }
+    }
+}
+
+/// The "show model prompt" disclosure to the raw judgement (prompt + reply). Nested
+/// `<details>` so it is collapsed by default; honest about an absent prompt/reply.
+fn model_prompt(j: &JudgementProps) -> Markup {
+    html! {
+        details.model-prompt {
+            summary.why-toggle role="button" aria-expanded="false" { "show model prompt" }
+            div.prompt-body {
+                @match &j.verdict {
+                    Some(v) => p.prompt-verdict { "final verdict: " span.mono { (v) } }
+                    None => p.muted { "no verdict recorded for this entry" }
+                }
+                h4.detail-h { "prompt" }
+                @match &j.prompt {
+                    Some(p) => pre.prompt-text { (p) }
+                    None => p.muted { "no prompt \u{2014} the deterministic pre-filter decided without asking the model" }
+                }
+                h4.detail-h { "reply" }
+                @match &j.reply {
+                    Some(r) => pre.prompt-text { (r) }
+                    None => p.muted { "no reply \u{2014} the model was unavailable (timed out)" }
+                }
+            }
+        }
+    }
+}
diff --git a/engine/src/engine/dashboard/components/finding_row.rs b/engine/src/engine/dashboard/components/finding_row.rs
new file mode 100644
index 0000000..025e241
--- /dev/null
+++ b/engine/src/engine/dashboard/components/finding_row.rs
@@ -0,0 +1,138 @@
+//! One Findings-table row: the posture rail+chip, entry→objective, Δ, evidence cluster,
+//! disposition, and the live/judged sub-tag — with the expand-in-place `<details>` "why" panel
+//! (brief §5). Pure component; no domain types. The row is a real `<tr>` and the expander is a
+//! `<button>` with `aria-expanded` (style guide accessibility gate §6).
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::{
+    DeltaProps, EvidenceSummary, FindingProps, LiveTag, Posture,
+};
+
+use super::finding_detail::detail_panel;
+
+/// Render one finding as a `<tr>` (the summary cells) followed by a full-width `<tr>` carrying
+/// the expand-in-place detail panel inside a `<details>` (so list context is kept on expand).
+pub(super) fn finding_row(f: &FindingProps) -> Markup {
+    html! {
+        tr.row id=(f.id) data-posture=(f.posture.token()) {
+            td.cell.cell-delta { (delta_cell(&f.delta)) }
+            td.cell.cell-posture { (posture_cell(f.posture, f.live_tag)) }
+            td.cell.cell-entry { (entry_objective(f)) }
+            td.cell.cell-path { (path_summary(f)) }
+            td.cell.cell-evidence { (evidence_cluster(&f.evidence_summary)) }
+            td.cell.cell-disposition { span.disp { (f.disposition) } }
+            td.cell.cell-live { (live_tag(f.live_tag)) }
+        }
+        tr.row-detail {
+            td.detail-host colspan="7" {
+                details.why data-finding=(f.id) {
+                    summary.why-toggle role="button" aria-expanded="false" {
+                        span.why-open { "why \u{2014} verdict, path, evidence" }
+                    }
+                    (detail_panel(f))
+                }
+            }
+        }
+    }
+}
+
+/// The Δ cell — an alarm glyph for a change, or the muted age for a steady entry (never an
+/// alarm for steady state).
+fn delta_cell(d: &DeltaProps) -> Markup {
+    match d.token() {
+        Some(token) => html! {
+            span class={ "delta delta-" (token) } title=(d.label()) {
+                span.glyph { (d.glyph()) }
+            }
+        },
+        None => {
+            // Steady: show the age, muted — not an alarm.
+            let age = match d {
+                DeltaProps::Unchanged { age: Some(a) } => a.clone(),
+                _ => "\u{2014}".to_string(),
+            };
+            html! { span.delta.delta-steady title=(d.label()) { (age) } }
+        }
+    }
+}
+
+/// The posture cell: a coloured rail + chip carrying colour + glyph + word. Uncertain &
+/// awaiting are texturally distinct (dashed/dotted rails) and never green.
+fn posture_cell(p: Posture, _tag: LiveTag) -> Markup {
+    html! {
+        span class={ "posture rail-" (p.token()) } {
+            span class={ "posture-chip chip-" (p.token()) } {
+                span.glyph { (p.glyph()) }
+                span.posture-word { (p.word()) }
+            }
+        }
+    }
+}
+
+/// Entry → objective, with the entry node-kind glyph (🌐 for an internet foothold) and the
+/// fan-out collapse (`→ ×N`) when the entry reaches many objectives.
+fn entry_objective(f: &FindingProps) -> Markup {
+    html! {
+        span.eo {
+            span.entry {
+                span.kind-glyph { (f.entry_glyph) }
+                span.entry-label { (f.entry) }
+            }
+            span.arrow { " \u{2192} " }
+            @match f.fanout {
+                Some(n) => span.objective.fanout { "\u{00D7}" (n) " reachable" }
+                None => span.objective { (f.objective) }
+            }
+        }
+    }
+}
+
+/// A one-line path summary for the row (the full hop-list lives in the detail panel): the
+/// entry, an arrow, and the objective, with the cut marker if a cut exists.
+fn path_summary(f: &FindingProps) -> Markup {
+    html! {
+        span.path-summary {
+            (f.entry)
+            span.hop-arrow { " \u{2500}\u{2192} " }
+            @if f.cut.is_some() {
+                span.cut-mark title="severable here" { "\u{2702}" }
+                " "
+            }
+            (f.objective)
+        }
+    }
+}
+
+/// The compact evidence cluster glyphs (CVE count + KEV + runtime alerts + secrets). Empty
+/// evidence renders an explicit "no evidence" — never a blank (invariant #3).
+fn evidence_cluster(s: &EvidenceSummary) -> Markup {
+    if s.is_empty() {
+        return html! { span.evidence-none { "no evidence" } };
+    }
+    html! {
+        span.evidence-cluster {
+            @if s.kev {
+                span.ev.ev-kev { "KEV" }
+            }
+            @if s.cve_count > 0 {
+                span.ev.ev-cve { (s.cve_count) " CVE" @if s.cve_count != 1 { "s" } }
+            }
+            @if s.runtime_alerts > 0 {
+                span.ev.ev-runtime { span.glyph { "\u{26A1}" } (s.runtime_alerts) }
+            }
+            @if s.exposed_secrets > 0 {
+                span.ev.ev-secret { span.glyph { "\u{1F511}" } (s.exposed_secrets) }
+            }
+        }
+    }
+}
+
+/// The live/judged sub-tag, or an em-dash when neither applies.
+fn live_tag(tag: LiveTag) -> Markup {
+    match tag {
+        LiveTag::Live => html! { span.subtag.subtag-live { "live" } },
+        LiveTag::Judged => html! { span.subtag.subtag-judged { "judged" } },
+        LiveTag::None => html! { span.subtag.subtag-none { "\u{2014}" } },
+    }
+}
diff --git a/engine/src/engine/dashboard/components/findings_view.rs b/engine/src/engine/dashboard/components/findings_view.rs
new file mode 100644
index 0000000..7193d35
--- /dev/null
+++ b/engine/src/engine/dashboard/components/findings_view.rs
@@ -0,0 +1,93 @@
+//! The Findings view body (brief §5): the findings table sorted by urgency, with honest
+//! empty / awaiting / blind states. The "all clear" state is rendered ONLY when the model is
+//! actively judging (invariant #1) — otherwise an empty list reads as "blind", not "safe".
+//! Pure component; no domain types.
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::FindingsViewProps;
+
+use super::finding_row::finding_row;
+
+/// Render the Findings view (the table + states). The status strip is composed by `page.rs`;
+/// this is the view body under the nav.
+pub fn findings_view(v: &FindingsViewProps) -> Markup {
+    html! {
+        main.view.view-findings {
+            @if v.findings.is_empty() {
+                (empty_state(v))
+            } @else {
+                (findings_table(v))
+            }
+        }
+    }
+}
+
+/// The findings table. A real `<table>` for keyboard/semantics (accessibility gate §6).
+fn findings_table(v: &FindingsViewProps) -> Markup {
+    html! {
+        table.findings {
+            thead {
+                tr {
+                    th.col-delta scope="col" { "\u{0394}" }
+                    th.col-posture scope="col" { "POSTURE" }
+                    th.col-entry scope="col" { "ENTRY \u{2192} OBJECTIVE" }
+                    th.col-path scope="col" { "PATH" }
+                    th.col-evidence scope="col" { "EVIDENCE" }
+                    th.col-disposition scope="col" { "DISP" }
+                    th.col-live scope="col" { "LIVE?" }
+                }
+            }
+            tbody {
+                @for f in &v.findings {
+                    (finding_row(f))
+                }
+            }
+        }
+    }
+}
+
+/// The honest empty state. Crucially, "all clear" is shown ONLY when the model is actively
+/// judging; when blind/warming the empty list reads as "we haven't looked", never as safe
+/// (the cardinal sin the design exists to prevent — brief §0/§9 invariant #1).
+fn empty_state(v: &FindingsViewProps) -> Markup {
+    if v.strip.calm_is_honest() {
+        return html! {
+            div.empty.empty-clear {
+                p.empty-head { "all clear" }
+                p.empty-sub.muted {
+                    "no breach-relevant exposed paths \u{2014} the model is judging and found nothing exploitable."
+                }
+            }
+        };
+    }
+    // Not honestly calm: an empty list is NOT a clearance. Say so, in the matching non-green
+    // amber/slate register.
+    let (cls, head, sub) = if v.strip.warming_up {
+        (
+            "empty empty-warming",
+            "warming up",
+            "no pass has completed yet \u{2014} verdicts are still loading (slow on a CPU model). \
+             This is not an all-clear.",
+        )
+    } else if !v.strip.model_attached {
+        (
+            "empty empty-blind",
+            "no model configured",
+            "nothing is judged exploitable without a model \u{2014} exposed paths are unjudged, not cleared.",
+        )
+    } else {
+        (
+            "empty empty-blind",
+            "model not answering",
+            "the model timed out or is down \u{2014} exposed paths are unjudged, not cleared. \
+             This is not an all-clear.",
+        )
+    };
+    html! {
+        div class=(cls) {
+            p.empty-head { (head) }
+            p.empty-sub.muted { (sub) }
+        }
+    }
+}
diff --git a/engine/src/engine/dashboard/components/mod.rs b/engine/src/engine/dashboard/components/mod.rs
new file mode 100644
index 0000000..3b3cc4a
--- /dev/null
+++ b/engine/src/engine/dashboard/components/mod.rs
@@ -0,0 +1,18 @@
+//! The **components** layer (ADR-0019): pure `Props -> Markup` renderers. A component imports
+//! ONLY `maud` and the `view_model::props` types — NEVER an `engine::`/`state::` domain type
+//! (invariant #4, guard-tested). It is the presentation half of the React-like split: given
+//! its props, it renders, escaping all untrusted text via maud's auto-escape (invariant #6).
+//!
+//! No component emits an inline `<style>`/`style=` attribute (invariant #5) — every visual is
+//! driven by a class mapped to a token in `docs/STYLEGUIDE.md` (served as `dashboard.css`).
+
+mod evidence;
+mod finding_detail;
+mod finding_row;
+mod findings_view;
+mod nav;
+mod status_strip;
+
+pub use findings_view::findings_view;
+pub use nav::{nav_bar, stub_view};
+pub use status_strip::status_strip;
diff --git a/engine/src/engine/dashboard/components/nav.rs b/engine/src/engine/dashboard/components/nav.rs
new file mode 100644
index 0000000..73f2bb2
--- /dev/null
+++ b/engine/src/engine/dashboard/components/nav.rs
@@ -0,0 +1,42 @@
+//! The 4-tab nav shell (brief §4) and the phase-2 stub view. The nav exists so all four
+//! surfaces are reachable; only Findings is built in phase 1. Pure component; no domain types.
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::Tab;
+
+/// The four top-level tabs, in priority order (default Findings).
+const TABS: [Tab; 4] = [Tab::Findings, Tab::Trust, Tab::Readiness, Tab::Activity];
+
+/// Render the tab nav bar, marking the active tab.
+pub fn nav_bar(active: Tab) -> Markup {
+    html! {
+        nav.tabs aria-label="dashboard sections" {
+            @for tab in TABS {
+                @let is_active = tab == active;
+                a.tab href=(tab.path())
+                   aria-current=[is_active.then_some("page")]
+                   class=(if is_active { "tab tab-active" } else { "tab" }) {
+                    (tab.label())
+                    @if matches!(tab, Tab::Trust | Tab::Readiness | Tab::Activity) {
+                        span.tab-phase { "phase 2" }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// A labelled phase-2 placeholder for the secondary tabs. Honest about what it will hold, so
+/// the nav is real rather than a dead link.
+pub fn stub_view(tab: Tab, blurb: &str) -> Markup {
+    html! {
+        main class={ "view view-stub view-" (tab.label()) } {
+            div.stub {
+                p.stub-head { (tab.label()) }
+                span.stub-badge { "phase 2" }
+                p.stub-sub.muted { (blurb) }
+            }
+        }
+    }
+}
diff --git a/engine/src/engine/dashboard/components/status_strip.rs b/engine/src/engine/dashboard/components/status_strip.rs
new file mode 100644
index 0000000..a6c95fb
--- /dev/null
+++ b/engine/src/engine/dashboard/components/status_strip.rs
@@ -0,0 +1,138 @@
+//! The persistent status strip (brief §3/§4): the three honesty axes — decided / judging /
+//! covered — carried on EVERY view. Its load-bearing rule (invariant #1): when the model is not
+//! judging or is warming up, it renders the honest "blind/warming" banner and NEVER a green
+//! all-clear. Pure component: props in, markup out, no domain types.
+
+use maud::{Markup, html};
+
+use crate::engine::dashboard::view_model::props::{CoverageChip, StatusStripProps};
+
+/// Render the status strip from its props.
+pub fn status_strip(s: &StatusStripProps) -> Markup {
+    html! {
+        header.strip {
+            div.strip-top {
+                div.strip-cluster {
+                    span.brand { "protector" }
+                    span.sep { "\u{25B8}" }
+                    span.cluster { (s.cluster) }
+                }
+                (mode_pill(s.armed))
+            }
+            div.strip-axes {
+                (judging_axis(s))
+                (coverage_axes(&s.coverage))
+                @if let Some(age) = &s.last_pass {
+                    span.axis.freshness { "last pass " (age) }
+                } @else {
+                    span.axis.freshness.muted { "no pass yet" }
+                }
+            }
+            (headline(s))
+        }
+    }
+}
+
+/// The shadow/enforce mode pill — posture, not a gap (always shown so the operator SEES it).
+fn mode_pill(armed: bool) -> Markup {
+    let (cls, word, sub) = if armed {
+        ("pill mode-enforce", "ENFORCE", "acting")
+    } else {
+        ("pill mode-shadow", "SHADOW", "proposes, never acts")
+    };
+    html! {
+        span class=(cls) {
+            span.pill-word { (word) }
+            span.pill-sub { (sub) }
+        }
+    }
+}
+
+/// The decided/judging axis. This is where the honest-calm invariant lives: only a judging,
+/// warmed model shows the calm "model judging" reading; otherwise the honest banner.
+fn judging_axis(s: &StatusStripProps) -> Markup {
+    // The honest-calm invariant (#1): calm only when judging AND not warming.
+    if s.calm_is_honest() {
+        return html! {
+            span.axis.judging.ok {
+                span.dot {}
+                "model judging"
+            }
+        };
+    }
+    // Not honestly calm — render the distinct, NON-green honest banner. The wording tells the
+    // operator WHY quiet is not clearance.
+    let (cls, glyph, text) = if s.warming_up {
+        (
+            "axis judging warming",
+            "\u{25CC}",
+            "warming up \u{2014} exposed paths are unjudged, not cleared",
+        )
+    } else if !s.model_attached {
+        (
+            "axis judging blind",
+            "\u{25D0}",
+            "no model \u{2014} nothing is judged exploitable",
+        )
+    } else {
+        (
+            "axis judging blind",
+            "\u{25D0}",
+            "model not answering \u{2014} exposed paths are unjudged, not cleared",
+        )
+    };
+    html! {
+        span class=(cls) {
+            span.glyph { (glyph) }
+            (text)
+        }
+    }
+}
+
+/// The covered axis: one chip per enrichment feed, each carrying colour + glyph + word.
+fn coverage_axes(coverage: &[CoverageChip]) -> Markup {
+    html! {
+        span.axis.coverage {
+            @for chip in coverage {
+                (coverage_chip(chip))
+            }
+        }
+    }
+}
+
+/// One coverage chip. Present / degraded / absent are visually distinct AND carry a glyph + the
+/// feed word — never colour alone.
+fn coverage_chip(chip: &CoverageChip) -> Markup {
+    let (cls, glyph) = if chip.present {
+        ("cov cov-present", "\u{2713}") // ✓
+    } else if chip.degraded {
+        ("cov cov-degraded", "\u{25D0}") // ◐
+    } else {
+        ("cov cov-absent", "\u{2014}") // —
+    };
+    html! {
+        span class=(cls) {
+            span.cov-label { (chip.label) }
+            span.cov-glyph { (glyph) }
+        }
+    }
+}
+
+/// The findings headline line: breach / awaiting / cleared counts + the Δ escalation note. The
+/// breach count is the only loud chip; awaiting/cleared are calm. Counts are honest even at
+/// zero (never blank).
+fn headline(s: &StatusStripProps) -> Markup {
+    html! {
+        div.headline {
+            span.count.count-breach { (s.breach_count) " breach" }
+            span.count.count-awaiting { (s.awaiting_count) " awaiting" }
+            span.count.count-cleared { (s.cleared_count) " cleared" }
+            @if s.escalated_count > 0 {
+                span.count.count-escalated {
+                    span.glyph { "\u{25B2}" }
+                    (s.escalated_count) " escalated since last pass"
+                }
+            }
+        }
+    }
+}
diff --git a/engine/src/engine/dashboard/mod.rs b/engine/src/engine/dashboard/mod.rs
new file mode 100644
index 0000000..854d34d
--- /dev/null
+++ b/engine/src/engine/dashboard/mod.rs
@@ -0,0 +1,196 @@
+//! The server-rendered operator dashboard (ADR-0019): the presentation platform for the
+//! engine's read-only output state. Zero-egress, same-origin only — the security graph and
+//! evidence never leave the cluster. Presentation is a VIEW, never a decision gate (ADR-0016).
+//!
+//! The module follows the React-like split the repo conventions mandate:
+//! - [`view_model`] shapes `state::` domain state into plain `Props` (the only layer touching
+//!   `engine::`/`state::`);
+//! - [`components`] are pure `maud` renderers (`Props -> Markup`) importing no domain type;
+//! - [`page`] composes components into pages/fragments + the persistent status strip + the
+//!   4-tab nav shell;
+//! - this `mod.rs` wires the axum routes, holds [`DashboardState`], and serves it
+//!   ([`serve_dashboard`]) behind `PROTECTOR_DASHBOARD_ADDR`, reading the same `state::` handles
+//!   the engine holds.
+
+mod components;
+pub mod page;
+pub mod view_model;
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use axum::Router;
+use axum::extract::{Query, State};
+use axum::http::header;
+use axum::response::{Html, IntoResponse, Response};
+use axum::routing::get;
+
+use super::state::{
+    BakeStats, Findings, JudgementLog, ModelHealth, Readiness, ReadinessConfig, ReversionLog,
+    derive_readiness,
+};
+use view_model::props::{StatusStripProps, Tab};
+
+/// The light-theme stylesheet, generated from the `docs/STYLEGUIDE.md` tokens. Served
+/// same-origin via `include_str!` — no third-party CSS (the zero-egress / no-CDN rule).
+const DASHBOARD_CSS: &str = include_str!("../../../web/dist/dashboard.css");
+
+/// The zero-dependency client script: `<details>` expand persistence + `/fragment` polling
+/// that preserves scroll/expansion. Served same-origin.
+const DASHBOARD_JS: &str = include_str!("../../../web/dist/dashboard.js");
+
+/// The blurb shown on each phase-2 stub tab, so the nav is honest about what is coming.
+const TRUST_BLURB: &str = "Would-have-acted: the arm/don't-arm evidence \u{2014} would-cut (sustained-first, short-lived \
+     = likely FP, coverage-gap = scrutinise) vs left-alone (the trust half).";
+const READINESS_BLURB: &str = "Coverage detail: one row per decision input (model / KEV / EPSS / Falco / eBPF / journal / \
+     arm-state) with state, why it matters, and the env var to enable it.";
+const ACTIVITY_BLURB: &str = "Audit: the self-reverted cuts (the safety story) plus the judgement ring (prompt/reply per \
+     judgement, for debugging the model).";
+
+/// The shared, read-only state the dashboard renders from — the SAME `Arc` handles the engine
+/// writes each pass. The dashboard never mutates them; it only snapshots. Cheaply cloneable.
+#[derive(Clone)]
+pub struct DashboardState {
+    /// The proven-chain findings snapshot (verdicts resolved at read time) + the per-pass
+    /// freshness / bake / readiness-config / model-health the engine stamps.
+    pub findings: Arc<Findings>,
+    /// The bounded judgement ring (prompt + reply per judgement) for the verbatim "show model
+    /// prompt" disclosure.
+    pub judgements: Arc<JudgementLog>,
+    /// The self-reverted-cuts ring (the audit/safety story) — read by the phase-2 Activity tab.
+    #[allow(dead_code)]
+    pub reversions: Arc<ReversionLog>,
+    /// The cluster label shown in the strip.
+    pub cluster: String,
+}
+
+impl DashboardState {
+    /// Build the live readiness snapshot from the findings handle's config + per-pass health.
+    fn readiness(&self) -> Readiness {
+        let config: ReadinessConfig = self.findings.readiness_config();
+        let health: ModelHealth = self.findings.model_health();
+        let bake: BakeStats = self.findings.bake();
+        let last_pass: Option<SystemTime> = self.findings.last_pass();
+        derive_readiness(&config, health, &bake, last_pass)
+    }
+
+    /// Build the whole Findings view props from the live state.
+    fn findings_view(&self) -> view_model::props::FindingsViewProps {
+        let findings = self.findings.snapshot();
+        let judgements = self.judgements.snapshot();
+        let readiness = self.readiness();
+        view_model::build_findings_view(
+            self.cluster.clone(),
+            &findings,
+            &judgements,
+            &readiness,
+            self.findings.last_pass(),
+        )
+    }
+
+    /// Build the persistent status strip alone (for the phase-2 stub tabs).
+    fn status_strip(&self) -> StatusStripProps {
+        let readiness = self.readiness();
+        view_model::build_status_strip(self.cluster.clone(), &readiness, self.findings.last_pass())
+    }
+}
+
+/// The tab query parameter (`?tab=trust`). Defaults to Findings.
+#[derive(serde::Deserialize, Default)]
+struct TabQuery {
+    tab: Option<String>,
+}
+
+impl TabQuery {
+    fn resolve(&self) -> Tab {
+        match self.tab.as_deref() {
+            Some("trust") => Tab::Trust,
+            Some("readiness") => Tab::Readiness,
+            Some("activity") => Tab::Activity,
+            _ => Tab::Findings,
+        }
+    }
+}
+
+/// The blurb for a stub tab.
+fn stub_blurb(tab: Tab) -> &'static str {
+    match tab {
+        Tab::Trust => TRUST_BLURB,
+        Tab::Readiness => READINESS_BLURB,
+        Tab::Activity => ACTIVITY_BLURB,
+        Tab::Findings => "",
+    }
+}
+
+/// `GET /` — the full page for the requested tab (default Findings).
+async fn index(State(state): State<DashboardState>, Query(q): Query<TabQuery>) -> Html<String> {
+    let tab = q.resolve();
+    let markup = match tab {
+        Tab::Findings => page::findings_page(&state.findings_view()),
+        other => page::stub_page(&state.status_strip(), other, stub_blurb(other)),
+    };
+    Html(markup.into_string())
+}
+
+/// `GET /fragment` — only the live-region inner content, for the JS to swap in place
+/// (preserving scroll/expansion). Re-pulls readiness so a model that just went down flips the
+/// banner immediately (brief §7).
+async fn fragment(State(state): State<DashboardState>, Query(q): Query<TabQuery>) -> Html<String> {
+    let tab = q.resolve();
+    let markup = match tab {
+        Tab::Findings => page::findings_fragment(&state.findings_view()),
+        other => page::stub_fragment(&state.status_strip(), other, stub_blurb(other)),
+    };
+    Html(markup.into_string())
+}
+
+/// `GET /assets/dashboard.css` — the light-theme stylesheet, same-origin.
+async fn dashboard_css() -> Response {
+    (
+        [(header::CONTENT_TYPE, "text/css; charset=utf-8")],
+        DASHBOARD_CSS,
+    )
+        .into_response()
+}
+
+/// `GET /assets/dashboard.js` — the zero-dep client script, same-origin.
+async fn dashboard_js() -> Response {
+    (
+        [(header::CONTENT_TYPE, "text/javascript; charset=utf-8")],
+        DASHBOARD_JS,
+    )
+        .into_response()
+}
+
+/// Build the dashboard router with the read-only state.
+pub fn router(state: DashboardState) -> Router {
+    Router::new()
+        .route("/", get(index))
+        .route("/fragment", get(fragment))
+        .route("/assets/dashboard.css", get(dashboard_css))
+        .route("/assets/dashboard.js", get(dashboard_js))
+        .with_state(state)
+}
+
+/// Serve the dashboard over plain HTTP on `addr` until the process exits. The dashboard is an
+/// in-cluster, read-only view of state the engine already holds (zero-egress); it is meant to
+/// sit behind the cluster's own ingress/mesh, not face the internet directly, so it terminates
+/// no TLS of its own. A bind failure is logged and the task exits — the engine loop is
+/// unaffected (the dashboard is strictly observational).
+pub async fn serve_dashboard(addr: SocketAddr, state: DashboardState) {
+    let listener = match tokio::net::TcpListener::bind(addr).await {
+        Ok(l) => l,
+        Err(error) => {
+            tracing::error!(%error, %addr, "dashboard: failed to bind; dashboard disabled");
+            return;
+        }
+    };
+    tracing::info!(%addr, "dashboard listening (read-only, zero-egress)");
+    if let Err(error) = axum::serve(listener, router(state).into_make_service()).await {
+        tracing::error!(%error, "dashboard server stopped");
+    }
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/engine/src/engine/dashboard/page.rs b/engine/src/engine/dashboard/page.rs
new file mode 100644
index 0000000..432f68c
--- /dev/null
+++ b/engine/src/engine/dashboard/page.rs
@@ -0,0 +1,67 @@
+//! Page composition (ADR-0019): assemble the components into full pages and the `/fragment`
+//! live region. This is the only place that knows the document shell (head, asset links, the
+//! persistent status strip, the 4-tab nav) and how the live-poll fragment is framed. It imports
+//! the components (markup) and the props (data) — never the engine directly.
+
+use maud::{DOCTYPE, Markup, html};
+
+use super::components::{findings_view, nav_bar, status_strip, stub_view};
+use super::view_model::props::{FindingsViewProps, StatusStripProps, Tab};
+
+/// The live-region id the JS polls and swaps. The status strip + active view live inside it so
+/// a poll re-pulls readiness (a model that just went down flips the banner) and the findings.
+pub const LIVE_REGION_ID: &str = "live";
+
+/// The full Findings page: document shell + assets + the live region (strip + nav + findings).
+pub fn findings_page(v: &FindingsViewProps) -> Markup {
+    document(&v.strip, Tab::Findings, findings_view(v))
+}
+
+/// A full phase-2 stub page (Trust / Readiness / Activity): the persistent strip + nav + the
+/// labelled placeholder, so the nav is navigable in phase 1.
+pub fn stub_page(strip: &StatusStripProps, tab: Tab, blurb: &str) -> Markup {
+    document(strip, tab, stub_view(tab, blurb))
+}
+
+/// The `/fragment` body for the Findings tab — only the live region's INNER content, for the
+/// JS to swap in place (preserving scroll/expansion/filter). No document shell.
+pub fn findings_fragment(v: &FindingsViewProps) -> Markup {
+    live_region_inner(&v.strip, Tab::Findings, findings_view(v))
+}
+
+/// The `/fragment` body for a stub tab.
+pub fn stub_fragment(strip: &StatusStripProps, tab: Tab, blurb: &str) -> Markup {
+    live_region_inner(strip, tab, stub_view(tab, blurb))
+}
+
+/// The document shell: head with same-origin assets (no third-party CSS/JS), then the live
+/// region carrying the persistent strip + nav + the view body.
+fn document(strip: &StatusStripProps, tab: Tab, body: Markup) -> Markup {
+    html! {
+        (DOCTYPE)
+        html lang="en" {
+            head {
+                meta charset="utf-8";
+                meta name="viewport" content="width=device-width, initial-scale=1";
+                title { "protector \u{2014} " (strip.cluster) }
+                link rel="stylesheet" href="/assets/dashboard.css";
+            }
+            body {
+                div id=(LIVE_REGION_ID) data-tab=(tab.label()) {
+                    (live_region_inner(strip, tab, body))
+                }
+                script src="/assets/dashboard.js" defer {}
+            }
+        }
+    }
+}
+
+/// The inner content of the live region — what `/fragment` returns and the JS swaps. The strip
+/// and nav are inside it so a poll refreshes coverage/freshness too (brief §7).
+fn live_region_inner(strip: &StatusStripProps, tab: Tab, body: Markup) -> Markup {
+    html! {
+        (status_strip(strip))
+        (nav_bar(tab))
+        (body)
+    }
+}
diff --git a/engine/src/engine/dashboard/tests.rs b/engine/src/engine/dashboard/tests.rs
new file mode 100644
index 0000000..87b23e5
--- /dev/null
+++ b/engine/src/engine/dashboard/tests.rs
@@ -0,0 +1,237 @@
+//! Render-level tests for the dashboard: the honesty invariants asserted against the actual
+//! emitted HTML (brief §9), plus escaping and the honest empty/awaiting/blind states. These
+//! drive the view_model + components directly (no HTTP, no engine), so they are fast and pure.
+
+use std::time::SystemTime;
+
+use crate::engine::reason::adjudicate::Verdict;
+use crate::engine::state::{
+    BakeStats, EntryEvidence, Finding, Judgement, ModelHealth, PathStep, Readiness,
+    ReadinessConfig, derive_readiness,
+};
+
+use super::page;
+use super::view_model::{build_findings_view, build_status_strip};
+
+/// A readiness snapshot for a fully-covered, actively-judging model.
+fn judging_readiness() -> Readiness {
+    let config = ReadinessConfig {
+        model_attached: true,
+        kev_count: 5,
+        epss_count: 5,
+        journal_durable: true,
+        armed: false,
+    };
+    let mut bake = BakeStats::default();
+    bake.signals_by_variant.insert("alert".into(), 1);
+    derive_readiness(&config, ModelHealth::Ok, &bake, Some(SystemTime::now()))
+}
+
+/// A readiness snapshot for a warming (no pass yet) engine — not honestly calm.
+fn warming_readiness() -> Readiness {
+    derive_readiness(
+        &ReadinessConfig::default(),
+        ModelHealth::Unknown,
+        &BakeStats::default(),
+        None,
+    )
+}
+
+/// A readiness snapshot for an attached-but-timed-out model — blind, not calm.
+fn timed_out_readiness() -> Readiness {
+    let config = ReadinessConfig {
+        model_attached: true,
+        kev_count: 5,
+        epss_count: 5,
+        journal_durable: true,
+        armed: false,
+    };
+    derive_readiness(
+        &config,
+        ModelHealth::Timeout,
+        &BakeStats::default(),
+        Some(SystemTime::now()),
+    )
+}
+
+fn breach_finding(entry: &str, verdict: Verdict) -> Finding {
+    Finding {
+        entry: entry.to_string(),
+        objective: "secret/app/db-creds".to_string(),
+        foothold: true,
+        corroborated: matches!(verdict, Verdict::Confirmed),
+        disposition: "auto-eligible".into(),
+        cut: Some(format!("{entry} -[reaches/Tcp/5432]-> secret/app/db-creds")),
+        breach_relevant: true,
+        verdict: Some(verdict),
+        path: vec![PathStep {
+            from: entry.to_string(),
+            relation: "reaches/Tcp/5432".into(),
+            to: "secret/app/db-creds".into(),
+        }],
+        evidence: EntryEvidence::default(),
+        recency: None,
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Invariant #1 — !model_judging or warming_up ⇒ never the green all-clear path.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn warming_empty_never_renders_all_clear() {
+    let view = build_findings_view("prod".into(), &[], &[], &warming_readiness(), None);
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        !html.contains("all clear"),
+        "a warming dashboard must never claim all-clear"
+    );
+    assert!(html.contains("warming up"), "it states it is warming");
+    assert!(
+        html.contains("not an all-clear"),
+        "and is explicit that warming is not safety"
+    );
+}
+
+#[test]
+fn timed_out_empty_never_renders_all_clear() {
+    let view = build_findings_view(
+        "prod".into(),
+        &[],
+        &[],
+        &timed_out_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(!html.contains("all clear"));
+    assert!(html.contains("not answering") || html.contains("unjudged"));
+}
+
+#[test]
+fn judging_empty_is_the_only_state_that_says_all_clear() {
+    let view = build_findings_view(
+        "prod".into(),
+        &[],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        html.contains("all clear"),
+        "an empty list IS all-clear when the model is judging"
+    );
+    assert!(html.contains("model judging"));
+}
+
+// ---------------------------------------------------------------------------
+// Invariant #2 — Uncertain & awaiting never map to the cleared/green token.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn uncertain_and_awaiting_rows_are_not_green() {
+    let findings = vec![
+        breach_finding("endpoint/a", Verdict::Uncertain("timed out".into())),
+        breach_finding("endpoint/b", Verdict::Confirmed), // ensure a non-empty table
+    ];
+    // An awaiting row (no verdict).
+    let mut awaiting = breach_finding("endpoint/c", Verdict::Confirmed);
+    awaiting.verdict = None;
+    let mut all = findings;
+    all.push(awaiting);
+    let view = build_findings_view(
+        "prod".into(),
+        &all,
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    // The uncertain/awaiting rows carry their own (non-cleared) posture tokens.
+    assert!(html.contains("rail-uncertain"));
+    assert!(html.contains("rail-awaiting"));
+    assert!(html.contains("awaiting judgement"));
+    // They must NOT be wearing the cleared chip.
+    assert!(!html.contains("chip-cleared\""), "no cleared chip leaked");
+}
+
+// ---------------------------------------------------------------------------
+// Invariant #3 — empty evidence renders explicit "none", never a blank.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn empty_evidence_renders_no_evidence_not_blank() {
+    let f = breach_finding("endpoint/a", Verdict::Confirmed); // default (empty) evidence
+    let view = build_findings_view(
+        "prod".into(),
+        &[f],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(html.contains("no evidence"), "the row says 'no evidence'");
+}
+
+// ---------------------------------------------------------------------------
+// Invariant #6 — untrusted free-text is escaped at render.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn untrusted_verdict_prose_is_escaped() {
+    let evil = "<script>alert('x')</script>";
+    let f = breach_finding("endpoint/a", Verdict::Exploitable(evil.to_string()));
+    let judgements = vec![Judgement {
+        entry: "endpoint/a".into(),
+        objectives: 1,
+        verdict: "Exploitable".into(),
+        prompt: Some(format!("prompt with {evil}")),
+        reply: Some(format!("reply with {evil}")),
+    }];
+    let view = build_findings_view(
+        "prod".into(),
+        &[f],
+        &judgements,
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        !html.contains("<script>alert"),
+        "a raw <script> must never reach the output"
+    );
+    assert!(
+        html.contains("&lt;script&gt;"),
+        "it is HTML-escaped instead"
+    );
+}
+
+// ---------------------------------------------------------------------------
+// Strip + nav smoke.
+// ---------------------------------------------------------------------------
+
+#[test]
+fn stub_pages_carry_the_persistent_strip_and_nav() {
+    let strip = build_status_strip("prod".into(), &judging_readiness(), Some(SystemTime::now()));
+    let html =
+        page::stub_page(&strip, super::view_model::props::Tab::Trust, "trust blurb").into_string();
+    assert!(html.contains("phase 2"), "stub is labelled phase 2");
+    assert!(html.contains("Findings"), "the nav still offers Findings");
+    assert!(html.contains("model judging"), "the strip is present");
+}
+
+#[test]
+fn fragment_has_no_document_shell() {
+    let view = build_findings_view(
+        "prod".into(),
+        &[],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let frag = page::findings_fragment(&view).into_string();
+    assert!(!frag.contains("<!DOCTYPE"), "a fragment carries no doctype");
+    assert!(!frag.contains("<html"), "nor a document element");
+    // But it does carry the strip (so a poll refreshes coverage/freshness).
+    assert!(frag.contains("strip"));
+}
diff --git a/engine/src/engine/dashboard/view_model/findings.rs b/engine/src/engine/dashboard/view_model/findings.rs
new file mode 100644
index 0000000..33247ef
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/findings.rs
@@ -0,0 +1,247 @@
+//! Map the engine's [`Finding`] rows (with their evidence, path, and typed verdict) into the
+//! presentation [`FindingProps`] the components render, and apply the URGENCY sort (ADR-0016 /
+//! brief §5) — corroborated-live → model-promoted → escalations → awaiting → cleared. This is
+//! the data layer: it touches `state::`/`graph::` domain types; the components never do.
+
+use crate::engine::graph::{Behavior, NodeKey};
+use crate::engine::state::{
+    CveEvidence, EntryEvidence, Finding, FindingEvidence, Judgement, PathStep,
+};
+
+use super::posture::{delta_of, live_tag_of, posture_of};
+use super::props::{
+    BehaviorProps, CveProps, EvidenceProps, EvidenceSummary, FindingProps, HopProps,
+    JudgementProps, LiveTag, Posture, ScanProps,
+};
+
+/// A reasonable threshold past which an entry's reachable-objective set reads as a fan-out
+/// (argocd → ~120 secrets), collapsed to `→ ×N` rather than listed as alarms (brief §5/§10).
+const FANOUT_THRESHOLD: usize = 8;
+
+/// Map a finding's entry node key to a kind glyph. An internet foothold is the globe; the
+/// other kinds get a compact glyph so the entry column reads structurally.
+fn entry_glyph(key: &str, foothold: bool) -> String {
+    if foothold {
+        return "\u{1F310}".to_string(); // 🌐
+    }
+    match NodeKey::kind_of(key) {
+        "workload" => "\u{25A2}",   // ▢
+        "secret" => "\u{1F511}",    // 🔑
+        "identity" => "\u{1F464}",  // 👤
+        "endpoint" => "\u{2192}",   // →
+        "image" => "\u{25A3}",      // ▣
+        "host" => "\u{1F5A5}",      // 🖥
+        "capability" => "\u{26A1}", // ⚡
+        _ => "\u{2022}",            // •
+    }
+    .to_string()
+}
+
+/// Project a CVE evidence record into its props (the subordinate severity channel).
+fn cve_props(c: &CveEvidence) -> CveProps {
+    CveProps {
+        id: c.id.clone(),
+        severity: c.severity.clone(),
+        score: c.score.clone(),
+        kev: c.kev,
+        epss: c.epss.clone(),
+        reachability: c.reachability.clone(),
+        fix: c.fix.clone(),
+        title: c.title.clone(),
+    }
+}
+
+/// Project a scanner finding (exposed secret / misconfig / RBAC) into its props.
+fn scan_props(f: &FindingEvidence) -> ScanProps {
+    ScanProps {
+        id: f.id.clone(),
+        severity: f.severity.clone(),
+        category: f.category.clone(),
+        title: f.title.clone(),
+    }
+}
+
+/// Project a runtime behavior into its props, marking whether it corroborates the chain.
+fn behavior_props(b: &Behavior) -> BehaviorProps {
+    BehaviorProps {
+        variant: b.variant_label().to_string(),
+        summary: b.summary(),
+        corroborating: b.is_alert(),
+    }
+}
+
+/// Build the full evidence panel props from an entry's evidence, splitting runtime behaviors
+/// into corroborating (alerts) vs context.
+fn evidence_props(ev: &EntryEvidence) -> EvidenceProps {
+    EvidenceProps {
+        cves: ev.cves.iter().map(cve_props).collect(),
+        corroborating: ev
+            .runtime
+            .iter()
+            .filter(|b| b.is_alert())
+            .map(behavior_props)
+            .collect(),
+        context: ev
+            .runtime
+            .iter()
+            .filter(|b| !b.is_alert())
+            .map(behavior_props)
+            .collect(),
+        exposed_secrets: ev.exposed_secrets.iter().map(scan_props).collect(),
+        misconfigs: ev.misconfigs.iter().map(scan_props).collect(),
+        rbac_findings: ev.rbac_findings.iter().map(scan_props).collect(),
+    }
+}
+
+/// The compact evidence-cluster summary for the row.
+fn evidence_summary(ev: &EntryEvidence) -> EvidenceSummary {
+    EvidenceSummary {
+        cve_count: ev.cves.len(),
+        kev: ev.cves.iter().any(|c| c.kev),
+        runtime_alerts: ev.runtime.iter().filter(|b| b.is_alert()).count(),
+        exposed_secrets: ev.exposed_secrets.len(),
+    }
+}
+
+/// Map the proven path's hops, marking structural (substrate) hops muted and the cut point.
+/// `cut` is the cut signature (`from -[relation]-> to`); a hop matching it is marked.
+fn path_props(path: &[PathStep], cut: Option<&str>) -> Vec<HopProps> {
+    path.iter()
+        .map(|h| {
+            let signature = format!("{} -[{}]-> {}", h.from, h.relation, h.to);
+            HopProps {
+                from: NodeKey::short_of(&h.from).to_string(),
+                relation: h.relation.clone(),
+                to: NodeKey::short_of(&h.to).to_string(),
+                structural: is_structural_relation(&h.relation),
+                is_cut: cut == Some(signature.as_str()),
+            }
+        })
+        .collect()
+}
+
+/// Whether a relation label names a STRUCTURAL substrate edge (runs-as / runs-image /
+/// scheduled-on) — these are rendered muted in the hop-list (brief §5). Mirrors
+/// [`crate::engine::graph::Relation::is_structural`] over the label string.
+fn is_structural_relation(relation: &str) -> bool {
+    matches!(relation, "runs-as" | "runs-image" | "scheduled-on")
+}
+
+/// A stable DOM/fragment id for a finding, derived from its entry key. Non-alphanumerics
+/// collapse to `-` so it is a safe `id`/anchor.
+fn finding_id(entry: &str) -> String {
+    let slug: String = entry
+        .chars()
+        .map(|c| if c.is_ascii_alphanumeric() { c } else { '-' })
+        .collect();
+    format!("f-{slug}")
+}
+
+/// The verbatim model judgement props for an entry, if one was captured in the log. Matches by
+/// entry key; the newest judgement for the entry wins.
+fn judgement_props(entry: &str, judgements: &[Judgement]) -> JudgementProps {
+    match judgements.iter().find(|j| j.entry == entry) {
+        Some(j) => JudgementProps {
+            prompt: j.prompt.clone(),
+            reply: j.reply.clone(),
+            verdict: Some(j.verdict.clone()),
+        },
+        None => JudgementProps::default(),
+    }
+}
+
+/// Map one [`Finding`] into its presentation props. `judgements` is the newest-first judgement
+/// snapshot, used to attach the verbatim prompt/reply for the "show model prompt" disclosure.
+pub(super) fn finding_props(f: &Finding, judgements: &[Judgement]) -> FindingProps {
+    let posture = posture_of(f.verdict.as_ref());
+    let live_tag = live_tag_of(f.verdict.as_ref());
+    FindingProps {
+        id: finding_id(&f.entry),
+        posture,
+        live_tag,
+        delta: delta_of(f.recency.as_ref()),
+        entry_glyph: entry_glyph(&f.entry, f.foothold),
+        entry: NodeKey::short_of(&f.entry).to_string(),
+        foothold: f.foothold,
+        objective: NodeKey::short_of(&f.objective).to_string(),
+        fanout: None, // single-objective rows; fan-out is computed in the collapse pass below.
+        evidence_summary: evidence_summary(&f.evidence),
+        disposition: f.disposition.clone(),
+        verdict_summary: f.verdict.as_ref().map(|v| v.summary()),
+        path: path_props(&f.path, f.cut.as_deref()),
+        cut: f.cut.clone(),
+        evidence: evidence_props(&f.evidence),
+        judgement: judgement_props(&f.entry, judgements),
+    }
+}
+
+/// The urgency rank for the sort (lower = MORE urgent). Urgency is NOT severity (ADR-0016): a
+/// corroborated-live breach outranks a model-promoted one, which outranks an escalation, which
+/// outranks an awaiting row, which outranks a cleared one (the calm tail).
+fn urgency_rank(f: &FindingProps) -> u8 {
+    match (f.posture, f.live_tag, &f.delta) {
+        // Corroborated-live breach — the loudest.
+        (Posture::Breach, LiveTag::Live, _) => 0,
+        // Model-promoted breach.
+        (Posture::Breach, _, _) => 1,
+        // An escalation (newly worsened), regardless of decisive posture.
+        (_, _, super::props::DeltaProps::Escalated) => 2,
+        // Uncertain — not safe, needs a look.
+        (Posture::Uncertain, _, _) => 3,
+        // Awaiting judgement.
+        (Posture::Awaiting, _, _) => 4,
+        // Cleared — the calm tail (collapsed group).
+        (Posture::Cleared, _, _) => 5,
+    }
+}
+
+/// Collapse a group of findings that share an entry into one fan-out row when the entry reaches
+/// many objectives (argocd → ~120 secrets), framed as reachable-but-cleared (brief §5). A small
+/// reachable set is left as individual rows.
+fn collapse_fanout(mut rows: Vec<FindingProps>) -> Vec<FindingProps> {
+    use std::collections::HashMap;
+    let mut counts: HashMap<String, usize> = HashMap::new();
+    for r in &rows {
+        *counts.entry(r.entry.clone()).or_default() += 1;
+    }
+    // Entries that fan out beyond the threshold collapse to a single representative row.
+    let mut seen: HashMap<String, ()> = HashMap::new();
+    rows.retain(|r| {
+        let n = counts.get(&r.entry).copied().unwrap_or(1);
+        if n > FANOUT_THRESHOLD {
+            // Keep only the first row per fanned-out entry.
+            seen.insert(r.entry.clone(), ()).is_none()
+        } else {
+            true
+        }
+    });
+    for r in &mut rows {
+        let n = counts.get(&r.entry).copied().unwrap_or(1);
+        if n > FANOUT_THRESHOLD {
+            r.fanout = Some(n);
+        }
+    }
+    rows
+}
+
+/// Map and URGENCY-sort a snapshot of findings into props (brief §5). Only breach-relevant
+/// findings are surfaced — the caller passes the breach-relevant set. Fan-out collapse runs
+/// first, then the urgency sort (stable within a rank, by entry for determinism).
+pub(super) fn map_findings(findings: &[Finding], judgements: &[Judgement]) -> Vec<FindingProps> {
+    let mut rows: Vec<FindingProps> = findings
+        .iter()
+        .filter(|f| f.breach_relevant)
+        .map(|f| finding_props(f, judgements))
+        .collect();
+    rows = collapse_fanout(rows);
+    rows.sort_by(|a, b| {
+        urgency_rank(a)
+            .cmp(&urgency_rank(b))
+            .then(a.entry.cmp(&b.entry))
+            .then(a.objective.cmp(&b.objective))
+    });
+    rows
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/engine/src/engine/dashboard/view_model/findings/tests.rs b/engine/src/engine/dashboard/view_model/findings/tests.rs
new file mode 100644
index 0000000..f57e862
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/findings/tests.rs
@@ -0,0 +1,176 @@
+//! Tests for the findings view_model mapping + urgency sort, split into its own file to keep
+//! the mapper under the 1,000-line cap (CLAUDE.md).
+
+use super::*;
+use crate::engine::dashboard::view_model::props::DeltaProps;
+use crate::engine::reason::adjudicate::Verdict;
+use crate::engine::state::{
+    CveEvidence, Delta, EntryEvidence, Finding, Judgement, PathStep, RecencyInfo,
+};
+
+/// A minimal breach-relevant finding with a typed verdict, for the mapping tests.
+fn finding(entry: &str, objective: &str, verdict: Option<Verdict>) -> Finding {
+    Finding {
+        entry: entry.to_string(),
+        objective: objective.to_string(),
+        foothold: true,
+        corroborated: false,
+        disposition: "auto-eligible".into(),
+        cut: None,
+        breach_relevant: true,
+        verdict,
+        path: vec![PathStep {
+            from: entry.to_string(),
+            relation: "reaches/Tcp/5432".into(),
+            to: objective.to_string(),
+        }],
+        evidence: EntryEvidence::default(),
+        recency: None,
+    }
+}
+
+#[test]
+fn only_breach_relevant_rows_are_surfaced() {
+    let mut keep = finding(
+        "endpoint/internet",
+        "secret/app/db",
+        Some(Verdict::Confirmed),
+    );
+    keep.foothold = true;
+    let mut drop = finding("workload/app/Pod/x", "secret/app/y", None);
+    drop.breach_relevant = false;
+    let rows = map_findings(&[keep, drop], &[]);
+    assert_eq!(rows.len(), 1);
+}
+
+#[test]
+fn urgency_sort_puts_live_breach_first_cleared_last() {
+    let live = finding("endpoint/a", "secret/x", Some(Verdict::Confirmed));
+    let promoted = finding(
+        "endpoint/b",
+        "secret/x",
+        Some(Verdict::Exploitable("RCE".into())),
+    );
+    let cleared = finding(
+        "endpoint/c",
+        "secret/x",
+        Some(Verdict::Refuted("internal".into())),
+    );
+    let awaiting = finding("endpoint/d", "secret/x", None);
+    let rows = map_findings(&[cleared, awaiting, promoted, live], &[]);
+    let order: Vec<Posture> = rows.iter().map(|r| r.posture).collect();
+    assert_eq!(
+        order,
+        vec![
+            Posture::Breach,   // live-corroborated
+            Posture::Breach,   // model-promoted
+            Posture::Awaiting, // awaiting
+            Posture::Cleared,  // calm tail
+        ]
+    );
+    // The live breach outranks the promoted one (live_tag).
+    assert_eq!(rows[0].live_tag, LiveTag::Live);
+    assert_eq!(rows[1].live_tag, LiveTag::Judged);
+}
+
+#[test]
+fn escalation_outranks_awaiting() {
+    let mut escalated = finding(
+        "endpoint/e",
+        "secret/x",
+        Some(Verdict::Refuted("now safe".into())),
+    );
+    escalated.recency = Some(RecencyInfo {
+        delta: Delta::Escalated,
+        age_secs: Some(5),
+    });
+    let awaiting = finding("endpoint/a", "secret/x", None);
+    let rows = map_findings(&[awaiting, escalated], &[]);
+    // The escalation (rank 2) sorts before the awaiting row (rank 4).
+    assert!(matches!(rows[0].delta, DeltaProps::Escalated));
+}
+
+#[test]
+fn evidence_summary_counts_and_kev() {
+    let mut f = finding("endpoint/a", "secret/x", Some(Verdict::Confirmed));
+    f.evidence.cves = vec![
+        CveEvidence {
+            id: "CVE-1".into(),
+            severity: "critical".into(),
+            score: Some("9.8".into()),
+            kev: true,
+            epss: Some("90%".into()),
+            reachability: "loaded-at-runtime".into(),
+            fix: "no fix available".into(),
+            title: Some("bad".into()),
+        },
+        CveEvidence {
+            id: "CVE-2".into(),
+            severity: "high".into(),
+            score: None,
+            kev: false,
+            epss: None,
+            reachability: "unknown".into(),
+            fix: "fix available: 2.0".into(),
+            title: None,
+        },
+    ];
+    let rows = map_findings(&[f], &[]);
+    assert_eq!(rows[0].evidence_summary.cve_count, 2);
+    assert!(rows[0].evidence_summary.kev);
+    assert!(!rows[0].evidence.is_empty());
+}
+
+#[test]
+fn empty_evidence_is_flagged_empty() {
+    let f = finding("endpoint/a", "secret/x", None);
+    let rows = map_findings(&[f], &[]);
+    assert!(rows[0].evidence.is_empty());
+    assert!(rows[0].evidence_summary.is_empty());
+}
+
+#[test]
+fn fanout_collapses_a_high_objective_entry() {
+    // One entry reaching many objectives collapses to a single fan-out row.
+    let mut rows = Vec::new();
+    for i in 0..20 {
+        rows.push(finding(
+            "endpoint/argocd",
+            &format!("secret/app/s{i}"),
+            Some(Verdict::Refuted("cleared".into())),
+        ));
+    }
+    let mapped = map_findings(&rows, &[]);
+    let argo: Vec<_> = mapped.iter().filter(|r| r.entry == "argocd").collect();
+    assert_eq!(argo.len(), 1, "fan-out collapses to one row");
+    assert_eq!(argo[0].fanout, Some(20));
+}
+
+#[test]
+fn judgement_prompt_is_attached_by_entry() {
+    let f = finding("endpoint/a", "secret/x", Some(Verdict::Confirmed));
+    let judgements = vec![Judgement {
+        entry: "endpoint/a".into(),
+        objectives: 1,
+        verdict: "Confirmed".into(),
+        prompt: Some("the prompt".into()),
+        reply: Some("the reply".into()),
+    }];
+    let rows = map_findings(&[f], &judgements);
+    assert_eq!(rows[0].judgement.prompt.as_deref(), Some("the prompt"));
+    assert_eq!(rows[0].judgement.reply.as_deref(), Some("the reply"));
+}
+
+#[test]
+fn verdict_summary_is_the_models_verbatim_words() {
+    let f = finding(
+        "endpoint/a",
+        "secret/x",
+        Some(Verdict::Exploitable("CVE reachable".into())),
+    );
+    let rows = map_findings(&[f], &[]);
+    assert_eq!(
+        rows[0].verdict_summary.as_deref(),
+        Some("exploitable — CVE reachable")
+    );
+}
diff --git a/engine/src/engine/dashboard/view_model/mod.rs b/engine/src/engine/dashboard/view_model/mod.rs
new file mode 100644
index 0000000..64cdff1
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/mod.rs
@@ -0,0 +1,64 @@
+//! The **view_model** layer (ADR-0019): the ONLY layer that touches `engine::`/`state::`
+//! domain types. It shapes the engine's read-only output state into the plain [`props`] the
+//! pure components render — the React-like data layer. The components import these props and
+//! nothing from `engine::`, a boundary the guard tests enforce (invariant #4).
+//!
+//! Nothing here makes a decision: it is a view, never a gate (ADR-0016). The honesty rules
+//! (Uncertain/Awaiting never green; calm only while judging) are encoded in the mapping
+//! (`posture`/`strip`) and tested at this boundary.
+
+pub mod props;
+
+mod findings;
+mod posture;
+mod strip;
+
+use std::time::SystemTime;
+
+use crate::engine::state::{Finding, Judgement, Readiness};
+
+use props::{FindingsViewProps, Posture, StatusStripProps};
+
+/// Build the whole Findings view's props from the engine's read-only state. `findings` is a
+/// findings snapshot (verdicts already resolved), `judgements` the newest-first judgement ring
+/// (for the verbatim "show model prompt" disclosure), `readiness` the coverage snapshot, and
+/// `last_pass` the freshness stamp. Pure given its inputs — driveable in tests with no engine.
+pub fn build_findings_view(
+    cluster: String,
+    findings: &[Finding],
+    judgements: &[Judgement],
+    readiness: &Readiness,
+    last_pass: Option<SystemTime>,
+) -> FindingsViewProps {
+    let rows = findings::map_findings(findings, judgements);
+    let breach = rows.iter().filter(|r| r.posture == Posture::Breach).count();
+    let awaiting = rows
+        .iter()
+        .filter(|r| r.posture == Posture::Awaiting)
+        .count();
+    let cleared = rows
+        .iter()
+        .filter(|r| r.posture == Posture::Cleared)
+        .count();
+    let escalated = rows
+        .iter()
+        .filter(|r| matches!(r.delta, props::DeltaProps::Escalated))
+        .count();
+    let strip = strip::status_strip(
+        cluster, readiness, last_pass, breach, awaiting, cleared, escalated,
+    );
+    FindingsViewProps {
+        strip,
+        findings: rows,
+    }
+}
+
+/// Build only the status strip (for views that don't list findings — the phase-2 stubs still
+/// carry the persistent strip). The headline counts are zeroed; a stub view shows no findings.
+pub fn build_status_strip(
+    cluster: String,
+    readiness: &Readiness,
+    last_pass: Option<SystemTime>,
+) -> StatusStripProps {
+    strip::status_strip(cluster, readiness, last_pass, 0, 0, 0, 0)
+}
diff --git a/engine/src/engine/dashboard/view_model/posture.rs b/engine/src/engine/dashboard/view_model/posture.rs
new file mode 100644
index 0000000..50cad0e
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/posture.rs
@@ -0,0 +1,116 @@
+//! Map the engine's typed [`Verdict`] and recency [`Delta`] into the presentation
+//! [`Posture`] / [`LiveTag`] / [`DeltaProps`] props (ADR-0019). This is the **only** place the
+//! posture mapping lives, so the honesty invariants (Uncertain/Awaiting never cleared) are
+//! enforced in one tested spot, and the components never see a `Verdict`.
+
+use crate::engine::reason::adjudicate::Verdict;
+use crate::engine::state::{Delta, RecencyInfo};
+
+use super::props::{DeltaProps, LiveTag, Posture};
+
+/// The posture a finding carries, from its typed verdict. `None` (no verdict yet) is
+/// [`Posture::Awaiting`] — never cleared. `Uncertain` is its own amber state — never cleared.
+/// `Confirmed`/`Exploitable` are a breach; `Refuted` is the only cleared/green path.
+pub(super) fn posture_of(verdict: Option<&Verdict>) -> Posture {
+    match verdict {
+        None => Posture::Awaiting,
+        Some(Verdict::Confirmed | Verdict::Exploitable(_)) => Posture::Breach,
+        Some(Verdict::Refuted(_)) => Posture::Cleared,
+        Some(Verdict::Uncertain(_)) => Posture::Uncertain,
+    }
+}
+
+/// The live-vs-judged sub-tag: a `Confirmed` (live-corroborated) breach is **live**; an
+/// `Exploitable` (model-promoted only) breach is **judged**; anything else has no sub-tag.
+pub(super) fn live_tag_of(verdict: Option<&Verdict>) -> LiveTag {
+    match verdict {
+        Some(Verdict::Confirmed) => LiveTag::Live,
+        Some(Verdict::Exploitable(_)) => LiveTag::Judged,
+        _ => LiveTag::None,
+    }
+}
+
+/// Format a whole-second age into a compact human string (`"12s"`, `"4m"`, `"2h"`, `"3d"`).
+pub(super) fn human_age(secs: u64) -> String {
+    if secs < 60 {
+        format!("{secs}s")
+    } else if secs < 3600 {
+        format!("{}m", secs / 60)
+    } else if secs < 86_400 {
+        format!("{}h", secs / 3600)
+    } else {
+        format!("{}d", secs / 86_400)
+    }
+}
+
+/// Map the per-entry [`RecencyInfo`] into the Δ props. A steady entry shows its age, not an
+/// alarm glyph. `None` recency (never seen / no update yet) reads as steady with no age.
+pub(super) fn delta_of(recency: Option<&RecencyInfo>) -> DeltaProps {
+    let Some(info) = recency else {
+        return DeltaProps::Unchanged { age: None };
+    };
+    match info.delta {
+        Delta::New => DeltaProps::New,
+        Delta::Escalated => DeltaProps::Escalated,
+        Delta::DeEscalated => DeltaProps::DeEscalated,
+        Delta::Restored => DeltaProps::Restored,
+        Delta::Unchanged => DeltaProps::Unchanged {
+            age: info.age_secs.map(human_age),
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn uncertain_and_awaiting_are_never_cleared() {
+        // The cardinal honesty rule, enforced at the mapping boundary (invariant #2).
+        assert!(!posture_of(None).is_cleared());
+        assert!(!posture_of(Some(&Verdict::Uncertain("timed out".into()))).is_cleared());
+        // Only Refuted clears.
+        assert!(posture_of(Some(&Verdict::Refuted("internal only".into()))).is_cleared());
+        // A breach is loud, not cleared.
+        assert!(!posture_of(Some(&Verdict::Confirmed)).is_cleared());
+        assert!(!posture_of(Some(&Verdict::Exploitable("RCE".into()))).is_cleared());
+    }
+
+    #[test]
+    fn live_vs_judged_sub_tag() {
+        assert_eq!(live_tag_of(Some(&Verdict::Confirmed)), LiveTag::Live);
+        assert_eq!(
+            live_tag_of(Some(&Verdict::Exploitable("x".into()))),
+            LiveTag::Judged
+        );
+        assert_eq!(live_tag_of(None), LiveTag::None);
+        assert_eq!(
+            live_tag_of(Some(&Verdict::Refuted("x".into()))),
+            LiveTag::None
+        );
+    }
+
+    #[test]
+    fn human_age_buckets() {
+        assert_eq!(human_age(12), "12s");
+        assert_eq!(human_age(240), "4m");
+        assert_eq!(human_age(7200), "2h");
+        assert_eq!(human_age(259_200), "3d");
+    }
+
+    #[test]
+    fn steady_delta_shows_age_not_glyph() {
+        let info = RecencyInfo {
+            delta: Delta::Unchanged,
+            age_secs: Some(90),
+        };
+        let d = delta_of(Some(&info));
+        assert_eq!(
+            d,
+            DeltaProps::Unchanged {
+                age: Some("1m".into())
+            }
+        );
+        assert_eq!(d.glyph(), "");
+    }
+}
diff --git a/engine/src/engine/dashboard/view_model/props.rs b/engine/src/engine/dashboard/view_model/props.rs
new file mode 100644
index 0000000..57c1d00
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/props.rs
@@ -0,0 +1,349 @@
+//! The plain presentation **Props** the components render (ADR-0019). These types are the
+//! contract between the `view_model` (which maps engine/`state::` domain types into them) and
+//! the `components` (pure `Props -> Markup` renderers). They carry NO engine/`state::` domain
+//! type — only owned strings, numbers, and small presentation enums — so the component layer
+//! can be compiled and guard-tested in isolation from the engine (invariant #4 of the brief).
+//!
+//! Every string here is treated as UNTRUSTED at render: the components escape it (maud
+//! auto-escape). The view_model never makes a decision — these props are a view, never a gate
+//! (ADR-0016).
+
+/// The model's posture for a finding — the LOUD channel. Mirrors the four states the style
+/// guide names (Breach / Cleared / Uncertain / Awaiting), each with a distinct colour token,
+/// glyph, and word so meaning never rides on colour alone. `Awaiting` and `Uncertain` are
+/// NEVER the cleared/green token — the honesty invariant.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Posture {
+    /// The model affirmed a real, exploitable breach (`Confirmed` / `Exploitable`).
+    Breach,
+    /// The model judged the path NOT exploitable (`Refuted`).
+    Cleared,
+    /// The model could not tell (`Uncertain`) — not safe, never green.
+    Uncertain,
+    /// No verdict yet — the model hasn't judged this entry. Never green.
+    Awaiting,
+}
+
+impl Posture {
+    /// The CSS token suffix (`--posture-{kind}`) for this posture.
+    pub fn token(self) -> &'static str {
+        match self {
+            Posture::Breach => "breach",
+            Posture::Cleared => "cleared",
+            Posture::Uncertain => "uncertain",
+            Posture::Awaiting => "awaiting",
+        }
+    }
+
+    /// The glyph that carries the posture without colour (style guide §posture).
+    pub fn glyph(self) -> &'static str {
+        match self {
+            Posture::Breach => "\u{25CF}",    // ● filled
+            Posture::Cleared => "\u{25CB}",   // ○ open
+            Posture::Uncertain => "\u{25D0}", // ◐ half
+            Posture::Awaiting => "\u{25CC}",  // ◌ dotted
+        }
+    }
+
+    /// The word — always present alongside colour + glyph.
+    pub fn word(self) -> &'static str {
+        match self {
+            Posture::Breach => "BREACH",
+            Posture::Cleared => "not exploitable",
+            Posture::Uncertain => "uncertain",
+            Posture::Awaiting => "awaiting judgement",
+        }
+    }
+
+    /// Whether this posture is the cleared/green path. The honesty guard asserts only
+    /// `Cleared` is ever true here — `Uncertain`/`Awaiting`/`Breach` are not green.
+    pub fn is_cleared(self) -> bool {
+        matches!(self, Posture::Cleared)
+    }
+}
+
+/// A finding's live-vs-judged sub-tag (style guide / brief §10): a live runtime signal backed
+/// the chain (`Confirmed` ⇒ **live**) vs a model-only promotion (`Exploitable` ⇒ **judged**).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum LiveTag {
+    /// Live-corroborated by a runtime signal.
+    Live,
+    /// Model-promoted only (no live corroboration).
+    Judged,
+    /// No sub-tag (not a breach posture).
+    None,
+}
+
+/// The recency Δ for a finding's entry — the calmer channel. A steady entry shows its AGE,
+/// not an alarm glyph (brief §5).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum DeltaProps {
+    /// First seen this pass.
+    New,
+    /// Posture worsened since last pass.
+    Escalated,
+    /// Posture de-escalated since last pass.
+    DeEscalated,
+    /// Steady — shows the human age (`"12s"`, `"4m"`), never an arrow. `None` when no age
+    /// is known yet.
+    Unchanged { age: Option<String> },
+    /// Restored from the durable journal on boot.
+    Restored,
+}
+
+impl DeltaProps {
+    /// The CSS token suffix (`--delta-{kind}`), or `None` for the muted steady-age case.
+    pub fn token(&self) -> Option<&'static str> {
+        match self {
+            DeltaProps::New => Some("new"),
+            DeltaProps::Escalated => Some("up"),
+            DeltaProps::DeEscalated => Some("down"),
+            DeltaProps::Restored => Some("restored"),
+            DeltaProps::Unchanged { .. } => None,
+        }
+    }
+
+    /// The glyph + word for the Δ cell (steady age has no glyph).
+    pub fn glyph(&self) -> &'static str {
+        match self {
+            DeltaProps::New => "\u{FF0B}",         // ＋
+            DeltaProps::Escalated => "\u{25B2}",   // ▲
+            DeltaProps::DeEscalated => "\u{25BC}", // ▼
+            DeltaProps::Restored => "\u{21BA}",    // ↺
+            DeltaProps::Unchanged { .. } => "",
+        }
+    }
+
+    /// A short label for the Δ (for the `title`/screen-reader text).
+    pub fn label(&self) -> String {
+        match self {
+            DeltaProps::New => "new this pass".to_string(),
+            DeltaProps::Escalated => "escalated".to_string(),
+            DeltaProps::DeEscalated => "de-escalated".to_string(),
+            DeltaProps::Restored => "restored".to_string(),
+            DeltaProps::Unchanged { age: Some(a) } => format!("steady · {a}"),
+            DeltaProps::Unchanged { age: None } => "steady".to_string(),
+        }
+    }
+}
+
+/// One CVE row for the evidence table (subordinate severity channel).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CveProps {
+    pub id: String,
+    /// The severity token suffix (`critical`/`high`/`medium`/`low`).
+    pub severity: String,
+    /// CVSS score string (`"9.8"`), or `None`.
+    pub score: Option<String>,
+    pub kev: bool,
+    /// EPSS percent string (`"90%"`), or `None`.
+    pub epss: Option<String>,
+    pub reachability: String,
+    pub fix: String,
+    /// Untrusted advisory title.
+    pub title: Option<String>,
+}
+
+/// One scanner finding row (exposed secret / misconfig / RBAC) for the evidence tables.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ScanProps {
+    pub id: String,
+    pub severity: String,
+    pub category: Option<String>,
+    /// Untrusted title (a redacted secret match, a check description).
+    pub title: Option<String>,
+}
+
+/// One runtime behavior line for the evidence panel, split corroborating vs context.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BehaviorProps {
+    /// The behavior's variant token (`alert`/`connection`/…).
+    pub variant: String,
+    /// The human summary (untrusted — carries peers/paths/secret names).
+    pub summary: String,
+    /// Whether this behavior corroborates the chain (an alert).
+    pub corroborating: bool,
+}
+
+/// One hop of the proven path, rendered as a text hop-list. Structural hops are muted; the
+/// cut point is marked (brief §5).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HopProps {
+    pub from: String,
+    pub relation: String,
+    pub to: String,
+    /// Whether this is a structural (substrate) hop — rendered muted.
+    pub structural: bool,
+    /// Whether the proposed cut severs at this hop.
+    pub is_cut: bool,
+}
+
+/// The verbatim model judgement behind a finding, for the "show model prompt" disclosure.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct JudgementProps {
+    /// The full prompt the model saw, if captured. `None` ⇒ the deterministic pre-filter
+    /// decided without asking the model.
+    pub prompt: Option<String>,
+    /// The model's raw reply, if any. `None` ⇒ the model was unavailable (timeout).
+    pub reply: Option<String>,
+    /// The final verdict line (Debug form).
+    pub verdict: Option<String>,
+}
+
+/// The full evidence cluster for a finding's expanded panel.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct EvidenceProps {
+    pub cves: Vec<CveProps>,
+    /// Runtime behaviors that corroborate (alerts).
+    pub corroborating: Vec<BehaviorProps>,
+    /// Runtime behaviors carried as context.
+    pub context: Vec<BehaviorProps>,
+    pub exposed_secrets: Vec<ScanProps>,
+    pub misconfigs: Vec<ScanProps>,
+    pub rbac_findings: Vec<ScanProps>,
+}
+
+impl EvidenceProps {
+    /// Whether there is no evidence at all — drives the honest "no evidence" state (never a
+    /// blank). Invariant #3.
+    pub fn is_empty(&self) -> bool {
+        self.cves.is_empty()
+            && self.corroborating.is_empty()
+            && self.context.is_empty()
+            && self.exposed_secrets.is_empty()
+            && self.misconfigs.is_empty()
+            && self.rbac_findings.is_empty()
+    }
+}
+
+/// The compact evidence-cluster glyph summary shown in the row (CVE count + KEV + runtime +
+/// secrets), or the honest "no evidence" marker.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct EvidenceSummary {
+    pub cve_count: usize,
+    pub kev: bool,
+    pub runtime_alerts: usize,
+    pub exposed_secrets: usize,
+}
+
+impl EvidenceSummary {
+    /// Whether the entry has no surfaced evidence — the row shows "no evidence", not a blank.
+    pub fn is_empty(&self) -> bool {
+        self.cve_count == 0 && !self.kev && self.runtime_alerts == 0 && self.exposed_secrets == 0
+    }
+}
+
+/// One finding row + its expand-in-place "why" — the unit of the Findings view.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FindingProps {
+    /// A stable id for the `<details>` toggle + deep-link fragment (derived from the entry key).
+    pub id: String,
+    pub posture: Posture,
+    pub live_tag: LiveTag,
+    pub delta: DeltaProps,
+    /// The entry node-kind glyph (🌐 for an internet foothold).
+    pub entry_glyph: String,
+    /// The short entry label (untrusted node key remainder).
+    pub entry: String,
+    /// Whether the entry is an internet-facing front door.
+    pub foothold: bool,
+    /// The objective label (untrusted).
+    pub objective: String,
+    /// The fan-out count when the entry reaches many secrets/objectives (`→ ×N`), else `None`.
+    pub fanout: Option<usize>,
+    pub evidence_summary: EvidenceSummary,
+    /// The mechanical disposition (auto-eligible / propose / durable-fix PR / …).
+    pub disposition: String,
+    /// The verbatim verdict summary (`Verdict::summary()`), or `None` while awaiting.
+    pub verdict_summary: Option<String>,
+    pub path: Vec<HopProps>,
+    /// The proposed/applied cut signature, if one exists.
+    pub cut: Option<String>,
+    pub evidence: EvidenceProps,
+    pub judgement: JudgementProps,
+}
+
+/// The three honesty axes the status strip carries (brief §3): decided/judging/covered. Never
+/// collapse into one signal.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct StatusStripProps {
+    /// The cluster label (`prod-east`), untrusted.
+    pub cluster: String,
+    /// `true` ⇒ enforcing; `false` ⇒ shadow.
+    pub armed: bool,
+    /// The model is answering RIGHT NOW (attached AND last call decisive). The ONLY condition
+    /// under which a calm/green all-clear is honest (invariant #1).
+    pub model_judging: bool,
+    /// No pass has completed — verdicts are still loading.
+    pub warming_up: bool,
+    /// Whether a model is configured at all (vs down).
+    pub model_attached: bool,
+    /// Coverage chips for the enrichment feeds (KEV/EPSS/Falco/eBPF).
+    pub coverage: Vec<CoverageChip>,
+    /// Human "last pass NNs ago", or `None` before the first pass.
+    pub last_pass: Option<String>,
+    /// The headline counts (breach / awaiting / cleared) for the findings summary line.
+    pub breach_count: usize,
+    pub awaiting_count: usize,
+    pub cleared_count: usize,
+    /// Newly-escalated since last pass (the Δ headline).
+    pub escalated_count: usize,
+}
+
+impl StatusStripProps {
+    /// Whether a calm/all-clear render is HONEST: only when the model is actively judging and
+    /// not warming up (invariant #1). When false, the honest "blind/warming" banner renders
+    /// instead of any green all-clear.
+    pub fn calm_is_honest(&self) -> bool {
+        self.model_judging && !self.warming_up
+    }
+}
+
+/// One coverage chip in the status strip (a feed's presence).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct CoverageChip {
+    pub label: String,
+    pub present: bool,
+    /// `true` when the feed is degraded (configured but not answering) — distinct from absent.
+    pub degraded: bool,
+}
+
+/// Which top-level tab is active (the 4-tab nav shell).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Tab {
+    Findings,
+    Trust,
+    Readiness,
+    Activity,
+}
+
+impl Tab {
+    /// The tab's route path.
+    pub fn path(self) -> &'static str {
+        match self {
+            Tab::Findings => "/",
+            Tab::Trust => "/?tab=trust",
+            Tab::Readiness => "/?tab=readiness",
+            Tab::Activity => "/?tab=activity",
+        }
+    }
+
+    /// The tab label.
+    pub fn label(self) -> &'static str {
+        match self {
+            Tab::Findings => "Findings",
+            Tab::Trust => "Trust",
+            Tab::Readiness => "Readiness",
+            Tab::Activity => "Activity",
+        }
+    }
+}
+
+/// The whole Findings view's props: the status strip + the sorted finding rows + the honest
+/// empty/awaiting/blind framing.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FindingsViewProps {
+    pub strip: StatusStripProps,
+    /// Findings, already sorted by URGENCY (not severity) — brief §5.
+    pub findings: Vec<FindingProps>,
+}
diff --git a/engine/src/engine/dashboard/view_model/strip.rs b/engine/src/engine/dashboard/view_model/strip.rs
new file mode 100644
index 0000000..f97cc4d
--- /dev/null
+++ b/engine/src/engine/dashboard/view_model/strip.rs
@@ -0,0 +1,142 @@
+//! Map the engine's [`Readiness`] coverage snapshot + the per-pass freshness into the
+//! persistent [`StatusStripProps`] (the three honesty axes — decided/judging/covered). This is
+//! the load-bearing honesty surface: `model_judging`/`warming_up` flow straight through so the
+//! components can refuse to render a calm/green all-clear when it would be dishonest (invariant
+//! #1).
+
+use std::time::SystemTime;
+
+use crate::engine::state::Readiness;
+
+use super::posture::human_age;
+use super::props::{CoverageChip, StatusStripProps};
+
+/// The enrichment feeds shown as coverage chips in the strip, in a stable order. Arm-state and
+/// journal are reported elsewhere (the mode pill / Readiness tab), not as coverage chips.
+const COVERAGE_FEEDS: [(&str, &str); 4] = [
+    ("kev", "KEV"),
+    ("epss", "EPSS"),
+    ("falco", "Falco"),
+    ("ebpf-agent", "eBPF"),
+];
+
+/// Build the coverage chips from the readiness rows. A `Present` row is covered; a `Degraded`
+/// one is degraded (configured but not answering — distinct from absent); `Absent` is a gap.
+fn coverage_chips(readiness: &Readiness) -> Vec<CoverageChip> {
+    use crate::engine::state::InputState;
+    COVERAGE_FEEDS
+        .iter()
+        .filter_map(|(id, label)| {
+            let row = readiness.inputs.iter().find(|r| r.id == *id)?;
+            Some(CoverageChip {
+                label: label.to_string(),
+                present: row.state == InputState::Present,
+                degraded: row.state == InputState::Degraded,
+            })
+        })
+        .collect()
+}
+
+/// Whether the engine is armed (enforcing), read from the readiness `arm-state` row's detail.
+fn armed_from(readiness: &Readiness) -> bool {
+    readiness
+        .inputs
+        .iter()
+        .find(|r| r.id == "arm-state")
+        .map(|r| r.detail.starts_with("enforcing"))
+        .unwrap_or(false)
+}
+
+/// Build the status-strip props. `cluster` is the cluster label; `last_pass` the engine's
+/// last-pass time (for the freshness line); the headline counts come from the mapped findings
+/// (filled by the caller — see [`super::build_status_strip`]). Pure given its inputs.
+pub(super) fn status_strip(
+    cluster: String,
+    readiness: &Readiness,
+    last_pass: Option<SystemTime>,
+    breach_count: usize,
+    awaiting_count: usize,
+    cleared_count: usize,
+    escalated_count: usize,
+) -> StatusStripProps {
+    StatusStripProps {
+        cluster,
+        armed: armed_from(readiness),
+        model_judging: readiness.model_judging,
+        warming_up: readiness.warming_up,
+        model_attached: readiness.model_attached(),
+        coverage: coverage_chips(readiness),
+        last_pass: last_pass.map(last_pass_age),
+        breach_count,
+        awaiting_count,
+        cleared_count,
+        escalated_count,
+    }
+}
+
+/// Render the "last pass NNs ago" age from a wall-clock instant, clamped at 0.
+fn last_pass_age(at: SystemTime) -> String {
+    let secs = SystemTime::now()
+        .duration_since(at)
+        .map(|d| d.as_secs())
+        .unwrap_or(0);
+    format!("{} ago", human_age(secs))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::engine::state::{BakeStats, ModelHealth, ReadinessConfig, derive_readiness};
+
+    fn covered() -> ReadinessConfig {
+        ReadinessConfig {
+            model_attached: true,
+            kev_count: 5,
+            epss_count: 5,
+            journal_durable: true,
+            armed: false,
+        }
+    }
+
+    #[test]
+    fn judging_model_strip_is_honest_calm() {
+        let mut bake = BakeStats::default();
+        bake.signals_by_variant.insert("alert".into(), 1);
+        let r = derive_readiness(&covered(), ModelHealth::Ok, &bake, Some(SystemTime::now()));
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 3, 0);
+        assert!(strip.calm_is_honest());
+        assert!(!strip.armed);
+        // KEV/EPSS present; Falco present (alert signal); eBPF absent.
+        let falco = strip.coverage.iter().find(|c| c.label == "Falco").unwrap();
+        assert!(falco.present);
+        let ebpf = strip.coverage.iter().find(|c| c.label == "eBPF").unwrap();
+        assert!(!ebpf.present);
+    }
+
+    #[test]
+    fn timed_out_model_strip_is_not_calm() {
+        let r = derive_readiness(
+            &covered(),
+            ModelHealth::Timeout,
+            &BakeStats::default(),
+            Some(SystemTime::now()),
+        );
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 0);
+        assert!(!strip.calm_is_honest());
+        assert!(strip.model_attached); // configured, just not answering
+    }
+
+    #[test]
+    fn warming_strip_is_not_calm() {
+        let r = derive_readiness(
+            &covered(),
+            ModelHealth::Unknown,
+            &BakeStats::default(),
+            None,
+        );
+        let strip = status_strip("prod".into(), &r, None, 0, 0, 0, 0);
+        assert!(!strip.calm_is_honest());
+        assert!(strip.warming_up);
+        assert!(strip.last_pass.is_none());
+    }
+}
diff --git a/engine/src/engine/mod.rs b/engine/src/engine/mod.rs
index beefce0..603729f 100644
--- a/engine/src/engine/mod.rs
+++ b/engine/src/engine/mod.rs
@@ -28,6 +28,10 @@
 //   respond/ — proven chains → self-retiring controls, then apply (ADR-0002/0009)
 // `model` is a cross-cutting single file; `state` is the engine's output-state domain layer;
 // this mod.rs is the orchestrator.
+// The server-rendered operator dashboard (ADR-0019): the read-only presentation platform for
+// the engine's output state (zero-egress, light theme). view_model → components → page → routes;
+// wired into the watch loop behind PROTECTOR_DASHBOARD_ADDR.
+pub mod dashboard;
 pub mod graph;
 pub mod journal;
 pub mod model;
diff --git a/engine/src/engine/run_loop.rs b/engine/src/engine/run_loop.rs
index cb03c15..37677c0 100644
--- a/engine/src/engine/run_loop.rs
+++ b/engine/src/engine/run_loop.rs
@@ -6,7 +6,8 @@
 
 use super::respond::actuator::{ActuationScope, Actuator, DryRunActuator, EnabledActions};
 use super::{
-    Engine, Snapshot, journal, model, notify, observe, policy_log, reason, respond, state,
+    Engine, Snapshot, dashboard, journal, model, notify, observe, policy_log, reason, respond,
+    state,
 };
 
 /// Replay the durable journal's admission lines (JEF-237) back into the shared
@@ -187,6 +188,31 @@ pub async fn run_watch(
             armed: !active.is_empty(),
         });
 
+    // The read-only operator dashboard (ADR-0019), served behind `PROTECTOR_DASHBOARD_ADDR`
+    // (e.g. `0.0.0.0:8080`). Off when unset — zero-egress, in-cluster only. It reads the SAME
+    // `state::` handles the engine writes each pass (findings, the judgement ring, the reversion
+    // log), never mutating them, so it is strictly observational and a bad render can never
+    // affect the engine (ADR-0016: presentation is a view, never a gate). A bind failure logs
+    // and the task exits; the engine loop is unaffected.
+    if let Ok(addr_str) = std::env::var("PROTECTOR_DASHBOARD_ADDR") {
+        match addr_str.parse::<std::net::SocketAddr>() {
+            Ok(addr) => {
+                let state = dashboard::DashboardState {
+                    findings: engine.findings(),
+                    judgements: journal.clone(),
+                    reversions: engine.reversions(),
+                    cluster: std::env::var("PROTECTOR_CLUSTER_LABEL")
+                        .unwrap_or_else(|_| "cluster".to_string()),
+                };
+                tokio::spawn(dashboard::serve_dashboard(addr, state));
+            }
+            Err(error) => tracing::error!(
+                %error, addr = %addr_str,
+                "PROTECTOR_DASHBOARD_ADDR is not a host:port socket address; dashboard disabled"
+            ),
+        }
+    }
+
     // Keep-warm (JEF-107): warm the model at startup and ping it periodically so it
     // stays resident between judging passes — the first post-restart pass isn't glacial.
     // Best-effort and shadow-safe; a no-op when no model is configured. Aborted on loop
diff --git a/engine/src/engine/state/mod.rs b/engine/src/engine/state/mod.rs
index f2620f9..b8944b2 100644
--- a/engine/src/engine/state/mod.rs
+++ b/engine/src/engine/state/mod.rs
@@ -23,7 +23,10 @@ mod verdict_store;
 pub use evidence::{CveEvidence, EntryEvidence, FindingEvidence};
 pub use findings::{Finding, Findings, PathStep};
 pub use judgement::{Judgement, JudgementLog};
-pub use readiness::Readiness;
+pub use readiness::{InputState, Readiness};
+// The dashboard view_model (ADR-0019) derives the live readiness snapshot from the engine's
+// config + per-pass health, the same pure aggregation the OTLP mirror reads.
+pub(crate) use readiness::derive_readiness;
 pub use recency::{Delta, RecencyInfo, StoredPosture};
 pub use report::{Report, default_window_report};
 pub use reversion::{ReversionLog, ReversionRecord};
diff --git a/engine/tests/dashboard_guards.rs b/engine/tests/dashboard_guards.rs
new file mode 100644
index 0000000..f587822
--- /dev/null
+++ b/engine/tests/dashboard_guards.rs
@@ -0,0 +1,169 @@
+//! Dashboard honesty / boundary guards (ADR-0019, design brief §9). These are SOURCE-level
+//! guards that complement the render-level invariant tests in the dashboard module:
+//!
+//! - **#4 component boundary** — a file under `dashboard/components/` must import NO
+//!   `engine::`/`state::`/`graph::`/`reason::` domain type. Components receive only their
+//!   `Props` (the view_model/component split). They may import `crate::engine::dashboard::
+//!   view_model::props` (the props ARE the contract) and `maud`.
+//! - **#5 no inline style** — no component (or any served asset/markup source) emits an inline
+//!   `style=`/`<style>`; every visual is a class mapped to a token in `docs/STYLEGUIDE.md`.
+//!
+//! The file-size cap (#7) is guarded by `file_size_guard.rs`. The remaining invariants
+//! (#1 honest-calm, #2 uncertain/awaiting-not-green, #3 no-blank-evidence, #6 escaping) are
+//! asserted at render in `engine/src/engine/dashboard/tests.rs`.
+
+use std::path::{Path, PathBuf};
+
+/// The repo root: the parent of the engine crate's manifest dir.
+fn repo_root() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR"))
+        .parent()
+        .expect("engine crate has a parent (the repo root)")
+        .to_path_buf()
+}
+
+/// Read a first-party dashboard source file, relative to the engine crate's `src`.
+fn read_engine_src(rel: &str) -> String {
+    let path = repo_root().join("engine/src").join(rel);
+    std::fs::read_to_string(&path).unwrap_or_else(|e| panic!("reading {path:?}: {e}"))
+}
+
+/// Collect every `.rs` file directly under `dashboard/components/`.
+fn component_files() -> Vec<PathBuf> {
+    let dir = repo_root().join("engine/src/engine/dashboard/components");
+    let mut out = Vec::new();
+    for entry in std::fs::read_dir(&dir)
+        .unwrap_or_else(|e| panic!("reading {dir:?}: {e}"))
+        .flatten()
+    {
+        let path = entry.path();
+        if path.extension().and_then(|e| e.to_str()) == Some("rs") {
+            out.push(path);
+        }
+    }
+    assert!(
+        !out.is_empty(),
+        "found no component files under {dir:?} — the guard would pass vacuously"
+    );
+    out
+}
+
+/// Strip `//`-line comments from a source line, so an explanatory comment that names a domain
+/// type doesn't trip the import guard. Block comments are not used for domain references here.
+fn strip_line_comment(line: &str) -> &str {
+    match line.find("//") {
+        Some(i) => &line[..i],
+        None => line,
+    }
+}
+
+#[test]
+fn components_import_no_domain_types() {
+    // The forbidden module roots. A component must not reach into the engine's domain — only
+    // the props contract (which lives under `view_model::props`).
+    let forbidden = [
+        "engine::graph",
+        "engine::reason",
+        "engine::state",
+        "engine::respond",
+        "engine::observe",
+        "engine::journal",
+        "crate::engine::graph",
+        "crate::engine::reason",
+        "crate::engine::state",
+        "super::super::state",
+        "super::super::graph",
+        // a bare `state::` / `graph::` path
+        "use crate::engine::state",
+        "use crate::engine::graph",
+    ];
+    let mut offenders: Vec<String> = Vec::new();
+    for file in component_files() {
+        let src = std::fs::read_to_string(&file).unwrap();
+        for (n, raw) in src.lines().enumerate() {
+            let line = strip_line_comment(raw);
+            // The one allowed engine path: the props contract.
+            if line.contains("view_model::props") {
+                continue;
+            }
+            for needle in forbidden {
+                if line.contains(needle) {
+                    offenders.push(format!("{}:{}  {}", file.display(), n + 1, raw.trim()));
+                }
+            }
+        }
+    }
+    assert!(
+        offenders.is_empty(),
+        "components must import no engine/state domain type (ADR-0019 invariant #4) — only \
+         `view_model::props`:\n{}",
+        offenders.join("\n")
+    );
+}
+
+#[test]
+fn components_emit_no_inline_style() {
+    let mut offenders: Vec<String> = Vec::new();
+    for file in component_files() {
+        let src = std::fs::read_to_string(&file).unwrap();
+        for (n, raw) in src.lines().enumerate() {
+            let line = strip_line_comment(raw);
+            // maud inline-style would appear as a `style=` attribute or a literal `<style>`.
+            if line.contains("style=") || line.contains("<style") {
+                offenders.push(format!("{}:{}  {}", file.display(), n + 1, raw.trim()));
+            }
+        }
+    }
+    assert!(
+        offenders.is_empty(),
+        "components must not emit inline `style=`/`<style>` (invariant #5) — use a class mapped \
+         to a STYLEGUIDE token:\n{}",
+        offenders.join("\n")
+    );
+}
+
+#[test]
+fn page_composition_emits_no_inline_style() {
+    // The page shell composes components; it must also stay token-driven (no inline style).
+    let page = read_engine_src("engine/dashboard/page.rs");
+    assert!(
+        !page.contains("style="),
+        "page.rs must not emit inline style"
+    );
+    assert!(
+        !page.contains("<style"),
+        "page.rs must not embed a <style> block"
+    );
+    // It must link the same-origin stylesheet (no third-party CSS — zero egress).
+    assert!(
+        page.contains("/assets/dashboard.css"),
+        "page links the same-origin stylesheet"
+    );
+    assert!(
+        !page.contains("http://") && !page.contains("https://"),
+        "page links nothing off-origin (zero-egress)"
+    );
+}
+
+#[test]
+fn served_assets_exist_and_are_same_origin() {
+    // The CSS/JS are served via include_str! from web/dist — they must exist and carry no
+    // off-origin reference (no CDN, no external fetch beyond the same-origin /fragment).
+    let css = repo_root().join("engine/web/dist/dashboard.css");
+    let js = repo_root().join("engine/web/dist/dashboard.js");
+    let css_src = std::fs::read_to_string(&css).unwrap_or_else(|e| panic!("reading {css:?}: {e}"));
+    let js_src = std::fs::read_to_string(&js).unwrap_or_else(|e| panic!("reading {js:?}: {e}"));
+    assert!(
+        !css_src.contains("@import url(http") && !css_src.contains("//fonts."),
+        "the stylesheet imports no third-party CSS (zero-egress)"
+    );
+    // The JS only talks to its own origin's /fragment.
+    assert!(
+        !js_src.contains("http://") && !js_src.contains("https://"),
+        "the client script makes no off-origin request (zero-egress)"
+    );
+    assert!(
+        js_src.contains("/fragment"),
+        "the client script polls the same-origin /fragment"
+    );
+}
diff --git a/engine/web/dist/dashboard.css b/engine/web/dist/dashboard.css
new file mode 100644
index 0000000..df63043
--- /dev/null
+++ b/engine/web/dist/dashboard.css
@@ -0,0 +1,381 @@
+/* Protector dashboard — light theme, generated from docs/STYLEGUIDE.md tokens.
+ * Served same-origin (no third-party CSS). A dense, light-theme information console:
+ * white/near-white surface, dark ink, monospace for all machine data. Calm by default,
+ * loud only on a real breach. Meaning is never carried by colour alone — every status
+ * also carries a glyph + word (the markup) and a distinct rail texture. */
+
+:root {
+  /* surfaces & ink (light) */
+  --bg: #FCFCFD;
+  --surface: #FFFFFF;
+  --surface-raised: #F4F6F8;
+  --surface-hover: #F0F2F5;
+  --border: #E2E6EB;
+  --ink-1: #1A1F26;
+  --ink-2: #5A6473;
+  --ink-3: #6B7280;
+
+  /* posture — the model's verdict (the loud channel) */
+  --posture-breach: #D92D20;
+  --posture-cleared: #067647;
+  --posture-uncertain: #B54708;
+  --posture-awaiting: #667085;
+
+  /* severity — CVE (subordinate, muted) */
+  --sev-critical: #B42318;
+  --sev-high: #B54708;
+  --sev-medium: #854A0E;
+  --sev-low: #6B7280;
+  --kev: #D92D20;
+
+  /* recency Δ, coverage, mode */
+  --delta-new: #1570EF;
+  --delta-up: #D92D20;
+  --delta-down: #067647;
+  --delta-restored: #6B7280;
+  --cov-present: #067647;
+  --cov-degraded: #B54708;
+  --cov-absent: #6B7280;
+  --mode-shadow: #667085;
+  --mode-enforce: #1570EF;
+
+  /* space (4px base) */
+  --space-1: 4px;
+  --space-2: 8px;
+  --space-3: 12px;
+  --space-4: 16px;
+  --space-6: 24px;
+  --space-8: 32px;
+
+  /* type */
+  --font-ui: Inter, system-ui, sans-serif;
+  --font-data: "JetBrains Mono", ui-monospace, monospace;
+
+  /* geometry */
+  --row-h: 36px;
+  --radius-chip: 3px;
+  --radius-panel: 6px;
+  --rail-strong: 3px;
+  --rail-soft: 2px;
+  --focus-ring: 2px solid #1570EF;
+}
+
+* { box-sizing: border-box; }
+
+html, body {
+  margin: 0;
+  background: var(--bg);
+  color: var(--ink-1);
+  font-family: var(--font-ui);
+  font-size: 14px;
+  line-height: 20px;
+}
+
+/* All machine data is monospace/tabular so columns align. */
+.mono, code, pre,
+.entry-label, .path-summary, .hop-list, .cut-sig,
+.ev-table td.mono, .cov-label, .count, .freshness {
+  font-family: var(--font-data);
+}
+
+/* ---- focus / a11y: focus ring always visible, visual = focus order ---- */
+a:focus-visible,
+button:focus-visible,
+summary:focus-visible,
+.tab:focus-visible,
+.why-toggle:focus-visible {
+  outline: var(--focus-ring);
+  outline-offset: 1px;
+}
+
+/* ============================ status strip ============================ */
+.strip {
+  background: var(--surface-raised);
+  border-bottom: 1px solid var(--border);
+  padding: var(--space-3) var(--space-4);
+}
+.strip-top {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: var(--space-4);
+}
+.strip-cluster { display: flex; align-items: center; gap: var(--space-2); }
+.brand { font-weight: 600; font-size: 16px; }
+.strip-cluster .sep { color: var(--ink-3); }
+.strip-cluster .cluster { color: var(--ink-2); font-family: var(--font-data); }
+
+.pill {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: flex-end;
+  padding: var(--space-1) var(--space-3);
+  border-radius: var(--radius-chip);
+  border: 1px solid var(--border);
+  background: var(--surface);
+}
+.pill-word { font-size: 11px; font-weight: 600; letter-spacing: 0.06em; }
+.pill-sub { font-size: 11px; color: var(--ink-3); }
+.mode-shadow .pill-word { color: var(--mode-shadow); }
+.mode-enforce .pill-word { color: var(--mode-enforce); }
+
+.strip-axes {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: var(--space-4);
+  margin-top: var(--space-3);
+  font-size: 13px;
+}
+.axis { display: inline-flex; align-items: center; gap: var(--space-2); }
+.axis .glyph { font-weight: 600; }
+
+/* the decided/judging axis — the honesty surface */
+.judging.ok { color: var(--posture-cleared); }
+.judging.ok .dot {
+  width: 8px; height: 8px; border-radius: 50%;
+  background: var(--posture-cleared); display: inline-block;
+}
+/* NOT-judging banners are amber/slate, NEVER the cleared green (invariant #1). */
+.judging.warming { color: var(--posture-uncertain); font-weight: 600; }
+.judging.blind { color: var(--posture-uncertain); font-weight: 600; }
+
+.coverage { gap: var(--space-2); }
+.cov {
+  display: inline-flex; align-items: center; gap: var(--space-1);
+  padding: 1px var(--space-2);
+  border-radius: var(--radius-chip);
+  border: 1px solid var(--border);
+  font-size: 11px; font-weight: 500;
+}
+.cov-label { letter-spacing: 0.04em; }
+.cov-present { color: var(--cov-present); border-color: var(--cov-present); }
+.cov-degraded { color: var(--cov-degraded); border-color: var(--cov-degraded); }
+.cov-absent { color: var(--cov-absent); }
+
+.freshness { color: var(--ink-2); }
+.muted { color: var(--ink-3); }
+
+.headline {
+  display: flex; flex-wrap: wrap; align-items: center;
+  gap: var(--space-3);
+  margin-top: var(--space-3);
+  font-size: 13px;
+}
+.count { display: inline-flex; align-items: center; gap: var(--space-1); }
+.count-breach { color: var(--posture-breach); font-weight: 600; }
+.count-awaiting { color: var(--posture-awaiting); }
+.count-cleared { color: var(--ink-2); }
+.count-escalated { color: var(--delta-up); font-weight: 600; }
+
+/* ============================ tab nav ============================ */
+.tabs {
+  display: flex; gap: var(--space-1);
+  padding: 0 var(--space-4);
+  background: var(--surface);
+  border-bottom: 1px solid var(--border);
+}
+.tab {
+  display: inline-flex; align-items: center; gap: var(--space-2);
+  padding: var(--space-3) var(--space-3);
+  color: var(--ink-2);
+  text-decoration: none;
+  border-bottom: 2px solid transparent;
+  font-size: 14px;
+}
+.tab:hover { background: var(--surface-hover); }
+.tab-active { color: var(--ink-1); font-weight: 600; border-bottom-color: var(--mode-enforce); }
+.tab-phase {
+  font-size: 10px; color: var(--ink-3);
+  border: 1px solid var(--border); border-radius: var(--radius-chip);
+  padding: 0 var(--space-1);
+}
+
+/* ============================ findings table ============================ */
+.view { padding: var(--space-4); }
+.findings {
+  width: 100%;
+  border-collapse: collapse;
+  background: var(--surface);
+  border: 1px solid var(--border);
+}
+.findings thead th {
+  text-align: left;
+  font-size: 11px; font-weight: 500; letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--ink-3);
+  padding: var(--space-2) var(--space-3);
+  border-bottom: 1px solid var(--border);
+  white-space: nowrap;
+}
+.findings th.num, .ev-table th.num, .ev-table td.num { text-align: right; }
+.row { height: var(--row-h); }
+.row:hover { background: var(--surface-hover); }
+.cell {
+  padding: var(--space-2) var(--space-3);
+  border-bottom: 1px solid var(--border);
+  vertical-align: middle;
+  font-size: 13px;
+}
+
+/* posture cell: rail texture conveys decisive/uncertain/awaiting even in greyscale */
+.posture { display: inline-flex; align-items: center; padding-left: var(--space-2); }
+.rail-breach { border-left: var(--rail-strong) solid var(--posture-breach); }
+.rail-cleared { border-left: var(--rail-soft) solid var(--posture-cleared); }
+.rail-uncertain { border-left: var(--rail-soft) dashed var(--posture-uncertain); }
+.rail-awaiting { border-left: var(--rail-soft) dotted var(--posture-awaiting); }
+
+.posture-chip { display: inline-flex; align-items: center; gap: var(--space-2); }
+.posture-chip .glyph { font-size: 13px; }
+.posture-word { font-size: 11px; font-weight: 600; letter-spacing: 0.03em; }
+.chip-breach { color: var(--posture-breach); }
+.chip-cleared { color: var(--posture-cleared); }
+.chip-uncertain { color: var(--posture-uncertain); }
+.chip-awaiting { color: var(--posture-awaiting); }
+
+.eo { display: inline-flex; align-items: center; gap: var(--space-1); flex-wrap: wrap; }
+.entry { display: inline-flex; align-items: center; gap: var(--space-1); }
+.kind-glyph { font-size: 13px; }
+.entry-label { font-weight: 600; }
+.arrow, .hop-arrow { color: var(--ink-3); }
+.objective { color: var(--ink-2); font-family: var(--font-data); }
+.objective.fanout { color: var(--ink-2); font-style: italic; }
+.path-summary { color: var(--ink-2); font-size: 12px; }
+.cut-mark { color: var(--posture-breach); }
+
+/* evidence cluster (subordinate severity channel) */
+.evidence-cluster { display: inline-flex; align-items: center; gap: var(--space-2); }
+.evidence-none { color: var(--ink-3); font-style: italic; }
+.ev {
+  display: inline-flex; align-items: center; gap: 2px;
+  font-size: 11px; padding: 0 var(--space-1);
+  border-radius: var(--radius-chip);
+}
+.ev-kev { background: var(--kev); color: #fff; font-weight: 600; padding: 0 var(--space-2); }
+.ev-cve { color: var(--ink-2); border: 1px solid var(--border); }
+.ev-runtime { color: var(--posture-breach); }
+.ev-secret { color: var(--sev-high); }
+
+.disp { color: var(--ink-2); font-size: 12px; }
+
+.subtag { font-size: 11px; font-weight: 600; }
+.subtag-live { color: var(--posture-breach); }
+.subtag-judged { color: var(--posture-uncertain); }
+.subtag-none { color: var(--ink-3); }
+
+/* Δ cell */
+.delta { display: inline-flex; align-items: center; }
+.delta .glyph { font-weight: 600; }
+.delta-new { color: var(--delta-new); }
+.delta-up { color: var(--delta-up); }
+.delta-down { color: var(--delta-down); }
+.delta-restored { color: var(--delta-restored); }
+.delta-steady { color: var(--ink-3); font-size: 12px; }
+
+/* ============================ detail panel ============================ */
+.row-detail td { padding: 0; border: 0; }
+.why { background: var(--surface); }
+.why[open] { background: var(--surface-raised); }
+.why-toggle {
+  cursor: pointer;
+  padding: var(--space-2) var(--space-4);
+  color: var(--mode-enforce);
+  font-size: 12px;
+  list-style: none;
+}
+.why-toggle::-webkit-details-marker { display: none; }
+.why-toggle::before { content: "\25B8 "; color: var(--ink-3); }
+.why[open] > .why-toggle::before { content: "\25BE "; }
+
+.detail {
+  background: var(--surface-raised);
+  padding: var(--space-4);
+  border-left: var(--rail-strong) solid var(--border);
+  border-radius: 0 0 var(--radius-panel) 0;
+}
+.detail.rail-breach { border-left-color: var(--posture-breach); }
+.detail.rail-cleared { border-left-color: var(--posture-cleared); }
+.detail.rail-uncertain { border-left-color: var(--posture-uncertain); }
+.detail.rail-awaiting { border-left-color: var(--posture-awaiting); }
+
+.detail-section { margin-bottom: var(--space-4); }
+.detail-h {
+  font-size: 11px; font-weight: 600; letter-spacing: 0.06em; text-transform: uppercase;
+  color: var(--ink-3);
+  margin: 0 0 var(--space-2);
+}
+.verdict-prose { margin: 0; font-size: 14px; line-height: 20px; }
+
+.hop-list { margin: 0; padding-left: var(--space-6); font-size: 13px; }
+.hop { margin: var(--space-1) 0; }
+.hop-structural { color: var(--ink-3); }
+.hop-rel { color: var(--ink-3); }
+.hop-cut { color: var(--posture-breach); font-weight: 600; }
+
+.cut-sig code {
+  display: inline-block;
+  background: var(--surface); border: 1px solid var(--border);
+  border-radius: var(--radius-chip); padding: 2px var(--space-2);
+  font-size: 12px;
+}
+.cut-revert { font-size: 12px; margin: var(--space-1) 0 0; }
+
+/* evidence tables — numerics right-aligned, severity muted */
+.ev-group { margin-bottom: var(--space-3); }
+.ev-table {
+  width: 100%; border-collapse: collapse;
+  font-family: var(--font-data); font-size: 12px;
+  background: var(--surface); border: 1px solid var(--border);
+}
+.ev-table th {
+  text-align: left; font-size: 11px; font-weight: 500; letter-spacing: 0.04em;
+  color: var(--ink-3); text-transform: uppercase;
+  padding: var(--space-1) var(--space-2); border-bottom: 1px solid var(--border);
+}
+.ev-table td { padding: var(--space-1) var(--space-2); border-bottom: 1px solid var(--border); }
+.ev-subrow td { color: var(--ink-3); }
+
+.sev { font-size: 11px; font-weight: 600; }
+.sev-critical { color: var(--sev-critical); }
+.sev-high { color: var(--sev-high); }
+.sev-medium { color: var(--sev-medium); }
+.sev-low { color: var(--sev-low); }
+
+.behavior-list { margin: var(--space-1) 0; padding-left: var(--space-4); font-size: 12px; }
+.behavior { margin: 2px 0; }
+.behavior-alert { color: var(--posture-breach); }
+.behavior-variant {
+  font-family: var(--font-data); font-size: 11px;
+  color: var(--ink-2); margin-right: var(--space-2);
+}
+.ev-sublabel { font-size: 11px; margin: var(--space-2) 0 var(--space-1); }
+
+.model-prompt { margin-top: var(--space-3); }
+.prompt-body { padding: var(--space-2) 0; }
+.prompt-text {
+  background: var(--surface); border: 1px solid var(--border);
+  border-radius: var(--radius-chip);
+  padding: var(--space-2); font-size: 12px;
+  white-space: pre-wrap; word-break: break-word;
+  max-height: 320px; overflow: auto;
+}
+
+/* ============================ empty / stub states ============================ */
+.empty, .stub {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius-panel);
+  padding: var(--space-8);
+  text-align: center;
+}
+.empty-head, .stub-head { font-size: 18px; font-weight: 600; margin: 0 0 var(--space-2); }
+.empty-sub, .stub-sub { margin: 0 auto; max-width: 60ch; }
+/* "all clear" is the ONLY posture-coloured empty state — and only when honestly earned. */
+.empty-clear .empty-head { color: var(--posture-cleared); }
+.empty-warming .empty-head { color: var(--posture-uncertain); }
+.empty-blind .empty-head { color: var(--posture-uncertain); }
+.stub-badge {
+  display: inline-block; font-size: 11px; color: var(--ink-3);
+  border: 1px solid var(--border); border-radius: var(--radius-chip);
+  padding: 0 var(--space-2); margin-bottom: var(--space-3);
+}
diff --git a/engine/web/dist/dashboard.js b/engine/web/dist/dashboard.js
new file mode 100644
index 0000000..81691e4
--- /dev/null
+++ b/engine/web/dist/dashboard.js
@@ -0,0 +1,117 @@
+// Protector dashboard — zero-dependency client script (served same-origin).
+//
+// Two jobs, both observational (the dashboard never acts):
+//   1. Persist which <details> "why" panels are expanded across live-poll swaps, keyed by the
+//      finding id (data-finding), so a refresh doesn't collapse what the operator opened.
+//   2. Poll /fragment for the active tab and swap the live region IN PLACE, preserving scroll
+//      position, expansion state, and the current tab/filter query — so a model that just went
+//      down flips the honest banner without the operator losing their place (design brief §7).
+//
+// No third-party code, no egress: it only talks to its own origin's /fragment.
+
+(function () {
+  "use strict";
+
+  var LIVE_ID = "live";
+  var POLL_MS = 5000;
+  var STORE_KEY = "protector.expanded";
+
+  // The set of expanded finding ids, persisted to sessionStorage so it survives a swap and a
+  // soft reload but not a new session.
+  function loadExpanded() {
+    try {
+      return new Set(JSON.parse(sessionStorage.getItem(STORE_KEY) || "[]"));
+    } catch (e) {
+      return new Set();
+    }
+  }
+  function saveExpanded(set) {
+    try {
+      sessionStorage.setItem(STORE_KEY, JSON.stringify(Array.from(set)));
+    } catch (e) {
+      /* sessionStorage unavailable — degrade to in-memory only */
+    }
+  }
+
+  var expanded = loadExpanded();
+
+  // Wire every <details data-finding> to record its open/closed state on toggle.
+  function bindDetails(root) {
+    var nodes = root.querySelectorAll("details[data-finding]");
+    for (var i = 0; i < nodes.length; i++) {
+      (function (el) {
+        var id = el.getAttribute("data-finding");
+        // Restore prior state on (re)bind.
+        if (expanded.has(id)) {
+          el.open = true;
+        }
+        el.addEventListener("toggle", function () {
+          if (el.open) {
+            expanded.add(id);
+          } else {
+            expanded.delete(id);
+          }
+          saveExpanded(expanded);
+          syncAria(el);
+        });
+        syncAria(el);
+      })(nodes[i]);
+    }
+  }
+
+  // Keep the summary's aria-expanded in sync with the details state (accessibility gate §6).
+  function syncAria(details) {
+    var summary = details.querySelector("summary");
+    if (summary) {
+      summary.setAttribute("aria-expanded", details.open ? "true" : "false");
+    }
+  }
+
+  // The active tab's fragment URL, preserving the current query (tab/filter), so a poll stays
+  // on the operator's view and is back-button correct.
+  function fragmentUrl() {
+    var params = window.location.search || "";
+    return "/fragment" + params;
+  }
+
+  // Poll /fragment and swap the live region's inner HTML, preserving scroll + expansion.
+  function poll() {
+    fetch(fragmentUrl(), { headers: { "X-Requested-With": "fragment" } })
+      .then(function (res) {
+        if (!res.ok) {
+          throw new Error("fragment " + res.status);
+        }
+        return res.text();
+      })
+      .then(function (html) {
+        var live = document.getElementById(LIVE_ID);
+        if (!live) {
+          return;
+        }
+        var scrollY = window.scrollY;
+        live.innerHTML = html;
+        bindDetails(live);
+        // Restore scroll — the swap reflows the list but the operator's position is kept.
+        window.scrollTo(0, scrollY);
+      })
+      .catch(function () {
+        // A failed poll (dashboard can't reach the engine, or a transient error) is left for
+        // the next tick — the last good render stays. The honest banner will follow once a
+        // fragment lands.
+      });
+  }
+
+  function start() {
+    var live = document.getElementById(LIVE_ID);
+    if (live) {
+      bindDetails(live);
+    }
+    window.setInterval(poll, POLL_MS);
+  }
+
+  if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", start);
+  } else {
+    start();
+  }
+})();

From ee09158fc3073c86ff5506dc465f5dc0f9594f1d Mon Sep 17 00:00:00 2001
From: Jeff Larson <thejefflarson@gmail.com>
Date: Sun, 28 Jun 2026 22:11:49 -0700
Subject: [PATCH 3/3] feat(dashboard): tighten green all-clear gate + elevate
 awaiting tone
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refinement A — green/calm only when the model is SURE nothing is happening.
The overall green/all-clear now renders ONLY when the model has affirmatively
cleared everything it is looking at: judging AND covered (no degraded feed)
AND zero breaches AND zero awaiting AND zero uncertain. If the model is up but
hasn't finished (any entry still awaiting/uncertain, or a feed degraded), the
strip + empty state render a new elevated, NON-green "watching" reading — quiet
because the model hasn't finished, visibly distinct from quiet because it
affirmatively cleared. StatusStripProps gains uncertain_count and the
all_clear()/watching()/fully_covered()/model_is_up() gates (replacing
calm_is_honest). Guard tests extended: green/all-clear is forbidden when any
entry is awaiting or uncertain, not just when !model_judging.

Refinement B — pre-judgements (Awaiting) read slightly elevated.
--posture-awaiting moves from slate #667085 to a muted ochre #9A6B2E (clearly
below Uncertain's stronger amber-brown #B54708), with a new
--posture-awaiting-tint #FBF6EC backing the awaiting chip and tinting the
un-judged row (data-posture="awaiting"). The awaiting glyph (◌) and word
("awaiting judgement") stay — meaning never by colour alone. The strip headline
gains an uncertain count and keeps awaiting in the elevated ochre tone.

Styleguide is the source of truth; CSS, view_model, components, and tests match
it. All gates green: build, fmt, clippy -D warnings, full test suite (incl.
dashboard guards + file_size_guard), helm lint/template. No file > 1000 lines.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP
---
 docs/STYLEGUIDE.md                            | 28 +++++---
 docs/dashboard-v3-design.md                   | 14 ++--
 .../dashboard/components/findings_view.rs     | 20 +++++-
 .../dashboard/components/status_strip.rs      | 39 +++++++---
 engine/src/engine/dashboard/tests.rs          | 72 +++++++++++++++++++
 engine/src/engine/dashboard/view_model/mod.rs |  8 ++-
 .../src/engine/dashboard/view_model/props.rs  | 39 ++++++++--
 .../src/engine/dashboard/view_model/strip.rs  | 41 +++++++++--
 engine/web/dist/dashboard.css                 | 24 ++++++-
 9 files changed, 248 insertions(+), 37 deletions(-)

diff --git a/docs/STYLEGUIDE.md b/docs/STYLEGUIDE.md
index 5f4544e..d7df905 100644
--- a/docs/STYLEGUIDE.md
+++ b/docs/STYLEGUIDE.md
@@ -8,8 +8,12 @@ calm by default, loud only on a real breach.
 
 ## Principles
 
-1. **Honesty over reassurance.** Green/calm is shown ONLY while the model is judging; unknown
-   and awaiting are never green. (Test-enforced — see the gate.)
+1. **Honesty over reassurance.** The overall green/all-clear is shown ONLY when the model has
+   *affirmatively cleared everything it is looking at* — judging AND covered AND zero breaches
+   AND zero entries still awaiting judgement AND zero uncertain. If any entry is still awaiting
+   or uncertain, the model isn't yet sure, so the posture is the elevated **"watching"** state
+   (calm but not green), never all-clear. Unknown and awaiting are never green. (Test-enforced —
+   see the gate.)
 2. **Posture ≠ severity.** The model's verdict is the loud channel; CVE severity is a cooler,
    subordinate channel. A wall of critical CVEs must never look like a wall of breaches.
 3. **Meaning never by colour alone.** Every status carries colour **+ glyph + word**.
@@ -38,9 +42,12 @@ calm by default, loud only on a real breach.
 | `--posture-breach` | `#D92D20` | ● filled | BREACH / EXPLOITABLE | 3px solid |
 | `--posture-cleared` | `#067647` | ○ open | not exploitable | 2px solid |
 | `--posture-uncertain` | `#B54708` | ◐ half | uncertain | 2px **dashed** |
-| `--posture-awaiting` | `#667085` | ◌ dotted | awaiting judgement | 2px **dotted** |
+| `--posture-awaiting` | `#9A6B2E` | ◌ dotted | awaiting judgement | 2px **dotted** |
 
-Uncertain & awaiting are amber-brown / slate — **never** the cleared green. Dashed/dotted
+Uncertain is a stronger amber-brown; **awaiting is a softer, muted ochre — slightly elevated,
+clearly *below* uncertain's intensity**. Neither is ever the cleared green. An un-judged exposed
+path reads as "pending the model's call / mild attention," not "fine" and not "uncertain." A
+subtle ochre tint backs the awaiting row/chip (`--posture-awaiting-tint: #FBF6EC`). Dashed/dotted
 rails make "not decided" texturally distinct even in greyscale.
 
 ### Colour — severity (CVE/`ScanFinding`; subordinate, muted)
@@ -81,7 +88,7 @@ Two weights only (400/600). Emphasis via weight + ink value, not a third weight.
 | Component | Tokens |
 |---|---|
 | Page / app frame | `--bg`, `--font-ui` |
-| Status strip | `--surface-raised`; posture-* count chips; honest banner uses `--posture-uncertain`/`--posture-awaiting`, **never** `--posture-cleared` |
+| Status strip | `--surface-raised`; posture-* count chips; green all-clear (`--posture-cleared`) only when judging+covered+nothing breach/awaiting/uncertain; elevated "watching" (judged+covered but still awaiting/uncertain) and the blind/warming banner use `--posture-awaiting`/`--posture-uncertain`, **never** `--posture-cleared` |
 | Finding row | `--surface`, `--row-h`, `--border` grid; entry/path `--font-data` `--text-data` |
 | Posture cell | `--posture-*` (rail style: solid=decisive, dashed=uncertain, dotted=awaiting) + glyph + word |
 | Severity chip | `--sev-*` border (muted); KEV → `--kev` fill |
@@ -96,9 +103,14 @@ Two weights only (400/600). Emphasis via weight + ink value, not a third weight.
 1. **Contrast:** body/status text ≥ **4.5:1** on its surface; chips/rails/glyphs ≥ **3:1**.
 2. **Meaning not by colour alone:** every posture / severity / Δ / coverage state renders a
    non-empty **glyph + text label** in addition to colour. (Assert each enum→(glyph,label).)
-3. **Honest-calm invariant:** `model_judging == false` OR `warming_up` ⇒ the status strip
-   never resolves to `--posture-cleared`/green and the honest banner renders. `Verdict::Uncertain`
-   and awaiting (`None`) never map to the cleared/green token.
+3. **Honest-calm invariant:** the overall green/all-clear resolves to `--posture-cleared`/green
+   ONLY when the model has affirmatively cleared everything — `model_judging == true` AND not
+   `warming_up` AND **covered** AND **zero breaches AND zero awaiting AND zero uncertain**. If
+   `model_judging == false` OR `warming_up`, the honest blind/warming banner renders. If the
+   model is judging+covered but **any** entry is still awaiting or uncertain, the strip renders
+   the elevated **"watching"** state (`--posture-awaiting` toned, calm — *not* green): the model
+   hasn't finished, so quiet is not clearance. `Verdict::Uncertain` and awaiting (`None`) never
+   map to the cleared/green token.
 4. **No implied-absent blanks:** any empty evidence/coverage field renders explicit
    "none"/"unknown".
 5. **Escaping:** all untrusted free-text (verdict prose, CVE/finding titles, model prompts,
diff --git a/docs/dashboard-v3-design.md b/docs/dashboard-v3-design.md
index 1b0e032..59c615e 100644
--- a/docs/dashboard-v3-design.md
+++ b/docs/dashboard-v3-design.md
@@ -52,9 +52,15 @@ Three **orthogonal axes** that must never collapse into one signal:
 - **decided vs awaiting** — has the model judged this entry yet?
 - **covered vs blind** — is the model up and are the feeds loaded?
 
-**Green/calm is only honest when `model_judging == true`.** If `warming_up` or
-`!model_judging`, exposed paths are *unjudged, not cleared*, and the UI says so. `Uncertain`
-and `Awaiting` are **never** green. This is enforced by tests, not just convention.
+**The overall green/all-clear is only honest when the model has affirmatively cleared everything
+it is looking at** — `model_judging == true` AND not `warming_up` AND **covered** (no feed
+degraded) AND **zero breaches AND zero entries still awaiting AND zero uncertain**. "Quiet because
+the model affirmatively cleared it" (green) must look different from "quiet because the model
+hasn't finished." If the model is up but anything is still `Awaiting` or `Uncertain`, the overall
+posture is the elevated **"watching"** state — calm but **not** green (the model isn't sure yet).
+If `warming_up` or `!model_judging`, exposed paths are *unjudged, not cleared*, and the UI says
+so. `Uncertain` and `Awaiting` are **never** green. This is enforced by tests, not just
+convention.
 
 ## 4. Information architecture
 
@@ -155,7 +161,7 @@ deeper than two levels. **Admission/policy** decisions fold in as a peer surface
 
 ## 9. Invariants (test-enforced)
 
-1. `!model_judging` or `warming_up` ⇒ the status strip never renders the green/all-clear path; the honest banner renders.
+1. The overall green/all-clear renders ONLY when judging + covered + zero breach/awaiting/uncertain; if `!model_judging` or `warming_up`, the honest blind/warming banner renders; if judging but anything is still awaiting/uncertain, the elevated "watching" (non-green) state renders.
 2. `Verdict::Uncertain` and awaiting (`None`) never map to the cleared/green token.
 3. Empty evidence/coverage renders explicit "none"/"unknown", never a blank.
 4. Components import no `engine::`/`state::` domain type (the view_model/component boundary).
diff --git a/engine/src/engine/dashboard/components/findings_view.rs b/engine/src/engine/dashboard/components/findings_view.rs
index 7193d35..fb112f7 100644
--- a/engine/src/engine/dashboard/components/findings_view.rs
+++ b/engine/src/engine/dashboard/components/findings_view.rs
@@ -51,7 +51,10 @@ fn findings_table(v: &FindingsViewProps) -> Markup {
 /// judging; when blind/warming the empty list reads as "we haven't looked", never as safe
 /// (the cardinal sin the design exists to prevent — brief §0/§9 invariant #1).
 fn empty_state(v: &FindingsViewProps) -> Markup {
-    if v.strip.calm_is_honest() {
+    // GREEN all-clear only when the model has affirmatively cleared everything (judging +
+    // covered + nothing breach/awaiting/uncertain). An empty list satisfies the count side, so
+    // here it turns on whether the model is up AND fully covered (invariant #1).
+    if v.strip.all_clear() {
         return html! {
             div.empty.empty-clear {
                 p.empty-head { "all clear" }
@@ -61,7 +64,20 @@ fn empty_state(v: &FindingsViewProps) -> Markup {
             }
         };
     }
-    // Not honestly calm: an empty list is NOT a clearance. Say so, in the matching non-green
+    // Model up but not fully covered (a feed is degraded): the empty list is calm but NOT a green
+    // all-clear — the elevated "watching" register (the model isn't fully equipped to clear).
+    if v.strip.watching() {
+        return html! {
+            div.empty.empty-watching {
+                p.empty-head { "watching" }
+                p.empty-sub.muted {
+                    "no breach-relevant exposed paths yet, but a decision feed is degraded \u{2014} \
+                     the model is judging but not fully equipped to clear. This is not an all-clear."
+                }
+            }
+        };
+    }
+    // Model down/warming: an empty list is NOT a clearance. Say so, in the matching non-green
     // amber/slate register.
     let (cls, head, sub) = if v.strip.warming_up {
         (
diff --git a/engine/src/engine/dashboard/components/status_strip.rs b/engine/src/engine/dashboard/components/status_strip.rs
index a6c95fb..51514fc 100644
--- a/engine/src/engine/dashboard/components/status_strip.rs
+++ b/engine/src/engine/dashboard/components/status_strip.rs
@@ -48,11 +48,33 @@ fn mode_pill(armed: bool) -> Markup {
     }
 }
 
-/// The decided/judging axis. This is where the honest-calm invariant lives: only a judging,
-/// warmed model shows the calm "model judging" reading; otherwise the honest banner.
+/// The decided/judging axis. This is where the honest-calm invariant lives (#1): the GREEN
+/// "all clear" reading is shown ONLY when the model has affirmatively cleared everything it is
+/// looking at (judging + covered + nothing breach/awaiting/uncertain). When the model is up but
+/// hasn't finished (something still awaiting/uncertain), it shows the elevated, NON-green
+/// "watching" reading. When the model is down/warming, the honest blind/warming banner.
 fn judging_axis(s: &StatusStripProps) -> Markup {
-    // The honest-calm invariant (#1): calm only when judging AND not warming.
-    if s.calm_is_honest() {
+    // Affirmatively-cleared everything ⇒ the only honest green all-clear.
+    if s.all_clear() {
+        return html! {
+            span.axis.judging.ok {
+                span.dot {}
+                "model judging \u{2014} all clear"
+            }
+        };
+    }
+    // Model up but not finished (awaiting/uncertain still open, or a feed degraded): elevated
+    // "watching" — calm, NOT green. Quiet here is "hasn't finished", not "cleared".
+    if s.watching() {
+        return html! {
+            span.axis.judging.watching {
+                span.glyph { "\u{25CC}" }
+                "model judging \u{2014} watching (not yet all-clear)"
+            }
+        };
+    }
+    // Model up with a breach is loud elsewhere (the headline/rows); the axis just states it judges.
+    if s.model_is_up() {
         return html! {
             span.axis.judging.ok {
                 span.dot {}
@@ -60,7 +82,7 @@ fn judging_axis(s: &StatusStripProps) -> Markup {
             }
         };
     }
-    // Not honestly calm — render the distinct, NON-green honest banner. The wording tells the
+    // Model down/warming — render the distinct, NON-green honest banner. The wording tells the
     // operator WHY quiet is not clearance.
     let (cls, glyph, text) = if s.warming_up {
         (
@@ -118,14 +140,15 @@ fn coverage_chip(chip: &CoverageChip) -> Markup {
     }
 }
 
-/// The findings headline line: breach / awaiting / cleared counts + the Δ escalation note. The
-/// breach count is the only loud chip; awaiting/cleared are calm. Counts are honest even at
-/// zero (never blank).
+/// The findings headline line: breach / awaiting / uncertain / cleared counts + the Δ escalation
+/// note. The breach count is the only loud chip; awaiting (ochre) and uncertain (amber-brown) are
+/// elevated-but-calm; cleared is muted. Counts are honest even at zero (never blank).
 fn headline(s: &StatusStripProps) -> Markup {
     html! {
         div.headline {
             span.count.count-breach { (s.breach_count) " breach" }
             span.count.count-awaiting { (s.awaiting_count) " awaiting" }
+            span.count.count-uncertain { (s.uncertain_count) " uncertain" }
             span.count.count-cleared { (s.cleared_count) " cleared" }
             @if s.escalated_count > 0 {
                 span.count.count-escalated {
diff --git a/engine/src/engine/dashboard/tests.rs b/engine/src/engine/dashboard/tests.rs
index 87b23e5..946ab55 100644
--- a/engine/src/engine/dashboard/tests.rs
+++ b/engine/src/engine/dashboard/tests.rs
@@ -124,6 +124,51 @@ fn judging_empty_is_the_only_state_that_says_all_clear() {
     assert!(html.contains("model judging"));
 }
 
+#[test]
+fn judging_but_awaiting_entry_is_watching_not_all_clear() {
+    // Refinement A: green/all-clear is forbidden when ANY entry is still awaiting, even though
+    // the model is actively judging. The strip shows the elevated "watching" state instead.
+    let mut awaiting = breach_finding("endpoint/a", Verdict::Confirmed);
+    awaiting.verdict = None; // no verdict yet ⇒ Awaiting
+    let view = build_findings_view(
+        "prod".into(),
+        &[awaiting],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        !html.contains("all clear"),
+        "an awaiting entry forbids the green all-clear"
+    );
+    assert!(
+        html.contains("watching"),
+        "it is the elevated watching state instead"
+    );
+    assert!(html.contains("not yet all-clear"));
+}
+
+#[test]
+fn judging_but_uncertain_entry_is_not_all_clear() {
+    // Refinement A: an Uncertain entry likewise forbids the green all-clear.
+    let f = breach_finding("endpoint/a", Verdict::Uncertain("timed out".into()));
+    let view = build_findings_view(
+        "prod".into(),
+        &[f],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        !html.contains("all clear"),
+        "an uncertain entry forbids the green all-clear"
+    );
+    // The watching reading is present on the strip (the model is up but not finished).
+    assert!(html.contains("watching"));
+}
+
 // ---------------------------------------------------------------------------
 // Invariant #2 — Uncertain & awaiting never map to the cleared/green token.
 // ---------------------------------------------------------------------------
@@ -155,6 +200,33 @@ fn uncertain_and_awaiting_rows_are_not_green() {
     assert!(!html.contains("chip-cleared\""), "no cleared chip leaked");
 }
 
+#[test]
+fn awaiting_row_carries_the_elevated_treatment_hooks() {
+    // Refinement B: an un-judged (awaiting) entry must render the elevated chip + a row the CSS
+    // can tint (data-posture="awaiting") — slightly elevated, not calm slate. Meaning stays
+    // carried by glyph + word too (never colour alone).
+    let mut awaiting = breach_finding("endpoint/a", Verdict::Confirmed);
+    awaiting.verdict = None;
+    let view = build_findings_view(
+        "prod".into(),
+        &[awaiting],
+        &[],
+        &judging_readiness(),
+        Some(SystemTime::now()),
+    );
+    let html = page::findings_page(&view).into_string();
+    assert!(
+        html.contains("data-posture=\"awaiting\""),
+        "the row exposes the awaiting hook the tint CSS targets"
+    );
+    assert!(
+        html.contains("chip-awaiting"),
+        "the chip carries the ochre tone"
+    );
+    // Meaning not by colour alone: the word stays.
+    assert!(html.contains("awaiting judgement"));
+}
+
 // ---------------------------------------------------------------------------
 // Invariant #3 — empty evidence renders explicit "none", never a blank.
 // ---------------------------------------------------------------------------
diff --git a/engine/src/engine/dashboard/view_model/mod.rs b/engine/src/engine/dashboard/view_model/mod.rs
index 64cdff1..e00a728 100644
--- a/engine/src/engine/dashboard/view_model/mod.rs
+++ b/engine/src/engine/dashboard/view_model/mod.rs
@@ -36,6 +36,10 @@ pub fn build_findings_view(
         .iter()
         .filter(|r| r.posture == Posture::Awaiting)
         .count();
+    let uncertain = rows
+        .iter()
+        .filter(|r| r.posture == Posture::Uncertain)
+        .count();
     let cleared = rows
         .iter()
         .filter(|r| r.posture == Posture::Cleared)
@@ -45,7 +49,7 @@ pub fn build_findings_view(
         .filter(|r| matches!(r.delta, props::DeltaProps::Escalated))
         .count();
     let strip = strip::status_strip(
-        cluster, readiness, last_pass, breach, awaiting, cleared, escalated,
+        cluster, readiness, last_pass, breach, awaiting, uncertain, cleared, escalated,
     );
     FindingsViewProps {
         strip,
@@ -60,5 +64,5 @@ pub fn build_status_strip(
     readiness: &Readiness,
     last_pass: Option<SystemTime>,
 ) -> StatusStripProps {
-    strip::status_strip(cluster, readiness, last_pass, 0, 0, 0, 0)
+    strip::status_strip(cluster, readiness, last_pass, 0, 0, 0, 0, 0)
 }
diff --git a/engine/src/engine/dashboard/view_model/props.rs b/engine/src/engine/dashboard/view_model/props.rs
index 57c1d00..085ec77 100644
--- a/engine/src/engine/dashboard/view_model/props.rs
+++ b/engine/src/engine/dashboard/view_model/props.rs
@@ -282,21 +282,50 @@ pub struct StatusStripProps {
     pub coverage: Vec<CoverageChip>,
     /// Human "last pass NNs ago", or `None` before the first pass.
     pub last_pass: Option<String>,
-    /// The headline counts (breach / awaiting / cleared) for the findings summary line.
+    /// The headline counts (breach / awaiting / uncertain / cleared) for the findings summary
+    /// line.
     pub breach_count: usize,
     pub awaiting_count: usize,
+    /// Entries the model could not decide (`Verdict::Uncertain`) — not safe, never green.
+    pub uncertain_count: usize,
     pub cleared_count: usize,
     /// Newly-escalated since last pass (the Δ headline).
     pub escalated_count: usize,
 }
 
 impl StatusStripProps {
-    /// Whether a calm/all-clear render is HONEST: only when the model is actively judging and
-    /// not warming up (invariant #1). When false, the honest "blind/warming" banner renders
-    /// instead of any green all-clear.
-    pub fn calm_is_honest(&self) -> bool {
+    /// Whether the model is up and answering (not warming/blind). This is the floor for a
+    /// non-blind render — but it is NOT enough for a green all-clear (see [`Self::all_clear`]).
+    pub fn model_is_up(&self) -> bool {
         self.model_judging && !self.warming_up
     }
+
+    /// Whether the engine is **covered** enough to call an all-clear: the model is up and no feed
+    /// is *degraded* (configured but not answering — a real, ambiguity-introducing coverage gap).
+    /// A feed that is simply absent (never deployed, e.g. the optional eBPF agent) is an honest
+    /// known-absence, not a degradation, so it does not by itself block the all-clear.
+    pub fn fully_covered(&self) -> bool {
+        self.model_is_up() && self.coverage.iter().all(|c| !c.degraded)
+    }
+
+    /// Whether the overall **green/all-clear** is HONEST: the model has affirmatively cleared
+    /// EVERYTHING it is looking at — judging, not warming, fully covered, and zero breaches AND
+    /// zero entries still awaiting AND zero uncertain (the tightened honesty gate, invariant #1).
+    /// "Quiet because the model affirmatively cleared it" is the ONLY thing that may go green.
+    pub fn all_clear(&self) -> bool {
+        self.fully_covered()
+            && self.breach_count == 0
+            && self.awaiting_count == 0
+            && self.uncertain_count == 0
+    }
+
+    /// Whether the strip should show the elevated **"watching"** state: the model is up but has
+    /// NOT yet affirmatively cleared everything — something is still awaiting or uncertain (or a
+    /// feed is missing). Calm, but **not** green — the model isn't sure yet. Distinct from a
+    /// breach (which is loud) and from blind/warming (model down).
+    pub fn watching(&self) -> bool {
+        self.model_is_up() && self.breach_count == 0 && !self.all_clear()
+    }
 }
 
 /// One coverage chip in the status strip (a feed's presence).
diff --git a/engine/src/engine/dashboard/view_model/strip.rs b/engine/src/engine/dashboard/view_model/strip.rs
index f97cc4d..e1f386d 100644
--- a/engine/src/engine/dashboard/view_model/strip.rs
+++ b/engine/src/engine/dashboard/view_model/strip.rs
@@ -50,12 +50,14 @@ fn armed_from(readiness: &Readiness) -> bool {
 /// Build the status-strip props. `cluster` is the cluster label; `last_pass` the engine's
 /// last-pass time (for the freshness line); the headline counts come from the mapped findings
 /// (filled by the caller — see [`super::build_status_strip`]). Pure given its inputs.
+#[allow(clippy::too_many_arguments)]
 pub(super) fn status_strip(
     cluster: String,
     readiness: &Readiness,
     last_pass: Option<SystemTime>,
     breach_count: usize,
     awaiting_count: usize,
+    uncertain_count: usize,
     cleared_count: usize,
     escalated_count: usize,
 ) -> StatusStripProps {
@@ -69,6 +71,7 @@ pub(super) fn status_strip(
         last_pass: last_pass.map(last_pass_age),
         breach_count,
         awaiting_count,
+        uncertain_count,
         cleared_count,
         escalated_count,
     }
@@ -103,8 +106,11 @@ mod tests {
         let mut bake = BakeStats::default();
         bake.signals_by_variant.insert("alert".into(), 1);
         let r = derive_readiness(&covered(), ModelHealth::Ok, &bake, Some(SystemTime::now()));
-        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 3, 0);
-        assert!(strip.calm_is_honest());
+        // Judging + covered + nothing breach/awaiting/uncertain (3 cleared) ⇒ honest all-clear.
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 3, 0);
+        assert!(strip.model_is_up());
+        assert!(strip.all_clear());
+        assert!(!strip.watching());
         assert!(!strip.armed);
         // KEV/EPSS present; Falco present (alert signal); eBPF absent.
         let falco = strip.coverage.iter().find(|c| c.label == "Falco").unwrap();
@@ -121,8 +127,10 @@ mod tests {
             &BakeStats::default(),
             Some(SystemTime::now()),
         );
-        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 0);
-        assert!(!strip.calm_is_honest());
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 0, 0, 0, 0);
+        assert!(!strip.model_is_up());
+        assert!(!strip.all_clear());
+        assert!(!strip.watching()); // model down ⇒ neither all-clear nor watching
         assert!(strip.model_attached); // configured, just not answering
     }
 
@@ -134,9 +142,30 @@ mod tests {
             &BakeStats::default(),
             None,
         );
-        let strip = status_strip("prod".into(), &r, None, 0, 0, 0, 0);
-        assert!(!strip.calm_is_honest());
+        let strip = status_strip("prod".into(), &r, None, 0, 0, 0, 0, 0);
+        assert!(!strip.model_is_up());
+        assert!(!strip.all_clear());
         assert!(strip.warming_up);
         assert!(strip.last_pass.is_none());
     }
+
+    /// Judging + covered but an entry is still awaiting/uncertain ⇒ NOT all-clear; the elevated
+    /// "watching" state (the model hasn't finished — quiet is not clearance). Refinement A.
+    #[test]
+    fn judging_with_pending_entries_is_watching_not_all_clear() {
+        let mut bake = BakeStats::default();
+        bake.signals_by_variant.insert("alert".into(), 1);
+        let r = derive_readiness(&covered(), ModelHealth::Ok, &bake, Some(SystemTime::now()));
+        // One entry still awaiting, one still uncertain — model hasn't cleared everything.
+        let strip = status_strip("prod".into(), &r, Some(SystemTime::now()), 0, 1, 1, 4, 0);
+        assert!(strip.model_is_up());
+        assert!(
+            !strip.all_clear(),
+            "pending entries forbid the green all-clear"
+        );
+        assert!(
+            strip.watching(),
+            "it is the elevated watching state instead"
+        );
+    }
 }
diff --git a/engine/web/dist/dashboard.css b/engine/web/dist/dashboard.css
index df63043..0d32a91 100644
--- a/engine/web/dist/dashboard.css
+++ b/engine/web/dist/dashboard.css
@@ -19,7 +19,10 @@
   --posture-breach: #D92D20;
   --posture-cleared: #067647;
   --posture-uncertain: #B54708;
-  --posture-awaiting: #667085;
+  /* awaiting (pre-judgement): a muted ochre — slightly elevated, clearly below uncertain's
+     intensity; reads as "pending the model's call", not "fine" and not "uncertain". */
+  --posture-awaiting: #9A6B2E;
+  --posture-awaiting-tint: #FBF6EC;
 
   /* severity — CVE (subordinate, muted) */
   --sev-critical: #B42318;
@@ -136,6 +139,9 @@ summary:focus-visible,
   width: 8px; height: 8px; border-radius: 50%;
   background: var(--posture-cleared); display: inline-block;
 }
+/* Judging-but-not-finished ("watching"): elevated ochre, calm — NEVER the cleared green
+   (invariant #1). Distinct from the loud breach channel and from the blind/warming banner. */
+.judging.watching { color: var(--posture-awaiting); font-weight: 600; }
 /* NOT-judging banners are amber/slate, NEVER the cleared green (invariant #1). */
 .judging.warming { color: var(--posture-uncertain); font-weight: 600; }
 .judging.blind { color: var(--posture-uncertain); font-weight: 600; }
@@ -164,7 +170,9 @@ summary:focus-visible,
 }
 .count { display: inline-flex; align-items: center; gap: var(--space-1); }
 .count-breach { color: var(--posture-breach); font-weight: 600; }
+/* awaiting reads slightly elevated (ochre), below uncertain's stronger amber-brown. */
 .count-awaiting { color: var(--posture-awaiting); }
+.count-uncertain { color: var(--posture-uncertain); }
 .count-cleared { color: var(--ink-2); }
 .count-escalated { color: var(--delta-up); font-weight: 600; }
 
@@ -231,7 +239,17 @@ summary:focus-visible,
 .chip-breach { color: var(--posture-breach); }
 .chip-cleared { color: var(--posture-cleared); }
 .chip-uncertain { color: var(--posture-uncertain); }
-.chip-awaiting { color: var(--posture-awaiting); }
+/* awaiting reads slightly elevated: ochre ink + a soft tint behind the chip — mild attention,
+   not calm slate, and clearly below uncertain (no dashed rail). */
+.chip-awaiting {
+  color: var(--posture-awaiting);
+  background: var(--posture-awaiting-tint);
+  border-radius: var(--radius-chip);
+  padding: 0 var(--space-1);
+}
+/* the whole un-judged row carries a subtle ochre tint so a pending path doesn't read as "fine". */
+.row[data-posture="awaiting"] { background: var(--posture-awaiting-tint); }
+.row[data-posture="awaiting"]:hover { background: var(--surface-hover); }
 
 .eo { display: inline-flex; align-items: center; gap: var(--space-1); flex-wrap: wrap; }
 .entry { display: inline-flex; align-items: center; gap: var(--space-1); }
@@ -372,6 +390,8 @@ summary:focus-visible,
 .empty-sub, .stub-sub { margin: 0 auto; max-width: 60ch; }
 /* "all clear" is the ONLY posture-coloured empty state — and only when honestly earned. */
 .empty-clear .empty-head { color: var(--posture-cleared); }
+/* watching: judged but not yet all-clear — elevated ochre, never green (invariant #1). */
+.empty-watching .empty-head { color: var(--posture-awaiting); }
 .empty-warming .empty-head { color: var(--posture-uncertain); }
 .empty-blind .empty-head { color: var(--posture-uncertain); }
 .stub-badge {