One shared record behind every enquiry and trip.

Six fixed return destinations keep each field section and the Check and save area paired with its existing navigator shortcut.

The matching shortcut shows its latest row count, required-value progress and first-missing destination after accepted edits.

Returning focuses the shortcut but never activates it, re-enters a section, runs Check or saves the draft.

Use only fictional or masked trip planning. Never enter real traveller contact, passport, identity, health or confidential document information.

Use fictional tasks, references and planning amounts. Never enter card, bank, payment, supplier credential, real booking or settlement information.

Use approved pilot teammate account emails and non-sensitive internal defaults. Never paste customer records, supplier logins or confidential documents.

Fixed wording identifies the first missing field and current row without repeating entered values, currencies or internal keys.

Labels and stable targets update together after additions, duplication, reordering, removal, Undo and revision-mode changes.

Completed or empty sections still open at their heading, and every other section entry path keeps its established destination.

Fixed interface wording identifies the exact field without repeating entered titles, notes, currencies or other draft text.

Current row positions update after accepted additions, duplication, reordering, removal, Undo and revision-mode changes.

The same ordered descriptor and stable row key still control the existing explicit focus action and its safety guards.

Quote details, manual rates, price items, itinerary and the revision-only explanation are grouped by their rendered section.

The section totals use the same descriptors as the overall count and first-missing shortcut across every accepted draft change.

A nonblank value counts as present, not valid. Check draft, Save and server verification keep every existing rule.

Accepted additions, copies, reordering, removal, Undo and revision mode all update the destination through stable current row keys.

Whitespace is missing, while a nonblank invalid value remains for Check draft and Save to assess through their existing rules.

The shortcut moves focus only after an explicit click. It does not edit, validate, save, request or publish anything.

Manual rates, price items, itinerary entries and the revision-only explanation update the count as their required inputs change.

A nonblank value counts as present, not valid. Check draft and Save still apply every format, relationship, timing and range rule.

The summary is derived from the current unsaved draft, repeats no entered wording and creates no saved progress record.

Manual-rate value, source and observed time plus every item quantity now use the same clear asterisk convention.

Native required semantics expose the field state without making screen readers repeat each decorative asterisk.

Optional inputs stay optional, and the existing Check, Save and server rules keep their order and exact behavior.

Exact rational conversion and running-subtotal bounds follow the same deterministic arithmetic as the server.

Guidance leads to the first crossing price item, or to markup, service fee or rounding when that later step exceeds the range.

Draft values and valid payloads stay unchanged. Save still performs the authoritative total calculation and final verification.

Valid until must be today's UTC date or later.

An Observed at time may be up to exactly five minutes ahead of the sampled current time.

Guidance returns to the exact field without rewriting it. The server independently verifies time again when saving.

Rates keep up to nine whole and six decimal digits. Source costs and service fees stay within the supported amount range.

Clear guidance and Go to field lead back to the exact rate row, price item, service fee or rounding choice that needs attention.

Your draft is never rewritten automatically. The server still verifies the request and calculates every saved quote total.

Counts follow current price-item currencies as you edit, duplicate or remove entries. They describe references, not rate validity.

Go to field returns to the exact source-currency input. Use that currency for a price item or remove the rate yourself.

Rates are never removed or converted automatically. Existing Undo remains available, and the server still calculates saved totals.

Local checks catch invalid days and months, including leap-year mistakes. Your entered dates are never corrected automatically.

Itinerary dates may stay blank. Repeated dates and your chosen entry order are preserved, without sorting or shifting the plan.

Go to field takes you to the relevant date input. Checking does not save, and the server still verifies expiry when you save.

Local checks compare normalized text with the current save rules. Character counters continue to show the separate input allowance.

Feedback identifies the field or current entry to revise. Go to field takes you there while keeping your draft intact.

Nothing is shortened or rewritten automatically. Check draft does not save; valid text retains its existing save preparation.

Keep up to 20 distinct non-empty lines, with up to 240 saved-text characters per line. Blank and repeated trimmed lines do not inflate the count.

An overlong-line message names its original line number. Go to field returns directly to Inclusions or Exclusions.

Checks do not shorten or rewrite your draft. Valid notes retain their existing save preparation, and Check never saves a record.

See current length alongside each allowance, with clear wording when the allowance is reached or an existing value exceeds it.

The summary field now allows 1,000 characters, matching the existing save rule. Existing draft text is never shortened.

Counts do not check or save a quote. Inclusions and exclusions also explain their separate saved-line limits.

Each service and itinerary entry has its own Edit button. Section-level links remain available for broader changes.

Review wording opens the existing review at the matching entry, including after you reorder or duplicate entries.

Navigation preserves search, removal Undo and check guidance. Editing, checking and saving remain separate actions.

See accepted edits and entry order immediately. Text and dates stay as entered, with clear placeholders for blank fields.

Edit links lead back to quote details, price items, itinerary or client-facing notes without changing your draft.

Pricing fields, totals and internal revision notes are omitted. Free text is not redacted; this is not a saved or shareable quote.

Check and save joins the five field-section shortcuts. All entries stay visible and your draft remains unchanged.

Read the local result, then go directly to the actions. Return to Draft sections whenever you need to keep editing.

The shortcut moves focus to a heading. It does not run a check, activate Save or consume your removal Undo.

Recover the currency, value, source and observed time in their original position, including unfinished inputs.

Undo the latest rate, price-item or itinerary removal before your next edit or Save, even after removing the last rate.

Removing a rate leaves price items unchanged. Check and Save still identify a missing rate needed by those items.

Choose the source currency for a new rate, or enter the title of a new price item or itinerary entry.

Existing entries and search wording stay in place. New rows use the same defaults and limits as before.

Adding is an unsaved edit. It ends the previous removal Undo opportunity and clears local checks so you can review again.

Find price-item titles and descriptions, or itinerary titles, locations, details and dates. No saved-record search is involved.

Results show each matching entry once, with its current position and title. Similar titles still lead to separate entries.

Every field stays visible. Search follows your latest draft without changing its contents, Undo opportunity or local check result.

Local check failures point to the relevant field or section. The check does not fill in or change any of your entries.

Checking preserves the current removal Undo opportunity. Editing clears the result so you can check the updated draft.

A local pass does not guarantee a save. Save still verifies the current quote, checks server rules and calculates totals.

Read the familiar error message, then choose Go to field or Go to section. Nothing changes or saves automatically.

Rate, price-item and itinerary guidance identifies the entry that failed the check, even when several entries share a title.

An edit clears the shortcut and field marker. Save again to run the existing checks; saved records and recovery rules stay unchanged.

Section shortcuts focus the relevant heading. Empty sections remain available when you are ready to add their first entry.

Current rate, price-item and itinerary counts follow your edits. They describe entries in the draft, not completed checks or approval.

Each section has a way back to the navigator. Your unsaved details and current Undo removal stay intact; saving remains your choice.

The entry returns to its original position with the same details, costs and dates. Focus follows the restored entry for easy review.

One removal can be undone at a time. A later removal replaces the opportunity; another edit or Save attempt ends it.

Undo only changes the unsaved draft. Existing limits, discard confirmation and save recovery continue to apply.

A separate copy appears immediately after the original. Edit, move or remove the copy independently, with focus following the new entry.

Quantities, source costs and dates are copied exactly. Dates do not advance automatically, and copied price lines count again when saved.

Copies stay in your unsaved draft until you save the quote. Existing item limits, discard confirmation and save recovery still apply.

Put services and itinerary entries in the order you want to show. Dates, quantities, currencies and source costs stay unchanged.

Keyboard focus follows the moved entry to its new numbered heading. The first and last entries clearly show when a move is unavailable.

Moves are unsaved edits until you save the quote. Existing save recovery and discard confirmation still apply.

Search, revision scope, filters, result counts and navigation stay outside the compact tools panel, including no-result recovery.

Open or close groups of sections and change reviews, or reset the review. The panel summary shows the currently available counts.

Opening or closing the tools leaves your review choices and loaded proposals unchanged. Reset keeps its own tools panel open.

Open every change review in the sections shown by your current search and filters. Each review opens its section too.

Close the inner reviews without closing their sections. Both complete original proposals remain available to read.

Hidden panels, entry filters, search scope and your search-highlight position stay unchanged. Reset remains a separate choice.

Clear search, search both revisions, show all six sections and restore every entry-review row, including rows in previously hidden sections.

Start with section and review panels closed. The comparison stays open, and the search-highlight position and shortcut list are cleared.

Both original proposals, their open and reference roles, and your revision-history choices remain unchanged. No reload is needed.

Each matching section lists the open or reference revision and its highlighted-passage count, following your current search scope.

Jump directly to the first match, including matches in later fields or saved entries. Only the destination section opens.

Previous and Next continue from your new position. Both originals and your existing review filters stay intact.

The search selector names the actual open and reference revision numbers. Matching sections and highlights follow your choice.

Both originals stay complete in each shown section. The unsearched side stays unmarked, so you can still compare its wording and saved entries.

Changing scope restarts highlight navigation without clearing your phrase, changed-only choice, section disclosures or entry-review filters.

Visit the open revision, then the reference, within each shown section. Only the destination section opens; navigation stops at each end.

See the last-visited position, section and revision. Counts describe highlighted passages; adjacent matches can form one passage.

Return to the search controls from either original proposal. Your section disclosures and entry-review filters stay intact when the search changes.

Matched rows offer both sources. Each shortcut uses the revision side and saved position, so repeated titles do not point to the wrong entry.

Go back to the corresponding review row. If its exact match is hidden, return to the review heading while keeping your filter choice.

Original text, search highlights and saved positions remain intact, including larger entries that are shown without alignment.

Start with every row visible. Hide exact matches in one review without changing the others, then uncheck to restore its full saved order.

Clear counts show visible and hidden alignment rows. A matched row can represent entries from both revisions; these are not unique-item totals.

Larger lists and fields still show every source-labelled row. The filter is unavailable when exact alignment has not been performed.

Service descriptions and itinerary details align only when all their proposal fields match. Pricing and internal notes are excluded.

Repeated entries keep their place in each revision. Changed or moved content can appear separately; matching titles do not establish identity.

Larger lists and fields keep every projected entry with source labels, without alignment or a claim that every entry changed.

Clear labels identify exact wording matches and entries added or removed when comparing the fixed reference with the open revision.

Each entry keeps its saved position in the relevant revision. Repeated wording is preserved and is not treated as a stable item identity.

Larger lists are shown completely with source labels, without entry alignment or a claim that every entry has changed.

Underlined additions and struck-through removals show exact wording changes from the fixed reference to the open revision, including case and punctuation.

Clear labels explain the comparison direction. Wording changes stay separate from the yellow search matches in the original proposal text.

Nothing is shortened or rewritten. Larger fields show complete removed and added text with an explanation instead of word-level alignment.

A compact index follows your current search and changed-only filter. Choose a section to open it and move to its heading.

Each proposal side includes a return to its own section in the list, including after long service lists and itineraries.

Your search, filter and other open sections stay as they are. No saved wording, selected revision or comparison reference changes.

Matching words are highlighted inside each searchable field, including displayed service categories and itinerary dates.

Original wording, capitalization and line breaks stay unchanged. Highlights disappear when you clear the search without resetting your other filter.

A highlight identifies search text, not a change between revisions. The existing changed-section labels and revision-match labels keep their meaning.

Find a case-insensitive phrase within a content field. Pricing, internal notes, identifiers and other quote history remain outside this search.

Section labels identify a match in the open revision, reference revision or both. The full section stays intact so you can read each proposal in context.

Use search with changed sections only. Clear the query without losing the filter or your opened sections; hidden counts explain each filtering step.

Each control names its section count and respects the changed-only filter. When nothing is shown, both controls are unavailable until you clear the filter.

Hidden unchanged sections keep their open or closed state. Clearing the filter brings them back without resetting your earlier review choices.

Every section can still be opened or closed separately. The controls affect only this comparison, without changing its saved content or revision pair.

All six sections appear by default. Show changed sections only keeps the existing revision pair and tells you how many unchanged sections are hidden.

Clearing the filter restores sections in their saved order and preserves opened disclosures. A new comparison pair starts with all sections again.

No proposal-content differences does not mean the entire quote is unchanged. Pricing, quantities and internal revision notes remain outside this view.

Review client summary, proposed services, itinerary, inclusions, exclusions and client notes, even when the quote totals have not changed.

Both revision numbers and their ordered content remain visible. Section changes do not imply that individual services or itinerary items were matched.

The retained comparison snapshot excludes source costs, quantities, rates, pricing rules and internal revision notes in both preview modes.

Open reference and compare back exchanges the two loaded revisions only after the requested full detail loads successfully.

The previously open revision becomes the fixed reference. Existing amount, date and status differences reverse, with different currencies kept separate.

A failed load leaves the original pair intact. Exact retry remembers the same two revisions; Find, preview mode and loaded history remain unchanged.

Automatic current follows the quote. A numbered reference stays fixed while you open other revisions, including when you review the current quote.

Compare the same five saved summary fields from the open revision to your reference. Different currencies remain separate, with no conversion.

A missing reference stays selected and is marked unavailable. An identical reference asks you to choose another; neither starts a history lookup.

Each action names its exact target. Your match position and result page stay visible, and review stops at the first or last match on that page.

One deliberate action opens that revision through the existing checked path, then returns focus to its preview. A failed open can retry the same revision.

No result page changes or earlier-history loads happen automatically. The separate return to loaded Find results remains available when review is absent.

A named shortcut leads to the exact open revision, after the comparison and before its pricing or internal client preview.

The return brings you back to the Find status without changing the query, filters or result page, even when the open revision is not a shown match.

Both shortcuts move focus only. They do not reload quotes or history, and they are unavailable while the required preview is missing, loading or being edited.

See its exact match position and result page within the filtered, loaded summaries. Revision numbers are not treated as page positions.

One named action shows and focuses that summary. It changes only the local result page when needed, leaving the quote and recovery details untouched.

The interface tells you when filters exclude the open revision or its summary has not been loaded. It does not clear filters or fetch history automatically.

See the shown match range and result-page position within the loaded search, without implying a complete history total.

Previous and next result pages change only the shown list. Opening a quote or loading earlier history remains a separate deliberate action.

Paging preserves filters, the open quote and recovery context. Changed filters and successful history replacement start at page one; earlier append does not.

See your position among the matches currently shown, not an all-history total. Review stops at either end of the bounded result list.

Open the adjacent newer or earlier match through the existing guarded detail path. Nothing opens or loads in the background.

Successful Find opens and their exact retries return focus to the confirmed review position, with the Find status as a fallback.

The alert and retry action identify the revision that did not open.

Retry reuses the existing exact-detail path once without refreshing history or starting an automatic attempt.

Progress receives focus and is announced, repeat failure returns to the alert, and verified success returns focus to the loaded revision selector.

The existing guarded cursor path appends one bounded earlier page per click.

The query, filters, previously loaded results and selected revision remain in place while the loaded result set expands.

The continuation action keeps focus while another page remains; the Find status receives focus when continuation ends, while retry keeps the exact cursor.

The existing guarded cursor path appends one bounded earlier page per click.

The open historical revision, Find filters and loaded summaries are preserved.

Focus returns to the ready comparison, the next step or the honest end state.

Same-currency totals show higher, lower or unchanged from saved minor units.

A currency change is named, but no amount is converted or subtracted.

Whole calendar days and the selected-to-current status transition stay explicit.

Matches and counts cover only summaries already present in the browser.

Status and validity choices compose with revision, title, date and total search.

Every result reuses the existing exact-detail and unsaved-work protections.

Title, status, total and currency, validity date and expiry are compared.

Every field names both revisions and makes its comparison result explicit.

An earlier-page summary must be loaded deliberately; no comparison read starts automatically.

The visible description states Define → Control → Operate → Approve.

The preview joins the four established ordered phase labels.

Routes, positions, statuses, evidence and approvals remain unchanged.

The visible description states Ends with Approve.

The same line states Gate 7 of 7 from the final phase entry.

Routes, positions, statuses, evidence and approvals remain unchanged.

The visible description states Starts with Define.

The same line states Gates 1–2 of 7 from the first phase entry.

Routes, positions, statuses, evidence and approvals remain unchanged.

The visible route context states 4 approval phases and 7 gates.

Both values come from the established phase and gate collections.

Routes, positions, statuses, evidence and approvals remain unchanged.

The fixed Back to approval sequence label moves without script or new state.

Header clearance and a target outline keep the sequence visible.

Routes, positions, statuses, evidence and approvals remain unchanged.

The fixed Review status guide label moves without script or new state.

Header clearance and a target outline keep the destination visible.

Routes, positions, statuses, evidence and approvals remain unchanged.

Status now separates current review state from every position label.

All seven sequence destinations keep the same shared accessible explanation.

Routes, positions, statuses, evidence and approvals remain unchanged.

Register position now separates full-register context from phase context.

All seven sequence destinations keep the same shared accessible explanation.

Routes, positions, statuses, evidence and approvals remain unchanged.

Approval phase now sits beside Phase gate, Remaining gate and Position meaning.

All seven sequence destinations keep the same shared accessible explanation.

Routes, positions, statuses, evidence and approvals remain unchanged.

Each continuing destination now names its parent phase's sequence position.

Phase-start and continuing links now share the same four-phase orientation.

Routes, positions, statuses, evidence and approvals remain unchanged.

Every adjacent destination now names its parent phase's sequence position.

Each visible and accessible value comes from the same four approval phases.

Routes, directions, statuses, evidence and approvals remain unchanged.

Every status-matched destination now names its parent phase's sequence position.

Each visible and accessible value comes from the same four approval phases.

Routes, counts, statuses, evidence and approvals remain unchanged.

Every Jump to gate destination now names its parent phase's sequence position.

Each visible and accessible value comes from the same four approval phases.

Routes, gate positions, statuses, evidence and approvals remain unchanged.

Every detailed gate now names its parent phase's place in the sequence.

Each value comes from the same four approval phases used by the overview.

Gate positions, statuses, evidence and approvals remain unchanged.

Each phase card now names its exact place in the approval sequence.

The visible position and exact accessible name share one derived value.

Ranges, routes, statuses, evidence and approvals remain unchanged.

Every phase range now names its first and last place in the seven-gate register.

Singular and plural ranges come from the established phase records.

Routes, positions, statuses, evidence and approvals remain unchanged.

All seven approval-sequence destinations now show their full-register place.

Every visible cue and exact accessible name uses the same register position.

Routes, phases, statuses, evidence and approvals remain unchanged.

Each previous and next destination now shows its place across all seven gates.

The visible direction label and exact accessible name use the same position.

Routes, phases, statuses, evidence and approvals remain unchanged.

Each matching destination now shows its position across all seven gates.

Visible and accessible destination context use the same derived total.

All status groups, destinations and approval decisions remain unchanged.

Each fixed destination now shows its position across all seven gates.

Visible and accessible destination context use the same derived total.

All seven destinations, statuses and approval decisions remain unchanged.

All six previous and six next destinations now show Phase gate position.

Visible and accessible destination context use the same derived position.

All 12 destinations, statuses and approval decisions remain unchanged.

Each Matching gates destination now shows its Phase gate position.

Visible and accessible destination context use the same derived position.

All seven destinations, statuses and approval decisions remain unchanged.

Each Jump to gate destination now shows its Phase gate position.

Visible and accessible destination context use the same derived position.

All seven destinations, statuses and approval decisions remain unchanged.

Every detailed gate now shows its exact Phase gate position.

The established Gate N of 7 label stays visible and unchanged.

All seven routes, statuses, records and approval decisions remain unchanged.

Each later destination now includes its exact Phase gate position.

The established Remaining gate position stays visible beside it.

All seven routes, labels, statuses and gate records remain unchanged.

Phase gate, Remaining gate and Position meaning are clearly separated.

Each term keeps one concise explanation of its established scope.

Every start and continuing destination remains unchanged.

Shows where a starting destination sits within its full fixed phase.

Shows the order of later destinations listed for that phase.

A position is register order, not completion or approval.

Define starts at phase gate 1 of 2, while Control starts at 1 of 3.

Operate and Approve each identify their start as phase gate 1 of 1.

Visible and accessible positions use the same fixed phase-group count.

Gate 2 is the first and only remaining Define gate.

Gates 4 and 5 are shown as the first and second of two remaining gates.

Visible and accessible positions use the same fixed group index and length.

Define shows one remaining gate and Control shows two.

One derived label uses gate or gates to match the fixed count.

The three continuing destinations remain Gates 2, 4 and 5.

Each continuation heading states the exact phase it belongs to.

The visible heading and accessible panel name use the same phase wording.

Three continuing routes still cover Gates 2, 4 and 5 exactly once.

Each start cue shows the exact title of the gate it opens.

The visible title and exact accessible name use the same fixed gate record.

Four start routes and three continuing routes still cover all seven gates.

Every phase card names the current status of the gate it opens first.

Define and Control provide direct status-labelled routes to their later gates.

Four start routes and three continuing routes cover all seven fixed gates.

Backward review names the preceding gate's place in the approval sequence.

Forward review names the following gate's place in the approval sequence.

Visible Phase and Status fields match each exact accessible destination name.

Each destination identifies its Define, Control, Operate or Approve phase.

Each destination repeats its current shared In progress or Open status.

Visible metadata and exact accessible names use the same field wording.

Backward review shows the preceding gate's current shared status value.

Forward review shows the following gate's current shared status value.

Visible status and exact accessible destination names use the same field wording.

Each gate names Phase before its Define, Control, Operate or Approve value.

Each definition route names Status before its current In progress or Open value.

Gate headers, definition links and index destinations now share field wording.

Each destination names Phase before its Define, Control, Operate or Approve value.

Each destination names Status before its current In progress or Open value.

Visible metadata and exact accessible names now use the same field wording.

Phase places each gate within Define, Control, Operate or Approve.

Status reports the existing evidence and approval condition for that gate.

The explanation orients a review; it does not evaluate or approve a gate.

Each fixed gate destination now names the phase that opens at that route.

Accessible names retain gate and status details while adding the shared phase.

The compact labels add orientation without changing navigation or approval.

Every fixed gate header now identifies its current approval phase.

The sequence overview and gate detail derive from the same fixed labels.

A phase label provides orientation; it does not approve or skip a gate.

Each fixed sequence card is now one direct native route into the register.

Every link names the phase, gate range, first gate number and gate title.

Opening a phase starts review; it does not skip or approve any gate.

Every current gate links to its matching established status definition.

The gate header names the destination before the native fragment link is used.

The links preserve three In progress gates, four Open gates and zero Approved.

Every current gate appears once beneath its matching fixed status definition.

Each native link shows the established gate number and destination title.

The zero-count Approved definition remains count-only.

Definition counts reuse the same In progress, Open and Approved totals.

Each selected card confirms its current gate count beside the status label.

The register still reports zero of seven gates approved.

In progress, Open and Approved each end with the same clear return cue.

Each accessible name identifies the status definition the reader is leaving.

Every link returns to the summary showing zero of seven gates approved.

Each count includes one visible Definition cue and an exact accessible name.

Native fragments land on the same In progress, Open and Approved guide cards.

The register still reports zero of seven gates approved.

Evidence is advancing, but the stated pass condition remains unmet.

Required work remains and no gate approval has been recorded.

The pass condition and accountable approval must both be recorded.

Each card shows Gate N of 7 before its established status and title.

The label reuses the mapped gate number and the seven-record register length.

The register still reports zero of seven gates approved.

Every index link shows its established gate number, title and status.

Seven wide-screen columns reflow to four and then two as space narrows.

The register still reports zero of seven gates approved.

All twelve adjacent-gate controls show the title beneath their gate number.

Each control still names and opens the same fixed preceding or following gate.

The register still reports zero of seven gates approved.

The same amber outline identifies the summary and all seven gate cards.

The offset outline changes no border, spacing or content position.

The register still reports zero of seven gates approved.

Each link names the preceding fixed gate number, title and current status.

Gate 1 remains the start with no circular previous-gate route.

The register still reports zero of seven gates approved.

Each link names the following fixed gate number, title and current status.

Gate 7 remains the final decision with no circular next-gate route.

The register still reports zero of seven gates approved.

Every link names its originating gate number and established title.

All seven links return to the same summary with sticky-header clearance.

The register still reports zero of seven gates approved.

Every gate uses one 100-pixel anchor clearance above its existing card.

All seven links, labels, order and fragment destinations stay fixed.

The register still reports zero of seven gates approved.

Every link names its fixed number, established title and current status.

Visible numbers, gate order, fragment targets and responsive controls stay fixed.

The register still reports zero of seven gates approved.

Records, Accountability and Lifecycle evidence all reference one fixed heading.

Exact labels, group visibility, scrolling, focus and active scope stay unchanged.

Filters, results, cards, files and all 17 owner downloads remain unchanged.

The existing shown-of-total owner-download count describes every centre scope.

Purpose, File format and Quick Find state are included without entered text.

The disclosure, controls, results, cards and all 17 downloads stay unchanged.

The existing group label, shown-of-total count and summary describe the region.

Purpose, File format and Quick Find state are included without entered text.

Region names, visibility, shortcuts, cards and all 17 downloads stay unchanged.

The active scope is included only while at least one catalogue filter is active.

Purpose, File format and Quick Find state are named without repeating query text.

All three shortcuts retain their existing visible target and focus behaviour.

The destination keeps the fixed Records, Accountability or Lifecycle identity.

Its existing shown-of-total badge provides the same local result context.

The visible coverage sentence completes orientation without adding new copy.

The return destination includes the existing x-of-17 owner-download count.

Unfiltered and filtered catalogues receive the same fixed count context.

The existing visible count is reused without adding another live announcement.

The fixed scope summary is included only while at least one filter is active.

Purpose, File format and Quick Find state are named without repeating query text.

All three actions keep the same heading target and preserve every selection.

All three return actions still focus the same fixed catalogue heading.

Catalogue-use and file-boundary copy remain visible and unchanged.

Purpose, File format and Quick Find remain exactly as the owner left them.

Records, Accountability and Lifecycle evidence are named without abbreviation.

Sighted and assistive-technology users receive the same exact button wording.

Each action still focuses the catalogue heading and preserves every filter.

All 24 fixed scope combinations use their established display labels.

Quick Find stays Active or Not used; entered search text is never repeated.

Shortcut visibility, counts, targets and keyboard focus remain unchanged.

All 24 fixed scope combinations use their established display labels.

The scope total stays separate from the Quick Find result count.

Only Active or Not used is announced; entered search text stays excluded.

One, two or three active dimensions are listed in fixed control order.

Quick Find is named without repeating the entered search text.

All four actions, their associations and the polite status stay intact.

The heading names both fixed selections behind the empty result.

Search-only and scoped-search empty headings remain unchanged.

Live status, count guidance and all four recovery actions stay intact.

The heading names both fixed selections constraining the empty search.

The entered Quick Find text remains excluded from the heading.

Live status, count guidance and all four recovery actions stay intact.

The visible help names both fixed selections shaping the current results.

Quick Find is shown only as Active or Not used; entered text stays excluded.

Counts, cards, recovery, availability and downloads remain unchanged.

The visible help names both fixed selections constraining current results.

Entered Quick Find text remains only in the existing search field.

Clearing Quick Find restores the exact named Purpose and format scope.

The visible help names the active fixed Purpose behind each count.

The same help names All formats, CSV or JSON as the active format.

The unavailable and active zero-count explanation remains intact.

A 0-count unselected pick is unavailable within the selected fixed scope.

An active pick remains available at 0 so it can still be cleared.

Counts, pressed states, focus return, filtering and downloads stay intact.

A 0-count Purpose remains available so File format can still be adjusted.

A 0-count File format remains available so Purpose can still be adjusted.

Existing empty-result guidance and every recovery action stay intact.

Purpose guidance names All formats, CSV or JSON.

File format guidance names the active fixed Purpose label.

Every count, filter, result, recovery path and download stays intact.

Visible help states that Purpose counts reflect the selected File format.

Visible help states that File format counts reflect the selected Purpose.

Every fixed choice, count, action, result and download stays intact.

Every visible Purpose count responds to the active File format.

Accessible labels name the same fixed format that scopes each count.

All four Purpose actions, result filters and recovery paths stay intact.

Accessible counts use the current fixed Purpose label.

Each count also names All formats, CSV or JSON.

Visible labels, counts, states, handlers, filtering and results stay intact.

Accessible counts use the current fixed Purpose label instead of a generic cue.

All three format totals still derive from the same selected-purpose catalogue.

Visible labels, pressed states, handlers, filtering and results stay intact.

Active-scope adjustment and empty recovery use the same exact wording.

Each action still names the same selected CSV or JSON value.

Conditions, handlers, focus return, reset-all recovery and results stay intact.

The filter heading and active scope use the same exact visible term.

Adjustment and empty-recovery controls retain the same scope summary.

Selected values, clear actions, reset-all recovery and focus return stay intact.

Recovery controls now identify both the empty result and its active scope.

Quick Find remains only Active or Not used; entered text is never repeated.

Clear actions, reset-all recovery, focus return and announcements stay intact.

Visible and assistive context now identify the same current selections.

Quick Find remains only Active or Not used; entered text is never repeated.

All individual clear actions, reset-all recovery and focus return stay intact.

Visible and assistive guidance now identify the same recovery path.

The existing one-, two- or three-filter wording describes the action group.

The established polite empty-result announcement remains unchanged.

The recovery message uses clear singular wording.

Two or three active filters receive their exact local count.

Whitespace-only Quick Find input is not counted as an active filter.

No inactive-search clear action appears beside an unchanged catalogue.

The existing Clear Quick Find action remains immediately available.

All clear surfaces now follow the same effective-query boolean.

The search-area button now uses the shared capitalization.

Its programmatic name now matches the complete visible label.

The same exact fixed name remains available without query text.

Owners can see the fixed purpose or format before clearing it.

Each programmatic name matches the complete visible action label.

Quick Find keeps its fixed label and never repeats entered text.

Search-only recovery keeps its familiar exact heading.

Combined search and scope filters now name that boundary directly.

The heading never repeats entered Quick Find content.

Each badge now reads as a complete shown-of-total download count.

The same catalogue-derived visible and group totals remain in use.

Existing detailed accessible descriptions retain each group name.

A one-result group receives an exact singular shortcut description.

Larger visible groups retain the familiar plural noun.

Every shortcut keeps its existing visible count and focus target.

Single-item format scopes no longer describe themselves as downloads.

Quick Picks use the singular noun when the fixed catalogue finds one item.

Every other existing count keeps the familiar plural wording.

The badge identifies both the shown count and what those results represent.

Purpose, format and search choices still derive one unchanged catalogue result.

Quick Find keeps the count update; availability and empty results stay separate.

Owners can distinguish an available file from one paused by current work.

Warm preparation and green or red outcomes are explained in the same guide.

Hover, press and keyboard focus identify only the action currently in use.

A subtle green-teal surface keeps each available download easy to identify.

File-format and data-coverage labels share the same available state.

Result, interaction, paused and preparing treatments retain their priority.

A warm surface keeps the download currently being prepared easy to identify.

File-format and data-coverage labels share the same active preparing state.

The disabled action, Preparing label, wait cursor and focus ring remain.

A calm red-tinted surface keeps the affected download easy to identify.

File-format and data-coverage labels share the same failed state.

The complete alert, exact retry cue and established interaction feedback remain.

A calm green-teal surface keeps the completed download easy to identify.

File-format and data-coverage labels share the same confirmed state.

Hover, active press and visible keyboard focus keep their established cues.

A deeper teal card surface acknowledges the active pointer press.

File-format and data-coverage labels share the same pressed treatment.

The established focused-card context and solid button ring remain strongest.

A very light teal card surface follows the enabled action under the pointer.

File-format and data-coverage labels share the same hovered treatment.

The established focused-card context and solid button ring remain primary.

A soft teal card surface follows the action that currently holds focus.

File-format and data-coverage labels share the same focused treatment.

The established solid button ring remains visible and unobscured.

A deeper teal surface and inset cue appear only while the action is pressed.

Ready, retry and repeat-download labels share the same pressed feedback.

Preparing stays warm, paused stays muted and keyboard focus keeps its ring.

A soft teal surface distinguishes an enabled download from the card around it.

Ready, retry and repeat-download labels share the same enabled treatment.

Preparing stays warm, paused stays muted and keyboard focus keeps its ring.

A solid teal ring sits outside the action without covering its label.

Ready, retry and repeat-download labels share the same focus treatment.

Paused and preparing actions remain natively disabled and unfocusable.

A neutral surface and inset marker identify the unavailable download.

The fixed file-format and coverage labels share the same paused treatment.

An active file preparation keeps its established warm state and wait cue.

A muted non-busy action uses a not-allowed cursor without changing its reason.

The warm active treatment retains its established wait cursor and exact label.

The existing availability status remains the explanation for every pause.

The active control stays fully readable instead of fading with ordinary pauses.

The established Preparing CSV or Preparing JSON action name remains unchanged.

Idle, success, error and non-busy disabled presentations remain distinct.

The failure message receives a clear red-tinted panel that remains easy to scan.

The existing alert role, live text and error precedence remain unchanged.

The exact established Retry action remains available without a second control.

The button keeps the download name and clearly prefixes it with Retry.

The complete existing alert remains visible beside the recovery cue.

Retry uses the existing button, handler, permissions and file contract.

The successful action label keeps its exact download name and adds “again”.

The complete count-and-filename confirmation remains visible beside it.

Preparing, idle and failed attempts keep their established action labels.

Completed feedback receives a calm, readable full-width presentation.

The existing count summary and exact fixed filename remain visible and live.

The existing red alert remains separate and wins whenever an error exists.

The existing live status names the file after the download action succeeds.

The confirmation reuses the constant that names and validates the download.

Current record and count feedback remains before the fixed filename.

The visible name comes from the existing fixed download contract.

The same constant names the browser download and validates the private response.

Long fixed names wrap inside their card without changing the action.

The action identifies whether the existing download is CSV or JSON.

The action includes the card's same fixed current, complete or inventory label.

The detailed download explanation and live success or error status remain connected to the same button.

Each group name comes from the same fixed 17-item export catalogue.

Stable local references connect the group to its visible file-format and data-coverage labels.

Card order, filters, disabled states, responsive layout and downloads remain exactly as before.

All owner downloads show as paused while a workspace change is being saved.

Some owner downloads show as paused until the owner saves or discards existing workspace changes.

The status confirms when workspace changes are not pausing downloads; every existing card check still applies.

Each card identifies the existing CSV or JSON file it prepares.

Each card states the fixed record or evidence coverage of that download.

Labels are informational; the owner must still choose the existing download action deliberately.

The owner first confirms that the file is intended for authorised fictional or masked pilot use.

The existing responsibilities remain clear: secure the copy, share it only with authorised people and delete it when no longer needed.

AgencyOS does not manage the downloaded copy after the browser saves it.

Purpose, File format, Quick Picks and Quick Find change only which fixed cards are shown.

Filtering never starts a file; the owner must still choose the existing download action on one matching card.

Every card retains its original scope, capacity, access check and file-handling boundary.

Fixed export names and coverage continue to update immediately without sending a request or starting a download.

Results stay inside the selected Purpose and File format, while clearing Quick Find restores that same selected scope.

The field is for fixed catalogue terms, not customer, traveller or other business-record information.

Choosing Quotes, Tasks, History or Inventory places that fixed catalogue term in the existing Quick Find field.

Choosing the already active Quick Pick removes only that fixed search and restores the unsearched scope.

Every existing count continues to reflect the selected Purpose and File format, including an unavailable zero-result choice.

Owners can understand the Records, Accountability and Lifecycle evidence shortcuts before choosing one.

Guidance and shortcuts remain absent when no download is visible, while each available button keeps its exact shown count.

Every shortcut still moves only to its fixed visible heading without changing a filter, URL or download.

Available owner downloads stays visible for complete, filtered and zero-result catalogue scopes.

The shown count derives from the existing filtered catalogue and compares with the same fixed 17-item total.

The existing result area is associated with the visible heading, guidance and count without adding a second live announcement.

Purpose explains that its four fixed choices change which download group is shown.

File format distinguishes every format, spreadsheet-ready CSV and structured JSON.

Choices, counts, selected states, catalogue order and existing downloads remain unchanged.

Clear purpose, Clear format and Clear Quick Find appear only for the dimensions currently narrowing the empty result.

Reset all filters remains available beside every empty result and restores the fixed 17-download catalogue.

Every action reuses the existing local filter and focus behavior without changing catalogue order, URL state or a download.

Clear purpose, Clear format and Clear Quick Find appear only while their matching dimension is active.

Each action clears one dimension, preserves the other filters and returns focus to the matching catalogue control.

Reset all filters is still available, and no action changes catalogue order, URL state or any existing download.

Records, Accountability and Lifecycle evidence expose the action only when their existing section is already visible.

Choosing the action scrolls to and focuses the visible catalogue heading before the fixed controls.

Purpose, format, Quick Find, catalogue order, URL and every existing download remain unchanged.

A shortcut appears only while its group has a current match and repeats the same visible-card count.

Choosing a shortcut scrolls to and focuses the matching heading, leaving a clear visual position for the next action.

Purpose, format, Quick Find, catalogue order, URL and every existing download remain exactly as they were.

Records and Accountability each compare against seven cards, while Lifecycle evidence compares against three.

Shown counts follow the same purpose, format and Quick Find result that controls card and group visibility.

The labels contain no record content and cannot run, inspect or change an existing download.

Quotes, Tasks, History and Inventory cover common catalogue searches without accepting customer information as a shortcut.

Every choice shows its exact match count inside the selected purpose and file format, and unavailable choices cannot create a dead-end search.

Selecting a choice fills Quick Find, selecting it again clears the query, and no download begins until its existing export control is deliberately used.

Fixed labels distinguish current summaries, complete saved families, reviewed activity, current responsibility, complete histories and inventory-only evidence.

Quick Find now matches those fixed coverage labels as well as the established export names, purpose and file-format terms.

Labels contain no record content and read the existing fixed catalogue; they do not inspect a file or create a second export rule.

The notice says to export fictional or masked, non-sensitive pilot data only before an owner chooses a purpose, format, search result or download.

It reminds the owner to secure the downloaded file, share it only with authorised people and delete it when it is no longer needed.

The static note contains no customer or business-record content and starts, blocks, inspects or records no download.

The Pipeline summary is labelled CSV file, while the other 16 agency-wide cards are labelled JSON file before an owner starts any download.

Labels read the established fixed catalogue instead of creating a second mapping that could drift from Quick Find or the format controls.

The non-interactive labels stay with mounted cards while filtering changes only visibility; they start, cancel or alter no download.

Fixed labels show the selected purpose and format and whether Quick Find is active, without repeating any entered search text.

One keyboard-sized action restores All downloads, All formats and an empty Quick Find, then returns focus to the search field.

The summary uses only existing local filter state, disappears at the default scope and starts or cancels no mounted download.

Every keyboard-sized format button shows the exact number available inside the current purpose, including an honest zero where no CSV download exists.

Purpose, format and literal Quick Find compose without changing catalogue order, and the status reports exactly how many downloads remain in that scope.

Empty searches keep their clear action; an empty purpose-and-format combination offers one reset that restores the complete catalogue and Quick Find focus.

Every keyboard-sized purpose button shows its fixed catalogue count and a clear selected state, with a two-column arrangement on narrow screens.

Search narrows only the selected purpose while the interface reports the exact number shown out of that view's complete fixed count.

Purpose selection stays in the current workspace view, writes no preference and starts or cancels no mounted export control.

Literal search tokens match the documented download names, purposes and CSV or JSON formats, preserve order and report the exact visible count.

The query sends no request and is not written to a database, browser storage, cookie, URL, analytics or telemetry.

Empty results explain useful terms and provide a keyboard-sized clear action; hidden cards remain mounted, so filtering starts or cancels no download.

A keyboard-operable disclosure keeps the Pipeline heading concise and clearly labels the complete catalogue as owner only.

Record exports, Operations and work-history evidence, and lifecycle inventories remain easy to distinguish on desktop and narrow screens.

Opening the centre runs nothing; each existing action retains its own scope, capacity, access checks, disabled state and transient file handoff.

Ten Team actions, one settings-change category and fourteen enquiry-activity actions appear in fixed order, including actions with no saved events.

Every action has an exact event count and, when non-empty, coherent oldest and newest event times; each family total must match its complete valid-action set.

The inventory contains no event details, summaries, changed fields, identities or business content and does not set retention or trigger a lifecycle action.

Team access, enquiries, quotes, quote revisions, Operations tasks and manual payment records appear in fixed order, including states with no current records.

Every state has an exact count and, when non-empty, coherent oldest and newest creation anchors; each family total must match the complete valid-state set.

The inventory contains no business-record content or identity and does not set retention, decide archive eligibility, delete, place a hold or close an agency.

Agency settings, Team records and events, enquiries and activity, quotes and their saved detail, Operations, tasks and manual payment records each receive one fixed inventory row.

Every row keeps only an exact count, its explicit timestamp basis and coherent oldest and newest anchors; empty families remain visible with null anchors.

The inventory contains no customer, trip, quote, payment, task or activity content and does not set a retention period, archive, delete or place a hold.

Every event keeps its prior and next saved status, current work titles and the approved pilot staff email already recorded for its actor.

Existing indexes scope one owner-only read, prove one initial state per current record and match every continuous transition to the current saved status.

Notes, budgets, pricing, payments, responsibility identities, non-status activity, Team history and internal identifiers stay omitted.

Prior and next responsibility map to stored approved pilot staff email, while unassigned state remains explicit and each saved actor is represented by email.

Existing indexes scope one owner-only read, prove one initial state for every current enquiry and task, and order all validated changes from oldest to newest.

Current work titles provide context while notes, budgets, pricing, payments, non-responsibility activity, Team history and internal identifiers stay omitted.

Assigned work maps to the stored approved pilot staff email and an explicit available or needs-reassignment state; unassigned work stays explicit.

Existing indexes scope the owner-only batched reads, validate every current enquiry and task relationship and preserve Operations whose task list is empty.

Minimized titles, states and dates provide context while notes, budgets, pricing, payments, creator identities, activity history and internal identifiers stay omitted.

Every record keeps its kind, amount, currency, occurrence date, method, optional reference and notes, recorded-or-voided state, timestamps and optional void reason beside minimized enquiry and accepted-quote context.

Existing Operations-family indexes scope one owner-only read, validate every manual-record family and preserve an Operations record whose record list is empty.

Recorded and voided outcomes remain useful while record-creator and void-actor identities, Operations tasks, activity history and internal identifiers stay omitted.

Every task keeps its title, category, status, optional due date, optional notes, assignment state and timestamps beside minimized enquiry and accepted-quote context.

Existing Operations-family indexes scope one owner-only read, validate every task family and preserve an Operations record whose task list is empty.

Assigned-or-unassigned state remains useful while assignee and creator identities, manual payment details, activity history and internal identifiers stay omitted.

Every day keeps its position, optional date, title, optional location and optional details beside minimized quote and revision context.

Existing quote-family indexes scope one owner-only read, validate complete history and sequential days, and preserve a revision whose itinerary is empty.

Priced lines, rate snapshots, pricing rules, staff identities, activity history, Operations and internal identifiers stay omitted.

Every item keeps its category, description, quantity, source-unit amount and currency, derived source-line amount and saved converted line amount beside minimized quote and revision context.

Existing quote-family indexes scope one owner-only read, verify each conversion against its saved rate and each revision subtotal, and produce no partial file above capacity.

Rate-snapshot details, itinerary days, client pricing rules, staff identities, activity history and internal identifiers stay omitted.

Every snapshot keeps its currencies, exact stored ratio, readable rate, source label and capture time beside minimized quote and revision context.

Existing quote, enquiry, revision and rate indexes scope one owner-only read, validate every complete rate family and produce no partial file above capacity.

Priced line items, itinerary days, client content, staff identities, activity history and internal identifiers stay omitted for separate lifecycle work.

Each revision keeps its client summary, lifecycle, validity, pricing settings and totals, inclusions, exclusions and saved notes.

Existing quote, enquiry and revision indexes scope one owner-only read, validate saved history and pricing, and produce no partial file above either record limit.

Line items, rate snapshots, itinerary days, staff identities, activity history and internal identifiers stay omitted for separate lifecycle work.

Each record includes title, source, destination, planning dates, budget, next action, saved notes, status and record timestamps.

The existing newest-first enquiry index scopes one owner-only read, and record or file capacity overflow produces no partial download.

Staff and account identities, responsibility, activity, quotes, Operations, payments, concurrency versions and internal identifiers stay omitted.

Up to 500 records show enquiry title, quote reference, overall status, accepted revision number and quote timestamps.

Each summary includes the current revision's number, status, title, currency, validity date, manual grand total and lifecycle timestamps.

Itinerary, pricing lines, rates, client summaries and notes, staff identities and internal identifiers stay omitted, and capacity overflow produces no partial file.

Up to 500 records show enquiry title, accepted quote reference, revision, currency, accepted total and the latest Operations update time.

Each summary includes task-status counts plus non-void manual payment and refund totals, net recorded value and the calculated manual balance.

Task and payment details, staff identities and internal identifiers stay omitted, and more than 500 Operations records produce no partial file.

The file records the agency name, primary and accent colours, default currency, default quote-validity period and latest saved update time.

Up to 500 newest-first settings events contain their time, staff actor email and changed field names, then stop without a partial file above that capacity.

Internal identifiers stay omitted, and the ledger does not invent historical setting values that the current audit model does not store.

Up to 11 current Team records show account email, access level, current state, relevant deadlines and any active planned-offboarding state.

Up to 500 access events reuse the owner-visible reviewed receipts in newest-first order and stop without a partial file above that capacity.

Staff and account email are included, while raw event details and internal account, membership and event identifiers stay omitted.

The file groups up to 2,000 total saved events by enquiry title and keeps each enquiry's entries in newest-first order.

The indexed owner-and-tenant read stops without a partial file when the current agency history exceeds the fixed capacity.

Staff actor email and reviewed summaries are included, while internal identifiers, raw event details and other free-text values stay omitted.

The file contains up to 500 newest-first events and stops without a partial download when that selected history exceeds the fixed limit.

Each entry contains its time, fixed action, agency staff actor email and a reviewed summary while internal identifiers and raw event details stay omitted.

The one-megabyte private response is accepted only through its fixed contract, then downloaded through a temporary browser URL that is immediately revoked.

The case file includes saved enquiry fields and notes, up to 50 quote revisions, each revision's bounded items and itinerary, up to 50 Operations tasks and up to 100 manual payment records.

Every bounded read proves the exact owner and tenant scope. Internal record, account and Team identifiers, responsibility and activity history are omitted.

A fixed five-megabyte JSON contract is privately downloaded through a temporary browser URL; AgencyOS stores no export copy or export analytics event.

The export rechecks the exact active owner membership, agency and immutable record scope in the same statement that selects the rows.

The CSV includes current enquiry planning fields but excludes notes, internal identifiers, histories, quotes, operations, payments and Team identities.

Every cell is quoted, formula-like prefixes are neutralised, and the browser accepts only the fixed private response contract before starting the download.

Each receipt maps one already-recorded self-service outcome instead of treating every member-revoked event as an unexplained owner removal.

Owner removal and invitation cancellation keep their existing actor, target, access-level and prior-state evidence without receiving a self-service label.

An older event without an originally recorded initiator remains visible without an exit receipt instead of receiving an inferred outcome.

The receipt derives both fixed roles from the same two membership rows only after the versioned demotion, promotion and event all succeed together.

The new owner is labelled as agency owner and the former owner as an operational member, beside the existing accountable actor and target labels.

An older transfer event without both originally recorded roles remains visible without a receipt instead of receiving an inferred handoff outcome.

The receipt uses the count stored by the winning review after the complete current roster and every submitted membership version have matched.

History returns only the 1-to-11 reviewed count. Stored membership identifiers and versions are never included in the owner-facing receipt.

An older review event without an originally recorded count remains visible without a receipt instead of receiving an inferred scope.

The existing event records the fixed access mode from the exact versioned invitation only when the membership change and receipt both succeed.

The receipt shows only the declined operational or viewer level. A declined offer never starts the separate 30-day summary-viewer access period.

An older decline event without an originally recorded role remains visible without a receipt instead of receiving an invented access level.

The receipt uses only the prior role and state already stored with the append-only removal event. It does not infer either fact from today's roster.

An active operational member or summary viewer is labelled as removed access. A pending operational or viewer offer is labelled as a cancelled invitation.

An older removal event without an originally recorded role remains visible without a receipt instead of receiving an invented level or prior state.

The receipt uses only the fixed access level already stored with the append-only invitation-created event. It does not infer a role from today's roster.

The existing invitation expiry remains the 14-day acceptance deadline. A viewer's separate 30-day access period still begins only after acceptance.

An older creation event without an originally recorded role remains visible without a receipt instead of receiving an invented access level.

The existing append-only Team event is created only when the exact versioned invitation becomes active with its fixed access contract intact.

Operational access has no deadline. Summary-viewer access is shown only with a deadline exactly 30 days after acceptance.

Older acceptance events remain visible without a receipt when their original history did not record the access level or deadline.

Expired viewers are separated from active access before any new workspace summary is returned. Protected summary reads repeat the same authority check.

Owners see the accepted viewer deadline in Team, and an open viewer workspace schedules an authoritative recheck for that exact time.

An expired viewer sees no agency summaries and may remove only their own retained Team record through a deliberate, version-checked action.

Viewers can review Command Centre totals and paged Pipeline summaries, but cannot open exact records, notes, quotes, tasks, payments, activity, Team or Settings.

Viewer responses omit assignee identifiers, next actions and item-level attention detail rather than relying on the interface to hide operational data.

Viewers cannot create or change business records and cannot be selected for an enquiry, task, claim, handoff, reassignment or ownership transfer.

One settle-then-schedule timeout starts after the current workspace opens and after each completed access attempt. It is not an overlapping interval.

Hiding the workspace or losing connectivity clears the pending cadence. Returning visible or online keeps the existing immediate check.

Cadence checks reuse the current abortable request and server decision: confirmed changes clear private state, while unverified results preserve it behind retry.

The central access-change path sends one fixed same-origin signal only after an existing protected operation or access check confirms a change.

A receiving tab reruns the current identity, agency and active-role check. The browser signal alone never clears private state.

Signal-started checks do not announce again, overlapping checks still coalesce and browsers without the channel keep the existing return and reconnect checks.

An online signal retries the access check only while the private workspace is visible. A hidden tab waits for its normal visibility-return check.

Browser history restore triggers the check only for a genuinely cached page, so an ordinary first page load does not create a redundant request.

Resume signals share the same abortable, sequenced and viewer-scoped request as focus and visibility, including the existing clear-or-retry result handling.

Focus and visibility events share one abortable request to the existing private workspace-context endpoint. There is no interval polling or new endpoint.

Lost access, a different agency or a different role uses the central reset to abort active requests and clear cached views and local drafts before reload.

A failed or unreadable check preserves the current view and offers one retry, while every protected read and write keeps its server-side access guard.

The interface locks routine removal until the exact fixed reason has started the existing versioned pause on new assignments.

The membership update independently requires that stored reason and pause time, so an older or bypassing client cannot skip the sequence.

Security or policy response still uses the current Team version, fixed reason and exact reviewed counts, but does not wait for a handoff pause.

The existing removal event keeps the pause start beside the fixed reason and exact reviewed enquiry and task counts before the membership clears its pause state.

The linked value must be a real canonical timestamp no later than removal. No work title, notes, traveller, supplier or customer content enters the receipt.

Direct removals and earlier receipts without a stored link remain valid. AgencyOS does not invent a pause time for them.

The teammate keeps access to existing work for deliberate handoff, but cannot receive or claim new enquiries or tasks while the pause is active.

One Team version, fixed operational reason and two reviewed counts must still match when the pause starts. Count drift changes nothing and requires another review.

The owner can restore assignment eligibility with the exact next Team version. Start and cancellation are recorded in owner-only access history.

The owner chooses one bounded operational category. There is no free-text reason field for customer, traveller, supplier or sensitive staff details.

An uncertain removal keeps the same reason, Team version and reviewed counts. A retry cannot substitute a different decision after Check latest.

Confirmed active removal shows the reason and reviewed counts in bounded access history. It exposes no enquiry, task, customer or supplier content.

The frozen request carries one Team version and two counts. Current owner access, tenant scope, target state and both counts must match in the removal statement.

New or changed assigned work returns the owner to impact review. Neither the membership nor its accountable Team-history event changes.

An uncertain active removal can retry the same frozen action only after Check latest confirms both the Team record and reviewed assigned-work counts.

The write requires both exact Team records and the reviewed enquiry and task counts, then selects no more than 20 still-open assignments in the current agency.

Only records still assigned at their exact versions move. Every successful change advances that record and uses its existing enquiry activity history.

The confirmed response refreshes what remains. Changed or newly assigned work stays visible for another deliberate batch or the owner's removal decision.

The owner-only read requires the selected active membership and its current version, then returns only open enquiry and operations-task counts.

The review explains that removal does not delete or reassign work. Unavailable assignments remain saved and visible in Needs an Owner.

AgencyOS checks the same snapshot again. Changed counts require a new decision; unchanged counts proceed through the existing versioned removal.

Three gates show partial evidence and four remain open. Partial work never appears as approval.

Every gate separates controls already present from legal, lifecycle, access, security, resilience or go-live work that remains outstanding.

Real data remains blocked until every gate is approved and the final decision names the first permitted data tier.

Pipeline, quote, itinerary, operations, manual-record, Team, settings and search inputs are mapped in the language used by the workspace.

Each rule states why the input exists, the least information needed to test it and how a submitted or transient value is handled.

The map records the current pilot boundary; it does not approve real customer data or complete the separate legal, lifecycle, security and go-live gates.

Each period lasts 90 days. Due soon begins exactly 14 days before the deadline, using workspace creation until the first review receipt exists.

The schedule is derived at read time from the latest existing review receipt in owner-only Team history and refreshes after a successful manual review.

The interface sends no email, reminder, notification or escalation and performs no automated or external action.

The browser freezes only current Team identifiers and versions. The service derives and rechecks the agency, actor, record scope and owner role at the write.

One append-only event records the reviewed roster versions. Any missing, extra, stale, expired or cross-agency record makes the request write nothing.

The review changes no member, role, invitation or business record and sends no message. Uncertain outcomes require a fresh Team and history check before retry.

The browser sends only both current membership versions. The service derives and rechecks the agency, signed-in owner, immutable scope and both roles at the write.

One atomic winner swaps the two roles and creates one Team-history event. Stale, pending, revoked, cross-agency or competing attempts write nothing.

Success returns no private payload. Success or uncertain delivery clears cached workspace views and requires a reload before either role is relied on.

The browser sends only the current membership version. The service derives and rechecks the signed-in member, agency and immutable record scope at the write.

One winning leave revokes that membership and creates one access-history event attributed to the leaving member. Stale or mismatched attempts write nothing.

Success or an uncertain delivery outcome clears cached workspace views and requires a reload before the user can continue or try again.

Responses prevent framing and MIME sniffing, restrict base URLs and embedded objects, limit referrer detail and disable unused device capabilities.

Workspace pages and APIs are explicitly private, no-store and marked noindex, nofollow and noarchive at the response boundary.

Public indexing and cache policy remain unchanged, while HTTPS responses request one year of strict transport handling.

Each explicit continuation request returns no more than 50 later enquiry follow-ups or trip tasks in the existing urgency order.

The cursor stores only the snapshot date and last position. It cannot choose an agency, membership, teammate, assignee or filter.

A failed page leaves prior records and filters in place. A full refresh intentionally restarts from the latest first page.

Search and filters inspect no more than the 50 attention summaries already loaded for the current viewer; they do not request or imply a complete agency workload.

Saved urgency counts remain authoritative while the interface reports exactly how many loaded records match, without changing their source order.

Filter state is transient and clears with viewer or access changes. Opening a record continues through the existing guarded handoff.

The first page loads automatically. Each explicit Load more triage work action appends no more than 50 later enquiries and trip tasks needing responsibility.

The opaque cursor records only the last ordered position. Current active access and uncovered agency responsibility are derived again for every page.

A failed next page keeps loaded work, filters and claim state unchanged. Open claims and recovery reviews lock pagination until they are resolved.

The first page loads automatically. Each explicit Load more action appends no more than 50 later assigned follow-ups and trip tasks.

The opaque cursor records only the last ordered position. Current active access and personal responsibility are derived again for every page.

A failed next page keeps loaded work and filters unchanged. Open action forms and recovery reviews lock pagination until they are resolved.

A direct result must contain the exact next draft, its coherent server-calculated totals and no quote-history or Activity spill before the editor announces success.

Check latest reads the current quote and, when later work exists, the exact expected revision. Revision-history pages are never used as save proof.

An unchanged baseline permits only the identical reviewed retry. A matching revision resolves without attribution; a newer mismatch permits only Use latest.

A direct result must be one coherent initial Operations record for the exact accepted revision, with no tasks or Activity spill and zero manual money totals.

Check latest uses the existing authenticated Operations read. A matching saved ledger resolves without request attribution or a synthetic Activity entry.

An unchanged eligible state permits only the same reviewed start. A coherent changed state permits only Use latest saved Operations and sends no retry.

A direct result must be a coherent owner-scoped Team envelope in which the exact frozen member or invitation is absent.

Check latest uses the existing queryless Team read. It never treats access-history pages as proof or invents an access-history entry.

An unchanged target permits only the same reviewed retry. A changed target permits only Use latest Team access and sends no retry.

Search loaded assigned summaries, then narrow by work type, work state or timing. The interface always says how many loaded items remain visible.

Filters cover every page explicitly loaded for the current viewer, with no more than 50 items per page, and preserve the urgency groups and source order.

Filters lock around next-step and task-progress forms. A return handoff clears only a hiding filter before focusing the requested work.

Search loaded task details, then narrow by status, responsibility or timing. The interface always says how many of the loaded tasks are shown.

Active overdue, due-today and next-seven-day tasks appear before later, unscheduled, completed and cancelled work.

Filters lock around task forms and recovery reviews. A direct task handoff clears only a hiding filter before opening the requested editor.

The existing task POST rechecks the current member, agency, record scope and exact active same-agency teammate in its decisive insert.

A winner creates one assigned or unassigned task, one task-created activity and one operation timestamp change. Same-key replay creates nothing twice.

A `409 assignment_unavailable` target writes nothing and returns the draft to Unassigned. An assigned reviewed retry reloads the active Team roster before it can run.

A direct result must be an exact `200` for the same work at the next version. Unreadable or incoherent confirmation never unlocks a blind repeat.

Check latest responsibility uses only the existing queryless My Work and Triage snapshots. A positive My Work match confirms saved responsibility without request attribution or a synthetic activity.

The exact unchanged Triage item permits only the identical reviewed retry. Changed, missing or out-of-window evidence permits only Use latest triage snapshot.

A direct result must be a strict `200` proving either the exact active member workspace or that the exact declined invitation is absent.

Check latest workspace uses the existing queryless context read and resolves a matching saved result without request attribution or a synthetic Team event.

An unchanged invitation permits only the identical reviewed response. A changed invitation or workspace permits only Use latest workspace state.

A direct result must be a strict `201` confirmation for the exact new owner workspace at version one before the interface announces success.

Check latest workspace uses the existing queryless context read. A matching owner workspace resolves without request attribution or a synthetic Team event.

Unchanged first-time setup permits only the identical reviewed retry. A different workspace or pending invitation permits only Use latest workspace state.

A direct result must be a strict `200` Settings envelope with the exact submitted values, untouched defaults preserved, the next version and one matching event.

Check latest uses the existing queryless Settings read. Matching saved state resolves without request attribution or a synthetic settings-history entry.

An unchanged baseline permits only the identical reviewed retry. A changed Settings state permits only Use latest saved settings and sends no retry.

A direct result must be a strict `200` Team envelope containing the exact requested name at the next version and a newer update time before success is announced.

Check latest uses the existing queryless Team read. Matching saved state resolves without request attribution or a synthetic access-history entry.

An unchanged baseline permits only the identical reviewed retry. A changed Team state permits only Use latest Team state and sends no rename retry.

A direct result must be a strict `201` Team envelope containing the exact new pending version-one member record before success is announced.

Check latest uses the existing queryless Team read. A matching pending or active record resolves without request attribution or a synthetic access-history entry.

An unchanged roster permits only the identical reviewed retry. A changed roster permits only Use latest Team state and sends no invitation retry.

Claim for me keeps the existing confirmed self-assignment flow. Assign teammate opens the latest record without assigning anyone automatically.

Enquiry follow-up opens Overview; operations work opens the exact task editor. In both cases, focus moves to Responsibility or its active-team status.

The user still chooses a teammate and saves through the existing versioned, review-safe editor. Existing navigation and recovery guards remain in force.

Arrow keys move through adjacent sections with wrapping. Home and End move directly to the first and last section, and only the active tab sits in the normal keyboard sequence.

At 850 pixels or less, the selector remains within reach on long records, scrolls horizontally when needed and brings the active tab into view.

Existing save, dirty-draft, discard and frozen-recovery guards still decide whether a section can change. Direct task openings keep their Operations focus.

Invalid controls expose their messages through aria-invalid and aria-describedby. Correcting one field clears only that field's message.

Title and destination allow 160 characters, next action 240 and operational notes 5,000—the same limits used by the saved-record contract.

Cancel returns to + New enquiry, while mobile error-summary actions remain full-width, wrapping and at least 44 pixels high at 390 pixels.

Search matches only the reviewed title, destination, next action, status, due date, work-type label and generic responsibility label already present in the response.

Members can narrow the loaded view to Tasks or Enquiries, Unassigned or Needs reassignment, and the existing overdue-through-unscheduled timing groups.

The screen says how many items are showing out of the loaded snapshot. It never presents that result as an exact all-work total or reveals work outside the page.

Exact 400, 404 and 415 outcomes leave the draft editable. A 409, delivery uncertainty, server failure, unexpected status or incoherent success freezes one immutable viewer-, enquiry-, operation- and task-scoped attempt.

Check latest task uses the existing authenticated queryless exact-task read. An unchanged baseline permits only an explicit retry of the identical frozen request body, while a later exact match resolves without attribution or synthetic activity.

A newer mismatch can only use the latest saved task or explicitly rebase the originally changed fields for another Save. Every non-null assignee is confirmed against the current active-team roster before retry or rebase.

A successful response must contain the exact authoritative next-version quote and selected revision for the reviewed transition, with coherent statuses and timestamps and empty revision-history and activity arrays.

Exact 400, 404 and 415 responses are known no-write outcomes. A 409 or unknown outcome freezes the attempt. Check latest quote uses the authenticated exact selected-revision GET /api/workspace/enquiries/:id/quote?revision=R before another action is considered.

A matching saved transition resolves without attributing the uncertain browser request and without synthesizing an activity. An unchanged exact baseline permits only an explicit retry of the same frozen request body or abandonment. A newer mismatch can only use the latest saved quote; it is never applied over newer work and cannot retry or rebase the decision.

A successful save must return the authoritative next-version enquiry and exactly one updated activity, plus one status-changed activity only when status changed. An incomplete or unexpected receipt is treated as an unknown delivery or response outcome.

Exact 400, 404 and 415 outcomes are known no-writes and leave the draft editable. A 409 or unknown outcome freezes the exact submitted fields and version. Check latest uses the authenticated, queryless exact enquiry read before any explicit reviewed retry with the same version.

A newer record matching every submitted field resolves without attributing the change and without synthesizing an activity. Only an explicit mismatch choice rebases the submitted fields over the latest record for another review.

Each decision binds the reviewed membership ID, agency ID, signed-in user ID and immutable record scope and requires that membership to remain active with the owner role. The browser supplies no agency, owner, role or scope selector.

Preparatory reads prove current owner access before record-dependent no-write feedback about a target, capacity or version. Because no business write follows, an access change committed after that read does not retroactively replace that feedback.

Business writes and their append-only Team or Settings events are counted together. Invitation replacement separately accounts for the expired record and new invitation, so no failed request can leave an orphan row or audit event.

Required values, dates, budget and currency are normalized and validated before save. Invalid or no-change attempts create no edit or activity and keep the draft available.

The exact existing same-origin versioned PATCH /api/workspace/enquiries/:id sends only normalized changed brief fields plus the reviewed version. One winning edit advances the version once and creates one accountable updated activity with changed field names only.

Stale, conflicting and unknown outcomes preserve and freeze the draft. Check latest reconciles the existing authenticated, queryless exact enquiry read before a member explicitly reviews any retry.

Pipeline, Activity, Quote, quote-history, Operations, Command Centre, Team-roster, Team-history and Settings reads share one current-access rule.

If revocation or another access change commits before a contributing read statement, that statement returns no shared rows. The whole private response is withheld with 403 access_changed; the interface aborts in-flight work and clears viewer-scoped shared data through the central access-change path.

If every contributing read statement completes first while access remains valid, the response is an authorised completed read and may be returned. A revocation committed afterward is not retroactive and applies to every later shared read.

The same-origin POST stores the key as the normal task ID. First save returns 201; the same canonical task replay returns 200 with no second activity or operation timestamp change.

An uncertain outcome freezes the exact request and draft. The authenticated, queryless exact-task GET must resolve a matching, missing or changed task before any reviewed same-key retry is available.

Create, replay and exact lookup return only top-level task and notice fields. Confirmation requires the selected operation, exact canonical create fields and optional responsibility at version 1 whose created and updated timestamps are equal.

Each winning statement binds the reviewed membership, agency, signed-in user and record scope. The browser cannot select or widen that authority.

If revocation or another access change is ordered before the decisive batch, the action returns access_changed. Zero business or activity writes occur, and no shared record, child row, version, total or operations timestamp is changed.

A decisive batch that fully commits while access is still valid remains an accountable committed change. A later access change withholds the private response and clears the viewer-scoped workspace.

The request key is sent in the same-origin POST body and stored as the normal enquiry ID. It contains no enquiry, query or staff information.

An unknown outcome freezes the exact request and draft. Check latest must review the authenticated saved detail before a same-key retry can be chosen.

Active membership, agency record scope and the existing 500-enquiry capacity are checked again for creation and exact record access.

Each tenant-scoped page has a fixed 25-record limit. The shown count describes only records loaded in this browser and is not an exact ledger total.

An explicit action appends one older page without replacing loaded records, changing the selected enquiry or discarding an open create or void draft.

Recorded payments, refunds, net and balance are calculated across all scoped records. Voided entries remain accountable but are excluded from active totals.

Loaded enquiries, agency-wide results, workspace snapshots, confirmed claims and newly captured enquiries all bring the latest authoritative detail into view.

The mobile detail pane provides a clear return control. Any existing return to Command Centre, Triage or My Work remains available alongside it.

Returning preserves selected detail and drafts, loaded pages, stage, local and agency-wide Find state, result shelf, page cursor and source-return context.

Nothing is sent while the member types. Only Search all agency records sends the exact bounded query in a same-origin POST body, never in the URL.

The read transiently scans no more than 500 same-tenant summaries across all stages and compares only title, destination, source and next action.

The response shows no more than eight matches and only whether more exist. It returns no exact total and does not echo the submitted query.

Members receive the bounded active roster and never receive team-event history. The owner keeps the existing invitation and revocation controls.

The owner's separate history request returns the newest 25 privacy-reviewed summaries. Each action appends one earlier page, and the shown count covers loaded entries only, never an exact event total.

Active membership and the owner role are checked before a history cursor, invitation email, workspace-name change, membership identifier or version is inspected.

Opening or acting on one quote no longer requires the service to scan every saved revision. Pricing and itinerary detail load only for the requested revision.

Each action appends one fixed 25-summary page. The shown count covers loaded summaries only, never an exact revision total. Each quote retains at most 50 saved revisions.

The opaque cursor records position only. Active membership, enquiry ownership and agency record scope are derived and checked again for every request.

Each response is bounded. Enquiry detail, quote and operations reads no longer return or scan an unbounded activity history.

Older pages append without replacing loaded entries or changing the selected enquiry. The shown count covers loaded entries only, not an exact history total.

The opaque cursor records position only. Active membership, enquiry ownership and agency record scope are derived and checked again for every request.

List responses omit enquiry notes and deeper private quote, operations, activity and payment detail. Detail is fetched separately for the selected or opened record.

Pipeline header and status counts cover only cumulative loaded records. Agency-wide Find & Open is a separate bounded request with no exact total.

The opaque cursor records position, not authority. The server derives active agency access again, and atomically caps stored enquiries at 500 across all statuses.

Up to 80 characters are normalised into literal tokens matched only against the enquiry title, destination, source and next action.

Matches remain combined with the selected Pipeline stage. At most eight are visible, with clear cumulative-loaded and refine-the-search wording.

Typing does not change the open record. Choosing a match uses the Pipeline's existing guarded navigation, and viewer or access changes clear the local state.

The snapshot includes assigned open enquiries, including those missing a next action, and assigned open or in-progress tasks.

Lagos dates group loaded work as overdue, due today, next seven days, later or unscheduled; an explicit action appends a later page when one exists.

Refreshing reads the latest saved records. It does not change an assignment, status, next action, due date or underlying activity history.

The service derives the active membership again and cannot use the action to plan another teammate's work.

The save succeeds only while the enquiry remains open, assigned to that member, missing a next action and at the version they reviewed.

A winning request changes only the next action and optional due date, advances the enquiry version and records one attributable activity.

The service derives the active membership again and rechecks the agency, current task assignment and record version when the change is committed.

An open task can start and an in-progress task can finish. The action cannot choose another status, skip ahead or reverse completed work.

A winning request changes only task status, advances the version and records one attributable operation-task activity with the saved status transition.

Open work appears as Unassigned or Needs reassignment. If a saved teammate is no longer available, their identity is never returned or shown.

Lagos dates group displayed work as overdue, due today, next seven days, later or unscheduled. Every count describes only the records shown.

The snapshot has no inline assignment. A member reviews the latest underlying enquiry or task before using its existing version-protected responsibility control.

The browser cannot choose an agency, membership, user, assignee or another teammate. The success response returns no staff identifier.

A claim succeeds only while that enquiry or task remains open, uncovered and at the version the member reviewed. Work with an available active teammate cannot be taken.

The winning update advances the version and records one activity. A stale, ineligible or competing request changes nothing and records no activity.

The claimed record remains visible after it leaves the responsibility-gap list, so success is not reduced to a disappearing row.

Open the claimed record, move to the personal My Work snapshot or continue reviewing uncovered work in triage.

A record opened from Command Centre attention, My Work or triage keeps a return path for that viewer while they review the latest underlying record.

A newly captured enquiry remains Unassigned until an active teammate chooses responsibility.

Owners and operational members share the same control and can select only an active operational membership in their agency.

Assignment, status, dates and other enquiry edits use the same version check and accountable activity history.

Choose one active operational agency membership for a task, or leave the task unassigned.

Owners and operational members have the same assignment control; summary viewers are excluded.

Version checks protect concurrent edits, and successful reassignments join the existing activity trail.