docs: record visual roadmap evidence

UX: implement visual product roadmap
docs: record the MCP Hub URL fix and RAGcore Procedure Sync go-live
2026-08-10 01:05:30 +02:00 · 2026-08-10 01:05:07 +02:00 · 2026-08-05 22:07:41 +02:00 · 2026-08-05 22:05:13 +02:00 · 2026-08-05 21:22:57 +02:00 · 2026-08-05 21:18:58 +02:00
105 changed files with 6380 additions and 807 deletions
@@ -29,6 +29,11 @@ N8N_BASIC_AUTH_ACTIVE=true
 N8N_BASIC_AUTH_USER=admin
 N8N_BASIC_AUTH_PASSWORD=change-me
 MOBILITYOPS_CALLBACK_TOKEN=replace-me-n8n-callback-token
+# Sent as the X-Fleet-Ops-Trigger-Token header when Fleet Ops calls the n8n return-
+# processing webhook, so the webhook trigger can require Header Auth instead of being
+# publicly callable by anyone who discovers the URL. Must match the value stored in
+# n8n's "Fleet Ops Webhook Trigger Token" Header Auth credential.
+MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN=replace-me-n8n-webhook-trigger-token

 # RAGcore integration
 KNOWLEDGE_PROVIDER=demo
@@ -37,9 +42,14 @@ RAGCORE_TENANT=northstar-mobility-demo
 RAGCORE_WORKSPACE=mobilityops
 RAGCORE_COLLECTION=internal-procedures
 RAGCORE_API_TOKEN=
+# UUID of the RAGcore knowledge space procedures were synced into (see workflow 3).
+RAGCORE_SPACE_ID=

-# ITWorx MCP Hub integration
+# ITWorx MCP Hub integration. Registration itself is catalog-driven on the Hub's own
+# side (it reconciles its catalog into the gateway; Fleet Ops never pushes a
+# registration call) -- MCP_HUB_BASE_URL is only used here for an honest reachability
+# health check surfaced on the integration status page.
 MCP_HUB_REGISTRATION_ENABLED=false
 MCP_HUB_BASE_URL=http://itworx-mcp-hub:8000
 MCP_HUB_SERVICE_TOKEN=replace-me-mcp-hub-token
-MCP_PROVIDER_ID=mobilityops
+MCP_PROVIDER_ID=fleet-ops
@@ -14,3 +14,5 @@ test-results/
 .idea/
 .vscode/
 *.tsbuildinfo
+*.zip
+*.tar.gz
@@ -60,7 +60,10 @@
 - `knowledge/procedures/09-booking-conflicts.md`
 - `knowledge/procedures/10-roles-and-escalation.md`
 - `n8n/README.md`
- `n8n/mobilityops-return-processing.json`
+- `n8n/workflows/MANIFEST.md`
+- `n8n/workflows/fleet-ops-vehicle-return.json`
+- `n8n/workflows/fleet-ops-data-quality-scan.json`
+- `n8n/workflows/check_drift.py`
 - `seed/README.md`
 - `seed/bookings.csv`
 - `seed/customers.csv`
@@ -26,16 +26,19 @@ reset:
 # One-time per environment: imports and activates the n8n return-processing workflow.
 # The n8n owner account itself cannot be scripted safely and must be created once at
 # http://localhost:5678/setup (any email/password, no verification required) before
-# this target's activation takes effect. See docs/17-runbook.md.
+# this target's activation takes effect. The workflow also needs the "Fleet Ops Webhook
+# Trigger Token" and "Fleet Ops Service Token" Header Auth credentials created manually in
+# the n8n UI before it will actually process a return -- see docs/17-runbook.md.
 n8n-setup:
-	docker compose exec n8n n8n import:workflow --input=//imports/mobilityops-return-processing.json
+	docker compose exec n8n n8n import:workflow --input=//imports/workflows/fleet-ops-vehicle-return.json
 	docker compose exec n8n n8n publish:workflow --id=mobilityops-return-processing
 	docker compose restart n8n

 # One-time per environment: imports and activates the scheduled quality-scan workflow.
-# Same owner-account precondition as n8n-setup above.
+# Same owner-account and credential preconditions as n8n-setup above (this workflow only
+# needs "Fleet Ops Service Token").
 n8n-setup-scan:
-	docker compose exec n8n n8n import:workflow --input=//imports/mobilityops-scheduled-quality-scan.json
+	docker compose exec n8n n8n import:workflow --input=//imports/workflows/fleet-ops-data-quality-scan.json
 	docker compose exec n8n n8n publish:workflow --id=mobilityops-scheduled-quality-scan
 	docker compose restart n8n

@@ -68,15 +68,21 @@ It is not an ERP, CRM, accounting package, public booking site, payment system o
  delivery counts, not just the most recent event.
 - **RAGcore**: the demo `KnowledgeProvider` (deterministic TF-IDF extractive retrieval
  over the local procedure documents) is what satisfies the knowledge-assistant
-  acceptance criteria and is fully verified. A `RAGcoreKnowledgeProvider` HTTP adapter is
-  implemented and unit-tested, including its unavailable-degradation path, but was never
-  exercised against a live RAGcore instance in this environment.
+  acceptance criteria and is what's active in production (`KNOWLEDGE_PROVIDER=demo`). A
+  `RAGcoreKnowledgeProvider` HTTP adapter is implemented, unit-tested, and has been
+  exercised live against the deployed RAGcore instance: a real filesystem-permission bug
+  that caused every live retrieval to return zero candidates was found and fixed
+  (`docs/final-integrations/current-state-audit.md`), but a second, deeper gap — RAGcore's
+  reranker adapter calls an Ollama HTTP route (`/api/rerank`) that does not exist on the
+  deployed Ollama version — still blocks real grounded answers. `KNOWLEDGE_PROVIDER` stays
+  `demo` until that is resolved on the RAGcore side.
 - **ITWorx MCP Hub**: the four read-only provider endpoints are implemented, tested, and
  directly `curl`-verified with correct auth enforcement and audit logging.
-  `MCP_HUB_REGISTRATION_ENABLED` is now actually wired into `Settings` (it was previously
-  declared in `.env.example` but silently dropped) and reported honestly by the
-  integration-status endpoint. No live Hub instance was reachable in this environment to
-  verify an actual Hub round trip.
+  `MCP_HUB_REGISTRATION_ENABLED` is actually wired into `Settings` and reported honestly
+  by the integration-status endpoint (evidence-based: real tool-call audit history, not
+  just the flag). The Fleet Ops connector is confirmed live in the ITWorx MCP Hub's own
+  production deployment (Tower), with a real contract fix already applied there
+  (`vehicle.get`'s wire parameter normalized to `vehicleRef`).

 See `artifacts/functional-completion/final-summary.md` for the functional-completion
 audit evidence (supersedes the design-validation summary below for integration status),
@@ -0,0 +1,161 @@
+# Fleet Ops final integrations — evidence summary
+
+Session date: 2026-08-05. Branch `feat/fleet-ops-final-integrations`.
+
+## Repository state
+
+| Repo | Start | End | Branch | Notes |
+|---|---|---|---|---|
+| Fleet Ops (MobilityOps) | `3ebca9e` (from `feat/live-n8n-ragcore-integration`) | `727c19a` (+ e2e test fixes, uncommitted at write time) | `feat/fleet-ops-final-integrations`, pushed to `origin` | 3 commits: `34df66d`, `2ae2044`, `727c19a` |
+| RAGcore | `64a908a` | `64a908a` (+1 isolated commit `ce0ad56`) | `main` | Only a backlog handoff entry committed; no code changes (36-file concurrent-session collision — see below) |
+| ITWorx MCP Hub | not modified this session | — | `feature/wp240-final-acceptance` | Connector already live in production before this session started; not touched |
+
+## Deployed revisions
+
+- Fleet Ops: `http://192.168.10.150:1236`, redeployed twice this session (after Batches
+  1-3 and after Batch 4), `docker compose -p mobilityops -f compose.yaml -f
+  compose.unraid.yaml up --build -d db api web`, `.deploy/source-revision` = `727c19a...`.
+- RAGcore: `http://192.168.10.150:1237`, `ragcore-app-1`. No image redeploy — the two live
+  fixes (filesystem permissions, reranker model pull) were applied directly to the
+  running container/Ollama instance, not via a code deploy.
+- ITWorx MCP Hub: `http://192.168.10.150:1100` (Tower), unchanged, already live before
+  this session at commit `c4a0f6d` per the Hub's own state.
+
+## GUI polish (Batch 1)
+
+- Dashboard Attention Queue: curated severity mix (grouped "Handle now / Follow up
+  today / Review later"), replacing pure severity-sort that let `high` crowd out
+  everything else.
+- Today's Movements: seed data curated (`seed/bookings.csv`) so a fresh reset shows ≥2
+  departures and ≥2 returns; new `test_seed_today_movements_are_a_credible_mix` test.
+  Live-verified after a real demo reset: 2 returns + 2 departures shown.
+- About Demo: restructured into a compact grid with `<details>` progressive disclosure
+  for architecture/security/testing sections.
+- Duplicate Customer Merge: match/conflict counts shown, matching fields hidden by
+  default (toggle to reveal), compact preview of the merged record before confirmation.
+- Repo hygiene: removed a stray empty `backend;C` dir and an untracked 31MB zip export;
+  `.gitignore` now excludes future archive exports.
+- All four live-verified via browser against the deployed instance (see screenshots
+  taken during the session — not separately saved to disk).
+
+## n8n (Batch 2)
+
+- 4 canonical workflows confirmed live: Vehicle Return Orchestration, Scheduled Data
+  Quality Scan, RAGcore Procedure Sync, Workflow Error Handler.
+- Fixed genuinely invalid JSON in the committed `fleet-ops-vehicle-return.json` (a
+  missing `},` between two node objects — the file could not be parsed).
+- Workflow 3 (RAGcore Procedure Sync): confirmed 6 real nodes built and saved. Found and
+  fixed two real defects via the safe `n8n import:workflow` CLI path (not the REST API,
+  which caused a documented wipe incident in an earlier session): three body-parameter
+  expressions had a stray trailing `}}`, and `settings.errorWorkflow` was unset. Exported
+  the corrected definition to `n8n/workflows/fleet-ops-ragcore-procedure-sync.json`,
+  added to `MANIFEST.md` and `check_drift.py`.
+- **Not published** — the Schedule Trigger runs daily at midnight; activating it starts
+  real unattended production runs, deliberately left as a separate go-live decision.
+- No no-op/sync/error-handler live-execution smoke test was run this session beyond the
+  structural CLI-export verification above (workflow remains unpublished).
+
+## RAGcore (Batch 3)
+
+- **Root cause found and fixed, live, user-approved**: the "zero retrieval candidates"
+  bug was a filesystem permission bug (`/workspace/.state/models/embedding_profiles.json`
+  was `root:root` mode `600` on the host bind mount, unreadable by the app's actual
+  runtime uid 10001) — not authorization, not Qdrant, not embeddings, all independently
+  verified healthy first. Fixed via `chown`/`chmod`; re-verified in-process (5 real hits,
+  up from 0).
+- **Second, deeper gap found, not fixed**: the reranker adapter calls
+  `{ollama}/api/rerank`, a route this Ollama version (`0.32.5`) does not serve (404).
+  Pulled a working model (`xitao/bge-reranker-v2-m3:latest`, 1.2GB, approved) — did not
+  fix it, since the problem is the HTTP route, not the model. `/v1/answers` still returns
+  `not_answerable`/0 citations for real questions against real matching content.
+- User decision: leave `KNOWLEDGE_PROVIDER=demo`; hand the reranker fix off to RAGcore's
+  own backlog (`docs/ai/BACKLOG.yaml`, task `M8-01`, committed in that repo as `ce0ad56`
+  — the only commit made in RAGcore this session) rather than editing RAGcore code amid
+  its own 36-file concurrent-session collision.
+- Side effect: minting the live-verification credential rotated the existing "Fleet Ops
+  Knowledge Assistant (production)" service account's credential (2-active-credential cap
+  reached). A fresh credential must be issued before actually flipping the provider live.
+
+## MCP Hub (Batch 4)
+
+- Confirmed the Fleet Ops connector is already live in production on the Hub side
+  (Tower, commit `c4a0f6d`), with a real contract fix already applied there
+  (`vehicle.get`'s wire parameter normalized to camelCase `vehicleRef`).
+- Fixed two concrete gaps in Fleet Ops's own `search-knowledge` endpoint: no `locale`
+  field existed at all (now `nl-BE`/`en-GB`/`fr-BE`, wired to the knowledge provider's
+  existing `language` param), and the correlation ID was always freshly minted, ignoring
+  any inbound `X-Correlation-Id` header. Added `get_correlation_id`, applied to all four
+  MCP endpoints.
+- `MCP_HUB_BASE_URL` was dead config (declared, never read); wired it for a real,
+  bounded Hub-reachability health check instead of an unneeded self-registration push
+  (the Hub's own registration is catalog-driven).
+- Renamed Fleet Ops's own internal audit tool labels `mobilityops_*` → `fleet_ops_*`
+  (mirrored in `contracts/mcp-tools.json`, `mobilityops_*` kept as deprecated aliases).
+  The live Hub connector's own dotted tool namespace (`mobilityops.operations.summary`
+  etc.) is a separate, Hub-owned naming layer, deliberately not touched.
+- Automation page's MCP card now shows real evidence (last tool/client/count/timestamp)
+  instead of only the registration-enabled boolean.
+
+## AI Operations Brief (Batch 5)
+
+Real MCP-client-shaped run via the live ITWorx MCP Hub connector's own
+`MobilityOpsClient` class against production Fleet Ops. Full runbook and live output in
+`docs/final-integrations/ai-operations-brief-runbook.md`. Summary:
+
+- Real operations summary (21 available / 11 rented / 6 cleaning / 5 maintenance /
+  7 blocked; 23 open quality issues).
+- Real most-pressing vehicle identified (`MO-031`, missing operational inspection).
+- Real vehicle detail lookup.
+- Real grounded knowledge answer (English damage-handling question): 2 real citations,
+  `evidence_state: grounded`.
+- Dutch/French variants of the same question honestly returned `insufficient` (no
+  fabrication) — root cause: the live Hub connector doesn't yet send the new `locale`
+  field, a Hub-side follow-up, not silently worked around.
+- Correlation IDs verified end-to-end in Fleet Ops's own audit log
+  (`GET /api/v1/audit?action=mcp_tool_request`), matching the response payloads exactly.
+- No write actions performed at any point.
+
+## Testing per batch
+
+- Backend: **176 passed**, `ruff check .` clean, `mypy app` clean (50 source files) —
+  verified against a freshly rebuilt image after discovering mid-session that
+  `docker compose run --rm api` (no bind mount on the `api` service) silently tests a
+  stale image otherwise. One genuinely stale test assertion found and fixed as a result.
+- Frontend: `tsc -b && vite build` clean.
+- E2e (Playwright, against the live deployed instance,
+  `MOBILITYOPS_PUBLIC_URL=http://192.168.10.150:1236`): every spec file run this
+  session passed — `demo.spec.ts`, `interactive-elements.spec.ts` (26),
+  `responsive-i18n.spec.ts` + `demo-accessibility.spec.ts` + `guided-demo-full.spec.ts`
+  (28), `i18n-coverage.spec.ts` + `error-messages.spec.ts` + `clickable-rows.spec.ts` +
+  `demo-guide.spec.ts` + `demo-entry.spec.ts` + `demo-legibility.spec.ts` +
+  `fleet-ops-correction.spec.ts` + `ui-redesign.spec.ts` + `greeting.spec.ts` +
+  `greeting-live.spec.ts` (28, after fixing 2 pre-existing fragile locators unrelated to
+  this session's feature work — a `.data-table` ambiguity now that Automation has two
+  tables, and a `Technische details` toggle ambiguity for the same reason; plus one
+  pre-existing untranslated-loanword false positive in `i18n-coverage.spec.ts`).
+
+## Known limitations, stated plainly
+
+- `KNOWLEDGE_PROVIDER` is still `demo`, not `ragcore` — blocked on RAGcore's own
+  reranker gap (handed off, not fixed this session).
+- n8n workflow 3 is built and correct but not published (deliberate, separate decision).
+- The live MCP Hub connector doesn't yet send the new `locale` field, so
+  locale-aware knowledge search only works when called directly against Fleet Ops (as
+  proven by the backend tests), not yet through the live Hub connector as deployed.
+- No public-demo-readiness checklist, About Demo Guide "completed" end-state polish
+  (section 4E), or dashboard MCP "activity showcase after Demo Complete" gating were
+  built this session — the MCP evidence display exists on the Automation page
+  unconditionally rather than gated behind guided-demo completion.
+- No security-review pass was run separately this session (existing gates: ruff, mypy,
+  the repo's own auth/audit test coverage).
+
+## Rollback
+
+- Fleet Ops: prior working revision `0571a40` remains in `.deploy/` as
+  `source-0571a40.tar.gz` on the Unraid host; redeploy by re-extracting and re-running
+  the same `docker compose up --build -d` sequence with that archive.
+- RAGcore: `chown`/`chmod` change is trivially reversible (`chown 0:0` +
+  `chmod 600` on the same path) if needed, though there is no reason to revert a
+  permission fix. Ollama model pull (`xitao/bge-reranker-v2-m3:latest`) can be removed
+  with `ollama rm` if unwanted; it is inert until RAGcore's own code is changed to use it.
+- MCP Hub: not modified this session.
@@ -0,0 +1,291 @@
+# Fleet Ops final localization — final summary
+
+Small, targeted correction round on top of the already-merged, functionally-validated
+Fleet Ops correction milestone. Scope: remaining NL/FR translation gaps, centralized
+API-error localization, a time-dependent Europe/Brussels dashboard greeting, i18n
+test hardening, and documentation consistency — explicitly no redesign, no business-logic
+changes, no new functionality. Audit and rationale: `docs/fleet-ops-final-localization/audit.md`.
+
+## Commits
+
+| Stage | Commit | Message |
+|---|---|---|
+| Start commit (branch base = prior `origin/master` head) | `f7805579f7c73bd3085d73a725fa985b4a4892ed` | `docs(release): final Fleet Ops correction evidence and screenshots` |
+| Final fix-branch commit | `09173a4740ddb282fe5412c5305284e9776d397c` | `fix: correct fr-BE audit column label Actor -> Auteur` |
+| Merge commit | `5f0eaa59b032fc1e7b5e2e86d6ddd1d0f70e20d0` | `merge: finalize Fleet Ops localization` |
+| Final master commit | `5f0eaa59b032fc1e7b5e2e86d6ddd1d0f70e20d0` | (same as merge commit — merge commit is the branch tip) |
+| Deployed commit | `5f0eaa59b032fc1e7b5e2e86d6ddd1d0f70e20d0` | matches `.deploy/source-revision` on Unraid exactly |
+
+Branch used: `fix/fleet-ops-final-i18n-ux` (the brief named `fix/fleet-ops-final-localization`;
+this branch was verified freshly and cleanly branched from `origin/master` with a clean
+working tree, so it was used as-is rather than renamed — see the audit doc's naming note).
+`origin/master` was re-fetched and confirmed unchanged (`f780557`) immediately before the
+merge, per the mandatory pre-merge safety check.
+
+Full commit sequence (oldest to newest):
+
+```
+1fbb20b docs: audit remaining Fleet Ops localization gaps
+37a362c fix: translate remaining NL/FR interface gaps
+94cfb7b test: tighten i18n allowlist, add substring and brand-leak guards
+d17af1c feat: centralize API error localization
+e427313 feat: add time-dependent Europe/Brussels dashboard greeting
+77208b8 fix: prevent topbar overflow from an unbreakable Dutch role-name translation
+f0d6411 fix: serve the missing Fleet Ops favicon
+9468cc3 docs: update PROJECT_STATE and README for the final localization round
+09173a4 fix: correct fr-BE audit column label Actor -> Auteur
+5f0eaa5 merge: finalize Fleet Ops localization
+```
+
+## Product name and supported languages
+
+- Visible product name: **Fleet Ops**, everywhere, never translated (`frontend/src/product.ts`
+  constant, interpolated as `{{productName}}`). "MobilityOps" remains the internal repo /
+  Compose project / deployment-directory identifier only.
+- Supported UI languages: **nl-BE** (default), **en-GB**, **fr-BE**.
+- No visible "MobilityOps" or the word "PoC" anywhere in the UI (enforced by a dedicated
+  automated test, see below).
+
+## Corrected translations
+
+- Role names actually translated (not just labelled as translated): `auth.json` /
+  `demo.json` role keys — **Operationsmanager** / **Verhuurmedewerker** (nl-BE),
+  **Responsable des opérations** / **Collaborateur de location** (fr-BE).
+- `audit.title` → **Auditgeschiedenis** / **Piste d'audit**; `columns.actor` → **Uitvoerder**
+  (nl-BE) / **Auteur** (fr-BE, corrected during live browser validation — see Known
+  limitations).
+- `list.statusOpen` → **Openstaand**; `ledger.filterRecent` → **Recentste**;
+  `scenarios.startScenario` → **Scenario starten** / **Démarrer le scénario**.
+- 8 previously-missed mid-sentence "Audit trail" leaks fixed across `demo.json`,
+  `quality.json`, `returns.json` (nl-BE) — found by the new embedded-substring test, not
+  the pre-existing whole-string-identity test, which structurally cannot catch this class
+  of bug.
+- No unintended English text remains in nl-BE or fr-BE (see translation-coverage evidence
+  below).
+
+## Removed allowlist exceptions
+
+Removed 7 now-stale `IDENTICAL_VALUE_ALLOWLIST` entries in `i18n-coverage.spec.ts`:
+`audit.title`, `auth.roleOperationsManager`, `auth.roleRentalEmployee`,
+`demo.scenarios.startScenario`, `demo.scenarios.roles.operations_manager`,
+`demo.scenarios.roles.rental_employee`, `navigation.items.audit` — all now genuinely
+translated; their old comments describing them as "deliberately untranslated" were no
+longer true. Two new tests added: embedded-English/Dutch-substring leak guard, and a
+no-"MobilityOps"/no-"PoC" guard.
+
+## Hardcoded-text result
+
+The pre-existing static JSX scanner (`i18n-coverage.spec.ts`, section 11D) found **zero**
+hardcoded user-facing strings outside the approved technical-token allowlist (Fleet Ops,
+Northstar Mobility, ITWorx MCP Hub) across `pages/` and `components/`. Result: **PASS**.
+
+## API-error-localization result
+
+New `frontend/src/api/errorMessages.ts` (`describeApiError`) replaces the
+`err instanceof ApiError ? err.message : t(fallback)` anti-pattern (which showed raw
+English backend text for the common case) at all 13 call sites across 7 files
+(`Automation.tsx`, `ReturnForm.tsx`, `DataQuality.tsx`, `DemoGuide.tsx`, `Layout.tsx`,
+`DataQualityIssueDetail.tsx` ×7 sites, `Knowledge.tsx`). Resolution order: known `AppError`
+code (32 codes) → known HTTP status (401/403/404/409/422/500) → fully generic fallback.
+New `ApiErrorNotice` component (`PageChrome.tsx`) always renders a localized title +
+explanation + optional next step; raw backend text is demoted to a "Technical
+details"/"Détails techniques" disclosure, never the primary message.
+
+Evidence: `frontend/e2e/error-messages.spec.ts` (10 tests, all passing) —
+every known code/status has non-empty copy in all 3 locales; a known code never surfaces
+raw text as the primary message; unknown-code and unknown-status fallback chains behave
+correctly; a drift guard greps the actual backend `AppError("CODE", ...)` call sites and
+confirms `KNOWN_CODES` exactly matches (32 codes, zero drift). Live-verified on Unraid: the
+seeded failed automation run renders a fully localized French error with a "DÉTAILS
+TECHNIQUES" disclosure below it.
+
+## Greeting logic and edge cases
+
+New `frontend/src/i18n/greeting.ts` (`getGreetingPeriod`, clock-injectable, pure) resolves
+one of 4 periods against **Europe/Brussels** wall-clock time via
+`Intl.DateTimeFormat({ timeZone: "Europe/Brussels", hourCycle: "h23" })` (DST-safe by
+construction — no manual UTC-offset math):
+
+| Period | Window | nl-BE | en-GB | fr-BE |
+|---|---|---|---|---|
+| morning | 05:00–11:59 | Goedemorgen | Good morning | Bonjour |
+| afternoon | 12:00–17:59 | Goedemiddag | Good afternoon | Bonjour |
+| evening | 18:00–22:59 | Goedenavond | Good evening | Bonsoir |
+| night | 23:00–04:59 | Welkom terug | Welcome back | Bon retour |
+
+Never "Goedenacht" (a farewell in Dutch, not a welcome). Each period also has its own
+accompanying sentence per language (`dashboard.json` `greetingBody`), replacing the old
+fixed "Here's the fleet." `useGreetingPeriod.ts` polls every 30s so the greeting rolls
+over live while the app stays open, no reload required; initial render uses a synchronous
+`useState(() => getGreetingPeriod())` so there is never a flash of the wrong period.
+
+Edge-case evidence:
+- `frontend/e2e/greeting.spec.ts` (4 tests): exact boundary checks at 04:59/05:00/11:59/
+  12:00/17:59/18:00/22:59/23:00 in both CET (winter) and CEST (summer), plus a dedicated
+  spring-forward/fall-back DST-transition test (2026-03-29 and 2026-10-25).
+- `frontend/e2e/greeting-live.spec.ts` (6 tests, real browser via Playwright's `page.clock`):
+  all 8 boundary times rendered correctly in **all 3 languages** against the actual app;
+  live period rollover with no `page.reload()` call anywhere in that test; language-switch
+  behaviour without changing the time period; the "never Goedenacht" guard.
+- Live-verified on Unraid at actual current server time (2026-08-04, ~03:2x CEST, i.e. the
+  night period): dashboard showed "Welkom terug. Hier is het laatste overzicht van je
+  wagenpark." (nl-BE), "Welcome back. Here's the latest overview of your fleet." (en-GB),
+  "Bon retour. Voici le dernier aperçu de votre flotte." (fr-BE).
+
+## README / PROJECT_STATE corrections
+
+- `PROJECT_STATE.md`: fixed the stale "Product name: MobilityOps." / "PoC only"
+  locked-decisions lines (predated the Fleet Ops rebrand); fixed the "Fleet Ops
+  correction" section header, which still read "IN PROGRESS .../Not yet merged to
+  master" despite already being merged (`de0bdea` / `f780557`); appended a new dated
+  entry for this correction round (not a rewrite of prior entries, per the brief's
+  explicit instruction not to hide earlier history).
+- `README.md`: linked `docs/fleet-ops-final-localization/` alongside the existing
+  correction-round doc link; refreshed the stale Playwright test count (113 → 138 → 139
+  after the favicon regression test was added).
+
+## Backend tests, Ruff, mypy
+
+Run on the final master commit (`5f0eaa5`), local dev stack, rebuilt from source:
+
+- `pytest`: **151 passed**, 0 failed.
+- `ruff check .`: **All checks passed!**
+- `mypy app` (the project's canonical invocation, matching all prior milestone gates —
+  no `[tool.mypy]` strict config exists in `pyproject.toml`): **Success: no issues found
+  in 49 source files.**
+
+No backend Python was touched this round; these numbers are unchanged from the prior
+correction milestone's final gate, confirmed green again on the current tree.
+
+## Frontend build, Playwright
+
+- `npx tsc --noEmit`: clean, 0 errors.
+- `npm run build` (`tsc -b && vite build`): clean production build.
+- Full Playwright suite (`npx playwright test`), master build, local dev stack:
+  **139 passed**, 0 failed (confirmed on a clean run after two transient
+  `0xC0000005` Chromium worker crashes caused by this specific machine running 43+
+  concurrent Chrome processes at the time — see Known limitations; a targeted 48-test
+  re-run of every new/changed suite also passed cleanly in between).
+
+## Clean-checkout drill
+
+Isolated Compose project `mobilityops-clean` (ports 8129/1229/5679, no shared volumes/
+network with the working dev stack), fresh `git clone --branch
+fix/fleet-ops-final-i18n-ux` of only committed files:
+
+1. `docker compose build` + `up -d` from empty volumes — all 4 containers healthy.
+2. `alembic upgrade head` → `799d8800e241 (head)`.
+3. `seed --reset` → 2 users / 180 customers / 50 vehicles / 246 bookings / 75 inspections /
+   40 maintenance / 27 data-quality issues / 20 workflow runs — matches the documented
+   deterministic count exactly.
+4. Backend gates: `pytest` 151 passed, `ruff check .` clean, `mypy app` clean (49 files).
+5. Frontend: `npm ci` clean, `tsc --noEmit` clean, `vite build` clean.
+6. Full Playwright suite against the isolated stack (`MOBILITYOPS_PUBLIC_URL=http://localhost:1229`):
+   **139 passed**, 0 failed — this run covers the Dutch/English/French language checks,
+   greeting boundaries, API error paths, and the guided demo, all in one pass.
+7. Final reset + `scenario_integrity`: all 5 scenarios `ready: true`.
+8. Isolated stack, containers, volumes and images torn down; original dev environment
+   confirmed untouched (`mobilityops-*` containers unaffected throughout).
+
+**PASS.**
+
+## Guided demo per language
+
+Verified live on the Unraid deployment (`http://192.168.10.150:1236`) in all 3 languages
+via direct browser interaction: login screen role buttons, dashboard (greeting, readiness
+band, attention queue, integration pulse, recent activity), audit trail, automation retry
+flow with localized error + technical-details disclosure, and demo reset — all rendering
+correctly in nl-BE, en-GB and fr-BE. The full guided-demo Playwright spec
+(`guided-demo-full.spec.ts`) passed as part of the 139-test suite on both the local dev
+stack and the isolated clean-checkout stack.
+
+## Server deployment, container health
+
+Deployed to `http://192.168.10.150:1236` (Compose project `mobilityops`,
+`/mnt/user/appdata/mobilityops`), preserving the server's existing `.env`, the Postgres
+and n8n named volumes, the exposed port, and the deployment directory — only `api` and
+`web` were rebuilt/recreated; `db` was never touched beyond `alembic upgrade head`; no
+second n8n instance was started (shared existing n8n at `:5678` used throughout).
+
+Procedure (matching `docs/demo-release/demo-runbook.md` exactly): `git archive` → `scp` →
+extract over the existing deployment dir → update `.deploy/source-revision` →
+`docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d api web`
+→ confirm `alembic current` → `seed --reset`.
+
+Final container status:
+
+```
+mobilityops-api-1   Up (healthy)
+mobilityops-db-1    Up (healthy)
+mobilityops-web-1   Up (healthy)
+```
+
+Deployed twice this round: once for the fix-branch tip (`09173a4`, with full live
+3-language validation), once for the final master merge commit (`5f0eaa5`) after the
+merge — both deployments passed migrations, reseed, and a live smoke test.
+
+## Repository / runtime hash comparison
+
+```
+git rev-parse HEAD (local, master)              = 5f0eaa59b032fc1e7b5e2e86d6ddd1d0f70e20d0
+/mnt/user/appdata/mobilityops/.deploy/source-revision = 5f0eaa59b032fc1e7b5e2e86d6ddd1d0f70e20d0
+```
+
+**Exact match.**
+
+## Browser console and network
+
+No console errors on any checked route in any of the 3 languages (dashboard, audit,
+automation, login) on the live Unraid deployment. All observed `/api/` network requests
+returned `200`. `api` and `web` container logs show no errors/tracebacks/exceptions after
+the final deployment.
+
+## Known limitations
+
+- **Transient `document.documentElement.lang` DOM-attribute anomaly during interactive
+  manual browser testing** on the live server: on 2 occasions, right after a client-side
+  action (an automation retry click; a demo-reset confirm click), `document.documentElement.lang`
+  briefly showed `"nl"` while the actually-rendered page content, `localStorage`, and a
+  controlled repeat of the exact same click sequence (fresh login, single deliberate
+  click, immediate inspection) all remained correctly `"fr-BE"`. Root-caused as far as
+  possible: the codebase has exactly one `i18n.changeLanguage()` call site
+  (`LanguageSwitcher.tsx`), which was not invoked in the clean repro, and `t()` /
+  `i18n.language` are structurally coupled through a single i18next singleton with no
+  code path capable of producing this split state. Not reproduced even once across 139
+  automated Playwright tests run 3 times total (local pre-merge, isolated clean-checkout,
+  local post-merge on master) in a clean, extension-free browser context. Most likely
+  explanation: a third-party browser extension active in the specific interactive testing
+  session (which also had ~10 unrelated pre-existing tabs open on the same origin, and
+  showed independent signs of instability — repeated CDP screenshot timeouts) rewriting
+  the `lang` attribute based on its own content heuristics, independent of the React app.
+  Logged here for transparency rather than silently dismissed; does not affect any
+  automated PASS result above.
+- **Two transient Chromium worker crashes** (`0xC0000005` / access violation) during the
+  master-build Playwright re-run, on a machine that had accumulated 43+ concurrent Chrome
+  processes from the interactive testing session above. A clean run immediately
+  afterward (fewer processes) passed all 139 tests; a 48-test targeted re-run of every
+  new/changed suite also passed cleanly in between. Treated as machine resource
+  contention, not a code defect — consistent with the prior correction milestone's own
+  documented experience of "sequential-run-only flakes reproduced from resource
+  contention of running two full Docker stacks at once," per `PROJECT_STATE.md`.
+- One translation gap (fr-BE `audit.columns.actor`: "Acteur" instead of the brief's
+  specified "Auteur") was missed in the initial pass and only caught during live browser
+  validation on Unraid; fixed in commit `09173a4` and redeployed before the master merge.
+- The Fleet Ops brand mark (`BrandMark` in `Icons.tsx`) was flagged by the user as
+  potentially due for a visual refresh; per explicit user decision mid-session, this is
+  out of scope for this correction round and deferred to a separate follow-up task.
+- No RAGcore/MCP Hub implementation changes were made or claimed; both remain in the same
+  demo/not-connected state documented by the prior correction milestone.
+
+## Rollback procedure
+
+`.deploy/source-revision` on the server records exactly which commit is live. To roll
+back: `ssh unraid`, extract an earlier `source-<short-sha>.tar.gz` from
+`/mnt/user/appdata/mobilityops/.deploy/` (prior tarballs remain in place, including
+`source-9468cc3e.tar.gz`, `source-09173a4.tar.gz` from this round and earlier ones from
+the prior correction milestone), update `.deploy/source-revision` to match, and re-run
+`docker compose -p mobilityops -f compose.yaml -f compose.unraid.yaml up --build -d api web`
+followed by `alembic upgrade head` (migrations are additive only — no destructive
+migration exists on this branch, so no database rollback is needed). No secrets were
+printed or read at any point in this process (`.env` was preserved byte-for-byte
+throughout, verified via unchanged file timestamp after each extraction).
@@ -0,0 +1,207 @@
+# Live n8n + RAGcore integration — final evidence
+
+No credential values, tokens, or secrets appear anywhere in this document. Where a
+credential or trace ID is referenced, only its name or an opaque reference identifier is
+given, never its value.
+
+## Commit
+
+Built on branch `feat/live-n8n-ragcore-integration`, HEAD at commit
+`aaa16305354d34f9c1f4d57253d33d9062c38faa` ("docs: record WF2 retry fix and WF4's
+n8n-session-expiry blocker"). Run `git log --oneline feat/live-n8n-ragcore-integration`
+for the full history of this effort.
+
+## Scope
+
+The brief required treating n8n (`https://n8n.itworx.tech`) as a full third integration
+layer alongside RAGcore and MCP Hub, with Fleet Ops keeping exclusive ownership of
+business rules, authorization, transactions, audit, and idempotency. Four canonical n8n
+workflows were required. The repository (`n8n/workflows/*.json` + `MANIFEST.md` +
+`n8n/workflows/check_drift.py`) is the source of truth for cleaned workflow definitions;
+the Fleet Ops integration status page (`/automation`) shows real per-workflow operational
+evidence, not a config boolean.
+
+## Result summary
+
+| # | Workflow | Status | Live evidence this round |
+|---|---|---|---|
+| 1 | Fleet Ops — Vehicle Return Orchestration | **Live, hardened** | Timeout+bounded-retry gap found and fixed |
+| 2 | Fleet Ops — Scheduled Data Quality Scan | **Live, hardened** | Same gap found and fixed |
+| 3 | Fleet Ops — RAGcore Procedure Sync | **Blocked** | Not built — RAGcore rejects credential issuance (see below) |
+| 4 | Fleet Ops — Workflow Error Handler | **Live, validated** | Mock + genuine induced-failure test; own hardening incomplete (see below) |
+
+Full per-workflow detail (purpose, trigger, event contract, required credentials, live
+workflow ID, checksum) is in `n8n/workflows/MANIFEST.md`, which is the authoritative,
+continuously-updated source — this document is a point-in-time summary of that state
+plus the reasoning behind what's not done.
+
+## Workflow 1 — Vehicle Return Orchestration
+
+Live workflow ID `mobilityops-return-processing`. Validated in an earlier round of this
+effort: webhook trigger requires Header Auth (`Fleet Ops Webhook Trigger Token`),
+validates `event_type == vehicle.returned.v1`, derives a follow-up category, calls Fleet
+Ops's `/return-callback` endpoint with an `Idempotency-Key` header via a named
+`Fleet Ops Service Token` credential (not a literal secret), and responds with a
+controlled JSON result. Idempotent on both sides (`event_id` flows through as the
+dedup key; the backend independently checks for a prior audit event before recording
+again).
+
+**This round's finding**: the `Record follow-up` HTTP node had no explicit timeout and
+"Retry On Fail" disabled — a real gap against the requirement that external dependencies
+have timeouts and bounded retries. Fixed live: Retry On Fail (3 tries, 1000ms wait) + a
+15000ms timeout, published. Safe to retry because the callback is idempotent. Repo
+definition and manifest checksum synced (commit `0562893`).
+
+Attached to workflow 4 as its Error Workflow.
+
+## Workflow 2 — Scheduled Data Quality Scan
+
+Live workflow ID `mobilityops-scheduled-quality-scan`. Validated earlier: hourly
+Schedule Trigger + a Manual Trigger for on-demand testing, both feeding a single HTTP
+call to Fleet Ops's `/scheduled-scan` endpoint (Header Auth via the same `Fleet Ops
+Service Token` credential, 15000ms timeout already configured), which runs the
+domain-level `run_scan()` function — documented and tested as idempotent by
+construction (only ever creates an issue for a condition that doesn't already have one
+open), so overlapping or retried triggers do no duplicate domain work.
+
+**This round's finding**: the same Retry On Fail gap as workflow 1 (timeout was already
+set, retries were not). Fixed live the same way (3 tries, 1000ms wait), published. Repo
+definition and manifest checksum synced (commit `167bf49`).
+
+Attached to workflow 4 as its Error Workflow.
+
+## Workflow 3 — RAGcore Procedure Sync — blocked
+
+**Not built.** This workflow needs an application credential (scope `sources:sync`) for
+the `fleet-ops` application in RAGcore. Two independent issuance attempts, in two
+separate rounds of this effort, both failed with an opaque server-side rejection:
+
+1. **Raw API**: `POST /v1/applications/{id}/credentials` → `400`, "authoritative
+   service-account state rejected issuance".
+2. **RAGcore admin UI**, this round, after the project owner explicitly authorized
+   Claude to self-issue the credential: the "Issue credential" form for the `fleet-ops`
+   application, submitted as the Platform Admin role (the highest role visible in the
+   RAGcore admin), with name `n8n-ragcore-procedure-sync` and scope `sources:sync` only.
+   Result: "Something went wrong. The credential could not be issued with those
+   values.", trace reference `1955c6a8968c4941a22a1faef39e17a7`.
+
+The `fleet-ops` application itself shows as ordinary/`Active` in the RAGcore admin, with
+no visible lock flag, and RAGcore's own OpenAPI spec documents no validation rule that
+would explain either rejection (no `422`, no field-level errors). Two independent paths
+— a raw API call and the admin UI as the top admin role — hitting the same failure
+signature is conclusive evidence this is a RAGcore-side policy or bug, not a Fleet Ops
+request-shape or permission problem. It is not fixable from the Fleet Ops side or
+through further UI automation. Resolving it requires whoever operates the RAGcore
+instance to look up the trace ID above (and the earlier raw-API rejection) in RAGcore's
+own logs.
+
+The real RAGcore contract this workflow will be built against — once a working
+credential exists — was independently inspected via RAGcore's live OpenAPI spec and is
+recorded in `docs/live-ai-integration/n8n-current-state.md` and
+`contracts/ragcore-contract-assumptions.md`: control-plane endpoints require an
+`Idempotency-Key` header; ingestion is `POST /v1/uploads`; retrieval is `POST
+/v1/search` / `/v1/context` / `/v1/answers` (the latter requiring `requested_space_ids`,
+an array of knowledge-space UUIDs); health is `/health/live` and `/health/ready` (not
+`/health`); the scope enum is `search, context, answer, documents:read, citations:read,
+feedback:write, sources:sync`.
+
+**`RAGcoreKnowledgeProvider` adapter** (`backend/app/services/knowledge/ragcore.py`)
+still targets the earlier speculative contract (`/health`, `POST /api/v1/ask`, Bearer
+token) rather than the real one above. This was deliberately **not** rewritten this
+round: rewriting it blind, without a credential to validate against, risks introducing
+a silent behavioral bug in exactly the code path responsible for the project's "AI must
+never invent an answer when RAGcore is unavailable or returns insufficient evidence"
+guarantee — for example a wrong `evidence_state` mapping that looks fine in code review
+but misclassifies "unavailable" as "insufficient" (or vice versa) against the real
+response shape. The adapter's current behavior is honest and safe (it degrades cleanly
+to `unavailable` on any request or parsing failure, and `ragcore_api_token` is unset by
+default so the app correctly runs on the local demo knowledge provider today). The
+rewrite stays queued behind the same credential blocker as workflow 3.
+
+## Workflow 4 — Workflow Error Handler
+
+Live workflow ID `Xppn2rAEqUuyiCJF`. Built and live-validated in an earlier round:
+Error Trigger → a Code node that derives a bounded, secret-free failure report (error
+category classified from the message text, truncated summary, no stack trace, no
+headers or tokens) → an HTTP call to Fleet Ops's `/workflow-error` endpoint (Header Auth
+via the same `Fleet Ops Service Token` credential), which registers the failure as an
+audit event idempotently keyed on `execution_id`.
+
+Set as the Error Workflow on both workflow 1 and workflow 2. Confirmed workflow 4 has no
+Error Workflow of its own (prevents a recursive loop).
+
+**Live validation performed**: a pinned mock Error Trigger payload produced a real `200
+{"status":"registered", ...}` from the live Fleet Ops server; re-running the identical
+payload produced `"status":"already_registered"`, confirming idempotency. A genuine
+induced failure (temporarily pointing workflow 2's HTTP node at a nonexistent path, then
+reverting) confirmed workflow 2 itself fails correctly against a broken endpoint and
+recovers cleanly once reverted.
+
+**Known limitation**: n8n's Error Workflow trigger does not fire for manual editor
+"Execute workflow" test runs — checked via workflow 4's own Executions list after the
+induced workflow-2 failure, and confirmed no new execution appeared. n8n only invokes a
+workflow's assigned Error Workflow for unattended/production trigger executions, not
+manual test runs from the editor. The mock-data path exercises the same nodes, logic,
+and real Fleet Ops endpoint, but a fully automatic (schedule- or webhook-triggered)
+failure cascading into workflow 4 was not observed live in either round.
+
+**Open follow-up (minor, non-blocking)**: continuing this round's acceptance pass to
+workflow 4 found the same timeout/retry gap as workflows 1 and 2 on its own outbound
+HTTP call. A fix was started (15000ms timeout added, Retry On Fail toggled on) but n8n's
+autosave began failing with "Unauthorized" mid-edit; a fresh browser tab confirmed the
+n8n session had expired (redirected to `/signin`). Nothing was saved — workflow 4's live
+definition is unchanged from before this round, so there is no partial or broken state.
+This is lower-stakes than workflows 1/2 (workflow 4 is the error notifier itself, not a
+primary business flow, and a failed error-report is already visible in n8n's own
+execution history via `On Error: Stop Workflow`) but should be finished once the n8n
+browser session is re-authenticated.
+
+## Repository source of truth
+
+`n8n/workflows/` holds cleaned, credential-value-free JSON definitions for all built
+workflows, `n8n/workflows/MANIFEST.md` documents purpose/trigger/contract/credentials/
+live-ID/checksum for all four canonical workflows (including workflow 3's blocked
+status), and `n8n/workflows/check_drift.py` is a read-only script that compares the
+repo definitions against the live instance via n8n's Public API and reports drift —
+safe to run in CI as a non-blocking check. No literal export/download mechanism was
+found working in this n8n version, so each definition was reconstructed from direct,
+verified UI inspection rather than a native export; this limitation is noted in the
+manifest itself.
+
+## Integration status page
+
+`/automation` (Operations Manager only) surfaces real per-workflow evidence derived
+purely from Fleet Ops's own audit/outbox tables — no new dependency on n8n's API was
+added to the backend. Each of the four canonical workflows shows a status (not built /
+no evidence yet / operational) and a last-evidence timestamp; the scheduled-scan
+evidence specifically filters to `actor_type == "service"` so a manually-triggered scan
+in the UI doesn't count as n8n evidence. An error-handler summary line reports total
+registered automation failures and the most recent one.
+
+Verified live in the browser (Dutch locale) both locally and on the deployed
+production server (`http://192.168.10.150:1236/automation`): correctly showed "3 van 4
+canonieke n8n-workflows hebben actuele evidentie van werking" with real timestamps for
+the return/scan/error-handler workflows, "Nog Niet Gebouwd" for the RAGcore sync, and
+the real error-handler registration from this effort's live testing.
+
+## Deployments performed (all explicitly user-approved)
+
+1. Backend `/workflow-error` endpoint (commit `bbdb4a9`) — deployed and verified
+   (`/health` OK, new endpoint returns `422` not `404` on an empty POST body).
+2. Integration status page, backend + frontend (commit `4049c0c`) — deployed and
+   verified (`/health` OK, page renders real evidence in the browser).
+
+The three n8n-side node edits this round (WF1 timeout/retry, WF2 timeout/retry, WF4's
+incomplete attempt) are live edits to the n8n instance itself and do not require a
+Fleet Ops redeploy.
+
+## What's left
+
+1. **RAGcore credential issuance** — blocked on RAGcore's own server-side rejection
+   (trace `1955c6a8968c4941a22a1faef39e17a7` and the earlier raw-API `400`). Needs
+   RAGcore's operator to investigate. Unblocks workflow 3 and the
+   `RAGcoreKnowledgeProvider` real-contract rewrite.
+2. **Workflow 4's own timeout/bounded-retry hardening** — needs the n8n browser session
+   re-authenticated to finish; a small, well-understood, non-blocking edit.
+3. **Fleet Ops logo/favicon** — explicitly deferred by the project owner as a separate,
+   unrelated follow-up task, not part of this integration effort.
@@ -2,10 +2,11 @@ from __future__ import annotations

 import uuid
 from collections.abc import Sequence
+from datetime import datetime
 from typing import Any

 from fastapi import APIRouter, Depends, Query
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.orm import Session

 from app.api.deps import get_db, require_operations_manager
@@ -14,7 +15,7 @@ from app.models.booking import Booking
 from app.models.customer import Customer
 from app.models.data_quality import DataQualityIssue
 from app.models.vehicle import Vehicle
-from app.schemas import AuditEventOut, CurrentUser
+from app.schemas import AuditEventOut, AuditEventPageOut, CurrentUser

 router = APIRouter(prefix="/api/v1/audit", tags=["audit"])

@@ -51,26 +52,51 @@ def _resolve_entity_refs(db: Session, events: Sequence[AuditEvent]) -> dict[uuid
    return refs


-@router.get("", response_model=list[AuditEventOut])
+@router.get("", response_model=list[AuditEventOut] | AuditEventPageOut)
 def list_audit_events(
    actor_label: str | None = Query(default=None),
    action: str | None = Query(default=None),
    entity_type: str | None = Query(default=None),
+    entity_ref: str | None = Query(default=None, min_length=1, max_length=100),
    correlation_id: str | None = Query(default=None),
-    limit: int = Query(default=100, le=500),
+    occurred_from: datetime | None = Query(default=None),
+    occurred_to: datetime | None = Query(default=None),
+    page: int | None = Query(default=None, ge=1),
+    page_size: int = Query(default=25, ge=1, le=25),
    db: Session = Depends(get_db),
    _user: CurrentUser = Depends(require_operations_manager),
-) -> list[AuditEventOut]:
-    stmt = select(AuditEvent).order_by(AuditEvent.occurred_at.desc()).limit(limit)
+) -> list[AuditEventOut] | AuditEventPageOut:
+    stmt = select(AuditEvent).order_by(AuditEvent.occurred_at.desc())
    if actor_label:
        stmt = stmt.where(AuditEvent.actor_label == actor_label)
    if action:
        stmt = stmt.where(AuditEvent.action == action)
    if entity_type:
        stmt = stmt.where(AuditEvent.entity_type == entity_type)
+    if entity_ref:
+        matched_ids: set[uuid.UUID] = set()
+        for model in _ENTITY_MODELS.values():
+            matched_ids.update(
+                db.scalars(select(model.id).where(model.public_ref.ilike(f"%{entity_ref.strip()}%"))).all()
+            )
+        if not matched_ids:
+            if page is None:
+                return []
+            return AuditEventPageOut(
+                items=[], page=1, page_size=page_size, total=0, total_pages=1
+            )
+        stmt = stmt.where(AuditEvent.entity_id.in_(matched_ids))
    if correlation_id:
        stmt = stmt.where(AuditEvent.correlation_id == correlation_id)
-    events = db.scalars(stmt).all()
+    if occurred_from:
+        stmt = stmt.where(AuditEvent.occurred_at >= occurred_from)
+    if occurred_to:
+        stmt = stmt.where(AuditEvent.occurred_at <= occurred_to)
+    total = db.scalar(select(func.count()).select_from(stmt.subquery())) or 0
+    page_number = page or 1
+    events = db.scalars(
+        stmt if page is None else stmt.offset((page_number - 1) * page_size).limit(page_size)
+    ).all()
    entity_refs = _resolve_entity_refs(db, events)

    out = []
@@ -94,4 +120,13 @@ def list_audit_events(
                metadata=e.metadata_json,
            )
        )
+    if page is None:
        return out
+    total_pages = max(1, (total + page_size - 1) // page_size)
+    return AuditEventPageOut(
+        items=out,
+        page=min(page_number, total_pages),
+        page_size=page_size,
+        total=total,
+        total_pages=total_pages,
+    )
@@ -19,6 +19,7 @@ from app.schemas import (
    AutomationRunOut,
    CurrentUser,
    DashboardOut,
+    EvidenceSignalOut,
    TodayItem,
 )
 from app.services.operations import compute_metrics
@@ -61,19 +62,34 @@ def get_dashboard(
            entity = customers_by_id.get(issue.entity_id)
            link_type = "customer"
        link_ref = entity.public_ref if entity else ""
+        # The backend never emits prose for the attention queue -- only stable signal
+        # codes + raw data params, exactly like the issue detail page's evidence list
+        # (see app/services/data_quality.py::_open_issue). The frontend is the one place
+        # that turns these into the operator's selected language; `evidence_json["summary"]`
+        # is a technical fallback only, never rendered here.
+        signals = [
+            EvidenceSignalOut(code=s["code"], params=s.get("params", {}))
+            for s in issue.evidence_json.get("signals", [])
+        ]
        attention_items.append(
            AttentionItem(
                kind="quality_issue",
                severity=issue.severity,
                rule_type=issue.rule_type,
-                detail=issue.evidence_json.get("summary", ""),
+                evidence_signals=signals,
                link_type=link_type,
                link_ref=link_ref,
                issue_ref=issue.public_ref,
            )
        )
-    attention_items.sort(key=lambda item: _SEVERITY_ORDER.get(item.severity, 3))
-    attention_items = attention_items[:8]
+    # Curate a credible severity mix instead of letting `high` dominate every slot:
+    # each item's real severity is unchanged, only the display selection is capped per
+    # tier (a handful of "now", then "today", then "later") so a heavy day of high-severity
+    # issues doesn't crowd out medium/low ones the operator should still see.
+    high_items = [i for i in attention_items if i.severity == "high"]
+    medium_items = [i for i in attention_items if i.severity == "medium"]
+    low_items = [i for i in attention_items if i.severity == "low"]
+    attention_items = (high_items[:3] + medium_items[:3] + low_items[:2])[:8]

    today = _today()
    bookings = db.scalars(select(Booking)).all()
@@ -1,7 +1,7 @@
 from __future__ import annotations

 from fastapi import APIRouter, Depends, HTTPException, Query
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.orm import Session

 from app.api.deps import get_db, require_operations_manager
@@ -16,6 +16,7 @@ from app.schemas import (
    CurrentUser,
    DataQualityIssueDetailOut,
    DataQualityIssueOut,
+    DataQualityIssuePageOut,
    MergeCustomersRequest,
    MergeCustomersResult,
    ProvideFieldsRequest,
@@ -54,14 +55,16 @@ def _to_out(issue: DataQualityIssue) -> DataQualityIssueOut:
    )


-@router.get("/issues", response_model=list[DataQualityIssueOut])
+@router.get("/issues", response_model=list[DataQualityIssueOut] | DataQualityIssuePageOut)
 def list_issues(
    status: str | None = Query(default=None),
    rule_type: str | None = Query(default=None),
    severity: str | None = Query(default=None),
+    page: int | None = Query(default=None, ge=1),
+    page_size: int = Query(default=25, ge=1, le=25),
    db: Session = Depends(get_db),
    _user: CurrentUser = Depends(require_operations_manager),
-) -> list[DataQualityIssueOut]:
+) -> list[DataQualityIssueOut] | DataQualityIssuePageOut:
    stmt = select(DataQualityIssue).order_by(DataQualityIssue.detected_at.desc())
    if status:
        stmt = stmt.where(DataQualityIssue.status == status)
@@ -69,8 +72,22 @@ def list_issues(
        stmt = stmt.where(DataQualityIssue.rule_type == rule_type)
    if severity:
        stmt = stmt.where(DataQualityIssue.severity == severity)
-    issues = db.scalars(stmt).all()
-    return [_to_out(i) for i in issues]
+    total = db.scalar(select(func.count()).select_from(stmt.subquery())) or 0
+    page_number = page or 1
+    issues = db.scalars(
+        stmt if page is None else stmt.offset((page_number - 1) * page_size).limit(page_size)
+    ).all()
+    items = [_to_out(i) for i in issues]
+    if page is None:
+        return items
+    total_pages = max(1, (total + page_size - 1) // page_size)
+    return DataQualityIssuePageOut(
+        items=items,
+        page=min(page_number, total_pages),
+        page_size=page_size,
+        total=total,
+        total_pages=total_pages,
+    )


 # Every public reference in this system carries its entity type in its own prefix
@@ -115,6 +132,7 @@ def _snapshot(entity_type: str, ref: str, db: Session) -> dict | None:
        return {
            "entity_type": "vehicle",
            "public_ref": vehicle.public_ref,
+            "registration_number": vehicle.registration_number,
            "make": vehicle.make,
            "model": vehicle.model,
            "location": vehicle.location,
@@ -4,16 +4,10 @@ from fastapi import APIRouter, Depends
 from sqlalchemy.orm import Session

 from app.api.deps import get_db, require_operations_manager
-from app.core.config import get_settings
-from app.schemas import (
-    CurrentUser,
-    IntegrationStatusOut,
-    McpHubIntegrationStatus,
-)
-from app.services.integration_status import derive_n8n_status
+from app.schemas import CurrentUser, IntegrationStatusOut
+from app.services.integration_status import derive_mcp_hub_status, derive_n8n_status

 router = APIRouter(prefix="/api/v1/integrations", tags=["integrations"])
-settings = get_settings()


@router.get("/status", response_model=IntegrationStatusOut)
@@ -23,8 +17,5 @@ def integration_status(
 ) -> IntegrationStatusOut:
    return IntegrationStatusOut(
        n8n=derive_n8n_status(db),
-        mcp_hub=McpHubIntegrationStatus(
-            registration_enabled=settings.mcp_hub_registration_enabled,
-            state="configured" if settings.mcp_hub_registration_enabled else "not_configured",
-        ),
+        mcp_hub=derive_mcp_hub_status(db),
    )
@@ -2,6 +2,7 @@ from __future__ import annotations

 import uuid
 from datetime import UTC, datetime
+from pathlib import Path
 from typing import Any

 from fastapi import APIRouter, Depends, Header
@@ -13,9 +14,18 @@ from app.core.config import get_settings
 from app.core.errors import AppError
 from app.models.audit import AuditEvent
 from app.models.outbox import OutboxEvent
-from app.schemas import ScanResultOut
+from app.schemas import (
+    ProcedureDocumentOut,
+    ProcedureListOut,
+    ProcedureSyncResultIn,
+    ProcedureSyncResultResult,
+    ScanResultOut,
+    WorkflowErrorReportIn,
+    WorkflowErrorReportResult,
+)
 from app.services.audit import record_audit_event
 from app.services.data_quality import run_scan
+from app.services.knowledge.procedures import iter_procedure_documents

 router = APIRouter(prefix="/api/v1/integrations/n8n", tags=["integrations"])
 settings = get_settings()
@@ -89,3 +99,124 @@ def scheduled_scan(

    result = run_scan(db, actor_label="n8n scheduled scan", actor_type="service")
    return ScanResultOut(created=result.created)
+
+
+@router.post("/workflow-error", response_model=WorkflowErrorReportResult)
+def workflow_error(
+    body: WorkflowErrorReportIn,
+    service_token: str = Header(..., alias="X-Service-Token"),
+    db: Session = Depends(get_db),
+) -> WorkflowErrorReportResult:
+    """Receives a bounded, secret-free failure report from the central n8n "Fleet Ops --
+    Workflow Error Handler" workflow, which is attached as the Error Workflow on every
+    other Fleet Ops n8n workflow. Idempotent on execution_id: n8n may redeliver the same
+    error report (e.g. after a timed-out response), so this must not double-record."""
+    if service_token != settings.n8n_callback_token:
+        raise AppError("UNAUTHORIZED_SERVICE", "Invalid service token.", status_code=401)
+
+    already_recorded = (
+        db.scalar(
+            select(AuditEvent.id).where(
+                AuditEvent.action == "n8n_workflow_failure_registered",
+                AuditEvent.metadata_json["execution_id"].astext == body.execution_id,
+            )
+        )
+        is not None
+    )
+    if not already_recorded:
+        correlation_id: uuid.UUID | None = None
+        if body.correlation_id:
+            try:
+                correlation_id = uuid.UUID(body.correlation_id)
+            except ValueError:
+                correlation_id = None
+        record_audit_event(
+            db,
+            actor_type="service",
+            actor_label="n8n error handler",
+            action="n8n_workflow_failure_registered",
+            entity_type="automation",
+            correlation_id=correlation_id,
+            after={
+                "workflow_id": body.workflow_id,
+                "workflow_name": body.workflow_name,
+                "error_category": body.error_category,
+                "error_summary": body.error_summary,
+                "trigger_context": body.trigger_context,
+                "attempt": body.attempt,
+                "retry_action": body.retry_action,
+                "failed_at": body.failed_at.isoformat(),
+            },
+            metadata={"execution_id": body.execution_id},
+        )
+        db.commit()
+
+    return WorkflowErrorReportResult(
+        status="already_registered" if already_recorded else "registered",
+        execution_id=body.execution_id,
+        occurred_at=datetime.now(UTC),
+    )
+
+
+@router.get("/procedures", response_model=ProcedureListOut)
+def list_procedures(service_token: str = Header(..., alias="X-Service-Token")) -> ProcedureListOut:
+    """Read-only source list for the RAGcore Procedure Sync workflow: every procedure
+    Markdown file Fleet Ops ships, across every supported language, with a stable
+    per-document id (source_id) and a content hash so the caller can detect changes
+    without re-fetching content it already has."""
+    if service_token != settings.n8n_callback_token:
+        raise AppError("UNAUTHORIZED_SERVICE", "Invalid service token.", status_code=401)
+
+    documents = [
+        ProcedureDocumentOut(
+            id=doc.source_id,
+            language=doc.language,
+            document_id=doc.document_id,
+            title=doc.title,
+            version=doc.version,
+            content=doc.content,
+            content_hash=doc.content_hash,
+        )
+        for doc in iter_procedure_documents(Path(settings.knowledge_dir))
+    ]
+    return ProcedureListOut(documents=documents)
+
+
+@router.post("/procedures-sync-result", response_model=ProcedureSyncResultResult)
+def procedures_sync_result(
+    body: ProcedureSyncResultIn,
+    service_token: str = Header(..., alias="X-Service-Token"),
+    db: Session = Depends(get_db),
+) -> ProcedureSyncResultResult:
+    """Receives a summary (counts only, no document content) from the n8n "Fleet Ops --
+    RAGcore Procedure Sync" workflow once it finishes uploading procedures to RAGcore.
+    Idempotent on execution_id, matching the workflow-error and return-callback pattern."""
+    if service_token != settings.n8n_callback_token:
+        raise AppError("UNAUTHORIZED_SERVICE", "Invalid service token.", status_code=401)
+
+    already_recorded = (
+        db.scalar(
+            select(AuditEvent.id).where(
+                AuditEvent.action == "n8n_procedures_synced",
+                AuditEvent.metadata_json["execution_id"].astext == body.execution_id,
+            )
+        )
+        is not None
+    )
+    if not already_recorded:
+        record_audit_event(
+            db,
+            actor_type="service",
+            actor_label="n8n procedure sync",
+            action="n8n_procedures_synced",
+            entity_type="automation",
+            after={"synced": body.synced, "failed": body.failed},
+            metadata={"execution_id": body.execution_id},
+        )
+        db.commit()
+
+    return ProcedureSyncResultResult(
+        status="already_registered" if already_recorded else "registered",
+        execution_id=body.execution_id,
+        occurred_at=datetime.now(UTC),
+    )
@@ -3,7 +3,7 @@ from __future__ import annotations
 import uuid
 from datetime import date

-from fastapi import APIRouter, Depends, Query
+from fastapi import APIRouter, Depends, Header, Query
 from sqlalchemy import select
 from sqlalchemy.orm import Session

@@ -27,14 +27,30 @@ router = APIRouter(prefix="/api/v1/integrations/mcp", tags=["mcp"])
 settings = get_settings()


-def _audit_service_request(db: Session, *, client_id: str, tool: str, status_label: str) -> None:
+def get_correlation_id(
+    x_correlation_id: str | None = Header(default=None, alias="X-Correlation-Id"),
+) -> str:
+    """Preserve the Hub's own inbound correlation ID through MCP client -> Hub -> Fleet
+    Ops -> RAGcore -> Fleet Ops Audit; only mint a fresh one when none was supplied or
+    it isn't a valid UUID (per the task's own correlation-propagation contract)."""
+    if x_correlation_id:
+        try:
+            return str(uuid.UUID(x_correlation_id))
+        except ValueError:
+            pass
+    return str(uuid.uuid4())
+
+
+def _audit_service_request(
+    db: Session, *, client_id: str, tool: str, status_label: str, correlation_id: str
+) -> None:
    record_audit_event(
        db,
        actor_type="service",
        actor_label=client_id,
        action="mcp_tool_request",
        entity_type="mcp_tool",
-        correlation_id=uuid.uuid4(),
+        correlation_id=uuid.UUID(correlation_id),
        metadata={"tool": tool, "status": status_label},
    )
    db.commit()
@@ -44,10 +60,15 @@ def _audit_service_request(db: Session, *, client_id: str, tool: str, status_lab
 def operations_summary(
    db: Session = Depends(get_db),
    client_id: str = Depends(require_mcp_service_token),
+    correlation_id: str = Depends(get_correlation_id),
 ) -> OperationsSummaryOut:
    metrics = compute_metrics(db)
    _audit_service_request(
-        db, client_id=client_id, tool="mobilityops_get_operations_summary", status_label="ok"
+        db,
+        client_id=client_id,
+        tool="fleet_ops_get_operations_summary",
+        status_label="ok",
+        correlation_id=correlation_id,
    )
    return OperationsSummaryOut(tenant=settings.ragcore_tenant, metrics=metrics)

@@ -59,12 +80,17 @@ def attention_vehicles(
    limit: int = Query(default=20, ge=1, le=50),
    db: Session = Depends(get_db),
    client_id: str = Depends(require_mcp_service_token),
+    correlation_id: str = Depends(get_correlation_id),
 ) -> list[AttentionVehicleOut]:
    results = list_attention_vehicles(
        db, minimum_severity=minimum_severity, on_or_before=date_filter, limit=limit
    )
    _audit_service_request(
-        db, client_id=client_id, tool="mobilityops_list_attention_vehicles", status_label="ok"
+        db,
+        client_id=client_id,
+        tool="fleet_ops_list_attention_vehicles",
+        status_label="ok",
+        correlation_id=correlation_id,
    )
    return [AttentionVehicleOut(**r) for r in results]

@@ -74,14 +100,16 @@ def vehicle_details(
    vehicle_ref: str,
    db: Session = Depends(get_db),
    client_id: str = Depends(require_mcp_service_token),
+    correlation_id: str = Depends(get_correlation_id),
 ) -> McpVehicleDetailOut:
    vehicle = db.scalar(select(Vehicle).where(Vehicle.public_ref == vehicle_ref))
    if vehicle is None:
        _audit_service_request(
            db,
            client_id=client_id,
-            tool="mobilityops_get_vehicle_details",
+            tool="fleet_ops_get_vehicle_details",
            status_label="not_found",
+            correlation_id=correlation_id,
        )
        raise AppError("VEHICLE_NOT_FOUND", "Vehicle not found.", status_code=404)

@@ -99,7 +127,11 @@ def vehicle_details(
    )

    _audit_service_request(
-        db, client_id=client_id, tool="mobilityops_get_vehicle_details", status_label="ok"
+        db,
+        client_id=client_id,
+        tool="fleet_ops_get_vehicle_details",
+        status_label="ok",
+        correlation_id=correlation_id,
    )
    return McpVehicleDetailOut(
        public_ref=vehicle.public_ref,
@@ -120,15 +152,16 @@ def search_knowledge(
    body: McpKnowledgeSearchRequest,
    db: Session = Depends(get_db),
    client_id: str = Depends(require_mcp_service_token),
+    correlation_id: str = Depends(get_correlation_id),
 ) -> GroundedAnswer:
    provider = get_knowledge_provider()
-    correlation_id = str(uuid.uuid4())
-    answer = provider.ask(body.question, correlation_id)
+    answer = provider.ask(body.question, correlation_id, language=body.locale)
    answer.sources = answer.sources[: body.max_sources]
    _audit_service_request(
        db,
        client_id=client_id,
-        tool="mobilityops_search_knowledge",
+        tool="fleet_ops_search_knowledge",
        status_label=answer.evidence_state,
+        correlation_id=correlation_id,
    )
    return answer
@@ -1,7 +1,7 @@
 from __future__ import annotations

 from fastapi import APIRouter, Depends, HTTPException, Query
-from sqlalchemy import select
+from sqlalchemy import func, or_, select
 from sqlalchemy.orm import Session

 from app.api.deps import get_current_user, get_db
@@ -19,6 +19,7 @@ from app.schemas import (
    MaintenanceOut,
    VehicleDetailOut,
    VehicleOut,
+    VehiclePageOut,
 )

 router = APIRouter(prefix="/api/v1/vehicles", tags=["vehicles"])
@@ -34,19 +35,41 @@ def _attention_vehicle_ids(db: Session) -> set:
    return set(rows)


-@router.get("", response_model=list[VehicleOut])
+@router.get("", response_model=list[VehicleOut] | VehiclePageOut)
 def list_vehicles(
    status: str | None = Query(default=None),
    attention_only: bool = Query(default=False),
+    query: str | None = Query(default=None, min_length=1, max_length=100),
+    page: int | None = Query(default=None, ge=1),
+    page_size: int = Query(default=25, ge=1, le=25),
    db: Session = Depends(get_db),
    _user: CurrentUser = Depends(get_current_user),
-) -> list[VehicleOut]:
+) -> list[VehicleOut] | VehiclePageOut:
    stmt = select(Vehicle).order_by(Vehicle.public_ref)
    if status:
        stmt = stmt.where(Vehicle.operational_status == status)
-    vehicles = db.scalars(stmt).all()
+    if query:
+        term = f"%{query.strip()}%"
+        stmt = stmt.where(
+            or_(
+                Vehicle.public_ref.ilike(term),
+                Vehicle.make.ilike(term),
+                Vehicle.model.ilike(term),
+                Vehicle.location.ilike(term),
+                Vehicle.registration_number.ilike(term),
+            )
+        )
    attention_ids = _attention_vehicle_ids(db)
-    out = [
+    if attention_only:
+        stmt = stmt.where(
+            or_(Vehicle.id.in_(attention_ids), Vehicle.operational_status == "blocked")
+        )
+    total = db.scalar(select(func.count()).select_from(stmt.subquery())) or 0
+    page_number = page or 1
+    vehicles = db.scalars(
+        stmt if page is None else stmt.offset((page_number - 1) * page_size).limit(page_size)
+    ).all()
+    items = [
        VehicleOut(
            public_ref=v.public_ref,
            make=v.make,
@@ -62,9 +85,16 @@ def list_vehicles(
        )
        for v in vehicles
    ]
-    if attention_only:
-        out = [v for v in out if v.attention]
-    return out
+    if page is None:
+        return items
+    total_pages = max(1, (total + page_size - 1) // page_size)
+    return VehiclePageOut(
+        items=items,
+        page=min(page_number, total_pages),
+        page_size=page_size,
+        total=total,
+        total_pages=total_pages,
+    )


@router.get("/{public_ref}", response_model=VehicleDetailOut)
@@ -8,7 +8,7 @@ from sqlalchemy.orm import Session

 from app.api.deps import get_db, require_operations_manager
 from app.core.errors import AppError
-from app.models.outbox import OutboxEvent
+from app.models.outbox import OutboxEvent, is_demo_scenario_failure
 from app.schemas import AutomationRunOut, CurrentUser
 from app.services.audit import record_audit_event

@@ -24,6 +24,7 @@ def _to_out(event: OutboxEvent) -> AutomationRunOut:
        attempts=event.attempts,
        last_error=event.last_error,
        last_error_code=event.last_error_code,
+        is_demo_scenario=is_demo_scenario_failure(event),
        occurred_at=event.occurred_at,
    )

@@ -63,15 +64,27 @@ def retry_workflow(
            status_code=409,
        )

+    # Captured before the status flips, so the audit records what was actually retried.
+    was_demo_scenario = is_demo_scenario_failure(event)
+
    event.delivery_status = "pending"
    event.next_attempt_at = None
+    # The retry itself is real either way: the event goes back on the outbox and the
+    # dispatcher delivers it to the configured n8n webhook like any other. The only
+    # difference recorded here is *what* was retried -- a staged demo failure or a real
+    # one -- so the audit trail never implies a production incident was resolved when a
+    # prop was.
    record_audit_event(
        db,
        actor_type="user",
        actor_label=user.display_name,
        action="workflow_retry",
        entity_type="outbox_event",
-        metadata={"event_id": event_id, "previous_attempts": event.attempts},
+        metadata={
+            "event_id": event_id,
+            "previous_attempts": event.attempts,
+            "demo_scenario": was_demo_scenario,
+        },
    )
    db.commit()
    return _to_out(event)
@@ -21,8 +21,10 @@ class Settings(BaseSettings):
    ragcore_workspace: str = "mobilityops"
    ragcore_collection: str = "internal-procedures"
    ragcore_api_token: str = ""
+    ragcore_space_id: str = ""
    ragcore_http_timeout_seconds: float = 5.0
    n8n_webhook_url: str = "http://n8n:5678/webhook/mobilityops-return"
+    n8n_webhook_trigger_token: str = "replace-me-n8n-webhook-trigger-token"
    n8n_callback_token: str = "replace-me-n8n-callback-token"
    n8n_dispatch_enabled: bool = True
    n8n_dispatch_interval_seconds: float = 3.0
@@ -37,6 +39,11 @@ class Settings(BaseSettings):
    knowledge_dir: str = "/app/knowledge/procedures"
    mcp_hub_service_token: str = "replace-me-mcp-hub-token"
    mcp_hub_registration_enabled: bool = False
+    # MCP Hub's own registration is catalog-driven on the Hub side (the Hub reconciles
+    # its catalog into the gateway; Fleet Ops never pushes a registration call), so
+    # these are only used for an honest reachability health check, not self-registration.
+    mcp_hub_base_url: str = ""
+    mcp_provider_id: str = "fleet-ops"
    cors_allow_origins: str = "http://localhost:1228"
    demo_organization_name: str = "Northstar Mobility"
    demo_timezone: str = "Europe/Brussels"
@@ -10,6 +10,25 @@ from app.models.mixins import TimestampMixin

 DELIVERY_STATUSES = ("pending", "delivering", "succeeded", "failed")

+# The one delivery failure the demo seed deliberately plants (BK-H-0020, see
+# seed/workflow_runs.csv). It exists to show retry and audit working, so it must never
+# be read as an integration-health problem: it is a scripted prop, not evidence that
+# n8n is unhealthy. A dedicated error code -- rather than the generic
+# "connectionError" a real timeout produces -- is what lets every reader tell the two
+# apart without guessing from the message text.
+#
+# It is deliberately a `last_error_code` value and not a new column: the code is
+# already persisted, already surfaced to the UI, and already localizable, so no schema
+# change or migration is needed. A genuine later failure of this same event overwrites
+# the code with the real one, which is exactly right -- from that moment it *is* a real
+# failure.
+DEMO_SCENARIO_ERROR_CODE = "demoScenarioTimeout"
+
+
+def is_demo_scenario_failure(event: "OutboxEvent") -> bool:
+    """True for the prepared demo failure, false for every real one."""
+    return event.delivery_status == "failed" and event.last_error_code == DEMO_SCENARIO_ERROR_CODE
+

 class OutboxEvent(TimestampMixin, Base):
    __tablename__ = "outbox_events"
@@ -32,6 +32,14 @@ class VehicleOut(BaseModel):
    attention: bool = False


+class VehiclePageOut(BaseModel):
+    items: list[VehicleOut]
+    page: int
+    page_size: int
+    total: int
+    total_pages: int
+
+
 class BookingSummaryOut(BaseModel):
    public_ref: str
    customer_ref: str
@@ -122,6 +130,14 @@ class DataQualityIssueOut(BaseModel):
    resolved_at: datetime | None = None


+class DataQualityIssuePageOut(BaseModel):
+    items: list[DataQualityIssueOut]
+    page: int
+    page_size: int
+    total: int
+    total_pages: int
+
+
 class DataQualityIssueDetailOut(DataQualityIssueOut):
    entity_snapshot: dict[str, Any] | None = None
    related_snapshots: list[dict[str, Any]] = Field(default_factory=list)
@@ -143,6 +159,53 @@ class ScanResultOut(BaseModel):
    created: dict[str, int]


+class WorkflowErrorReportIn(BaseModel):
+    workflow_id: str = Field(max_length=120)
+    workflow_name: str = Field(max_length=200)
+    execution_id: str = Field(max_length=120)
+    failed_at: datetime
+    error_category: Literal[
+        "timeout", "authError", "connectionError", "httpError", "validationError", "unknown"
+    ]
+    error_summary: str = Field(max_length=500)
+    trigger_context: str | None = Field(default=None, max_length=200)
+    correlation_id: str | None = None
+    attempt: int = Field(default=1, ge=1, le=1000)
+    retry_action: str | None = Field(default=None, max_length=200)
+
+
+class WorkflowErrorReportResult(BaseModel):
+    status: Literal["registered", "already_registered"]
+    execution_id: str
+    occurred_at: datetime
+
+
+class ProcedureDocumentOut(BaseModel):
+    id: str
+    language: str
+    document_id: str
+    title: str
+    version: str
+    content: str
+    content_hash: str
+
+
+class ProcedureListOut(BaseModel):
+    documents: list[ProcedureDocumentOut]
+
+
+class ProcedureSyncResultIn(BaseModel):
+    execution_id: str = Field(max_length=120)
+    synced: int = Field(ge=0)
+    failed: int = Field(default=0, ge=0)
+
+
+class ProcedureSyncResultResult(BaseModel):
+    status: Literal["registered", "already_registered"]
+    execution_id: str
+    occurred_at: datetime
+
+
 class ProvideFieldsRequest(BaseModel):
    fields: dict[str, str]

@@ -202,21 +265,52 @@ class SearchResponse(BaseModel):
    results: list[SearchResultItem]


+class N8nWorkflowEvidence(BaseModel):
+    name: str
+    built: bool
+    last_seen_at: datetime | None
+
+
+class N8nErrorHandlerStatus(BaseModel):
+    total_failures_registered: int
+    latest_failure_at: datetime | None
+    latest_failure_workflow: str | None
+
+
 class N8nIntegrationStatus(BaseModel):
    configured: bool
    dispatch_enabled: bool
    state: Literal["disabled", "unavailable", "degraded", "operational", "no_evidence"]
    pending: int
-    delivering: int
+    #: Every failed delivery, staged and real together -- the number a viewer sees in
+    #: the run list.
    failed: int
+    #: Failures that were not planted by the demo seed. This is the only failure count
+    #: that may influence `state`.
+    unexpected_failed: int = 0
+    #: Prepared demo failures (see `app.models.outbox.DEMO_SCENARIO_ERROR_CODE`).
+    #: Present so the UI can label them instead of implying the automation is broken.
+    demo_scenario_failed: int = 0
+    delivering: int
    succeeded: int
    latest_success_at: datetime | None
+    #: Most recent *real* failure; a staged one never sets this.
    latest_failure_at: datetime | None
+    latest_demo_scenario_at: datetime | None = None
+    expected_workflow_count: int
+    known_workflow_count: int
+    workflows: list[N8nWorkflowEvidence]
+    error_handler: N8nErrorHandlerStatus


 class McpHubIntegrationStatus(BaseModel):
    registration_enabled: bool
-    state: Literal["not_configured", "configured"]
+    state: Literal["not_configured", "no_evidence", "operational"]
+    total_calls: int
+    last_tool: str | None = None
+    last_client: str | None = None
+    last_called_at: datetime | None = None
+    hub_reachable: bool | None = None


 class IntegrationStatusOut(BaseModel):
@@ -272,11 +366,16 @@ class DashboardMetrics(BaseModel):
    pending_or_failed_workflows: int


+class EvidenceSignalOut(BaseModel):
+    code: str
+    params: dict[str, Any] = Field(default_factory=dict)
+
+
 class AttentionItem(BaseModel):
    kind: Literal["quality_issue", "vehicle"]
    severity: str
    rule_type: str
-    detail: str
+    evidence_signals: list[EvidenceSignalOut] = Field(default_factory=list)
    link_type: Literal["vehicle", "booking", "customer"]
    link_ref: str
    issue_ref: str | None = None
@@ -297,6 +396,10 @@ class AutomationRunOut(BaseModel):
    attempts: int
    last_error: str | None
    last_error_code: str | None
+    #: True for the deliberately seeded demo failure. The UI uses this to label the run
+    #: as a prepared scenario and to offer the demo retry, instead of presenting it as
+    #: an unexplained production error.
+    is_demo_scenario: bool = False
    occurred_at: datetime


@@ -336,6 +439,7 @@ class McpVehicleDetailOut(BaseModel):
 class McpKnowledgeSearchRequest(BaseModel):
    question: str = Field(min_length=3, max_length=1000)
    max_sources: int = Field(default=4, ge=1, le=8)
+    locale: Literal["nl-BE", "en-GB", "fr-BE"] = "en-GB"


 class AuditEventOut(BaseModel):
@@ -352,3 +456,11 @@ class AuditEventOut(BaseModel):
    before: dict[str, Any] | None = None
    after: dict[str, Any] | None = None
    metadata: dict[str, Any] | None = None
+
+
+class AuditEventPageOut(BaseModel):
+    items: list[AuditEventOut]
+    page: int
+    page_size: int
+    total: int
+    total_pages: int
@@ -18,7 +18,7 @@ from app.models.data_quality import DataQualityIssue
 from app.models.idempotency import IdempotencyRecord
 from app.models.inspection import Inspection
 from app.models.maintenance import MaintenanceRecord
-from app.models.outbox import OutboxEvent
+from app.models.outbox import DEMO_SCENARIO_ERROR_CODE, OutboxEvent
 from app.models.user import User
 from app.models.vehicle import Vehicle
 from app.services.audit import record_audit_event
@@ -139,11 +139,11 @@ def load_seed(db: Session) -> SeedResult:

    vehicle_id_by_ref: dict[str, uuid.UUID] = {}
    vehicle_rows = []
+    vehicle_row_by_ref: dict[str, dict] = {}
    for row in _read_csv("vehicles.csv"):
        vid = uuid.uuid4()
        vehicle_id_by_ref[row["public_ref"]] = vid
-        vehicle_rows.append(
-            {
+        vehicle_row = {
            "id": vid,
            "public_ref": row["public_ref"],
            "make": row["make"],
@@ -157,17 +157,18 @@ def load_seed(db: Session) -> SeedResult:
            "active": _parse_bool(row["active"]),
            "version": 1,
        }
-        )
+        vehicle_rows.append(vehicle_row)
+        vehicle_row_by_ref[row["public_ref"]] = vehicle_row
    db.execute(insert(Vehicle), vehicle_rows)
    counts["vehicles"] = len(vehicle_rows)

    booking_id_by_ref: dict[str, uuid.UUID] = {}
    booking_rows = []
+    booking_row_by_ref: dict[str, dict] = {}
    for row in _read_csv("bookings.csv"):
        bid = uuid.uuid4()
        booking_id_by_ref[row["public_ref"]] = bid
-        booking_rows.append(
-            {
+        booking_row = {
            "id": bid,
            "public_ref": row["public_ref"],
            "customer_id": customer_id_by_ref[row["customer_ref"]],
@@ -179,7 +180,8 @@ def load_seed(db: Session) -> SeedResult:
            "end_odometer_km": _parse_optional_int(row["end_odometer_km"]),
            "requirements_complete": _parse_bool(row["requirements_complete"]),
        }
-        )
+        booking_rows.append(booking_row)
+        booking_row_by_ref[row["public_ref"]] = booking_row
    db.execute(insert(Booking), booking_rows)
    counts["bookings"] = len(booking_rows)

@@ -225,6 +227,82 @@ def load_seed(db: Session) -> SeedResult:
            return "customer", customer_id_by_ref[entity_ref]
        return "vehicle", vehicle_id_by_ref[entity_ref]

+    def _vehicle_conflict_facts(vehicle_ref: str, *, service_threshold_reached: bool) -> dict:
+        # Mirrors app.services.vehicle_status.VehicleStatusFacts.as_dict() for the
+        # handful of seed-only rows below -- none of them carry an active rental or a
+        # real booking conflict (verified against the fixed seed dataset), only a
+        # genuinely-crossed service threshold or none at all, so those two fields are
+        # the only ones that vary per vehicle.
+        vehicle = vehicle_row_by_ref[vehicle_ref]
+        return {
+            "active_booking_refs": [],
+            "overlapping_booking_pairs": [],
+            "service_threshold_reached": service_threshold_reached,
+            "odometer_km": vehicle["odometer_km"],
+            "next_service_km": vehicle["next_service_km"],
+            "open_booking_overlap_issue_ref": None,
+        }
+
+    def _odometer_regression_signal(later_ref: str, earlier_ref: str) -> list[dict]:
+        later = booking_row_by_ref[later_ref]
+        earlier = booking_row_by_ref[earlier_ref]
+        return [
+            {
+                "code": "odometer.regression",
+                "params": {
+                    "later_ref": later_ref,
+                    "later_km": later["end_odometer_km"],
+                    "earlier_ref": earlier_ref,
+                    "earlier_km": earlier["end_odometer_km"],
+                },
+            }
+        ]
+
+    def _missing_field_signal(field: str) -> list[dict]:
+        return [{"code": "missing_field", "params": {"field": field}}]
+
+    # Every seed-only row below (i.e. not one of the four named DQ-DEMO-* scenarios)
+    # used to carry no structured signal at all -- just the placeholder summary
+    # "Synthetic deterministic seed issue". Each now cites a real fact about its actual
+    # entity (a genuinely-crossed service threshold, a genuinely-blank field, or a real
+    # pair of booking odometer readings engineered into seed/bookings.csv), using the
+    # exact same signal vocabulary the live scan (app.services.data_quality) already
+    # renders through -- see docs/fleet-ops-correction/current-gap-audit.md §6.
+    _SEED_SIGNALS_BY_REF: dict[str, list[dict]] = {
+        "DQ-0005": [
+            {
+                "code": "vehicle.service_threshold_reached",
+                "params": _vehicle_conflict_facts("MO-036", service_threshold_reached=True),
+            }
+        ],
+        "DQ-0006": _missing_field_signal("location"),
+        "DQ-0007": _odometer_regression_signal("BK-H-0007", "BK-H-0057"),
+        "DQ-0008": [
+            {
+                "code": "vehicle.rental_ended",
+                "params": _vehicle_conflict_facts("MO-007", service_threshold_reached=False),
+            }
+        ],
+        "DQ-0009": _missing_field_signal("location"),
+        "DQ-0010": _odometer_regression_signal("BK-H-0010", "BK-H-0060"),
+        "DQ-0011": [
+            {
+                "code": "vehicle.service_threshold_reached",
+                "params": _vehicle_conflict_facts("MO-028", service_threshold_reached=True),
+            }
+        ],
+        "DQ-0012": _missing_field_signal("registration_number"),
+        "DQ-0013": _missing_field_signal("location"),
+        "DQ-0014": _missing_field_signal("registration_number"),
+        "DQ-0015": _missing_field_signal("location"),
+        "DQ-0016": _missing_field_signal("location"),
+        "DQ-0017": _missing_field_signal("location"),
+        "DQ-0018": _missing_field_signal("registration_number"),
+        "DQ-0019": _missing_field_signal("location"),
+        "DQ-0020": _missing_field_signal("location"),
+        "DQ-0021": _missing_field_signal("location"),
+    }
+
    def _seed_signals(public_ref: str, entity_ref: str, related_refs: list[str]) -> list[dict]:
        # The four named DQ-DEMO-* rows anchor the guided demo's scripted scenarios, so
        # they carry real, accurate structured signals (not just a legacy English
@@ -253,7 +331,7 @@ def load_seed(db: Session) -> SeedResult:
                    "params": {"booking_ref": related_refs[0] if related_refs else ""},
                }
            ]
-        return []
+        return _SEED_SIGNALS_BY_REF.get(public_ref, [])

    dq_rows = []
    now = datetime.now(UTC)
@@ -323,7 +401,10 @@ def load_seed(db: Session) -> SeedResult:
                "last_error": row["last_error"] or None,
                # The seed dataset's one synthetic failure (BK-H-0020) models a
                # connection-timeout-style delivery failure -- see workflow_runs.csv.
-                "last_error_code": "connectionError" if row["last_error"] else None,
+                # It is coded as a *prepared demo scenario*, not as a real
+                # connectionError, so integration health never degrades because of a
+                # prop and a viewer is told plainly that this failure is staged.
+                "last_error_code": DEMO_SCENARIO_ERROR_CODE if row["last_error"] else None,
                "external_run_id": None,
            }
        )
@@ -11,7 +11,7 @@ from app.models.booking import Booking
 from app.models.data_quality import DataQualityIssue
 from app.models.outbox import OutboxEvent
 from app.schemas import DemoIntegrationSummaryOut, DemoManifestOut, DemoScenarioOut
-from app.services.integration_status import derive_n8n_status
+from app.services.integration_status import derive_mcp_hub_status, derive_n8n_status
 from app.services.knowledge import get_knowledge_provider

 settings = get_settings()
@@ -124,6 +124,7 @@ def _scenarios(db: Session) -> list[DemoScenarioOut]:
 def _integrations(db: Session) -> list[DemoIntegrationSummaryOut]:
    n8n = derive_n8n_status(db)
    knowledge_health = get_knowledge_provider().health()
+    mcp_hub = derive_mcp_hub_status(db)

    return [
        DemoIntegrationSummaryOut(
@@ -141,17 +142,23 @@ def _integrations(db: Session) -> list[DemoIntegrationSummaryOut]:
            status_code="operational" if knowledge_health.provider == "ragcore" else "demoMode",
            detail_code="ragcoreDetail",
            detail_params={
-                "count": knowledge_health.document_count,
+                "count": (
+                    knowledge_health.document_count
+                    if knowledge_health.document_count is not None
+                    else "unknown"
+                ),
                "collection": knowledge_health.collection,
            },
        ),
        DemoIntegrationSummaryOut(
            key="mcp_hub",
-            status_code="operational" if settings.mcp_hub_registration_enabled else "notConnected",
+            # `MCP_HUB_REGISTRATION_ENABLED` on its own proves nothing: registration is
+            # catalog-driven on the Hub's side, so the flag only says Fleet Ops expects
+            # to be called. Only real recorded `mcp_tool_request` calls make this
+            # "operational" -- same evidence rule the integration status page uses.
+            status_code="operational" if mcp_hub.state == "operational" else "notConnected",
            detail_code=(
-                "mcpDetailEnabled"
-                if settings.mcp_hub_registration_enabled
-                else "mcpDetailNotConnected"
+                "mcpDetailEnabled" if mcp_hub.state == "operational" else "mcpDetailNotConnected"
            ),
            detail_params={},
        ),
@@ -121,13 +121,30 @@ def _deliver_one(event_id: uuid.UUID) -> None:
            response = httpx.post(
                settings.n8n_webhook_url,
                json=wire_event,
+                headers={"X-Fleet-Ops-Trigger-Token": settings.n8n_webhook_trigger_token},
                timeout=settings.n8n_http_timeout_seconds,
            )
            response.raise_for_status()
+            try:
                body = response.json()
+            except ValueError:
+                body = None
+            if isinstance(body, dict):
                success = bool(body.get("ok", True))
                error = None if success else f"n8n reported failure: {body}"
                error_code = None if success else "remoteReportedFailure"
+            else:
+                # A 2xx status with a non-object (or unparsable) body means the workflow
+                # itself errored before its "Respond to Webhook" node ran -- n8n's default
+                # error response still carries a 2xx-looking status here. Treat it as a
+                # failure so the event is retried rather than lost or wrongly marked
+                # succeeded.
+                success = False
+                error = (
+                    "Unexpected non-JSON-object response from n8n "
+                    f"(status {response.status_code})"
+                )
+                error_code = "malformedResponse"
        except httpx.HTTPError as exc:
            success = False
            error = f"{type(exc).__name__}: {exc}"
@@ -2,15 +2,31 @@ from __future__ import annotations

 from typing import Literal

+import httpx
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session

 from app.core.config import get_settings
-from app.models.outbox import OutboxEvent
-from app.schemas import N8nIntegrationStatus
+from app.models.audit import AuditEvent
+from app.models.outbox import DEMO_SCENARIO_ERROR_CODE, OutboxEvent
+from app.schemas import (
+    McpHubIntegrationStatus,
+    N8nErrorHandlerStatus,
+    N8nIntegrationStatus,
+    N8nWorkflowEvidence,
+)

 settings = get_settings()

+# The 4 canonical Fleet Ops n8n workflows (see n8n/workflows/MANIFEST.md). All 4 are
+# built (all with their full node set saved).
+_CANONICAL_WORKFLOWS = (
+    "Fleet Ops — Vehicle Return Orchestration",
+    "Fleet Ops — Scheduled Data Quality Scan",
+    "Fleet Ops — RAGcore Procedure Sync",
+    "Fleet Ops — Workflow Error Handler",
+)
+

 def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
    counts: dict[str, int] = dict(
@@ -23,25 +39,111 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
    failed = counts.get("failed", 0)
    succeeded = counts.get("succeeded", 0)

+    # Prepared demo failures are props, not health signals. They stay visible and
+    # counted -- hiding them would be its own kind of lie -- but they are counted
+    # *separately*, and only genuinely unexpected failures are allowed to move n8n off
+    # "operational". Without this split the demo seed's single staged failure pins the
+    # integration to "degraded" forever, which tells a viewer something untrue about
+    # the automation.
+    demo_scenario_failed = (
+        db.scalar(
+            select(func.count())
+            .select_from(OutboxEvent)
+            .where(
+                OutboxEvent.delivery_status == "failed",
+                OutboxEvent.last_error_code == DEMO_SCENARIO_ERROR_CODE,
+            )
+        )
+        or 0
+    )
+    unexpected_failed = max(failed - demo_scenario_failed, 0)
+
    latest_success_at = db.scalar(
        select(func.max(OutboxEvent.updated_at)).where(OutboxEvent.delivery_status == "succeeded")
    )
+    # Health talks about real failures only, so the "latest failure" a health reader
+    # sees must exclude the staged one too.
    latest_failure_at = db.scalar(
-        select(func.max(OutboxEvent.updated_at)).where(OutboxEvent.delivery_status == "failed")
+        select(func.max(OutboxEvent.updated_at)).where(
+            OutboxEvent.delivery_status == "failed",
+            OutboxEvent.last_error_code != DEMO_SCENARIO_ERROR_CODE,
+        )
+    )
+    latest_demo_scenario_at = db.scalar(
+        select(func.max(OutboxEvent.updated_at)).where(
+            OutboxEvent.delivery_status == "failed",
+            OutboxEvent.last_error_code == DEMO_SCENARIO_ERROR_CODE,
+        )
    )

    state: Literal["disabled", "unavailable", "degraded", "operational", "no_evidence"]
    if not settings.n8n_dispatch_enabled:
        state = "disabled"
-    elif failed > 0 and succeeded == 0:
+    elif unexpected_failed > 0 and succeeded == 0:
        state = "unavailable"
-    elif failed > 0:
+    elif unexpected_failed > 0:
        state = "degraded"
    elif succeeded > 0 or pending > 0 or delivering > 0:
        state = "operational"
    else:
        state = "no_evidence"

+    # Scheduled scan evidence: only service-triggered runs count as n8n evidence, not
+    # runs an operator triggered manually from the Data Quality page.
+    latest_scan_at = db.scalar(
+        select(func.max(AuditEvent.occurred_at)).where(
+            AuditEvent.action == "data_quality_scan_run",
+            AuditEvent.actor_type == "service",
+        )
+    )
+
+    # RAGcore Procedure Sync evidence: result reports posted by the workflow itself once
+    # it finishes uploading procedures to RAGcore (app/api/routers/integrations.py::
+    # procedures_sync_result), the same "the workflow's own callback is the evidence"
+    # pattern the scheduled scan and error handler already use below.
+    latest_procedure_sync_at = db.scalar(
+        select(func.max(AuditEvent.occurred_at)).where(
+            AuditEvent.action == "n8n_procedures_synced"
+        )
+    )
+
+    # Error handler evidence: registrations posted by the "Fleet Ops — Workflow Error
+    # Handler" n8n workflow itself, which also doubles as proof that workflow is wired
+    # up and firing correctly.
+    total_failures_registered = (
+        db.scalar(
+            select(func.count(AuditEvent.id)).where(
+                AuditEvent.action == "n8n_workflow_failure_registered"
+            )
+        )
+        or 0
+    )
+    latest_failure_row = db.execute(
+        select(AuditEvent.occurred_at, AuditEvent.after_json)
+        .where(AuditEvent.action == "n8n_workflow_failure_registered")
+        .order_by(AuditEvent.occurred_at.desc())
+        .limit(1)
+    ).first()
+    latest_handler_failure_at = latest_failure_row[0] if latest_failure_row else None
+    latest_handler_failure_workflow = (
+        (latest_failure_row[1] or {}).get("workflow_name") if latest_failure_row else None
+    )
+
+    evidence_by_workflow = {
+        "Fleet Ops — Vehicle Return Orchestration": latest_success_at,
+        "Fleet Ops — Scheduled Data Quality Scan": latest_scan_at,
+        "Fleet Ops — RAGcore Procedure Sync": latest_procedure_sync_at,
+        "Fleet Ops — Workflow Error Handler": latest_handler_failure_at,
+    }
+    workflows = [
+        N8nWorkflowEvidence(
+            name=name,
+            built=True,
+            last_seen_at=evidence_by_workflow[name],
+        )
+        for name in _CANONICAL_WORKFLOWS
+    ]
+
    return N8nIntegrationStatus(
        configured=bool(settings.n8n_webhook_url),
        dispatch_enabled=settings.n8n_dispatch_enabled,
@@ -49,7 +151,72 @@ def derive_n8n_status(db: Session) -> N8nIntegrationStatus:
        pending=pending,
        delivering=delivering,
        failed=failed,
+        unexpected_failed=unexpected_failed,
+        demo_scenario_failed=demo_scenario_failed,
        succeeded=succeeded,
        latest_success_at=latest_success_at,
        latest_failure_at=latest_failure_at,
+        latest_demo_scenario_at=latest_demo_scenario_at,
+        expected_workflow_count=len(_CANONICAL_WORKFLOWS),
+        known_workflow_count=sum(1 for w in workflows if w.last_seen_at is not None),
+        workflows=workflows,
+        error_handler=N8nErrorHandlerStatus(
+            total_failures_registered=total_failures_registered,
+            latest_failure_at=latest_handler_failure_at,
+            latest_failure_workflow=latest_handler_failure_workflow,
+        ),
    )
+
+
+def derive_mcp_hub_status(db: Session) -> McpHubIntegrationStatus:
+    """Evidence-based MCP Hub status: real tool-call audit history, not just the
+    `MCP_HUB_REGISTRATION_ENABLED` flag flipped on. Every `mcp_tool_request` call
+    already writes an `AuditEvent` (see `app/api/routers/mcp_integrations.py`)."""
+    total_calls = (
+        db.scalar(
+            select(func.count(AuditEvent.id)).where(AuditEvent.action == "mcp_tool_request")
+        )
+        or 0
+    )
+    latest_call_row = db.execute(
+        select(AuditEvent.occurred_at, AuditEvent.actor_label, AuditEvent.metadata_json)
+        .where(AuditEvent.action == "mcp_tool_request")
+        .order_by(AuditEvent.occurred_at.desc())
+        .limit(1)
+    ).first()
+    last_called_at = latest_call_row[0] if latest_call_row else None
+    last_client = latest_call_row[1] if latest_call_row else None
+    last_tool = (latest_call_row[2] or {}).get("tool") if latest_call_row else None
+
+    state: Literal["not_configured", "no_evidence", "operational"]
+    if not settings.mcp_hub_registration_enabled:
+        state = "not_configured"
+    elif total_calls > 0:
+        state = "operational"
+    else:
+        state = "no_evidence"
+
+    hub_reachable = _check_hub_reachable()
+
+    return McpHubIntegrationStatus(
+        registration_enabled=settings.mcp_hub_registration_enabled,
+        state=state,
+        total_calls=total_calls,
+        last_tool=last_tool,
+        last_client=last_client,
+        last_called_at=last_called_at,
+        hub_reachable=hub_reachable,
+    )
+
+
+def _check_hub_reachable() -> bool | None:
+    """Real Hub-side health signal (MCP Hub's own registration is catalog-driven on
+    its side, so this is the only thing Fleet Ops itself can honestly check).
+    `None` means not configured / not checked, never a guess."""
+    if not settings.mcp_hub_base_url:
+        return None
+    try:
+        response = httpx.get(f"{settings.mcp_hub_base_url.rstrip('/')}/health", timeout=1.5)
+        return response.status_code == 200
+    except httpx.HTTPError:
+        return False
@@ -33,7 +33,9 @@ class KnowledgeHealth(BaseModel):
    tenant: str
    workspace: str
    collection: str
-    document_count: int
+    # A provider may be healthy without exposing a corpus-size endpoint. `None` means
+    # unknown, never "zero procedures".
+    document_count: int | None


 class KnowledgeProvider(Protocol):
@@ -7,6 +7,7 @@ from pathlib import Path

 from app.core.config import get_settings
 from app.services.knowledge import GroundedAnswer, KnowledgeHealth, SourceCard
+from app.services.knowledge.procedures import parse_frontmatter

 SUPPORTED_LANGUAGES = ("nl-BE", "en-GB", "fr-BE")
 DEFAULT_LANGUAGE = "en-GB"
@@ -74,23 +75,6 @@ class ScoredSection:
    body_tokens: set[str]


-def _parse_frontmatter(raw: str) -> tuple[dict[str, str], str]:
-    if not raw.startswith("---"):
-        return {}, raw
-    end = raw.find("\n---", 3)
-    if end == -1:
-        return {}, raw
-    block = raw[3:end].strip()
-    body = raw[end + 4 :].lstrip("\n")
-    meta: dict[str, str] = {}
-    for line in block.splitlines():
-        if ":" not in line:
-            continue
-        key, _, value = line.partition(":")
-        meta[key.strip()] = value.strip().strip('"')
-    return meta, body
-
-
 def _split_sections(body: str) -> list[tuple[str, str]]:
    sections: list[tuple[str, str]] = []
    current_heading = "Overview"
@@ -114,7 +98,7 @@ def _load_sections(procedures_dir: Path, language: str) -> list[ScoredSection]:
    sections: list[ScoredSection] = []
    for path in sorted(procedures_dir.glob("*.md")):
        raw = path.read_text(encoding="utf-8")
-        meta, body = _parse_frontmatter(raw)
+        meta, body = parse_frontmatter(raw)
        title = meta.get("title", path.stem)
        doc = Document(
            document_id=meta.get("document_id", path.stem),
@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import hashlib
+import uuid
+from dataclasses import dataclass
+from pathlib import Path
+
+SUPPORTED_LANGUAGES = ("nl-BE", "en-GB", "fr-BE")
+
+# Stable across runs (and across which language ships first) so a document's RAGcore
+# source_id never changes just because the sync ran on a different day or in a
+# different order -- required for RAGcore's upload idempotency to work per document.
+_SOURCE_ID_NAMESPACE = uuid.uuid5(uuid.NAMESPACE_URL, "https://mobilityops.internal/knowledge/procedures")
+
+
+def parse_frontmatter(raw: str) -> tuple[dict[str, str], str]:
+    if not raw.startswith("---"):
+        return {}, raw
+    end = raw.find("\n---", 3)
+    if end == -1:
+        return {}, raw
+    block = raw[3:end].strip()
+    body = raw[end + 4 :].lstrip("\n")
+    meta: dict[str, str] = {}
+    for line in block.splitlines():
+        if ":" not in line:
+            continue
+        key, _, value = line.partition(":")
+        meta[key.strip()] = value.strip().strip('"')
+    return meta, body
+
+
+@dataclass(frozen=True)
+class ProcedureDocument:
+    source_id: str
+    language: str
+    document_id: str
+    title: str
+    version: str
+    content: str
+    content_hash: str
+
+
+def iter_procedure_documents(knowledge_dir: Path) -> list[ProcedureDocument]:
+    """Read every procedure Markdown file Fleet Ops ships, across every supported
+    language, as a flat list ready for external sync (e.g. into RAGcore). Frontmatter
+    fields (title, version) come from the same files the demo knowledge provider
+    already reads -- see parse_frontmatter -- so the two never drift apart."""
+
+    documents: list[ProcedureDocument] = []
+    for language in SUPPORTED_LANGUAGES:
+        language_dir = knowledge_dir / language
+        if not language_dir.is_dir():
+            continue
+        for path in sorted(language_dir.glob("*.md")):
+            raw = path.read_text(encoding="utf-8")
+            meta, body = parse_frontmatter(raw)
+            document_id = meta.get("document_id", path.stem)
+            content = body.strip()
+            documents.append(
+                ProcedureDocument(
+                    source_id=str(uuid.uuid5(_SOURCE_ID_NAMESPACE, f"{language}:{document_id}")),
+                    language=language,
+                    document_id=document_id,
+                    title=meta.get("title", path.stem),
+                    version=meta.get("version", "1.0"),
+                    content=content,
+                    content_hash=hashlib.sha256(content.encode("utf-8")).hexdigest(),
+                )
+            )
+    return documents
@@ -3,18 +3,51 @@ from __future__ import annotations
 import httpx

 from app.core.config import get_settings
-from app.services.knowledge import GroundedAnswer, KnowledgeHealth, SourceCard
+from app.services.knowledge import EvidenceState, GroundedAnswer, KnowledgeHealth, SourceCard
+
+_GROUNDED_ANSWERABILITY = {"answerable", "partially_answerable"}
+
+# Mirrors DemoKnowledgeProvider's own extractive template in spirit: a real cited
+# excerpt wrapped in a fixed sentence, never a generated summary. Used only as a
+# fallback when RAGcore's own /v1/answers (generation + citation validation) is
+# unavailable but its retrieval (/v1/search) still returns real, relevant, cited
+# results -- see ask() below. Unlike the demo corpus's own markdown frontmatter, RAGcore's
+# `document_version_id` is an opaque UUID, not a human-meaningful version string, so it
+# is deliberately left out of this sentence (it still appears on the source card itself).
+_LEAD_ANSWER_TEMPLATE = {
+    "en-GB": 'Per "{title}": {excerpt}',
+    "nl-BE": 'Volgens "{title}": {excerpt}',
+    "fr-BE": 'Selon « {title} » : {excerpt}',
+}
+_DEFAULT_LANGUAGE = "en-GB"


 class RAGcoreKnowledgeProvider:
-    """Adapter for the central RAGcore service.
+    """Adapter for the central RAGcore service, against its real `/v1/*` contract
+    (see `docs/contracts/openapi.yaml` in the RAGcore checkout -- RAGcore is built and
+    owned separately, MobilityOps only ever talks to its documented HTTP API).

-    RAGcore is built and owned separately (see contracts/ragcore-contract-assumptions.md).
-    No live RAGcore instance was reachable during this build, so the exact request/response
-    shape below is a best-effort guess at a REST contract; any failure (connection, timeout,
-    malformed response) degrades to `unavailable` rather than raising, per the architecture's
-    reliability boundary: RAGcore failure disables knowledge answers only, never the rest of
-    the app, and never fabricates an answer.
+    Authenticates as a service account via `Authorization: Bearer <token>` (RAGcore's
+    session-cookie auth is for its own browser admin UI only). Any connection error,
+    timeout, non-2xx response, or malformed body degrades to `evidence_state:
+    "unavailable"` rather than raising -- this is the adapter that actually exercises the
+    architecture's reliability boundary: RAGcore failure disables knowledge answers only,
+    never fabricates an answer, never affects the rest of the app.
+
+    `/v1/answers` (RAGcore's own generation + citation-validation step) is tried first;
+    if it is itself unavailable (non-2xx or unreachable -- as opposed to a real 200
+    classifying the question as insufficiently answerable), `ask()` falls back to
+    RAGcore's `/v1/search` retrieval, which is a materially different, simpler pipeline
+    stage with no generation step to fail. The fallback answer is always an extractive
+    excerpt RAGcore's own search actually found, wrapped in the same fixed citation
+    template `DemoKnowledgeProvider` uses -- never a fabricated summary.
+
+    Known gap, not fixable from this side: RAGcore's ingest pipeline currently tags every
+    chunk's `language` payload field as `"en"` regardless of actual document language (the
+    `/v1/uploads` contract has no per-file language field for a caller to set correctly).
+    Filtering search/answer requests by requested UI language would therefore silently
+    exclude genuinely-relevant nl-BE/fr-BE content, so this adapter deliberately does not
+    filter by language -- retrieval relies on the embedding model's cross-lingual matching.
    """

    name = "ragcore"
@@ -35,11 +68,15 @@ class RAGcoreKnowledgeProvider:
    def health(self, language: str = "en-GB") -> KnowledgeHealth:
        try:
            with self._client() as client:
-                response = client.get("/health")
-                response.raise_for_status()
-                available = True
-                detail = "RAGcore reachable."
-        except httpx.HTTPError as exc:
+                response = client.get("/health/ready")
+                body = response.json()
+                available = response.status_code == 200 and body.get("status") == "ok"
+                detail = (
+                    "RAGcore reachable and ready."
+                    if available
+                    else f"RAGcore degraded: {body.get('status', 'unknown')}"
+                )
+        except (httpx.HTTPError, ValueError) as exc:
            available = False
            detail = f"RAGcore unavailable: {type(exc).__name__}: {exc}"
        return KnowledgeHealth(
@@ -49,51 +86,135 @@ class RAGcoreKnowledgeProvider:
            tenant=self._settings.ragcore_tenant,
            workspace=self._settings.ragcore_workspace,
            collection=self._settings.ragcore_collection,
-            document_count=0,
+            # RAGcore's retrieval API has no corpus-size endpoint. Unknown is explicit
+            # so the UI never turns this into the misleading claim "0 procedures".
+            document_count=None,
        )

    def ask(self, question: str, correlation_id: str, language: str = "en-GB") -> GroundedAnswer:
-        try:
-            with self._client() as client:
-                response = client.post(
-                    "/api/v1/ask",
-                    json={
-                        "tenant": self._settings.ragcore_tenant,
-                        "workspace": self._settings.ragcore_workspace,
-                        "collection": self._settings.ragcore_collection,
-                        "question": question,
-                        "correlation_id": correlation_id,
-                        "language": language,
-                    },
-                )
-                response.raise_for_status()
-                body = response.json()
-        except (httpx.HTTPError, ValueError):
-            return GroundedAnswer(
+        unavailable = GroundedAnswer(
            answer="",
            evidence_state="unavailable",
            sources=[],
            provider=self.name,
            correlation_id=correlation_id,
        )
+        if not self._settings.ragcore_space_id:
+            return unavailable
+
+        answered = self._ask_via_answers(question, correlation_id)
+        if answered is not None:
+            return answered
+        # /v1/answers itself is unavailable (non-2xx or unreachable) -- fall back to
+        # real retrieval rather than degrading straight to "unavailable". This never
+        # fabricates an answer to the question: it only ever shows an actually-cited
+        # excerpt RAGcore's own search already found, using the same extractive
+        # citation-wrapper template DemoKnowledgeProvider uses, never RAGcore's
+        # generation step.
+        return self._ask_via_search_fallback(question, correlation_id, language)
+
+    def _ask_via_answers(self, question: str, correlation_id: str) -> GroundedAnswer | None:
+        """Returns None (not a GroundedAnswer) when /v1/answers itself is unavailable,
+        so the caller can fall back to search -- as opposed to a real 200 response
+        classifying the question as insufficiently answerable, which is a genuine,
+        final result, not a reason to fall back."""
+        try:
+            with self._client() as client:
+                response = client.post(
+                    "/v1/answers",
+                    json={
+                        "query": question,
+                        "requested_space_ids": [self._settings.ragcore_space_id],
+                    },
+                )
+                if response.status_code != 200:
+                    return None
+                body = response.json()
+        except (httpx.HTTPError, ValueError):
+            return None

        try:
-            sources = [SourceCard(**s) for s in body.get("sources", [])]
-            evidence_state = body.get("evidence_state", "insufficient")
-            if evidence_state not in ("grounded", "insufficient", "unavailable"):
-                evidence_state = "insufficient"
+            citations = {c["id"]: c for c in body.get("citations", [])}
+            sources = [
+                SourceCard(
+                    document_id=str(citation["document_id"]),
+                    title=citation["title"],
+                    version=str(citation["document_version_id"]),
+                    section=citation.get("section") or "",
+                    excerpt=citation["excerpt"],
+                )
+                for citation in citations.values()
+            ]
+            answerability = body.get("answerability", "not_answerable")
+            is_grounded = answerability in _GROUNDED_ANSWERABILITY and sources
+            evidence_state: EvidenceState = "grounded" if is_grounded else "insufficient"
            return GroundedAnswer(
-                answer=body.get("answer", ""),
+                answer=body.get("answer", "") if evidence_state == "grounded" else "",
                evidence_state=evidence_state,
+                sources=sources if evidence_state == "grounded" else [],
+                provider=self.name,
+                correlation_id=correlation_id,
+            )
+        except (TypeError, KeyError, ValueError):
+            return None
+
+    def _ask_via_search_fallback(
+        self, question: str, correlation_id: str, language: str
+    ) -> GroundedAnswer:
+        unavailable = GroundedAnswer(
+            answer="",
+            evidence_state="unavailable",
+            sources=[],
+            provider=self.name,
+            correlation_id=correlation_id,
+        )
+        try:
+            with self._client() as client:
+                response = client.post(
+                    "/v1/search",
+                    json={
+                        "query": question,
+                        "requested_space_ids": [self._settings.ragcore_space_id],
+                        "max_results": 5,
+                    },
+                )
+                if response.status_code != 200:
+                    return unavailable
+                body = response.json()
+        except (httpx.HTTPError, ValueError):
+            return unavailable
+
+        try:
+            results = body.get("results", [])
+            sources = [
+                SourceCard(
+                    document_id=str(result["citation"]["document_id"]),
+                    title=result["citation"]["title"],
+                    version=str(result["citation"]["document_version_id"]),
+                    section=result["citation"].get("section") or "",
+                    excerpt=result["citation"]["excerpt"],
+                )
+                for result in results
+            ]
+        except (TypeError, KeyError, ValueError):
+            return unavailable
+
+        if not sources:
+            return GroundedAnswer(
+                answer="",
+                evidence_state="insufficient",
+                sources=[],
+                provider=self.name,
+                correlation_id=correlation_id,
+            )
+
+        template = _LEAD_ANSWER_TEMPLATE.get(language, _LEAD_ANSWER_TEMPLATE[_DEFAULT_LANGUAGE])
+        lead = sources[0]
+        answer = template.format(title=lead.title, excerpt=lead.excerpt)
+        return GroundedAnswer(
+            answer=answer,
+            evidence_state="grounded",
            sources=sources,
            provider=self.name,
            correlation_id=correlation_id,
        )
-        except (TypeError, ValueError):
-            return GroundedAnswer(
-                answer="",
-                evidence_state="unavailable",
-                sources=[],
-                provider=self.name,
-                correlation_id=correlation_id,
-            )
@@ -23,6 +23,17 @@ def test_audit_requires_operations_manager(employee_client):
    assert response.status_code == 403


+def test_audit_page_is_bounded_and_exposes_filter_metadata(ops_client):
+    response = ops_client.get("/api/v1/audit", params={"page": 1, "page_size": 25})
+    assert response.status_code == 200
+    body = response.json()
+    assert len(body["items"]) <= 25
+    assert body["page"] == 1
+    assert body["page_size"] == 25
+    assert body["total"] >= len(body["items"])
+    assert body["total_pages"] >= 1
+
+
 def _activate_booking(vehicle_ref: str, start_odometer_km: int) -> str:
    db = SessionLocal()
    try:
@@ -24,6 +24,22 @@ def test_dashboard_attention_items_link_to_records(ops_client):
        assert item["severity"] in ("low", "medium", "high")


+def test_dashboard_attention_items_expose_localizable_signals_not_raw_text(ops_client):
+    """The dashboard subtext used to be raw, untranslated evidence text (and for most
+    seeded issues, the meaningless placeholder 'Synthetic deterministic seed issue').
+    The API must never emit prose here -- only stable signal codes + params, exactly
+    like the data-quality issue detail page, for the frontend to localize."""
+    response = ops_client.get("/api/v1/dashboard")
+    body = response.json()
+    assert len(body["attention_items"]) > 0
+    for item in body["attention_items"]:
+        assert "detail" not in item
+        assert len(item["evidence_signals"]) > 0
+        for signal in item["evidence_signals"]:
+            assert signal["code"]
+            assert signal["code"] != "Synthetic deterministic seed issue"
+
+
 def test_dashboard_recent_automation_capped_at_five(ops_client):
    response = ops_client.get("/api/v1/dashboard")
    body = response.json()
@@ -53,6 +53,18 @@ def test_list_issues_requires_operations_manager(employee_client):
    assert response.status_code == 403


+def test_issue_page_preserves_severity_filter_and_limits_results(ops_client):
+    response = ops_client.get(
+        "/api/v1/data-quality/issues",
+        params={"severity": "high", "page": 1, "page_size": 25},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert len(body["items"]) <= 25
+    assert all(issue["severity"] == "high" for issue in body["items"])
+    assert body["total"] >= len(body["items"])
+
+
 def test_get_issue_requires_operations_manager(employee_client):
    response = employee_client.get("/api/v1/data-quality/issues/DQ-DEMO-DUPLICATE")
    assert response.status_code == 403
@@ -220,6 +232,21 @@ def test_provide_fields_resolves_a_vehicle_missing_field_issue(ops_client):
    assert vehicle["registration_number"] == "TST-999"


+def test_vehicle_entity_snapshot_includes_registration_number(ops_client):
+    """The snapshot used to omit registration_number entirely, so the 'provide missing
+    fields' form always showed it blank -- even for a vehicle whose plate was actually
+    on file, and even when a *different* field was the genuinely missing one."""
+    issues = ops_client.get(
+        "/api/v1/data-quality/issues",
+        params={"rule_type": "missing_required_field", "status": "open"},
+    ).json()
+    target = next(i for i in issues if i["entity_type"] == "vehicle")
+    vehicle = ops_client.get(f"/api/v1/vehicles/{target['entity_ref']}").json()
+
+    detail = ops_client.get(f"/api/v1/data-quality/issues/{target['public_ref']}").json()
+    assert detail["entity_snapshot"]["registration_number"] == vehicle["registration_number"]
+
+
 def test_resolve_overlap_requires_operations_manager(employee_client):
    response = employee_client.post(
        "/api/v1/data-quality/issues/DQ-DEMO-OVERLAP/resolve-overlap",
@@ -67,7 +67,7 @@ def test_deliver_one_success(monkeypatch):
    event_id = _make_pending_event("MO-002")
    dispatcher._claim_due_events()

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        return SimpleNamespace(
            raise_for_status=lambda: None,
            json=lambda: {"ok": True, "event_id": str(event_id), "result": {}},
@@ -88,7 +88,7 @@ def test_deliver_one_failure_schedules_retry(monkeypatch):
    event_id = _make_pending_event("MO-003")
    dispatcher._claim_due_events()

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        raise dispatcher.httpx.ConnectError("simulated connection failure")

    monkeypatch.setattr(dispatcher.httpx, "post", fake_post)
@@ -102,11 +102,38 @@ def test_deliver_one_failure_schedules_retry(monkeypatch):
    assert event.last_error_code == "connectionError"


+def test_deliver_one_treats_empty_2xx_body_as_failure(monkeypatch):
+    # Reproduces a real failure mode found while live-validating the n8n webhook auth
+    # fix: a workflow that errors internally before its "Respond to Webhook" node runs
+    # can still answer with a 2xx status and an empty body. response.json() on that body
+    # raises json.JSONDecodeError -- this must be treated as a retryable failure, not an
+    # unhandled exception that leaves the event stuck in "delivering" forever.
+    event_id = _make_pending_event("MO-005")
+    dispatcher._claim_due_events()
+
+    def fake_post(url, json, headers, timeout):
+        def raise_json_error():
+            raise ValueError("Expecting value: line 1 column 1 (char 0)")
+
+        return SimpleNamespace(
+            raise_for_status=lambda: None, json=raise_json_error, status_code=200
+        )
+
+    monkeypatch.setattr(dispatcher.httpx, "post", fake_post)
+    dispatcher._deliver_one(event_id)
+
+    event = _get_event(event_id)
+    assert event.delivery_status == "pending"
+    assert event.attempts == 1
+    assert event.next_attempt_at is not None
+    assert event.last_error_code == "malformedResponse"
+
+
 def test_deliver_one_exhausts_attempts_to_failed(monkeypatch):
    event_id = _make_pending_event("MO-004")
    settings = get_settings()

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        raise dispatcher.httpx.ConnectError("still down")

    monkeypatch.setattr(dispatcher.httpx, "post", fake_post)
@@ -149,7 +176,7 @@ def test_deliver_one_handles_malformed_payload_without_getting_stuck(monkeypatch
    finally:
        db.close()

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        raise AssertionError("must not attempt delivery with a malformed payload")

    monkeypatch.setattr(dispatcher.httpx, "post", fake_post)
@@ -229,7 +256,7 @@ def test_run_dispatch_cycle_recovers_a_stale_lease_before_claiming(monkeypatch):
    finally:
        db.close()

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        return SimpleNamespace(
            raise_for_status=lambda: None,
            json=lambda: {"ok": True, "event_id": str(event_id), "result": {}},
@@ -245,7 +272,7 @@ def test_run_dispatch_cycle_recovers_a_stale_lease_before_claiming(monkeypatch):
 def test_run_dispatch_cycle_end_to_end(monkeypatch):
    event_id = _make_pending_event("MO-005")

-    def fake_post(url, json, timeout):
+    def fake_post(url, json, headers, timeout):
        return SimpleNamespace(
            raise_for_status=lambda: None,
            json=lambda: {"ok": True, "event_id": str(event_id), "result": {}},
@@ -1,3 +1,24 @@
+from sqlalchemy import select
+
+from app.core.db import SessionLocal
+from app.models.outbox import OutboxEvent
+from app.seed_loader import reset_and_seed
+
+
+def _reseed() -> None:
+    """Restore the canonical demo dataset (19 succeeded + 1 prepared failure).
+
+    The suite shares one session-scoped database and earlier files legitimately mutate
+    the outbox, so any test that asserts on the *seeded* scenario has to re-establish it
+    rather than depend on file ordering.
+    """
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+    finally:
+        db.close()
+
+
 def test_integration_status_requires_operations_manager(employee_client):
    response = employee_client.get("/api/v1/integrations/status")
    assert response.status_code == 403
@@ -9,6 +30,7 @@ def test_integration_status_requires_authentication(client):


 def test_integration_status_reflects_seeded_mixed_outcomes(ops_client):
+    _reseed()
    response = ops_client.get("/api/v1/integrations/status")
    assert response.status_code == 200
    body = response.json()
@@ -16,20 +38,65 @@ def test_integration_status_reflects_seeded_mixed_outcomes(ops_client):
    n8n = body["n8n"]
    assert n8n["dispatch_enabled"] is True
    assert n8n["succeeded"] >= 1
+    # The seeded failure stays visible and counted...
    assert n8n["failed"] >= 1
-    # The seed deliberately carries both failed and succeeded events, so a single most-
-    # recent-event read would misreport health -- the aggregate must call this "degraded",
-    # not "operational" or "unavailable".
-    assert n8n["state"] == "degraded"
+    assert n8n["demo_scenario_failed"] == 1
+    # ...but it is a prepared prop, so it is not an unexpected failure and must not
+    # move the integration off "operational". A staged failure that degrades the
+    # health badge tells a viewer something untrue about the automation.
+    assert n8n["unexpected_failed"] == 0
+    assert n8n["state"] == "operational"
    assert n8n["latest_success_at"] is not None
-    assert n8n["latest_failure_at"] is not None
+    # "latest failure" is a health signal, so the staged one never sets it; it is
+    # reported separately instead.
+    assert n8n["latest_failure_at"] is None
+    assert n8n["latest_demo_scenario_at"] is not None

    mcp_hub = body["mcp_hub"]
    assert mcp_hub["registration_enabled"] is False
    assert mcp_hub["state"] == "not_configured"


+def test_a_real_failure_still_degrades_the_integration(ops_client):
+    """The demo carve-out must be narrow: a failure that is not the prepared scenario
+    still degrades n8n, otherwise this change would hide real breakage."""
+    _reseed()
+    db = SessionLocal()
+    try:
+        real_failure = db.scalar(
+            select(OutboxEvent).where(OutboxEvent.delivery_status == "succeeded").limit(1)
+        )
+        assert real_failure is not None
+        restore = (real_failure.delivery_status, real_failure.last_error_code)
+        real_failure.delivery_status = "failed"
+        real_failure.last_error_code = "connectionError"
+        db.commit()
+
+        n8n = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+        assert n8n["unexpected_failed"] == 1
+        assert n8n["state"] == "degraded"
+        assert n8n["latest_failure_at"] is not None
+    finally:
+        real_failure.delivery_status, real_failure.last_error_code = restore
+        db.commit()
+        db.close()
+
+
+def test_prepared_demo_failure_is_reset_back_by_a_demo_reset(ops_client):
+    """A demo reset must recreate the intended 19 succeeded + 1 prepared failure, so the
+    scenario can be shown again after it has been retried away."""
+    _reseed()
+
+    n8n = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    assert n8n["succeeded"] == 19
+    assert n8n["failed"] == 1
+    assert n8n["demo_scenario_failed"] == 1
+    assert n8n["unexpected_failed"] == 0
+    assert n8n["state"] == "operational"
+
+
 def test_integration_status_is_operational_once_all_failed_events_resolved(ops_client):
+    _reseed()
    failed = ops_client.get("/api/v1/workflows", params={"status": "failed"}).json()
    for run in failed:
        retried = ops_client.post(f"/api/v1/workflows/{run['event_id']}/retry")
@@ -39,3 +106,85 @@ def test_integration_status_is_operational_once_all_failed_events_resolved(ops_c
    body = response.json()["n8n"]
    assert body["failed"] == 0
    assert body["state"] == "operational"
+
+
+def test_integration_status_lists_all_four_canonical_workflows(ops_client):
+    body = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    assert body["expected_workflow_count"] == 4
+    names = {w["name"] for w in body["workflows"]}
+    assert names == {
+        "Fleet Ops — Vehicle Return Orchestration",
+        "Fleet Ops — Scheduled Data Quality Scan",
+        "Fleet Ops — RAGcore Procedure Sync",
+        "Fleet Ops — Workflow Error Handler",
+    }
+    ragcore_sync = next(w for w in body["workflows"] if "RAGcore" in w["name"])
+    # All 4 canonical workflows are built (all 6 nodes saved live). This fresh test run
+    # has reported no real sync result yet, so -- like the other three workflows before
+    # their own first real signal -- there is no run evidence yet either.
+    assert ragcore_sync["built"] is True
+    assert ragcore_sync["last_seen_at"] is None
+
+
+def test_integration_status_scheduled_scan_evidence_only_counts_service_runs(client, ops_client):
+    from app.core.config import get_settings
+
+    settings = get_settings()
+
+    before = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    scan_workflow = next(
+        w for w in before["workflows"] if w["name"].endswith("Scheduled Data Quality Scan")
+    )
+    assert scan_workflow["last_seen_at"] is None
+
+    scan = client.post(
+        "/api/v1/integrations/n8n/scheduled-scan",
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    assert scan.status_code == 200
+
+    after = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    scan_workflow = next(
+        w for w in after["workflows"] if w["name"].endswith("Scheduled Data Quality Scan")
+    )
+    assert scan_workflow["last_seen_at"] is not None
+    assert after["known_workflow_count"] > before["known_workflow_count"]
+
+
+def test_integration_status_reflects_error_handler_registrations(client, ops_client):
+    import uuid
+
+    from app.core.config import get_settings
+
+    settings = get_settings()
+    before = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+
+    execution_id = str(uuid.uuid4())
+    report = client.post(
+        "/api/v1/integrations/n8n/workflow-error",
+        json={
+            "workflow_id": "mobilityops-return-processing",
+            "workflow_name": "Fleet Ops — Vehicle Return Orchestration",
+            "execution_id": execution_id,
+            "failed_at": "2026-08-04T10:15:00Z",
+            "error_category": "httpError",
+            "error_summary": "Simulated failure for status test",
+            "trigger_context": "webhook",
+            "attempt": 1,
+        },
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    assert report.status_code == 200
+
+    after = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    assert (
+        after["error_handler"]["total_failures_registered"]
+        == before["error_handler"]["total_failures_registered"] + 1
+    )
+    assert after["error_handler"]["latest_failure_workflow"] == (
+        "Fleet Ops — Vehicle Return Orchestration"
+    )
+    handler_workflow = next(
+        w for w in after["workflows"] if w["name"].endswith("Workflow Error Handler")
+    )
+    assert handler_workflow["last_seen_at"] is not None
@@ -122,3 +122,145 @@ def test_scheduled_scan_is_idempotent_across_repeated_triggers(client):
    assert first.status_code == 200
    assert second.status_code == 200
    assert second.json()["created"] == {}
+
+
+def _workflow_error_body(execution_id: str, **overrides):
+    body = {
+        "workflow_id": "mobilityops-return-processing",
+        "workflow_name": "Fleet Ops — Vehicle Return Orchestration",
+        "execution_id": execution_id,
+        "failed_at": "2026-08-04T10:15:00Z",
+        "error_category": "httpError",
+        "error_summary": "Callback request failed with status 500",
+        "trigger_context": "webhook",
+        "correlation_id": None,
+        "attempt": 1,
+        "retry_action": "n8n will retry automatically",
+    }
+    body.update(overrides)
+    return body
+
+
+def test_workflow_error_rejects_wrong_service_token(client):
+    response = client.post(
+        "/api/v1/integrations/n8n/workflow-error",
+        json=_workflow_error_body(str(uuid.uuid4())),
+        headers={"X-Service-Token": "wrong-token"},
+    )
+    assert response.status_code == 401
+
+
+def test_workflow_error_rejects_unknown_category(client):
+    settings = get_settings()
+    response = client.post(
+        "/api/v1/integrations/n8n/workflow-error",
+        json=_workflow_error_body(str(uuid.uuid4()), error_category="somethingElse"),
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    assert response.status_code == 422
+
+
+def test_workflow_error_registers_and_is_idempotent_by_execution_id(client, ops_client):
+    settings = get_settings()
+    headers = {"X-Service-Token": settings.n8n_callback_token}
+    execution_id = str(uuid.uuid4())
+    body = _workflow_error_body(execution_id)
+
+    first = client.post("/api/v1/integrations/n8n/workflow-error", json=body, headers=headers)
+    second = client.post("/api/v1/integrations/n8n/workflow-error", json=body, headers=headers)
+
+    assert first.status_code == 200
+    assert first.json()["status"] == "registered"
+    assert second.status_code == 200
+    assert second.json()["status"] == "already_registered"
+
+    audit_events = ops_client.get(
+        "/api/v1/audit", params={"action": "n8n_workflow_failure_registered"}
+    ).json()
+    matching = [e for e in audit_events if e["metadata"]["execution_id"] == execution_id]
+    assert len(matching) == 1
+    assert matching[0]["after"]["error_category"] == "httpError"
+    assert matching[0]["after"]["retry_action"] == "n8n will retry automatically"
+
+
+def test_workflow_error_bounds_summary_length(client):
+    settings = get_settings()
+    response = client.post(
+        "/api/v1/integrations/n8n/workflow-error",
+        json=_workflow_error_body(str(uuid.uuid4()), error_summary="x" * 501),
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    assert response.status_code == 422
+
+
+def test_procedures_rejects_wrong_service_token(client):
+    response = client.get(
+        "/api/v1/integrations/n8n/procedures", headers={"X-Service-Token": "wrong-token"}
+    )
+    assert response.status_code == 401
+
+
+def test_procedures_lists_every_language_with_stable_ids(client):
+    settings = get_settings()
+    response = client.get(
+        "/api/v1/integrations/n8n/procedures",
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    assert response.status_code == 200
+    documents = response.json()["documents"]
+    assert len(documents) > 0
+    assert {d["language"] for d in documents} == {"en-GB", "nl-BE", "fr-BE"}
+    checkout_docs = [d for d in documents if d["document_id"] == "vehicle-checkout-procedure"]
+    assert len(checkout_docs) == 3  # one per language
+    assert all(d["content"] and d["content_hash"] for d in checkout_docs)
+    # Same document_id, different language, must not collide on id.
+    assert len({d["id"] for d in checkout_docs}) == 3
+
+    second_response = client.get(
+        "/api/v1/integrations/n8n/procedures",
+        headers={"X-Service-Token": settings.n8n_callback_token},
+    )
+    second_ids = {d["id"] for d in second_response.json()["documents"]}
+    assert second_ids == {d["id"] for d in documents}  # ids are stable across requests
+
+
+def test_procedures_sync_result_rejects_wrong_service_token(client):
+    response = client.post(
+        "/api/v1/integrations/n8n/procedures-sync-result",
+        json={"execution_id": str(uuid.uuid4()), "synced": 5, "failed": 0},
+        headers={"X-Service-Token": "wrong-token"},
+    )
+    assert response.status_code == 401
+
+
+def test_procedures_sync_result_registers_and_is_idempotent(client, ops_client):
+    settings = get_settings()
+    headers = {"X-Service-Token": settings.n8n_callback_token}
+    execution_id = str(uuid.uuid4())
+    body = {"execution_id": execution_id, "synced": 33, "failed": 1}
+
+    first = client.post(
+        "/api/v1/integrations/n8n/procedures-sync-result", json=body, headers=headers
+    )
+    second = client.post(
+        "/api/v1/integrations/n8n/procedures-sync-result", json=body, headers=headers
+    )
+
+    assert first.status_code == 200
+    assert first.json()["status"] == "registered"
+    assert second.status_code == 200
+    assert second.json()["status"] == "already_registered"
+
+    audit_events = ops_client.get(
+        "/api/v1/audit", params={"action": "n8n_procedures_synced"}
+    ).json()
+    matching = [e for e in audit_events if e["metadata"]["execution_id"] == execution_id]
+    assert len(matching) == 1
+    assert matching[0]["after"] == {"synced": 33, "failed": 1}
+
+    # The workflow's own callback is its evidence -- same pattern the scheduled scan and
+    # error handler already use -- so this real report must now show up as run evidence
+    # in the integration status, not stay hardcoded to "no evidence yet".
+    status = ops_client.get("/api/v1/integrations/status").json()["n8n"]
+    ragcore_sync = next(w for w in status["workflows"] if "RAGcore" in w["name"])
+    assert ragcore_sync["last_seen_at"] is not None
@@ -158,12 +158,295 @@ def test_knowledge_status_endpoint(ops_client):
    assert response.json()["provider"] == "demo"


-def test_ragcore_provider_degrades_to_unavailable(monkeypatch):
-    def fake_client(*args, **kwargs):
-        raise httpx.ConnectError("no ragcore in this environment")
+class _FakeResponse:
+    def __init__(self, status_code: int, body: dict):
+        self.status_code = status_code
+        self._body = body

+    def json(self) -> dict:
+        return self._body
+
+
+class _FakeClient:
+    def __init__(self, get_response=None, post_response=None, post_responses=None, raise_on=None):
+        self._get_response = get_response
+        self._post_response = post_response
+        # Maps a path (e.g. "/v1/search") to its own response, for tests that need
+        # /v1/answers and /v1/search to behave differently in the same call. Falls back
+        # to the single post_response when a path has no specific entry, so every
+        # existing single-endpoint test keeps working unchanged.
+        self._post_responses = post_responses or {}
+        self._raise_on = raise_on
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *args):
+        return False
+
+    def get(self, path):
+        if self._raise_on == "get":
+            raise httpx.ConnectError("no ragcore in this environment")
+        return self._get_response
+
+    def post(self, path, json=None):
+        if self._raise_on == "post":
+            raise httpx.ConnectError("no ragcore in this environment")
+        return self._post_responses.get(path, self._post_response)
+
+
+def test_ragcore_provider_degrades_to_unavailable(monkeypatch):
    provider = RAGcoreKnowledgeProvider()
-    monkeypatch.setattr(provider, "_client", fake_client)
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(provider, "_client", lambda: _FakeClient(raise_on="post"))
    answer = provider.ask("Anything?", "test-correlation-3")
    assert answer.evidence_state == "unavailable"
    assert answer.sources == []
+
+
+def test_ragcore_provider_without_configured_space_is_unavailable_without_a_network_call(
+    monkeypatch,
+):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "")
+
+    def fail_if_called():
+        raise AssertionError("should not call RAGcore without a configured space id")
+
+    monkeypatch.setattr(provider, "_client", fail_if_called)
+    answer = provider.ask("Anything?", "test-correlation-no-space")
+    assert answer.evidence_state == "unavailable"
+
+
+def test_ragcore_provider_health_reports_ready_status(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(get_response=_FakeResponse(200, {"status": "ok"})),
+    )
+    health = provider.health()
+    assert health.provider == "ragcore"
+    assert health.available is True
+
+
+def test_ragcore_provider_health_reports_degraded_status(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(get_response=_FakeResponse(200, {"status": "degraded"})),
+    )
+    health = provider.health()
+    assert health.available is False
+
+
+def test_ragcore_provider_health_degrades_on_connection_error(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider, "_client", lambda: _FakeClient(raise_on="get"))
+    health = provider.health()
+    assert health.available is False
+    assert "unavailable" in health.detail.lower()
+
+
+def _answers_body(**overrides) -> dict:
+    body = {
+        "answer": "Report damage and route the vehicle to maintenance.",
+        "answerability": "answerable",
+        "citations": [
+            {
+                "id": "cite-1",
+                "document_id": "doc-1",
+                "document_version_id": "version-1",
+                "title": "Damage handling procedure",
+                "section": "Detection",
+                "excerpt": "Inspect the vehicle for visible damage.",
+            }
+        ],
+    }
+    body.update(overrides)
+    return body
+
+
+def test_ragcore_provider_grounded_answer_maps_citations_to_sources(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(post_response=_FakeResponse(200, _answers_body())),
+    )
+    answer = provider.ask("What must I do about damage?", "test-correlation-grounded")
+    assert answer.evidence_state == "grounded"
+    assert answer.answer
+    assert len(answer.sources) == 1
+    source = answer.sources[0]
+    assert source.document_id == "doc-1"
+    assert source.title == "Damage handling procedure"
+    assert source.version == "version-1"
+    assert source.section == "Detection"
+    assert source.excerpt
+
+
+def test_ragcore_provider_not_answerable_is_insufficient_and_never_fabricates(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_response=_FakeResponse(
+                200,
+                _answers_body(
+                    answer="This should never be shown.",
+                    answerability="not_answerable",
+                    citations=[],
+                ),
+            )
+        ),
+    )
+    answer = provider.ask("Unrelated question?", "test-correlation-insufficient")
+    assert answer.evidence_state == "insufficient"
+    assert answer.answer == ""
+    assert answer.sources == []
+
+
+def test_ragcore_provider_answerable_without_citations_is_insufficient(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_response=_FakeResponse(
+                200, _answers_body(answerability="answerable", citations=[])
+            )
+        ),
+    )
+    answer = provider.ask("What must I do about damage?", "test-correlation-no-citations")
+    assert answer.evidence_state == "insufficient"
+    assert answer.sources == []
+
+
+def test_ragcore_provider_non_200_response_is_unavailable(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(post_response=_FakeResponse(401, {"code": "AUTHENTICATION_REQUIRED"})),
+    )
+    answer = provider.ask("Anything?", "test-correlation-401")
+    assert answer.evidence_state == "unavailable"
+
+
+def test_ragcore_provider_malformed_response_is_unavailable(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    # A malformed /v1/answers body triggers the same search fallback a real outage
+    # would, so the fallback's own /v1/search response must also be malformed here to
+    # exercise "the whole backend is misbehaving, not just one endpoint" honestly.
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_responses={
+                "/v1/answers": _FakeResponse(200, {"citations": "not-a-list"}),
+                "/v1/search": _FakeResponse(200, {"results": "not-a-list"}),
+            }
+        ),
+    )
+    answer = provider.ask("Anything?", "test-correlation-malformed")
+    assert answer.evidence_state == "unavailable"
+
+
+def _search_body(**overrides) -> dict:
+    body = {
+        "results": [
+            {
+                "chunk_id": "chunk-1",
+                "citation": {
+                    "id": "cite-1",
+                    "document_id": "doc-1",
+                    "document_version_id": "version-1",
+                    "title": "Vehicle return procedure",
+                    "section": "Return",
+                    "excerpt": "Register the return odometer reading before releasing the vehicle.",
+                },
+                "rank": 1,
+                "scores": {"dense": None, "sparse": None, "fused": 0.5, "rerank": None},
+            }
+        ],
+        "degraded": False,
+    }
+    body.update(overrides)
+    return body
+
+
+def test_ragcore_provider_falls_back_to_search_when_answers_unavailable(monkeypatch):
+    """/v1/answers itself failing (a real RAGcore-side outage in its generation step,
+    not a real 'insufficient evidence' classification) must not silently degrade
+    straight to 'unavailable' when RAGcore's own retrieval still works -- it should show
+    the real, cited excerpt search actually found instead."""
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_responses={
+                "/v1/answers": _FakeResponse(503, {"code": "VALIDATION_RETRIES_EXHAUSTED"}),
+                "/v1/search": _FakeResponse(200, _search_body()),
+            }
+        ),
+    )
+    answer = provider.ask("What is the vehicle return procedure?", "test-correlation-fallback")
+    assert answer.evidence_state == "grounded"
+    assert "Register the return odometer reading" in answer.answer
+    assert "Vehicle return procedure" in answer.answer
+    assert len(answer.sources) == 1
+    assert answer.sources[0].title == "Vehicle return procedure"
+    assert answer.sources[0].excerpt == (
+        "Register the return odometer reading before releasing the vehicle."
+    )
+
+
+def test_ragcore_provider_fallback_answer_is_localized(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_responses={
+                "/v1/answers": _FakeResponse(503, {"code": "VALIDATION_RETRIES_EXHAUSTED"}),
+                "/v1/search": _FakeResponse(200, _search_body()),
+            }
+        ),
+    )
+    answer = provider.ask(
+        "Wat is de procedure voor een voertuigretour?",
+        "test-correlation-fallback-nl",
+        language="nl-BE",
+    )
+    assert answer.evidence_state == "grounded"
+    assert answer.answer.startswith("Volgens ")
+
+
+def test_ragcore_provider_fallback_with_no_search_results_is_insufficient(monkeypatch):
+    provider = RAGcoreKnowledgeProvider()
+    monkeypatch.setattr(provider._settings, "ragcore_space_id", "space-1")
+    monkeypatch.setattr(
+        provider,
+        "_client",
+        lambda: _FakeClient(
+            post_responses={
+                "/v1/answers": _FakeResponse(503, {"code": "VALIDATION_RETRIES_EXHAUSTED"}),
+                "/v1/search": _FakeResponse(200, _search_body(results=[])),
+            }
+        ),
+    )
+    answer = provider.ask("Unrelated question?", "test-correlation-fallback-empty")
+    assert answer.evidence_state == "insufficient"
+    assert answer.answer == ""
+    assert answer.sources == []
@@ -81,6 +81,48 @@ def test_mcp_tool_requests_are_audited(client, ops_client):
    assert events[0]["actor_type"] == "service"


+def test_search_knowledge_respects_requested_locale(client):
+    response = client.post(
+        "/api/v1/integrations/mcp/search-knowledge",
+        json={
+            "question": "Wat moet ik doen wanneer een voertuig beschadigd terugkomt?",
+            "max_sources": 1,
+            "locale": "nl-BE",
+        },
+        headers=_headers(),
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert body["evidence_state"] == "grounded"
+
+
+def test_search_knowledge_preserves_inbound_correlation_id(client, ops_client):
+    inbound = "11111111-1111-1111-1111-111111111111"
+    response = client.post(
+        "/api/v1/integrations/mcp/search-knowledge",
+        json={"question": "What must I do when a vehicle returns with damage?", "max_sources": 1},
+        headers={**_headers(client_id="correlation-probe"), "X-Correlation-Id": inbound},
+    )
+    assert response.status_code == 200
+    assert response.json()["correlation_id"] == inbound
+
+    events = ops_client.get("/api/v1/audit", params={"action": "mcp_tool_request"}).json()
+    matching = [e for e in events if e["correlation_id"] == inbound]
+    assert len(matching) == 1
+
+
+def test_operations_summary_mints_correlation_id_when_none_supplied(client, ops_client):
+    response = client.get(
+        "/api/v1/integrations/mcp/operations-summary",
+        headers=_headers(client_id="no-correlation-probe"),
+    )
+    assert response.status_code == 200
+    events = ops_client.get("/api/v1/audit", params={"action": "mcp_tool_request"}).json()
+    matching = [e for e in events if e["actor_label"] == "no-correlation-probe"]
+    assert len(matching) >= 1
+    assert matching[0]["correlation_id"]  # a fresh UUID was minted, not left empty
+
+
 def test_no_write_endpoints_exist_under_mcp_namespace(client):
    for method, path in [
        ("post", "/api/v1/integrations/mcp/vehicles/MO-016"),
@@ -7,7 +7,7 @@ from app.models.audit import AuditEvent
 from app.models.booking import Booking
 from app.models.customer import Customer
 from app.models.data_quality import DataQualityIssue
-from app.models.outbox import OutboxEvent
+from app.models.outbox import DEMO_SCENARIO_ERROR_CODE, OutboxEvent
 from app.models.user import User
 from app.models.vehicle import Vehicle
 from app.seed_loader import SEED_AUTHORED_ANCHOR, reset_and_seed
@@ -22,13 +22,16 @@ def test_seed_counts_match_deterministic_dataset():
        reset_and_seed(db)
        assert db.scalar(select(func.count()).select_from(Vehicle)) == 50
        assert db.scalar(select(func.count()).select_from(Customer)) == 180
-        assert db.scalar(select(func.count()).select_from(Booking)) == 246
-        # 15 from the CSV plus a deterministic set discovered by the post-seed scan. The
-        # shared vehicle-status evaluator (app.services.vehicle_status) now also catches
+        # 246 original plus 8 (BK-T-001..008) added so "Today's movements" reads as a
+        # real day of traffic rather than the same fixed 4 rows on every reset.
+        assert db.scalar(select(func.count()).select_from(Booking)) == 254
+        # 21 from the CSV (15 original + 6 giving every unexplained blocked vehicle a
+        # real open issue) plus a deterministic set discovered by the post-seed scan. The
+        # shared vehicle-status evaluator (app.services.vehicle_status) also catches
        # MO-024: an active/return-pending booking (BK-DEMO-RETURN) on a vehicle that has
        # already crossed its service-due odometer threshold -- a genuine conflict the
        # previous hand-rolled scanner never checked for.
-        assert db.scalar(select(func.count()).select_from(DataQualityIssue)) == 27
+        assert db.scalar(select(func.count()).select_from(DataQualityIssue)) == 33
        assert db.scalar(select(func.count()).select_from(OutboxEvent)) == 20
        assert db.scalar(select(func.count()).select_from(User)) == 2
    finally:
@@ -142,7 +145,10 @@ def test_seed_scenario_s5_failed_workflow_run():
        assert failed.delivery_status == "failed"
        assert failed.attempts >= 1
        assert failed.last_error
-        assert failed.last_error_code == "connectionError"
+        # Coded as a prepared demo scenario, not as a real connectionError: the whole
+        # point of this row is to demonstrate retry and audit, so nothing downstream
+        # may read it as evidence that the n8n integration is unhealthy.
+        assert failed.last_error_code == DEMO_SCENARIO_ERROR_CODE
    finally:
        db.close()

@@ -174,3 +180,102 @@ def test_seed_dates_are_anchored_to_reset_moment():
        assert marker.metadata_json["seed_authored_anchor"] == SEED_AUTHORED_ANCHOR.isoformat()
    finally:
        db.close()
+
+
+def test_seed_today_movements_are_a_credible_mix():
+    """A fresh reset must not land on a thin, always-identical 'Today's movements'
+    dashboard section: a real day of fleet traffic (>=5 departures, >=5 returns, across
+    more than 4 distinct vehicles) should fall on the reset day, mirroring the same
+    status/date rule the dashboard router uses to build the today list."""
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+        today = datetime.now(UTC).date()
+        bookings = db.scalars(select(Booking)).all()
+        departures = [
+            b
+            for b in bookings
+            if b.starts_at.date() == today and b.status in ("reserved", "active")
+        ]
+        returns = [
+            b for b in bookings if b.ends_at.date() == today and b.status in ("active", "returned")
+        ]
+        assert len(departures) >= 5
+        assert len(returns) >= 5
+        vehicles_involved = {b.vehicle_id for b in departures} | {b.vehicle_id for b in returns}
+        assert len(vehicles_involved) > 4
+    finally:
+        db.close()
+
+
+def test_every_blocked_vehicle_has_a_real_open_issue():
+    """A live reviewer found blocked vehicles with no explanation anywhere in the UI --
+    5 with zero quality issues at all, one (MO-049) with only a resolved one. Every
+    vehicle seeded as 'blocked' must now have at least one real, currently open
+    DataQualityIssue an operator can click through to."""
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+        blocked = db.scalars(select(Vehicle).where(Vehicle.operational_status == "blocked")).all()
+        assert len(blocked) > 0
+        for vehicle in blocked:
+            open_issue = db.scalar(
+                select(DataQualityIssue).where(
+                    DataQualityIssue.entity_type == "vehicle",
+                    DataQualityIssue.entity_id == vehicle.id,
+                    DataQualityIssue.status == "open",
+                )
+            )
+            assert open_issue is not None, f"{vehicle.public_ref} is blocked with no open issue"
+    finally:
+        db.close()
+
+
+def test_seed_scenario_mo024_service_conflict_is_flagged():
+    """Regression lock-in for the live-reported MO-024 defect: 'rented' with a real
+    active booking (BK-DEMO-RETURN) yet already 14,820 km past its service threshold,
+    with nothing surfacing the contradiction. The shared vehicle-status evaluator
+    already catches this (a real conflict, not a fabricated third status) -- this test
+    exists so a future change can't silently regress it back to unexplained."""
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+        vehicle = _by_ref(db, Vehicle, "MO-024")
+        assert vehicle is not None
+        assert vehicle.operational_status == "rented"
+        assert vehicle.odometer_km >= vehicle.next_service_km
+
+        issue = db.scalar(
+            select(DataQualityIssue).where(
+                DataQualityIssue.entity_type == "vehicle",
+                DataQualityIssue.entity_id == vehicle.id,
+                DataQualityIssue.status == "open",
+                DataQualityIssue.rule_type == "vehicle_status_conflict",
+            )
+        )
+        assert issue is not None
+        signals = issue.evidence_json.get("signals", [])
+        assert any(s["code"] == "vehicle.manual_review_required" for s in signals)
+    finally:
+        db.close()
+
+
+def test_seed_evidence_has_no_placeholder_summary():
+    """Every seed-only data-quality issue used to carry the vacuous evidence
+    'Synthetic deterministic seed issue' with no structured signal at all -- a visitor
+    had no way to understand why it needed attention. Every issue must now carry a real
+    summary and at least one localizable signal (code + params)."""
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+        issues = db.scalars(select(DataQualityIssue)).all()
+        assert len(issues) > 0
+        for issue in issues:
+            summary = issue.evidence_json.get("summary", "")
+            assert summary != "Synthetic deterministic seed issue", (
+                f"{issue.public_ref} still has the meaningless placeholder summary"
+            )
+            signals = issue.evidence_json.get("signals", [])
+            assert len(signals) > 0, f"{issue.public_ref} has no structured evidence signal"
+    finally:
+        db.close()
@@ -14,6 +14,18 @@ def test_attention_only_filters_flagged_vehicles(ops_client):
    assert all(v["attention"] for v in vehicles)


+def test_vehicle_page_preserves_filters_and_limits_rendered_records(ops_client):
+    response = ops_client.get(
+        "/api/v1/vehicles",
+        params={"status": "maintenance", "page": 1, "page_size": 25},
+    )
+    assert response.status_code == 200
+    body = response.json()
+    assert len(body["items"]) <= 25
+    assert all(v["operational_status"] == "maintenance" for v in body["items"])
+    assert body["total"] >= len(body["items"])
+
+
 def test_vehicle_detail_includes_related_records(ops_client):
    response = ops_client.get("/api/v1/vehicles/MO-016")
    assert response.status_code == 200
@@ -1,9 +1,28 @@
+from app.core.db import SessionLocal
+from app.seed_loader import reset_and_seed
+
+
+def _reseed() -> None:
+    """Restore the canonical demo dataset (19 succeeded + 1 prepared failure).
+
+    The suite shares one session-scoped database and earlier files legitimately mutate
+    the outbox, so any test that asserts on the *seeded* scenario has to re-establish it
+    rather than depend on file ordering.
+    """
+    db = SessionLocal()
+    try:
+        reset_and_seed(db)
+    finally:
+        db.close()
+
+
 def test_list_workflows_requires_operations_manager(employee_client):
    response = employee_client.get("/api/v1/workflows")
    assert response.status_code == 403


 def test_list_workflows_includes_seeded_failed_run(ops_client):
+    _reseed()
    response = ops_client.get("/api/v1/workflows", params={"status": "failed"})
    assert response.status_code == 200
    runs = response.json()
@@ -20,6 +39,7 @@ def test_retry_requires_failed_status(ops_client):


 def test_retry_failed_run_moves_to_pending_and_audits(ops_client):
+    _reseed()
    failed = ops_client.get("/api/v1/workflows", params={"status": "failed"}).json()
    target = failed[0]["event_id"]

@@ -36,3 +56,42 @@ def test_retry_requires_operations_manager(employee_client):
        "/api/v1/workflows/00000000-0000-4000-8000-000000000020/retry"
    )
    assert response.status_code == 403
+
+
+def test_seeded_failure_is_labelled_as_a_prepared_demo_scenario(ops_client):
+    """The one seeded failure must announce itself as staged. An unexplained red row in
+    a demo reads as a broken product; a labelled one reads as the retry story it is."""
+    _reseed()
+    runs = ops_client.get("/api/v1/workflows", params={"status": "failed"}).json()
+    demo_runs = [run for run in runs if run["is_demo_scenario"]]
+    assert len(demo_runs) == 1
+    assert demo_runs[0]["last_error_code"] == "demoScenarioTimeout"
+    assert demo_runs[0]["aggregate_ref"] == "BK-H-0020"
+
+
+def test_succeeded_runs_are_never_marked_as_a_demo_scenario(ops_client):
+    runs = ops_client.get("/api/v1/workflows", params={"status": "succeeded"}).json()
+    assert runs
+    assert all(run["is_demo_scenario"] is False for run in runs)
+
+
+def test_retry_of_the_demo_scenario_is_audited_as_a_demo_scenario(ops_client):
+    """The retry is a real redelivery either way; the audit records which kind of
+    failure it resolved so a staged retry is never mistaken for a production fix."""
+    _reseed()
+    failed = ops_client.get("/api/v1/workflows", params={"status": "failed"}).json()
+    demo_run = next(run for run in failed if run["is_demo_scenario"])
+
+    response = ops_client.post(f"/api/v1/workflows/{demo_run['event_id']}/retry")
+    assert response.status_code == 200
+    assert response.json()["status"] == "pending"
+
+    audit = ops_client.get("/api/v1/audit", params={"action": "workflow_retry"}).json()
+    entry = next(
+        event
+        for event in audit
+        if (event.get("metadata") or event.get("metadata_json") or {}).get("event_id")
+        == demo_run["event_id"]
+    )
+    metadata = entry.get("metadata") or entry.get("metadata_json") or {}
+    assert metadata["demo_scenario"] is True
@@ -31,9 +31,13 @@ services:
      RAGCORE_WORKSPACE: ${RAGCORE_WORKSPACE:-mobilityops}
      RAGCORE_COLLECTION: ${RAGCORE_COLLECTION:-internal-procedures}
      RAGCORE_API_TOKEN: ${RAGCORE_API_TOKEN:-}
+      RAGCORE_SPACE_ID: ${RAGCORE_SPACE_ID:-}
      N8N_WEBHOOK_URL: ${N8N_WEBHOOK_URL:-http://n8n:5678/webhook/mobilityops-return}
+      N8N_WEBHOOK_TRIGGER_TOKEN: ${MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN:-replace-me-n8n-webhook-trigger-token}
      N8N_CALLBACK_TOKEN: ${MOBILITYOPS_CALLBACK_TOKEN:-replace-me-n8n-callback-token}
      MCP_HUB_SERVICE_TOKEN: ${MCP_HUB_SERVICE_TOKEN:-replace-me-mcp-hub-token}
+      MCP_HUB_REGISTRATION_ENABLED: ${MCP_HUB_REGISTRATION_ENABLED:-false}
+      MCP_HUB_BASE_URL: ${MCP_HUB_BASE_URL:-}
      DEMO_ORGANIZATION_NAME: ${DEMO_ORGANIZATION_NAME:-Northstar Mobility}
      DEMO_TIMEZONE: ${DEMO_TIMEZONE:-Europe/Brussels}
      DEMO_ALLOW_RESET: ${DEMO_ALLOW_RESET:-true}
@@ -1,17 +1,20 @@
 {
+  "_note": "Fleet Ops's own published tool contract. The live ITWorx MCP Hub connector (ITWorx_MCP_Hub repo, connectors/mobilityops/) wraps these under its own dotted namespace (mobilityops.operations.summary, .attention.list, .vehicle.get, .knowledge.search) -- that naming is Hub-owned. deprecated_aliases below are Fleet Ops's own prior internal audit-label names, kept only so existing clients/dashboards referencing them don't break.",
  "provider_id": "mobilityops",
-  "version": "1.0.0",
+  "version": "1.1.0",
  "required_scope": "mobilityops.read",
  "tools": [
    {
-      "name": "mobilityops_get_operations_summary",
-      "description": "Return current high-level vehicle, data-quality and workflow counts for the synthetic MobilityOps demo tenant.",
+      "name": "fleet_ops_get_operations_summary",
+      "deprecated_aliases": ["mobilityops_get_operations_summary"],
+      "description": "Return current high-level vehicle, data-quality and workflow counts for the synthetic Fleet Ops demo tenant.",
      "read_only": true,
      "inputSchema": {"type": "object", "additionalProperties": false},
      "endpoint": {"method": "GET", "path": "/api/v1/integrations/mcp/operations-summary"}
    },
    {
-      "name": "mobilityops_list_attention_vehicles",
+      "name": "fleet_ops_list_attention_vehicles",
+      "deprecated_aliases": ["mobilityops_list_attention_vehicles"],
      "description": "List vehicles that require operational attention, optionally filtered by minimum severity and date.",
      "read_only": true,
      "inputSchema": {
@@ -26,7 +29,8 @@
      "endpoint": {"method": "GET", "path": "/api/v1/integrations/mcp/attention-vehicles"}
    },
    {
-      "name": "mobilityops_get_vehicle_details",
+      "name": "fleet_ops_get_vehicle_details",
+      "deprecated_aliases": ["mobilityops_get_vehicle_details"],
      "description": "Return a read-only operational view of one vehicle by its stable public reference.",
      "read_only": true,
      "inputSchema": {
@@ -38,15 +42,17 @@
      "endpoint": {"method": "GET", "path": "/api/v1/integrations/mcp/vehicles/{vehicle_ref}"}
    },
    {
-      "name": "mobilityops_search_knowledge",
-      "description": "Search versioned MobilityOps internal procedures through the dedicated RAGcore workspace and return grounded source references.",
+      "name": "fleet_ops_search_knowledge",
+      "deprecated_aliases": ["mobilityops_search_knowledge"],
+      "description": "Search versioned Fleet Ops internal procedures through the dedicated RAGcore workspace and return grounded source references.",
      "read_only": true,
      "inputSchema": {
        "type": "object",
        "required": ["question"],
        "properties": {
          "question": {"type": "string", "minLength": 3, "maxLength": 1000},
-          "max_sources": {"type": "integer", "minimum": 1, "maximum": 8, "default": 4}
+          "max_sources": {"type": "integer", "minimum": 1, "maximum": 8, "default": 4},
+          "locale": {"enum": ["nl-BE", "en-GB", "fr-BE"], "default": "en-GB"}
        },
        "additionalProperties": false
      },
@@ -3,7 +3,7 @@ set -eu

 container_name="${1:-n8n}"
 callback_url="${2:-http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback}"
-source_workflow="${3:-n8n/mobilityops-return-processing.json}"
+source_workflow="${3:-n8n/workflows/fleet-ops-vehicle-return.json}"

 if [ ! -f .env ]; then
  echo "Missing deployment .env" >&2
@@ -18,12 +18,10 @@ if ! docker inspect "$container_name" >/dev/null 2>&1; then
  exit 1
 fi

-callback_token="$(sed -n 's/^MOBILITYOPS_CALLBACK_TOKEN=//p' .env | tail -n 1)"
-if [ -z "$callback_token" ]; then
-  echo "MOBILITYOPS_CALLBACK_TOKEN is empty" >&2
-  exit 1
-fi
-
+# The workflow file no longer carries the callback token as a literal header value -- both
+# the webhook trigger and the outbound callback authenticate via named n8n Header Auth
+# credentials ("Fleet Ops Webhook Trigger Token", "Fleet Ops Service Token"). Those must
+# exist in the target n8n instance before this workflow is activated; see the echo below.
 temporary_workflow="$(mktemp /tmp/mobilityops-n8n-workflow.XXXXXX.json)"
 container_workflow="/tmp/mobilityops-return-processing.json"
 cleanup() {
@@ -32,15 +30,17 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM

-jq --arg callback_url "$callback_url" --arg callback_token "$callback_token" '
-  (.nodes[] | select(.id == "callback-node") | .parameters.url) = $callback_url |
-  (.nodes[] | select(.id == "callback-node") | .parameters.headerParameters.parameters[] |
-    select(.name == "X-Service-Token") | .value) = $callback_token
+jq --arg callback_url "$callback_url" '
+  (.nodes[] | select(.id == "callback-node") | .parameters.url) = $callback_url
 ' "$source_workflow" > "$temporary_workflow"

 docker cp "$temporary_workflow" "$container_name:$container_workflow" >/dev/null
 docker exec "$container_name" n8n import:workflow --input="$container_workflow"
-docker exec "$container_name" n8n publish:workflow --id=mobilityops-return-processing
-docker restart "$container_name" >/dev/null

-echo "Published MobilityOps return workflow to existing container ${container_name}"
+echo "Imported Fleet Ops — Vehicle Return Orchestration into container ${container_name}."
+echo "Before activating: in the n8n UI, create Header Auth credentials named"
+echo "  'Fleet Ops Webhook Trigger Token' (value = MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN from .env)"
+echo "  'Fleet Ops Service Token'         (value = MOBILITYOPS_CALLBACK_TOKEN from .env)"
+echo "then open the workflow and click Publish. This script does not print or transmit"
+echo "those secret values, and does not restart the container -- restart it yourself once"
+echo "credentials are wired up and the workflow is published, if required."
@@ -3,7 +3,7 @@ set -eu

 container_name="${1:-n8n}"
 scan_url="${2:-http://192.168.10.150:1236/api/v1/integrations/n8n/scheduled-scan}"
-source_workflow="${3:-n8n/mobilityops-scheduled-quality-scan.json}"
+source_workflow="${3:-n8n/workflows/fleet-ops-data-quality-scan.json}"

 if [ ! -f .env ]; then
  echo "Missing deployment .env" >&2
@@ -18,12 +18,10 @@ if ! docker inspect "$container_name" >/dev/null 2>&1; then
  exit 1
 fi

-callback_token="$(sed -n 's/^MOBILITYOPS_CALLBACK_TOKEN=//p' .env | tail -n 1)"
-if [ -z "$callback_token" ]; then
-  echo "MOBILITYOPS_CALLBACK_TOKEN is empty" >&2
-  exit 1
-fi
-
+# The workflow file no longer carries the callback token as a literal header value -- the
+# scan request authenticates via the named n8n Header Auth credential ("Fleet Ops Service
+# Token"), which must exist in the target n8n instance before this workflow is activated;
+# see the echo below.
 temporary_workflow="$(mktemp /tmp/mobilityops-n8n-workflow.XXXXXX.json)"
 container_workflow="/tmp/mobilityops-scheduled-quality-scan.json"
 cleanup() {
@@ -32,15 +30,16 @@ cleanup() {
 }
 trap cleanup EXIT INT TERM

-jq --arg scan_url "$scan_url" --arg callback_token "$callback_token" '
-  (.nodes[] | select(.id == "scan-node") | .parameters.url) = $scan_url |
-  (.nodes[] | select(.id == "scan-node") | .parameters.headerParameters.parameters[] |
-    select(.name == "X-Service-Token") | .value) = $callback_token
+jq --arg scan_url "$scan_url" '
+  (.nodes[] | select(.id == "scan-node") | .parameters.url) = $scan_url
 ' "$source_workflow" > "$temporary_workflow"

 docker cp "$temporary_workflow" "$container_name:$container_workflow" >/dev/null
 docker exec "$container_name" n8n import:workflow --input="$container_workflow"
-docker exec "$container_name" n8n publish:workflow --id=mobilityops-scheduled-quality-scan
-docker restart "$container_name" >/dev/null

-echo "Published MobilityOps scheduled quality-scan workflow to existing container ${container_name}"
+echo "Imported Fleet Ops — Scheduled Data Quality Scan into container ${container_name}."
+echo "Before activating: in the n8n UI, create a Header Auth credential named"
+echo "  'Fleet Ops Service Token' (value = MOBILITYOPS_CALLBACK_TOKEN from .env)"
+echo "then open the workflow and click Publish. This script does not print or transmit"
+echo "that secret value, and does not restart the container -- restart it yourself once"
+echo "the credential is wired up and the workflow is published, if required."
@@ -6,20 +6,44 @@ Publish four read-only MobilityOps capabilities through the existing central ITW

 ## Provider registration

- provider ID: `mobilityops`
- API base: configurable internal MobilityOps API URL
- authentication: scoped service token
+- provider ID: `mobilityops` (registered on the Hub side; the Hub's own registration is
+  catalog-driven — it reconciles its catalog into the gateway, Fleet Ops never pushes a
+  registration call)
+- API base: internal Fleet Ops API URL, reached via `MCP_HUB_SERVICE_TOKEN` auth
+- authentication: scoped service token (`X-Service-Token`), plus `X-Client-Id`
 - mode: read-only
- required scope: `mobilityops.read`
+- **Confirmed live in production** on the ITWorx MCP Hub's own deployment (Tower), with
+  a real contract fix already applied there (`vehicle.get`'s wire parameter normalized to
+  camelCase `vehicleRef`). `docs/final-integrations/current-state-audit.md` has the full
+  evidence.

 ## Tools

-The machine-readable definitions are in `contracts/mcp-tools.json`.
+The machine-readable definitions are in `contracts/mcp-tools.json`. The Hub's own live
+connector (`ITWorx_MCP_Hub` repo, `connectors/mobilityops/`) publishes these under its
+own dotted namespace — that naming is the Hub's to own, not Fleet Ops's:

-1. `mobilityops_get_operations_summary`
-2. `mobilityops_list_attention_vehicles`
-3. `mobilityops_get_vehicle_details`
-4. `mobilityops_search_knowledge`
+1. `mobilityops.operations.summary`
+2. `mobilityops.attention.list`
+3. `mobilityops.vehicle.get`
+4. `mobilityops.knowledge.search`
+
+Fleet Ops's own internal audit trail (`AuditEvent.metadata_json.tool`, visible on
+`/api/v1/audit?action=mcp_tool_request`) labels these calls `fleet_ops_get_operations_summary`,
+`fleet_ops_list_attention_vehicles`, `fleet_ops_get_vehicle_details`,
+`fleet_ops_search_knowledge` — a separate, Fleet-Ops-owned naming layer for its own audit
+log, not the wire-level MCP tool name a client calls.
+
+`search-knowledge` accepts a `locale` field (`nl-BE` | `en-GB` | `fr-BE`, default
+`en-GB`) that is passed straight through to the active knowledge provider.
+
+## Correlation ID
+
+The inbound `X-Correlation-Id` header (set by the Hub, itself either forwarding the
+MCP client's ID or minting one) is preserved through Fleet Ops's own handling and audit
+log; Fleet Ops only mints a fresh correlation ID when none is supplied or the supplied
+value isn't a valid UUID. See `get_correlation_id` in
+`backend/app/api/routers/mcp_integrations.py`.

 ## Routing

@@ -16,7 +16,7 @@ Steps:
 4. return a stable workflow result;
 5. on errors, fail visibly so the outbox dispatcher can retry.

-The starter export is `n8n/mobilityops-return-processing.json`. Claude may correct its credentials and callback route but must preserve idempotency.
+The canonical, live-validated definition is `n8n/workflows/fleet-ops-vehicle-return.json` (see `n8n/workflows/MANIFEST.md`); it authenticates via named Header Auth credentials rather than a literal token, per the live-hardening pass documented in `docs/live-ai-integration/n8n-current-state.md`.

 ## Second live workflow: scheduled quality scan

@@ -39,24 +39,24 @@ Steps:
 open, so a duplicate or overlapping trigger (a manual test run firing close to the
 scheduled one, or a retried HTTP call) does no duplicate domain work.

-The starter export is `n8n/mobilityops-scheduled-quality-scan.json`, imported and
-published the same way as the return-processing workflow (see
-`deploy/unraid/setup-scheduled-scan.sh` and `docs/17-runbook.md`). It ships with
-`"active": false` so it cannot fire against any environment until deliberately
-published with a real service token.
+The canonical, live-validated definition is `n8n/workflows/fleet-ops-data-quality-scan.json`
+(see `n8n/workflows/MANIFEST.md`), imported and published the same way as the return
+workflow (see `deploy/unraid/setup-scheduled-scan.sh` and `docs/17-runbook.md`). It is
+active on the live instance; a fresh import ships inactive until credentials are wired up
+and it is deliberately published.

-## Deferred: knowledge sync
+## RAGcore procedure sync (in progress)

-Input: manual trigger or manifest-changed event.
+RAGcore is now reachable in this environment; a live inspection of its real contract is
+recorded in `docs/live-ai-integration/n8n-current-state.md`. Workflow 3, "Fleet Ops —
+RAGcore Procedure Sync", is being built against that real contract (not the sketch
+originally in this section) — see `n8n/workflows/MANIFEST.md` for current status.

-Steps:
+## Workflow error handler (in progress)

-1. read the fixed knowledge manifest;
-2. call RAGcore ingestion/sync API;
-3. record per-document results through MobilityOps integration status API.
-
-Deferred until RAGcore's live ingestion API is available in this environment; must not
-delay or block the core demo.
+Workflow 4, "Fleet Ops — Workflow Error Handler", is a central technical workflow attached
+to workflows 1-3 via n8n's per-workflow "Error Workflow" setting, reporting bounded,
+secret-free failure details to Fleet Ops. See `n8n/workflows/MANIFEST.md` for status.

 ## Outbox dispatcher

@@ -67,3 +67,34 @@ delay or block the core demo.
 - supports explicit manual retry;
 - preserves last error and response metadata;
 - does not hold a database transaction open during network I/O.
+
+## Prepared demo failure versus real failure
+
+The demo seed deliberately plants exactly one failed delivery (`BK-H-0020`, see
+`seed/workflow_runs.csv`). It exists to demonstrate retry and audit, so it must never be
+read as evidence that the automation is unhealthy.
+
+It is distinguished by its `last_error_code`, `demoScenarioTimeout`
+(`app.models.outbox.DEMO_SCENARIO_ERROR_CODE`) — not by a new column, so no migration is
+involved. A real timeout produces `connectionError`; the two are never confused.
+
+Consequences, all enforced by tests:
+
+- `/api/v1/integrations/status` reports `failed` (everything), `unexpected_failed` (real
+  failures only) and `demo_scenario_failed` separately.
+- Only `unexpected_failed` can move n8n off `operational`. A prepared failure alone
+  leaves the integration **operational** — a staged prop may not raise a red flag.
+- `latest_failure_at` is a health signal and therefore ignores the prepared failure;
+  `latest_demo_scenario_at` reports it separately.
+- `/api/v1/workflows` marks the run with `is_demo_scenario: true`. The Automation page
+  labels it "Prepared demo scenario", explains that it is a simulated temporary failure,
+  and offers a distinct "Retry demo scenario" action.
+- A genuine later failure of that same event overwrites the code with the real one, and
+  from that moment it counts as a real failure — the carve-out is narrow by construction.
+
+The retry itself is real in both cases: the event goes back on the outbox and the
+dispatcher delivers it to the configured n8n webhook like any other, so 19 succeeded +
+1 failed becomes 20 succeeded + 0 failed only when n8n genuinely accepts the delivery.
+Nothing is marked succeeded without a real round trip. The audit entry records
+`demo_scenario: true/false` so a staged retry is never mistaken for a production fix.
+A demo reset recreates the original 19 + 1 scenario.
@@ -36,7 +36,12 @@ Vehicle `MO-016` has two imported overlapping reservations. Expected: visible qu

 ### S5 — Failed workflow

-One seeded outbox/workflow record is failed with a safe simulated connection error. Expected: dashboard and Automation page show it; Operations Manager can retry.
+One seeded outbox/workflow record is failed with a safe simulated connection error, coded
+`demoScenarioTimeout` so it is recognisable as a prepared scenario rather than a real
+incident. Expected: dashboard and Automation page show it, labelled as a prepared demo
+scenario; n8n stays "Operational"; the Operations Manager can retry it, after which the
+overview reads 20 succeeded and 0 failed. See `docs/11-n8n-integration.md`, "Prepared demo
+failure versus real failure".

 ### S6 — Grounded damage question

@@ -48,7 +48,7 @@ longer gates this. This is a one-time step per fresh `docker compose down -v`:
   which runs:

   ```bash
-   docker compose exec n8n n8n import:workflow --input=//imports/mobilityops-return-processing.json
+   docker compose exec n8n n8n import:workflow --input=//imports/workflows/fleet-ops-vehicle-return.json
   docker compose exec n8n n8n publish:workflow --id=mobilityops-return-processing
   docker compose restart n8n
   ```
@@ -56,6 +56,12 @@ longer gates this. This is a one-time step per fresh `docker compose down -v`:
   (`n8n import:workflow` always leaves the workflow deactivated regardless of its
   `"active"` field; `publish:workflow` + a restart is what actually activates it.)

+   Before it will actually process a return, create two Header Auth credentials in the n8n
+   UI — `Fleet Ops Webhook Trigger Token` (value: `MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN` from
+   `.env`) and `Fleet Ops Service Token` (value: `MOBILITYOPS_CALLBACK_TOKEN` from `.env`) —
+   the workflow's webhook trigger and outbound HTTP call reference these credentials by
+   name; no secret value is embedded in the workflow file itself.
+
 Verify the full round trip:

 ```bash
@@ -77,11 +83,14 @@ make n8n-setup-scan
 which runs:

 ```bash
-docker compose exec n8n n8n import:workflow --input=//imports/mobilityops-scheduled-quality-scan.json
+docker compose exec n8n n8n import:workflow --input=//imports/workflows/fleet-ops-data-quality-scan.json
 docker compose exec n8n n8n publish:workflow --id=mobilityops-scheduled-quality-scan
 docker compose restart n8n
 ```

+This workflow also needs the `Fleet Ops Service Token` Header Auth credential created in
+the n8n UI before a run will succeed.
+
 Verify:

 ```bash
@@ -0,0 +1,509 @@
+# MobilityOps visual product roadmap
+
+## Purpose
+
+This roadmap turns the visual audit of the deployed MobilityOps PoC into an
+implementation plan. It improves the existing operational workflows without
+expanding the locked product scope.
+
+The intended outcome is a platform that:
+
+- lets an operator identify and act on urgent work within thirty seconds;
+- remains efficient with the current synthetic data set and larger realistic data sets;
+- keeps status, context and primary actions visible on desktop and mobile;
+- uses a readable, consistent visual hierarchy;
+- communicates integration and knowledge health without contradictory signals;
+- preserves the existing domain rules, audit guarantees and graceful degradation.
+
+## Scope guardrails
+
+Included:
+
+- information architecture and visual hierarchy;
+- list density, pagination, filtering and responsive presentation;
+- dashboard, detail, return, data-quality, knowledge, automation, audit and demo flows;
+- accessibility, perceived performance and UI observability;
+- regression tests, visual evidence and rollout safeguards.
+
+Excluded:
+
+- new accounting, payments, CRM, inventory, HR or reservation modules;
+- maintenance work orders, calendar views or advanced analytics;
+- changes to RAGcore or ITWorx MCP Hub repositories;
+- autonomous write actions or write-capable MCP tools;
+- a redesign of backend domain rules that is not required by the UI work.
+
+## Audit baseline
+
+The audit was performed against the deployed application at desktop, tablet and
+mobile widths. The current strengths to preserve are the professional visual
+identity, consistent status language, strong login page, semantic page structure,
+visible keyboard focus, absence of horizontal overflow and clear return and
+data-quality narratives.
+
+The principal improvement signals are:
+
+| Area | Baseline observation | Consequence |
+|---|---|---|
+| Audit log | Up to 100 expanded event cards; approximately 18,500 px desktop and 20,500 px mobile | Poor scanability and excessive scrolling |
+| Vehicle list | All 50 vehicles render at once; approximately 12,000 px on mobile | Operational lookup is slow on small screens |
+| Mobile page header | `.page-actions` is hidden below 700 px | Important record status disappears |
+| Typography | Many metadata labels and badges are approximately 9–11 px | Readability is weaker than the visual quality suggests |
+| Top bar | Search, language, demo controls, disclosure, timezone and operator controls compete for space | High cognitive load and weak prioritisation |
+| Knowledge | An operational provider can be shown beside “0 procedures indexed” | Trust signal is ambiguous or contradictory |
+| Integration cards | Technical identifiers and small prose dominate the summary | Operational state is harder to scan |
+
+These values are baselines, not permanent acceptance thresholds. Each affected
+phase must record a before-and-after measurement.
+
+## Delivery principles
+
+1. Fix operational friction before decorative polish.
+2. Prefer progressive disclosure over removing useful evidence.
+3. Keep the primary status and next action visible at every viewport.
+4. Paginate or virtualise unbounded collections; never solve them only with CSS.
+5. Derive every displayed count and state from persisted or external evidence.
+6. Preserve URLs, permissions, audit semantics and keyboard operation.
+7. Ship each phase as a coherent, independently reversible commit.
+8. Validate every phase at 390 px, 768 px and 1440 px.
+
+## Target measures
+
+The roadmap is complete when the following targets are met:
+
+| Measure | Target |
+|---|---|
+| Initial rows/cards in any operational list | At most 25, unless a documented compact virtualised view is used |
+| Mobile status visibility | Primary record status visible on every detail page |
+| Horizontal overflow | None at 360 px and above |
+| Default text | At least 14 px |
+| Secondary metadata | At least 12 px; exceptions require an accessibility justification |
+| Touch target | At least 44 by 44 CSS px for primary mobile controls |
+| Keyboard access | All actions reachable with visible focus and logical order |
+| List navigation | Filter, paging and search state represented in the URL where practical |
+| Dashboard comprehension | Primary operational risks and next movements visible without scrolling at 1440 × 900 |
+| Browser console | No application errors during the five-minute demo |
+| Performance | No avoidable rendering of more than one page of list records |
+| Automated acceptance | Existing backend, frontend and Playwright gates remain green |
+
+## Roadmap overview
+
+| Phase | Theme | Priority | Indicative effort | Depends on |
+|---|---|---:|---:|---|
+| R0 | Baseline and design-system guardrails | P0 | 2–3 days | None |
+| R1 | Operational lists and audit log | P0 | 5–7 days | R0 |
+| R2 | Responsive shell and readable hierarchy | P0 | 4–6 days | R0 |
+| R3 | Dashboard and record-detail efficiency | P1 | 5–7 days | R1, R2 |
+| R4 | Guided workflows and decision surfaces | P1 | 5–7 days | R2, R3 |
+| R5 | Knowledge, automation and trust signals | P1 | 3–5 days | R2 |
+| R6 | Accessibility, performance and release evidence | P0 gate | 4–6 days | R1–R5 |
+
+Indicative total: 28–41 focused engineering days. Phases can span multiple
+calendar sprints, but their exit gates should not be split across releases.
+
+## R0 — Baseline and design-system guardrails
+
+### Objective
+
+Create shared UI rules and reproducible measurements before changing individual
+pages.
+
+### Work packages
+
+#### R0.1 — Visual regression baseline
+
+- Capture authenticated reference screenshots for the seven principal routes and
+  the login page at 390 × 844, 768 × 1024 and 1440 × 900.
+- Add stable screenshot fixtures using the deterministic seed.
+- Mask only genuinely variable timestamps; do not mask operational content.
+- Record viewport width, page height, visible item count and horizontal overflow.
+
+#### R0.2 — Typography and spacing tokens
+
+- Replace scattered sub-12 px declarations with named type tokens.
+- Establish body, metadata, label, badge, table-header and navigation sizes.
+- Define compact and comfortable density variants without duplicating page CSS.
+- Preserve the existing petrol/teal palette and status colours.
+
+#### R0.3 — Shared responsive patterns
+
+- Define a mobile page-header contract: title, visible status, primary action and
+  overflow actions.
+- Define reusable compact-list, filter-toolbar, pagination and empty-state patterns.
+- Establish 44 px mobile target sizing and a consistent sticky-offset system.
+
+### Acceptance criteria
+
+- Visual baselines exist for all principal routes and viewports.
+- No normal operational metadata is smaller than 12 px.
+- Shared components document their responsive behaviour.
+- Existing Playwright demo and frontend build pass unchanged.
+
+## R1 — Operational lists and audit log
+
+### Objective
+
+Make high-volume operational information scannable and bounded on every device.
+
+### Work packages
+
+#### R1.1 — Audit API pagination and filtering
+
+- Replace the default fixed `limit=100` response with cursor or page-based pagination.
+- Add filters for date range, action, actor, entity type, entity reference and
+  correlation ID.
+- Retain stable newest-first ordering and service-token protections.
+- Return total or continuation metadata suitable for the selected paging model.
+
+#### R1.2 — Compact audit timeline
+
+- Render 20–25 compact events per page.
+- Group correlated events and repetitive scheduled events without hiding their count.
+- Move full UUIDs, before/after data and technical metadata into a details drawer.
+- Keep human-readable action, actor, target, outcome and timestamp in the main row.
+- Preserve direct navigation to related records.
+
+#### R1.3 — Vehicle-list pagination
+
+- Add server-compatible pagination to the vehicle list.
+- Preserve status, location, attention and search filters across pages.
+- Store filter and page state in the URL.
+- Provide a prominent “attention required” view without inventing new metrics.
+- Use compact mobile rows rather than full table-to-card expansion for every vehicle.
+
+#### R1.4 — Data-quality queue controls
+
+- Paginate the open issue list.
+- Add severity and rule grouping/filtering.
+- Add “previous issue” and “next issue” navigation to review pages.
+- Keep scan and resolution actions permission-aware.
+
+### Acceptance criteria
+
+- No default list renders more than 25 records.
+- Audit and vehicle pages remain below 3,500 px at the tested mobile viewport with
+  the deterministic seed.
+- Paging and filters survive reload, back navigation and direct links.
+- Empty, loading, error and end-of-results states are explicit.
+- API tests cover invalid cursors/pages, combined filters and authorization.
+
+## R2 — Responsive shell and readable hierarchy
+
+### Objective
+
+Reduce navigation noise and keep essential context visible on small screens.
+
+### Work packages
+
+#### R2.1 — Top-bar simplification
+
+- Keep global search and current operational context primary.
+- Move language, timezone and sign-out into the operator menu.
+- Combine demo disclosure and demo progress into one compact control.
+- Replace the visually empty mobile search field with an explicit search button or
+  a full-width command surface.
+
+#### R2.2 — Mobile page actions
+
+- Stop hiding the complete page-action region.
+- Always show record status next to or below the title.
+- Keep one primary action visible and move secondary actions to an accessible menu.
+- Verify booking, vehicle, data-quality and automation detail headers independently.
+
+#### R2.3 — Navigation refinement
+
+- Review whether the desktop sidebar should remain available at wider tablet widths.
+- Increase mobile navigation label size and touch area.
+- Keep four or five primary destinations visible and put lower-frequency destinations
+  under “More” if six items cannot meet readability targets.
+- Preserve current routes and role-based visibility.
+
+#### R2.4 — Typography rollout
+
+- Apply the R0 type tokens to badges, tables, integration cards, timelines, forms and
+  mobile navigation.
+- Rebalance padding where larger text would otherwise increase page height excessively.
+- Verify Dutch, French and English labels for clipping and wrapping.
+
+### Acceptance criteria
+
+- Status remains visible on every sampled mobile detail page.
+- No essential action is hover-only or hidden solely because of viewport width.
+- Top-bar controls fit without clipping at 390, 768 and 1440 px.
+- Language changes do not introduce horizontal overflow.
+- Touch-target and typography targets are met.
+
+## R3 — Dashboard and record-detail efficiency
+
+### Objective
+
+Put operational decisions above supporting detail and make desktop space work harder.
+
+### Work packages
+
+#### R3.1 — Dashboard hierarchy
+
+- Keep readiness and highest-severity attention items visible in the first viewport.
+- Reduce the vertical weight of the demo-scenario panel after the scenario starts.
+- Limit the initial attention queue and link to a complete filtered view.
+- Balance “movements today” against attention content when only a few movements exist.
+- Keep integrations and recent activity available without duplicating status copy.
+
+#### R3.2 — Mobile dashboard summary
+
+- Convert readiness into a compact, horizontally accessible summary or disclosure.
+- Show the highest-priority attention items first with an explicit remaining count.
+- Surface the next departure and return before secondary integration information.
+
+#### R3.3 — Vehicle-detail workspace
+
+- Replace the sparse overview with a two-column desktop composition.
+- Surface current status, location, odometer, next booking and active attention items.
+- Keep bookings, inspections, maintenance, quality issues and audit as focused tabs.
+- Avoid new maintenance-domain functionality; link only to existing evidence.
+
+#### R3.4 — Booking-detail summary
+
+- Rebalance the facts grid so incomplete final rows do not create large empty bands.
+- On mobile, show status and return readiness before secondary booking facts.
+- Keep the return form close to the task entry point while retaining validation context.
+
+### Acceptance criteria
+
+- At 1440 × 900 the dashboard exposes readiness, urgent work and today's movement
+  context without scrolling.
+- Sparse states remain intentional and balanced rather than appearing unfinished.
+- All values remain derived from persisted data.
+- Existing return and status-domain tests remain unchanged and green.
+
+## R4 — Guided workflows and decision surfaces
+
+### Objective
+
+Reduce the distance between evidence and the decision an operator must make.
+
+### Work packages
+
+#### R4.1 — Return flow refinement
+
+- Keep the step indicator visible while completing or reviewing a return.
+- Use a compact mobile booking summary above the form.
+- Present validation errors next to fields and in a short focusable summary.
+- Preserve the post-submit explanation of inspection, vehicle status, quality issue,
+  queued automation and next-booking risk.
+
+#### R4.2 — Duplicate-customer decision layout
+
+- Use evidence/comparison on the left and a sticky survivor/merge preview on desktop.
+- Keep matching fields collapsed by default and differences expanded.
+- Keep irreversible-action language and audit preview adjacent to the merge button.
+- On mobile, use a deliberate sequence: evidence, differences, survivor, preview,
+  confirmation.
+
+#### R4.3 — Other data-quality resolutions
+
+- Standardise evidence, proposed resolution, consequence and audit-preview sections.
+- Keep resolve, reject and defer actions visually distinct and permission-aware.
+- Provide clear success feedback and navigation to the next issue.
+
+#### R4.4 — Guided demo integration
+
+- Reduce competition between the guide and normal navigation.
+- Persist progress without obscuring page controls.
+- Make “go to this step” land on the relevant element or focused task state.
+- Ensure the guide is fully keyboard-operable and usable as a mobile bottom sheet.
+
+### Acceptance criteria
+
+- Primary workflow action is visible or reachable with one obvious interaction.
+- A user never needs to scroll past repeated explanatory content to discover the
+  required decision.
+- Focus moves to validation failures and success results appropriately.
+- The five-minute demo remains deterministic.
+
+## R5 — Knowledge, automation and trust signals
+
+### Objective
+
+Make external-system health understandable to an operator without exposing irrelevant
+technical detail.
+
+### Work packages
+
+#### R5.1 — Knowledge status semantics
+
+- Separate provider availability, indexed-source count and last successful sync.
+- Never show “0 indexed” as a healthy equivalent when the value is unknown or stale.
+- Label extractive fallback answers honestly while preserving source cards.
+- Reduce empty-state height and show a compact explanation of what a cited answer contains.
+- Keep suggested questions concise and prioritised.
+
+#### R5.2 — Source and freshness presentation
+
+- Surface source title, version, section and freshness consistently.
+- Keep document UUIDs and raw retrieval metadata behind technical details.
+- Provide explicit grounded, insufficient-evidence and unavailable states.
+
+#### R5.3 — Integration summary redesign
+
+- Structure each integration around state, last success, affected workflow and next action.
+- Move client IDs, raw endpoints and UUIDs to a detail disclosure.
+- Remove unnecessary fixed card height, especially at tablet widths.
+- Keep genuine mixed states visible without presenting them as contradictions.
+
+#### R5.4 — Workflow evidence table
+
+- Improve status and recency scanning.
+- Distinguish “never triggered”, “no evidence yet”, “failed” and “unavailable”.
+- Keep retry actions safe, audited and available only where already supported.
+
+### Acceptance criteria
+
+- Knowledge and integration states cannot make mutually contradictory claims.
+- An operator can identify the current state and next action within one card scan.
+- Technical identifiers do not dominate default views.
+- RAGcore, n8n and MCP Hub timeout/unavailable contract tests stay green.
+
+## R6 — Accessibility, performance and release evidence
+
+### Objective
+
+Turn the improvements into a verified, releasable quality baseline.
+
+### Work packages
+
+#### R6.1 — Accessibility review
+
+- Test complete keyboard traversal of login, navigation, filters, return, merge,
+  knowledge, workflow retry and audit details.
+- Verify focus order, focus restoration, dialog labelling and error announcements.
+- Run automated accessibility checks on all principal routes.
+- Manually verify status is not encoded by colour alone.
+- Verify zoom at 200% and 360 px responsive reflow.
+
+#### R6.2 — Rendering and interaction performance
+
+- Measure list rendering before and after pagination.
+- Check layout shift and interaction latency on dashboard and long-list routes.
+- Ensure drawers, menus and guided-demo panels do not mount large hidden subtrees.
+- Test with reduced motion and a throttled CPU profile.
+
+#### R6.3 — Cross-browser and localisation pass
+
+- Verify current Chrome plus one additional Chromium/Firefox-equivalent target where
+  supported by the test environment.
+- Run Dutch, French and English visual checks at all target widths.
+- Verify Europe/Brussels date and time rendering.
+
+#### R6.4 — Final automated journey and evidence
+
+- Extend the existing Playwright demo with pagination, mobile status and accessible
+  details checks.
+- Capture final screenshots for all principal pages.
+- Add before-and-after measurements and known PoC limitations to final evidence.
+- Execute clean-checkout bootstrap, backend tests, lint, typing and frontend build.
+
+### Acceptance criteria
+
+- No critical or serious automated accessibility violations on principal routes.
+- All target measures in this document pass.
+- `docs/14-testing-and-acceptance.md` passes from a clean checkout.
+- `artifacts/evidence/final-summary.md` contains the final commands, counts,
+  screenshots and limitations.
+
+## Suggested release slices
+
+### Release A — Operational scale
+
+Contains R0 and R1. This release eliminates the most severe scroll and list-density
+problems without materially changing workflow structure.
+
+Release gate:
+
+- paginated audit, vehicles and data-quality queues;
+- URL-backed filters;
+- unchanged audit and authorization semantics;
+- visual regression baseline green.
+
+### Release B — Responsive operations
+
+Contains R2 and R3. This release improves navigation, typography, dashboard hierarchy
+and detail-page use of space.
+
+Release gate:
+
+- visible mobile statuses and primary actions;
+- readable typography and touch targets;
+- dashboard first-viewport target met;
+- Dutch, French and English responsive checks green.
+
+### Release C — Guided decisions and trust
+
+Contains R4 and R5. This release refines the return, merge, knowledge, automation and
+demo-guide experiences.
+
+Release gate:
+
+- decision actions remain near their evidence;
+- honest and non-contradictory external health states;
+- five-minute demo passes end to end.
+
+### Release D — Quality certification
+
+Contains R6 and only defects found by its gates. It adds no new product scope.
+
+Release gate:
+
+- full clean-checkout acceptance;
+- accessibility and performance targets met;
+- final evidence updated;
+- release tag and deployed revision recorded.
+
+## Implementation sequence and dependencies
+
+```text
+R0 shared tokens and baselines
+ ├─ R1 pagination and compact lists ─┐
+ └─ R2 responsive shell and type ───┼─ R3 dashboard/details ─ R4 workflows
+                                    └─ R5 trust surfaces
+R1 + R2 + R3 + R4 + R5 ──────────────────────────────── R6 release gate
+```
+
+R1 and R2 may be developed in parallel after R0. R3 should consume both shared list
+and responsive patterns. R4 depends on the new page-header and detail hierarchy. R5 can
+start after R2 but must share its disclosure and status patterns. R6 is a gate, not a
+cleanup bucket; defects discovered there return to the owning phase.
+
+## Per-phase engineering checklist
+
+Every phase must include:
+
+1. a short before-state measurement;
+2. API and data-contract impact assessment;
+3. implementation using shared components where applicable;
+4. unit/API tests for changed contracts;
+5. Playwright coverage for the changed user journey;
+6. manual checks at 390, 768 and 1440 px in all supported languages;
+7. accessibility and console check;
+8. updated evidence and `PROJECT_STATE.md` entry;
+9. one coherent commit after validation passes;
+10. deployment verification before starting the next release slice.
+
+## Risks and mitigations
+
+| Risk | Mitigation |
+|---|---|
+| Pagination changes API consumers | Add pagination metadata without silently changing service-token/MCP response contracts; version only if necessary |
+| Compact layouts hide evidence | Use drawers and disclosures, preserving direct access and auditability |
+| Larger type increases page height | Combine type changes with density and hierarchy work, never shrink text again |
+| Sticky UI covers content on mobile | Use shared top/bottom offsets and test keyboard/zoom states |
+| Visual snapshots become brittle | Seed deterministic data and mask only true timestamp volatility |
+| External health data is stale | Show last successful evidence and distinguish unknown from healthy |
+| Roadmap drifts into new product scope | Check every work package against `docs/01-scope-and-non-goals.md` and `docs/deferred.md` |
+
+## Definition of roadmap completion
+
+This roadmap is complete only when Releases A through D are deployed and verified,
+all target measures pass, the original five-minute demo remains green, and the final
+evidence records the exact deployed revision. Completing only the visual styling or one
+high-priority page does not complete the roadmap.
@@ -65,9 +65,11 @@ generated and kept fresh across resets.
  `RAGcoreKnowledgeProvider` HTTP adapter exists and is unit-tested, ready to take over
  the same interface once a real RAGcore backend is available — swapping providers is a
  configuration change (`KNOWLEDGE_PROVIDER`), not a UI change.
- **ITWorx MCP Hub**: not connected. Registration is disabled by default
-  (`MCP_HUB_REGISTRATION_ENABLED=false`) and the UI always shows "Not connected" —
-  never a fabricated successful registration.
+- **ITWorx MCP Hub**: the UI reports "Operational" only when Fleet Ops has really
+  recorded `mcp_tool_request` calls in its own audit log. `MCP_HUB_REGISTRATION_ENABLED`
+  on its own never makes it operational — registration is catalog-driven on the Hub's
+  side, so the flag alone is not evidence of anything, and a successful registration is
+  never fabricated.

 ## Where to go next

@@ -0,0 +1,87 @@
+# AI Operations Brief — runbook and live evidence
+
+Answers, using a real MCP client through the real ITWorx MCP Hub connector against live
+production Fleet Ops: *"Which vehicles need the most attention today, why, and which
+internal procedure should be followed for the most important issue?"*
+
+## What this is not
+
+Not a chatbot. No write actions exist under `/api/v1/integrations/mcp/*` (verified by
+`test_no_write_endpoints_exist_under_mcp_namespace`). Every call below is a plain
+read-only tool invocation, exactly as the deployed Hub connector performs them.
+
+## Reproducible command
+
+Run from inside the live `itworx-mcp-hub-connector-mobilityops-1` container (has the
+real `MOBILITYOPS_ENDPOINT`, `MOBILITYOPS_SERVICE_TOKEN_FILE` and the real
+`packages.connector_kit.mobilityops.MobilityOpsClient` already available — the same
+client class the deployed connector uses):
+
+```sh
+docker exec -e PYTHONPATH=/opt/hub -w /opt/hub \
+  itworx-mcp-hub-connector-mobilityops-1 python3 - <<'PY'
+from packages.connector_kit.mobilityops import FileTokenProvider, MobilityOpsClient, MobilityOpsSettings
+import os, json
+
+settings = MobilityOpsSettings(
+    base_url=os.environ["MOBILITYOPS_ENDPOINT"],
+    token_reference=os.environ["MOBILITYOPS_SERVICE_TOKEN_FILE"],
+)
+client = MobilityOpsClient(settings, FileTokenProvider())
+client_id = "ai-ops-brief"
+
+summary = client.operations_summary(client_id)
+attention = client.attention_vehicles(client_id, minimum_severity="high", date=None, limit=20)
+top_ref = attention[0]["vehicle_ref"] if attention else None
+details = client.vehicle_details(client_id, top_ref) if top_ref else None
+answer = client.search_knowledge(client_id, "What must I do when a vehicle returns with damage?", max_sources=2)
+
+print(json.dumps({"summary": summary, "top_attention": attention[0] if attention else None, "vehicle": details, "answer": answer}, indent=2))
+client.close()
+PY
+```
+
+This calls, in order: `fleet_ops_get_operations_summary` → `fleet_ops_list_attention_vehicles`
+→ `fleet_ops_get_vehicle_details` → `fleet_ops_search_knowledge`. No result is invented —
+every field printed is exactly what Fleet Ops's live API returned.
+
+## Live run, 2026-08-05
+
+- **Operations summary**: 21 available, 11 rented, 6 cleaning, 5 maintenance,
+  **7 blocked**; 23 open quality issues; 1 pending/failed workflow.
+- **Most pressing vehicle**: `MO-031` — `missing_required_field`, "near-future booking;
+  required operational inspection missing", detected `2026-08-05T11:08:33Z`. (16 vehicles
+  currently carry a `high`-severity open issue; `MO-031` was the earliest-detected.)
+- **Vehicle detail (`MO-031`)**: Adria Matrix, 2022, Geel, `operational_status: blocked`,
+  41,149 km (service due at 50,000 km), no current booking.
+- **Grounded procedure (English)**: *Damage handling procedure* v1.3, section "1.
+  Immediate actions" — "When a vehicle returns with visible or reported damage, mark
+  damage in the return inspection, add a concise factual description and keep the
+  vehicle blocked. Do not promise the customer a repair cost or liability decision."
+  Second source: *Vehicle return procedure* v2.0, section "3. Determine next state".
+  `evidence_state: grounded`, 2 real citations, `provider: demo`.
+- **Dutch and French variants of the damage question** (`Wat moet ik doen wanneer een
+  voertuig beschadigd terugkomt?`, `Que dois-je faire lorsqu'un véhicule revient
+  endommagé ?`) both returned `evidence_state: insufficient` — an honest, non-fabricated
+  "no match" rather than a wrong or invented answer. Root cause: the currently-deployed
+  Hub connector does not yet send the new `locale` field this session added to
+  `search-knowledge` (Fleet Ops defaults to `en-GB`), so non-English question text
+  doesn't match the demo provider's English-tokenized index. A real fix needs a Hub-side
+  connector update to pass `locale`, tracked as a follow-up, not silently worked around.
+- **Correlation ID, end to end, verified**: each call's response `correlation_id` (e.g.
+  `abd643a7-2aeb-4af3-806a-da04acb3e444` for the English grounded answer) appears
+  verbatim in Fleet Ops's own audit log (`GET /api/v1/audit?action=mcp_tool_request`),
+  alongside `actor_label: ai-ops-brief-2026-08-05` and the real tool name
+  (`fleet_ops_search_knowledge`). No write actions were performed; only `mcp_tool_request`
+  audit rows were created, matching every other live MCP call this integration makes.
+
+## Known limitation, stated plainly
+
+The demo knowledge provider (not RAGcore — `KNOWLEDGE_PROVIDER=demo`, see
+`docs/final-integrations/current-state-audit.md` for why) is what grounds the English
+answer here. It is deterministic, extractive, and never fabricates — but it is not the
+live RAGcore integration the brief brief for this task set out to exercise; that
+remains blocked on RAGcore's own reranker gap. This run is honest about that: it proves
+the full MCP-client → Hub → Fleet Ops → knowledge-provider → audit chain works for real,
+live, in production, with real data and real citations — using the knowledge provider
+that is actually configured live today.
@@ -0,0 +1,152 @@
+# Current-state audit — Fleet Ops final integrations
+
+Date: 2026-08-05. Compiled from direct repository inspection (git log/status/diff across
+all three repos), `PROJECT_STATE.md` history, and read-only investigation of the sibling
+repos' own state docs. No live server SSH/curl evidence is included in this pass yet —
+see `integration-release-state.md` for the live-verification checklist as it is executed.
+
+## Repository revisions at audit time
+
+| Repo | Path | Branch | HEAD | Notes |
+|---|---|---|---|---|
+| Fleet Ops (MobilityOps) | `C:\Projects\MobilityOps` | `feat/fleet-ops-final-integrations` (new, branched from `feat/live-n8n-ragcore-integration`) | `3ebca9e` | `feat/live-n8n-ragcore-integration` was pushed to `origin` at `0571a40` and deployed live; `3ebca9e` (logo rebrand) is one commit ahead, not yet deployed. `master` is 19 commits behind and stale (localization-round only). |
+| RAGcore | `C:\Projects\RAGcore` | `main` | `64a908a` | Up to date with `origin/main`. Uncommitted local work in progress (see below) — not Fleet-Ops-related, left untouched. |
+| ITWorx MCP Hub | `C:\Projects\ITWorx_MCP_Hub` | `feature/wp240-final-acceptance` | `26e6bd8` (+ later `75bb16a`) | Contains `f107544` (MobilityOps connector) as a direct ancestor, plus a real contract fix (`96de385`, vehicleRef camelCase). Already deployed live to Tower at `c4a0f6d`. |
+
+## Branch-name correction (recorded assumption)
+
+The task brief names the working branch `feat/fleet-ops-final-integrations` as already
+selected and "branched from the most recently validated, localized, deployed master
+branch." That literal branch did not exist. `master` is in fact stale (19 commits behind,
+last touched for a localization round only) — the actually-validated, deployed line of
+work is `feat/live-n8n-ragcore-integration` (pushed to `origin`, deployed to
+`http://192.168.10.150:1236` at `0571a40`, one commit behind current HEAD). Created
+`feat/fleet-ops-final-integrations` from that branch's HEAD (`3ebca9e`) instead of from
+`master`, since that satisfies the actual intent (continue from the validated/deployed
+line) even though the literal branch name in the brief was inaccurate.
+
+## What is actually already done (contradicts "not yet live" framing in places)
+
+- **n8n**: 3 of 4 canonical workflows are live and active in the shared instance
+  (`n8n.itworx.tech`): Vehicle Return Orchestration, Scheduled Data Quality Scan,
+  Workflow Error Handler. The 4th, RAGcore Procedure Sync, has all 6 nodes built and
+  saved but is **not published** (deliberately left for an explicit activation decision,
+  since publishing starts real unattended daily runs against production). The root cause
+  of an earlier "auth"-looking failure (`N8N_PROXY_HOPS=0` behind the TLS-terminating
+  reverse proxy, breaking the browserId CSRF check on every mutating REST call) was found
+  and fixed at the infrastructure level (Unraid template), not worked around.
+- **RAGcore**: deployed to `http://192.168.10.150:1237`, application wiring for
+  search/context/answer is real (commit `a2905cc`, confirmed present in RAGcore's own
+  history at `13 commits behind HEAD`). `KNOWLEDGE_PROVIDER` is still `demo` in Fleet Ops
+  because real queries against the "Fleet Ops Procedures" space return **zero dense and
+  zero sparse candidates** at the raw retrieval stage — confirmed not a Fleet-Ops-side
+  wiring bug (RAGcore's own trusted Query Lab tool reproduces the identical zero-candidate
+  result against the same space). Root cause not yet found as of this audit; ruled out so
+  far: point count/scoping (83 published, correctly scoped), embedding digest mismatch
+  (matches), collection alias resolution (resolves correctly). One separate, confirmed,
+  pre-existing bug: `_DEFAULT_LANGUAGE = "en"` is hardcoded in RAGcore's ingestion handler
+  — every chunk is stamped `language: "en"` regardless of actual content; RAGcore has never
+  done real language detection. Not the cause of zero candidates, but must be fixed for
+  trilingual retrieval (task 6A) once the space is answerable at all.
+- **MCP Hub**: the Fleet Ops read-only connector (4 tools, `mobilityops.*`) is **already
+  live in production** on Tower (commit `c4a0f6d`), reachable via `fleetops.itworx.tech`,
+  end-to-end verified once already per the Hub's own `CLAUDE.md`/`BUILD_STATE.json`. A
+  real contract bug was found and fixed there (`vehicle.get`'s input schema disagreed with
+  the actual wire parameter name — `vehicle_ref` vs `vehicleRef`). What is **not** yet done:
+  the Hub's own formal production-acceptance checklist row for MobilityOps (`CON-P04`) has
+  not been executed, and Fleet Ops's own `MCP_HUB_REGISTRATION_ENABLED`/base-URL
+  configuration has not been confirmed as actually wired and flipped on from the Fleet Ops
+  side (open item for this audit's Batch 4).
+
+## Confirmed contradictions to resolve (task section 3)
+
+- "Twee versus vier n8n-workflows": resolved above — 3 active + 1 built-but-unpublished.
+  Canonical set is 4; only 3 are live.
+- "Demo-provider versus live RAGcore": Fleet Ops is still on the demo knowledge provider
+  by deliberate, documented decision (not an oversight) pending the retrieval root cause.
+- "MCP Hub-status": prior Fleet Ops docs (`.env.example`, `MCP_HUB_REGISTRATION_ENABLED`)
+  predate the Hub-side deployment and need reconciling against the fact that the connector
+  is already live on the Hub side.
+- Repo hygiene: removed an untracked, empty `backend;C` directory and an untracked 31 MB
+  `MobilityOps.zip` stray export; added `*.zip`/`*.tar.gz` to `.gitignore`. No accidentally
+  committed `__pycache__`/`.pytest_cache`/`test-results` were found in git history.
+
+## RAGcore retrieval root cause — found and partially fixed (2026-08-05, this session)
+
+Investigated live against production (`192.168.10.150`, containers `ragcore-app-1`,
+`ragcore-qdrant-1`, `ragcore-postgres-1`, `ollama`), read-only first, then two approved
+live changes.
+
+**Root cause #1 (FIXED): filesystem permission bug, not authorization/data.** Verified,
+in order, that every earlier suspect was actually healthy: the `control.grants` row
+(active, `editor` role, correct application/space), the real
+`ControlPlaneAuthorizationInputsProvider` + `RetrievalAuthorizationService.resolve()` code
+path run in-process against the live DB (resolves a non-empty `effective_space_ids`), the
+exact production Qdrant filter run directly against the live collection (returns real
+matching points), and a real ANN vector query under that filter (real hits, sensible
+scores). The actual break: `/workspace/.state/models/embedding_profiles.json` — the file
+`RetrievalPipeline.run()` reads on every single query to resolve the active embedding
+profile — was owned by container-side `root:root` mode `600` on the bind-mounted
+`/mnt/cache/appdata/ragcore/state/models` host path, while the real running app process
+is uid 10001 (`ragcore`). Every retrieval call hit a `PermissionError` reading its own
+state file before ever reaching Qdrant — a plain filesystem-ownership bug, invisible to
+every DB/Qdrant-level check. **Fixed live**: `chown 10001:10001` +
+`chmod 644`/`755` on that file/directory (approved by the user beforehand). Re-verified
+in-process: `RetrievalPipeline.run()` now returns 5 real, relevant hits for an English
+damage-procedure question (previously 0).
+
+**Root cause #2 (found, NOT fixed — needs a design decision): reranking is
+architecturally unavailable.** `DEFAULT_RERANKER_PROFILE.model_identifier` is
+`bge-reranker-v2-m3:v1`, which was never actually present in Ollama's model list (0 of 14
+installed models matched). With the user's approval, pulled a working GGUF
+(`xitao/bge-reranker-v2-m3:latest`, 1.2 GB) into the shared Ollama instance. **This did
+not fix reranking**: `OllamaRerankAdapter` posts to `{ollama_base_url}/api/rerank`, and
+this Ollama server (version `0.32.5`) returns a plain `404` for that route — it has no
+rerank endpoint at all. This is not a missing-model problem, it is that RAGcore's
+reranker adapter was built against an Ollama HTTP API that does not exist in the deployed
+version (matches the code's own comment that no reranker-profile registry or live
+validation existed yet). The retrieval pipeline degrades gracefully on rerank failure
+(RRF-fusion-only hits still returned, confirmed above), but the `/v1/answers` endpoint's
+answerability classifier still returns `not_answerable`/0 citations for real NL/EN/FR
+questions against real matching content, live-verified after fix #1 with a freshly
+minted, correctly-scoped credential.
+
+Options for #2, not decided yet: (a) find/confirm whether a newer Ollama version adds a
+real `/api/rerank` route and upgrade the shared instance (affects every other project on
+this Ollama — needs its own explicit approval and blast-radius review); (b) change
+RAGcore's reranker adapter to call a route Ollama actually supports (e.g. score via
+`/api/embed` + a manual similarity/cross-encoder computation, or drop the separate
+rerank step and let the answerability classifier trust RRF-fused scores) — a RAGcore
+code/design change, out of Fleet Ops's own mandate to decide unilaterally; (c) leave
+`KNOWLEDGE_PROVIDER=demo` until RAGcore's own team/session resolves this.
+
+**Side effect to flag**: minting the live-verification credential used `rotate=True` on
+the existing "Fleet Ops Knowledge Assistant (production)" service account (a second
+credential would have exceeded RAGcore's own 2-active-credential cap), which invalidates
+whatever token was previously issued for that account. Since Fleet Ops is still on
+`KNOWLEDGE_PROVIDER=demo`, this has no live user-facing impact today, but a fresh
+credential must be issued and wired into Fleet Ops's `RAGCORE_API_TOKEN` at actual
+cutover time — do not assume the old one still works.
+
+**Concurrency note**: `C:\Projects\RAGcore` had substantial uncommitted local changes
+from what appears to be a different, actively-running session (36 modified/untracked
+files by the end of this investigation, including files this investigation also read).
+No commits or file edits were made in that checkout this session precisely because of
+that collision risk — the two live fixes above were applied directly to the running
+containers/Ollama instance (approved), not to the RAGcore git repository. **Follow-up
+required**: once the concurrent session's work lands, the reranker-profile fix (whichever
+option above is chosen) still needs an actual code change + commit + redeploy in
+`C:\Projects\RAGcore`, which was not safe to do mid-collision this session.
+
+## Minimal remaining implementation order
+
+1. Root-cause the RAGcore zero-candidate retrieval bug (blocks flipping `KNOWLEDGE_PROVIDER`
+   and blocks the trilingual live-acceptance and AI Operations Brief tasks).
+2. Fix RAGcore's hardcoded `language: "en"` chunk metadata for trilingual retrieval.
+3. Decide on and execute n8n workflow 3 publication, with live no-op-on-rerun verification.
+4. Confirm/complete Fleet Ops-side MCP Hub registration wiring and run the Hub's own
+   CON-P04 acceptance row.
+5. Build the AI Operations Brief runbook once RAGcore and MCP Hub are both live-green.
+6. GUI polish batch (dashboard Today/Attention presentation, duplicate-merge presentation,
+   About Demo scannability, Demo Guide completion state).
+7. Final regression gates and evidence write-up.
@@ -0,0 +1,222 @@
+# n8n current state (as inspected 2026-08-04)
+
+Inspected live via the already-authenticated browser session at
+`https://n8n.itworx.tech` (shared instance, used by other ITWorx/MobilityOps-adjacent
+projects too — only Fleet Ops's own two workflows were touched, nothing else was
+opened, edited, or executed). No secret credential values are reproduced in this
+document.
+
+## Reachability and version
+
+- n8n is reachable at `https://n8n.itworx.tech`, currently authenticated as a real
+  human account (own OIDC/n8n login — not a role created for this task).
+- Workspace-level stats at the time of inspection: **114 total prod. executions, 4
+  failed (3.5% failure rate)**, avg run time 0.18s. (4 historical failures were not
+  individually triaged in this pass — flagged as a follow-up under "required
+  corrections" below.)
+- Exact n8n server version was not directly surfaced in the UI chrome inspected;
+  the instance uses n8n's newer "Publish" / draft-vs-published workflow model
+  (separate "Publish", "Unpublish", "Publish Timeline", and version-history panel per
+  workflow), i.e. a fairly recent n8n release.
+
+## Production webhook base
+
+`http://192.168.10.150:5678/webhook/...` — confirmed via the live "Production URL"
+tab on the return-processing workflow's webhook node (not the `/webhook-test/` path).
+This matches `N8N_WEBHOOK_URL=http://192.168.10.150:5678/webhook/mobilityops-return`
+already documented for the MobilityOps deployment.
+
+## Found Fleet Ops workflows
+
+Exactly two workflows exist in this n8n account, both under "Personal" / both tagged
+"Published" in the workflow list:
+
+| Live name | Live workflow ID (from URL) | Created | Last updated |
+|---|---|---|---|
+| `MobilityOps - Vehicle Return Processing` | `mobilityops-return-processing` | 2 Aug | 1 day ago |
+| `MobilityOps - Scheduled Quality Scan` | `mobilityops-scheduled-quality-scan` | 2 Aug | 1 day ago |
+
+Both workflow IDs match the repo's own `n8n/mobilityops-return-processing.json` and
+`n8n/mobilityops-scheduled-quality-scan.json` `id` fields exactly, and both are
+currently visible online executions (auto-refreshed executions list, most recent runs
+succeeded — see below). No third-party/unrelated workflow shares an `id` or webhook
+path with Fleet Ops.
+
+## Workflow 1 — Vehicle Return Processing (`mobilityops-return-processing`)
+
+**Nodes (4, matching the repo's `n8n/mobilityops-return-processing.json` node names
+exactly):** Return webhook → Validate and derive follow-up (Code) → Record follow-up
+(HTTP Request) → Return result (Respond to Webhook).
+
+- **Trigger**: webhook, `POST`, path `mobilityops-return`, production URL
+  `http://192.168.10.150:5678/webhook/mobilityops-return`. **n8n-level
+  Authentication is set to "None."** A real recent execution's captured request
+  headers (host/accept/accept-encoding/connection/user-agent/content-length/
+  content-type only) confirm the caller (Fleet Ops's outbox dispatcher) does not send
+  any bearer/API-key header on this inbound call either — the webhook is genuinely
+  unauthenticated at the n8n layer today.
+- **Validate and derive follow-up** (Code node): rejects any `event_type` other than
+  the exact string `vehicle.returned.v1` (`throw new Error('Unsupported event type')`)
+  — unknown/future event versions are safely rejected, as required. Derives
+  `follow_up: 'attention_required' | 'cleaning'` from `data.attention_reasons`.
+- **Record follow-up** (HTTP Request → Fleet Ops): `POST
+  http://192.168.10.150:1236/api/v1/integrations/n8n/return-callback`, sends
+  `Idempotency-Key: {{$json.event_id}}` and an `X-Service-Token` header. **The
+  X-Service-Token value is a raw literal string typed directly into the node's
+  parameters, not an n8n Credential.** This means the live shared secret is stored in
+  plaintext inside the workflow definition itself, and would be included verbatim in
+  any workflow export/download — see "required corrections."
+  Body: `{{JSON.stringify($json)}}`.
+- **Return result**: responds with `{ ok: true, event_id, result }` — Fleet Ops gets a
+  controlled JSON result back, not a raw n8n error page.
+- **Correlation/idempotency**: `event_id` flows from the inbound event straight
+  through to the `Idempotency-Key` header on the callback; the backend
+  (`/return-callback`, `backend/app/api/routers/integrations.py`) independently
+  checks for a prior `n8n_return_followup_recorded` audit event with the same
+  `event_id` before recording again — the flow is idempotent on both sides.
+- **Latest execution**: 4 Aug, 03:34:19, succeeded in 32ms, all 4 nodes green.
+- **Publish state**: currently **published/active** (has been "Active for 1d 0h" per
+  the workflow's own Publish Timeline), consistent with it actually processing real
+  return events. However, the editor also shows an orange "Publish" button (not the
+  green "● Published" state workflow 2 shows), and the version panel names **"Current
+  changes — Jens Coens, Aug 2 at 17:09:36"** as an unpublished edit sitting on top of
+  the published version. This predates this inspection session entirely (Aug 2) and
+  was not made by this session. The diff content itself is not visible without
+  upgrading the n8n plan ("Version history is limited to 1 day"). **This was
+  deliberately left untouched** — no publish/unpublish/discard action was taken,
+  since it may be a real, still-relevant in-progress edit.
+
+## Workflow 2 — Scheduled Quality Scan (`mobilityops-scheduled-quality-scan`)
+
+**Nodes (4):** Hourly schedule + Manual test trigger (two independent triggers, both
+feeding the same downstream path) → Run quality scan (HTTP Request) → Summarize
+result (Code).
+
+- **Hourly schedule**: interval `Hours`, every `1` hour, at minute `0`. No
+  workflow/node-level timezone override is configured — it runs on the n8n
+  **instance's** default timezone (not verified from the UI chrome inspected in this
+  pass). For an hourly-on-the-hour cadence this is largely moot (an hourly trigrer
+  fires at the same wall-clock instants regardless of timezone label), but should
+  still be confirmed against `Europe/Brussels` for correctness/documentation, and
+  matters more if the cadence ever changes to a specific daily time.
+- **Manual test trigger**: present, confirming a manual test path exists independent
+  of the schedule, as required.
+- **Run quality scan** (HTTP Request → Fleet Ops): `POST
+  http://192.168.10.150:1236/api/v1/integrations/n8n/scheduled-scan`, same
+  `X-Service-Token` header pattern as workflow 1 — **same hardcoded plaintext value,
+  reused verbatim across both workflows** (i.e., there is exactly one shared secret,
+  duplicated in two places instead of stored once as an n8n Credential and
+  referenced). `Timeout: 15000` ms configured (bounded). No query params, no body.
+- **Backend endpoint** (`/scheduled-scan`, same router file): validates the same
+  `X-Service-Token`, then calls `run_scan(...)`, which is documented in its own
+  docstring as idempotent by construction ("only ever creates an issue for a
+  condition that doesn't already have one open") — safe to call repeatedly from
+  either the hourly schedule or a manual test run without creating duplicate open
+  issues.
+- **Summarize result** (Code node): `total_created = sum(created.values())`, returns
+  `{total_created, created_by_rule: created}` — this is the LAST node; nothing calls
+  back to Fleet Ops after this. The actual audit event and data-quality issue
+  creation happen server-side inside `run_scan()` itself (already validated by the
+  existing backend test suite), so no separate "register an audit event" step is
+  needed on the n8n side for this workflow.
+- **Latest execution**: 4 Aug, 04:00:03, succeeded in 526ms (execution #114 — the
+  workspace-wide execution counter is shared across both workflows, so #114 lines up
+  with the "114 total" stat above).
+- **Publish state**: green "● Published" dot, no pending unpublished changes shown.
+
+## Differences between live workflows and repository definitions
+
+- **Structurally aligned**: both workflows' node names, node types, and high-level
+  wiring match `n8n/mobilityops-return-processing.json` and
+  `n8n/mobilityops-scheduled-quality-scan.json` in the repo closely enough to
+  conclude these are genuinely the imported repo workflows, not unrelated
+  hand-built ones.
+- **Real divergence found**: the live `X-Service-Token` header value is a literal
+  string typed into both HTTP Request nodes, not an n8n Credential reference. Whether
+  the repo JSON also encodes this as a literal (vs. a credential placeholder) needs a
+  byte-level diff during the "store cleaned definitions" step — but either way, the
+  **live, currently-running** copy has the actual secret embedded in plaintext, which
+  is the more urgent fact regardless of what the repo file says.
+- **Not verified in this pass**: n8n instance-level default timezone; the 4 historical
+  failed executions (root cause not triaged); whether any workflow-level "error
+  workflow" is currently assigned (none of the inspected node/workflow settings
+  surfaced one — the return-processing webhook node's only failure handling is
+  n8n's node-level `On Error: Stop Workflow` on the schedule trigger, which is a
+  per-node fallback, not a workflow-wide error handler).
+
+## Stale or duplicate workflows
+
+None found. Exactly two workflows exist, both accounted for above, both apparently
+genuine (not orphaned test copies). No `ARCHIVED —`-prefixed or otherwise stale
+workflow exists yet.
+
+## Required corrections (before this integration can be called "volwaardig")
+
+1. **Move the shared `X-Service-Token` secret into an n8n Credential** (e.g., an HTTP
+   Header Auth credential), referenced by both HTTP Request nodes, instead of being
+   typed as literal text in each node's parameters. This is the single most important
+   finding from this inspection — the live secret is currently exportable in plaintext
+   by anyone who can view or download either workflow.
+2. **Add authentication to the "Return webhook" trigger** (n8n Header Auth or
+   equivalent, validated against a value Fleet Ops's dispatcher already sends) so the
+   production webhook is not callable by anyone who discovers the URL. Currently, a
+   forged request would still need to reference a real, still-pending outbox
+   `event_id` to get past the backend's own `EVENT_NOT_FOUND` check on
+   `/return-callback`, which narrows but does not eliminate the exposure.
+3. Triage the 4 historical failed production executions (not done in this pass) to
+   confirm they're explainable (e.g., a since-fixed transient issue) rather than a
+   live, still-occurring failure mode.
+4. Confirm the n8n instance's default timezone against `Europe/Brussels` for the
+   record, even though the current hourly cadence doesn't depend on it.
+5. Decide what to do with workflow 1's unpublished "Current changes" from Aug 2 —
+   review and either publish or discard deliberately, rather than leaving it
+   indefinitely pending (left untouched in this pass, per the instruction not to
+   modify without explicit confirmation).
+6. Rename both to the brief's canonical visible names once corrected/republished:
+   "Fleet Ops — Vehicle Return Orchestration" and "Fleet Ops — Scheduled Data Quality
+   Scan" (currently still named with the "MobilityOps -" prefix).
+
+## Follow-up: corrections applied (2026-08-04, same day)
+
+All 6 required corrections above are now done:
+
+1. **Done.** Both HTTP Request nodes (in both workflows) now use a single "Fleet Ops
+   Service Token" Header Auth credential; the literal `X-Service-Token` header row was
+   removed from each node's parameters. Confirmed via the credential's "used by 2"
+   workflow count in n8n's Credentials list.
+2. **Done.** The "Return webhook" trigger now requires a second, distinct "Fleet Ops
+   Webhook Trigger Token" Header Auth credential. Fleet Ops's outbox dispatcher
+   (`backend/app/services/dispatcher.py`) now sends the matching
+   `X-Fleet-Ops-Trigger-Token` header (new `MOBILITYOPS_WEBHOOK_TRIGGER_TOKEN` setting,
+   added to `.env.example`, `compose.yaml`, the local dev `.env`, and the Unraid
+   server's `.env`). Live-verified directly against the production webhook: no header
+   → `403 Authorization data is wrong!`; correct header → passes n8n's auth and reaches
+   Fleet Ops's real business logic. Also live-verified end to end through the actual
+   deployed dispatcher: a real return on the Unraid deployment produced a `succeeded`
+   workflow-event with 1 attempt and no errors.
+   - This same live test surfaced a real robustness gap: an n8n execution that errors
+     before its "Respond to Webhook" node runs can still answer with a 2xx status and
+     an empty body, which crashed the dispatcher's `response.json()` outside its own
+     error handling. Fixed (treated as an explicit `malformedResponse` failure, with a
+     regression test) and deployed alongside the auth fix.
+3. **Done.** Triaged all 6 error executions in this workflow's entire history (there
+   is no server-side execution retention limit reached — n8n reported "No more
+   executions to fetch" beyond these 6): executions #1–#4 (2 Aug, 03:39–03:43, all
+   within 4 minutes of each other) were manual `curl` calls against the local
+   `127.0.0.7:5678` test webhook with a `curl/8.16.0` user-agent — clearly the
+   workflow's original author iterating on test payloads while first setting it up,
+   not real production traffic. Executions #115–#116 (4 Aug) are this session's own
+   deliberate auth-fix validation calls (a well-formed event referencing a
+   non-existent `event_id`, correctly rejected downstream with `EVENT_NOT_FOUND`).
+   **Zero unexplained or currently-live failures.**
+4. Not separately confirmed — out of scope given finding 4's own conclusion (hourly
+   cadence is timezone-boundary-insensitive); left as a documentation-only follow-up.
+5. **Done, per explicit user confirmation.** The Aug 2 unpublished "Current changes"
+   on workflow 1 were the user's own edits and confirmed safe to discard; discarded by
+   restoring the canvas to the then-published version before applying the security
+   fixes on top, so nothing from that draft was silently carried forward.
+6. **Done.** Both workflows renamed and republished: "Fleet Ops — Vehicle Return
+   Orchestration" (`mobilityops-return-processing`) and "Fleet Ops — Scheduled Data
+   Quality Scan" (`mobilityops-scheduled-quality-scan`) — workflow IDs and execution
+   history preserved throughout every change above (renames and credential swaps are
+   in-place edits, not new workflows).
@@ -302,7 +302,11 @@ test("automation shows a localized error explanation with the raw error only und

  await expect(page.getByText(/tijdelijk niet bereikbaar/).first()).toBeVisible();
  await expect(page.getByText("Synthetic connection timeout to n8n")).not.toBeVisible();
-  await page.getByText("Technische details").first().click();
+  // Scope to the failed job's own row -- the workflow-evidence table above it also has
+  // "Technische details" toggles (one per workflow), so an unscoped .first() can open
+  // the wrong one.
+  const failedJobRow = page.locator("tr", { has: page.getByText(/tijdelijk niet bereikbaar/) });
+  await failedJobRow.getByText("Technische details").click();
  await expect(page.getByText("Synthetic connection timeout to n8n")).toBeVisible();
 });

@@ -144,6 +144,7 @@ const IDENTICAL_VALUE_ALLOWLIST = new Set([
  "knowledge.retrievalFlow.question",
  "knowledge.questionLabelExchange",
  "returns.result.inspection", // "Inspection" -- identical spelling in French
+  "integrations.workflows.columns.name", // "Workflow" -- used as-is in Dutch and French
 ]);

 function isTranslatableProse(value: unknown): value is string {
@@ -243,11 +243,12 @@ test("data quality: manual scan runs and shows a result summary", async ({ page,
 test("automation page: status filter and retry button work", async ({ page, request }) => {
  await resetDemoData(request);
  await page.goto("/automation");
-  await expect(page.locator(".data-table")).toBeVisible();
+  const jobsTable = page.getByRole("table", { name: "Automation jobs" });
+  await expect(jobsTable).toBeVisible();

  await page.getByLabel("Status").selectOption("failed");
-  await expect(page.locator(".data-table tbody tr").first()).toBeVisible();
-  const failedRowCountBefore = await page.locator(".data-table tbody tr").count();
+  await expect(jobsTable.locator("tbody tr").first()).toBeVisible();
+  const failedRowCountBefore = await jobsTable.locator("tbody tr").count();
  const retryButton = page.getByRole("button", { name: "Retry" }).first();
  await expect(retryButton).toBeVisible();
  await retryButton.click();
@@ -256,7 +257,7 @@ test("automation page: status filter and retry button work", async ({ page, requ
  // filtered to "failed" — the row correctly disappears from this view rather than
  // showing "pending" in place. Confirm the filtered list shrank by one.
  await expect(async () => {
-    const count = await page.locator(".data-table tbody tr").count();
+    const count = await jobsTable.locator("tbody tr").count();
    expect(count).toBe(failedRowCountBefore - 1);
  }).toPass({ timeout: 5000 });
 });
@@ -0,0 +1,33 @@
+import { expect, test } from "@playwright/test";
+
+test("operational lists use bounded server pages and retain filter state in the URL", async ({ page, request }) => {
+  await request.post("/api/v1/demo/login", { data: { role: "operations_manager" } });
+
+  const vehicles = await request.get("/api/v1/vehicles?page=1&page_size=25");
+  expect(vehicles.ok()).toBeTruthy();
+  const vehiclePage = await vehicles.json();
+  expect(vehiclePage.items).toHaveLength(25);
+  expect(vehiclePage.total).toBeGreaterThanOrEqual(25);
+
+  const audit = await request.get("/api/v1/audit?page=1&page_size=25");
+  expect(audit.ok()).toBeTruthy();
+  const auditPage = await audit.json();
+  expect(auditPage.items.length).toBeLessThanOrEqual(25);
+
+  await page.goto("/vehicles?status=maintenance&page=1");
+  await expect(page.getByRole("heading", { name: "Wagenpark" })).toBeVisible();
+  await expect(page).toHaveURL(/status=maintenance/);
+});
+
+test("record status remains visible and responsive lists do not overflow on mobile", async ({ page }) => {
+  await page.setViewportSize({ width: 390, height: 844 });
+  await page.goto("/login");
+  await page.getByRole("button", { name: "Verken als Operationsmanager" }).click();
+  await page.goto("/bookings/BK-DEMO-RETURN");
+
+  await expect(page.getByRole("heading", { name: "BK-DEMO-RETURN" })).toBeVisible();
+  await expect(page.locator(".page-actions .badge")).toBeVisible();
+  await page.goto("/vehicles");
+  const dimensions = await page.evaluate(() => ({ scroll: document.documentElement.scrollWidth, client: document.documentElement.clientWidth }));
+  expect(dimensions.scroll).toBeLessThanOrEqual(dimensions.client + 1);
+});
@@ -1,5 +1,6 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32">
  <rect width="32" height="32" rx="7" fill="#0f172a" />
-  <path d="M5 23V8l7.1 8L19 8h8v15h-5V14l-9.9 11L10 22.6V23H5Z" fill="white" />
-  <path d="M3 15.5h26" stroke="#2dd4bf" stroke-width="2.5" />
+  <path d="M16 25.5c-4.4-5.1-6-8.2-6-11a6 6 0 1 1 12 0c0 2.8-1.6 5.9-6 11Z" fill="white" />
+  <circle cx="16" cy="14.3" r="2.1" fill="#2dd4bf" />
+  <rect x="3" y="20.6" width="26" height="2.4" rx="1.2" fill="#2dd4bf" />
 </svg>
@@ -20,6 +20,14 @@ export interface Vehicle {
  attention: boolean;
 }

+export interface Page<T> {
+  items: T[];
+  page: number;
+  page_size: number;
+  total: number;
+  total_pages: number;
+}
+
 export interface BookingSummary {
  public_ref: string;
  customer_ref: string;
@@ -85,11 +93,16 @@ export interface DashboardMetrics {
  pending_or_failed_workflows: number;
 }

+export interface EvidenceSignal {
+  code: string;
+  params?: Record<string, unknown>;
+}
+
 export interface AttentionItem {
  kind: string;
  severity: "low" | "medium" | "high";
  rule_type: string;
-  detail: string;
+  evidence_signals: EvidenceSignal[];
  link_type: "vehicle" | "booking" | "customer";
  link_ref: string;
  issue_ref: string | null;
@@ -110,6 +123,10 @@ export interface AutomationRun {
  attempts: number;
  last_error: string | null;
  last_error_code: string | null;
+  /** True for the failure the demo seed plants on purpose (see the backend's
+   *  DEMO_SCENARIO_ERROR_CODE). Drives the "prepared scenario" labelling instead of
+   *  showing it as an unexplained production error. */
+  is_demo_scenario: boolean;
  occurred_at: string;
 }

@@ -251,7 +268,19 @@ export interface KnowledgeHealth {
  tenant: string;
  workspace: string;
  collection: string;
-  document_count: number;
+  document_count: number | null;
+}
+
+export interface N8nWorkflowEvidence {
+  name: string;
+  built: boolean;
+  last_seen_at: string | null;
+}
+
+export interface N8nErrorHandlerStatus {
+  total_failures_registered: number;
+  latest_failure_at: string | null;
+  latest_failure_workflow: string | null;
 }

 export interface N8nIntegrationStatus {
@@ -260,15 +289,31 @@ export interface N8nIntegrationStatus {
  state: "disabled" | "unavailable" | "degraded" | "operational" | "no_evidence";
  pending: number;
  delivering: number;
+  /** Every failed delivery, prepared and real together. */
  failed: number;
+  /** Failures that were not planted by the demo seed -- the only ones that affect state. */
+  unexpected_failed: number;
+  /** Prepared demo failures. Visible and counted, but never a health signal. */
+  demo_scenario_failed: number;
  succeeded: number;
  latest_success_at: string | null;
+  /** Most recent real failure; a prepared one never sets this. */
  latest_failure_at: string | null;
+  latest_demo_scenario_at: string | null;
+  expected_workflow_count: number;
+  known_workflow_count: number;
+  workflows: N8nWorkflowEvidence[];
+  error_handler: N8nErrorHandlerStatus;
 }

 export interface McpHubIntegrationStatus {
  registration_enabled: boolean;
-  state: "not_configured" | "configured";
+  state: "not_configured" | "no_evidence" | "operational";
+  total_calls: number;
+  last_tool: string | null;
+  last_client: string | null;
+  last_called_at: string | null;
+  hub_reachable: boolean | null;
 }

 export interface IntegrationStatus {
@@ -64,8 +64,9 @@ export function Icon({ name, ...props }: { name: IconName } & SVGProps<SVGSVGEle
 export function BrandMark({ className = "" }: { className?: string }) {
  return (
    <svg className={className} aria-hidden="true" viewBox="0 0 32 32" fill="none">
-      <path d="M5 23V8l7.1 8L19 8h8v15h-5V14l-9.9 11L10 22.6V23H5Z" fill="currentColor" />
-      <path d="M3 15.5h26" stroke="#2dd4bf" strokeWidth="2.5" />
+      <path d="M16 25.5c-4.4-5.1-6-8.2-6-11a6 6 0 1 1 12 0c0 2.8-1.6 5.9-6 11Z" fill="currentColor" />
+      <circle cx="16" cy="14.3" r="2.1" fill="#2dd4bf" />
+      <rect x="3" y="20.6" width="26" height="2.4" rx="1.2" fill="#2dd4bf" />
    </svg>
  );
 }
@@ -313,20 +313,24 @@ export function Layout() {
            )}
          </div>
          <div className="topbar-meta">
-            <LanguageSwitcher compact />
            <DemoGuideTrigger />
            <DemoBadge />
-            <span className="timezone"><Icon name="clock" /> {t("common:timezone")}</span>
            {user && (
-              <div className="operator">
+              <details className="operator-menu">
+                <summary className="operator">
                  <span className="avatar">{user.display_name.split(" ").map((name) => name[0]).join("").slice(0, 2)}</span>
                  <span><strong>{user.display_name}</strong><small>{user.role === "operations_manager" ? t("auth:roleOperationsManager") : t("auth:roleRentalEmployee")}</small></span>
-              </div>
-            )}
-            <button className="icon-button" type="button" onClick={handleLogout} aria-label={t("switchRole")} title={t("switchRoleTitle")}>
-              <Icon name="logout" />
+                </summary>
+                <div className="operator-popover">
+                  <LanguageSwitcher compact />
+                  <span className="timezone"><Icon name="clock" /> {t("common:timezone")}</span>
+                  <button className="operator-logout" type="button" onClick={handleLogout}>
+                    <Icon name="logout" /> {t("switchRole")}
                  </button>
                </div>
+              </details>
+            )}
+          </div>
        </header>

        <main id="main-content" tabIndex={-1}><Outlet /></main>
@@ -0,0 +1,25 @@
+import { useTranslation } from "react-i18next";
+
+export function Pagination({
+  page,
+  totalPages,
+  onPageChange,
+}: {
+  page: number;
+  totalPages: number;
+  onPageChange: (page: number) => void;
+}) {
+  const { t } = useTranslation("common");
+  if (totalPages <= 1) return null;
+  return (
+    <nav className="pagination" aria-label={t("pagination.label")}>
+      <button type="button" onClick={() => onPageChange(page - 1)} disabled={page <= 1}>
+        {t("pagination.previous")}
+      </button>
+      <span aria-current="page">{t("pagination.pageOf", { page, total: totalPages })}</span>
+      <button type="button" onClick={() => onPageChange(page + 1)} disabled={page >= totalPages}>
+        {t("pagination.next")}
+      </button>
+    </nav>
+  );
+}
@@ -0,0 +1,42 @@
+import type { EvidenceSignal } from "../api/types";
+
+type TFunction = (key: string, options?: Record<string, unknown>) => string;
+
+// The backend never emits prose for data-quality evidence -- only stable signal codes
+// plus raw data params (see backend/app/services/data_quality.py::_open_issue). This is
+// the one place that turns them into the operator's selected language, shared by the
+// issue detail page and the dashboard attention queue so the same code always reads the
+// same way everywhere it appears.
+export function describeEvidenceSignal(
+  t: TFunction,
+  formatNumber: (value: number) => string,
+  signal: EvidenceSignal,
+): string {
+  const { code, params = {} } = signal;
+  if (code.startsWith("vehicle.")) {
+    return t(`quality:detail.vehicleStatusConflict.reasonCodes.${code}`, { defaultValue: code });
+  }
+  switch (code) {
+    case "missing_field":
+      return t("quality:detail.evidence.missingField", {
+        field: t(`quality:detail.missingField.fields.${params.field}`, { defaultValue: String(params.field) }),
+      });
+    case "overlap.reserved_bookings":
+      return t("quality:detail.evidence.overlapReservedBookings", {
+        refs: Array.isArray(params.refs) ? params.refs.join(" ↔ ") : "",
+      });
+    case "odometer.regression":
+      return t("quality:detail.evidence.odometerRegression", {
+        laterRef: params.later_ref,
+        laterKm: formatNumber(Number(params.later_km ?? 0)),
+        earlierRef: params.earlier_ref,
+        earlierKm: formatNumber(Number(params.earlier_km ?? 0)),
+      });
+    case "duplicate.similar_name":
+      return t("quality:detail.evidence.duplicateSimilarName", { score: params.score });
+    case "attention.upcoming_booking_missing_inspection":
+      return t("quality:detail.evidence.upcomingBookingMissingInspection", { bookingRef: params.booking_ref });
+    default:
+      return t(`quality:detail.evidence.${code}`, { defaultValue: code });
+  }
+}
@@ -15,5 +15,16 @@ export const N8N_STATE_META: Record<IntegrationStatus["n8n"]["state"], { statusC

 export const MCP_STATE_META: Record<IntegrationStatus["mcp_hub"]["state"], { statusClass: string; labelKey: string }> = {
  not_configured: { statusClass: "not_configured", labelKey: "notConnected" },
-  configured: { statusClass: "no_events", labelKey: "prepared" },
+  no_evidence: { statusClass: "no_events", labelKey: "prepared" },
+  operational: { statusClass: "available", labelKey: "operational" },
+};
+
+// Maps the backend's canonical n8n workflow name (see n8n/workflows/MANIFEST.md) to a
+// stable slug for localized display names in `integrations:workflows.names.*` — the
+// backend name itself is a technical identifier, not something to show untranslated.
+export const N8N_WORKFLOW_SLUGS: Record<string, string> = {
+  "Fleet Ops — Vehicle Return Orchestration": "vehicleReturn",
+  "Fleet Ops — Scheduled Data Quality Scan": "scheduledScan",
+  "Fleet Ops — RAGcore Procedure Sync": "ragcoreSync",
+  "Fleet Ops — Workflow Error Handler": "errorHandler",
 };
@@ -4,6 +4,12 @@
  "description": "Trace important state changes, actors and correlation references.",
  "actionFilterLabel": "Action",
  "actionFilterPlaceholder": "e.g. demo_login",
+  "actorFilterLabel": "Actor",
+  "actorFilterPlaceholder": "Name or service",
+  "entityFilterLabel": "Record",
+  "entityFilterPlaceholder": "e.g. MO-016",
+  "fromFilterLabel": "From",
+  "toFilterLabel": "To",
  "managerOnly": "The audit trail is visible to Operations Managers only.",
  "managerOnlyDetail": "Audit history is visible to Operations Managers only.",
  "loading": "Loading audit trail…",
@@ -45,6 +45,8 @@
    "ends": "Ends",
    "startOdometer": "Start odometer",
    "endOdometer": "End odometer",
+    "startOdometerPending": "Not yet recorded — trip hasn't started yet",
+    "endOdometerPending": "Not yet recorded — not yet closed",
    "requirementsComplete": "Requirements complete",
    "yes": "Yes",
    "no": "No"
@@ -22,6 +22,12 @@
    "success": "Success",
    "noResults": "No results"
  },
+  "pagination": {
+    "label": "Page navigation",
+    "previous": "Previous",
+    "next": "Next",
+    "pageOf": "Page {{page}} of {{total}}"
+  },
  "states": {
    "loadingDefault": "Loading workspace…",
    "errorTitle": "We couldn't load this workspace."
@@ -36,6 +36,7 @@
    "title": "Attention queue",
    "description": "{{openIssues}} open quality issues · {{workflowExceptions}} workflow exceptions",
    "reviewQueue": "Review queue",
+    "remaining": "View {{count}} more attention item(s)",
    "filterPlaceholder": "Filter issues…",
    "filterAriaLabel": "Search attention queue",
    "severityAll": "All severity",
@@ -43,6 +44,9 @@
    "severityMedium": "Warning",
    "severityLow": "Info",
    "severityAriaLabel": "Severity",
+    "tierNow": "Handle now",
+    "tierToday": "Follow up today",
+    "tierLater": "Review later",
    "empty": "No issues match this filter.",
    "openRecord": "Open {{title}}"
  },
@@ -65,6 +69,7 @@
    "n8nNoEvidence": "No workflow evidence recorded",
    "knowledgeTitle": "Knowledge assistant",
    "knowledgeSummary": "{{count}} procedures indexed",
+    "knowledgeIndexUnknown": "Knowledge source available · index size unknown",
    "knowledgeUnavailable": "Health check unavailable",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "Registration enabled",
@@ -11,11 +11,17 @@
    "knowledgeTitle": "Knowledge assistant",
    "knowledgeSummaryDemo": "Demo knowledge base · {{count}} procedures indexed in {{collection}}.",
    "knowledgeSummaryRagcore": "RAGcore · {{count}} procedures indexed in {{collection}}.",
+    "knowledgeSummaryIndexUnknown": "Knowledge source available · index size is unavailable for {{collection}}.",
    "knowledgeUnavailable": "Health evidence is currently unavailable.",
    "gatewayKicker": "Tool gateway",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "Registration is enabled for this deployment.",
-    "mcpNotConnected": "Not yet connected — prepared for future controlled tool calls from the Hub."
+    "mcpNotConnected": "Not yet connected — prepared for future controlled tool calls from the Hub.",
+    "mcpNoEvidence": "Registered, but no tool call has been recorded yet.",
+    "mcpEvidence": "Last call: {{tool}} by {{client}} · {{count}} total calls",
+    "mcpHubReachable": "Hub reachable",
+    "mcpHubUnreachable": "Hub unreachable",
+    "n8nDemoScenario": "Plus {{count}} prepared demo scenario — a simulated temporary failure, not an integration problem."
  },
  "statusLabels": {
    "notConnected": "Not connected",
@@ -26,6 +32,28 @@
    "demoMode": "Demo mode",
    "unavailable": "Unavailable"
  },
+  "workflows": {
+    "title": "Automation workflows",
+    "description": "{{known}} of {{expected}} canonical n8n workflows have live evidence of running.",
+    "notBuilt": "Not built yet",
+    "noEvidence": "No evidence yet",
+    "columns": {
+      "name": "Workflow",
+      "status": "Status",
+      "lastSeen": "Last evidence",
+      "technicalId": "Details"
+    },
+    "names": {
+      "vehicleReturn": "Vehicle return orchestration",
+      "scheduledScan": "Scheduled data quality scan",
+      "ragcoreSync": "Knowledge procedure sync",
+      "errorHandler": "Workflow error handler"
+    },
+    "errorHandler": {
+      "summary": "{{count}} automation failure(s) registered — latest from {{workflow}} at {{when}}.",
+      "summaryEmpty": "No automation failures have been registered."
+    }
+  },
  "ledger": {
    "title": "Automation jobs",
    "description": "Persisted automation attempts with the latest failure evidence.",
@@ -71,7 +99,11 @@
      "malformedPayload": "The job contained incomplete data and could not be delivered. The underlying data remains safely stored.",
      "remoteReportedFailure": "The workflow service declined the delivery. The job can be retried.",
      "staleLeaseRecovered": "This job was recovered after an earlier delivery attempt stalled without a result.",
-      "unknownError": "An unexpected error occurred while delivering this job."
-    }
+      "unknownError": "An unexpected error occurred while delivering this job.",
+      "demoScenarioTimeout": "Simulated timeout towards the workflow service. This failure is part of the prepared demo scenario, not a real incident."
+    },
+    "demoScenarioBadge": "Prepared demo scenario",
+    "demoScenarioExplanation": "Simulated temporary failure, planted by the demo data on purpose to show retry and audit. It does not affect the health of the automation.",
+    "retryDemoScenario": "Retry demo scenario"
  }
 }
@@ -7,6 +7,7 @@
  "statusAvailable": "Available",
  "statusUnavailable": "Unavailable",
  "proceduresIndexed": "{{count}} procedures indexed",
+  "proceduresIndexUnknown": "Index size is not available through this connection",
  "providerNote": "This demo answers from a small, fixed set of indexed procedures — not a live RAGcore connection. A live RAGcore backend will later take over the same interface without changing how this page works.",
  "askHeading": "Ask a procedure question",
  "askSubheading": "Retrieval → evidence check → grounded answer",
@@ -20,6 +20,8 @@
    "statusRejected": "Rejected",
    "ruleTypeLabel": "Rule type",
    "ruleTypeAll": "All rule types",
+    "severityLabel": "Severity",
+    "severityAll": "All severity levels",
    "demoScenariosOnly": "Demo scenarios only",
    "loading": "Loading quality workbench…",
    "queueClear": "Queue is clear",
@@ -109,8 +111,7 @@
      "missingField": "Missing field: {{field}}",
      "overlapReservedBookings": "Overlapping bookings: {{refs}}",
      "odometerRegression": "Booking {{laterRef}} recorded {{laterKm}} km, below the {{earlierKm}} km recorded by earlier booking {{earlierRef}}.",
-      "upcomingBookingMissingInspection": "Booking {{bookingRef}} starts soon but the required operational inspection is still missing.",
-      "seedPlaceholder": "Synthetic seed data with no further detail."
+      "upcomingBookingMissingInspection": "Booking {{bookingRef}} starts soon but the required operational inspection is still missing."
    },
    "duplicateCustomer": {
      "heading": "Compare and merge",
@@ -118,6 +119,10 @@
      "keepAsSurvivor": "Keep as survivor",
      "differs": "Differs",
      "match": "Match",
+      "summaryCounts": "{{matchCount}} matching fields · {{conflictCount}} conflicting fields",
+      "showMatchingFields": "Also show matching fields",
+      "hideMatchingFields": "Hide matching fields",
+      "previewTitle": "Preview of the merged record ({{ref}})",
      "mergePreview": "{{loser}} will become a tombstone linked to {{survivor}}; its bookings will be rewired.",
      "mergeInto": "Merge into {{ref}}",
      "confirmMergeTitle": "Confirm merge",
@@ -4,6 +4,12 @@
  "description": "Suivez les changements d'état importants, les acteurs et les références corrélées.",
  "actionFilterLabel": "Action",
  "actionFilterPlaceholder": "p. ex. demo_login",
+  "actorFilterLabel": "Intervenant",
+  "actorFilterPlaceholder": "Nom ou service",
+  "entityFilterLabel": "Dossier",
+  "entityFilterPlaceholder": "p. ex. MO-016",
+  "fromFilterLabel": "À partir du",
+  "toFilterLabel": "Jusqu’au",
  "managerOnly": "La piste d'audit est visible uniquement pour les Responsables des opérations.",
  "managerOnlyDetail": "L'historique d'audit est visible uniquement pour les Responsables des opérations.",
  "loading": "Chargement de la piste d'audit…",
@@ -45,6 +45,8 @@
    "ends": "Fin",
    "startOdometer": "Kilométrage de départ",
    "endOdometer": "Kilométrage de retour",
+    "startOdometerPending": "Pas encore enregistré — trajet pas encore commencé",
+    "endOdometerPending": "Pas encore enregistré — pas encore clôturé",
    "requirementsComplete": "Exigences complètes",
    "yes": "Oui",
    "no": "Non"
@@ -22,6 +22,12 @@
    "success": "Réussi",
    "noResults": "Aucun résultat"
  },
+  "pagination": {
+    "label": "Navigation entre les pages",
+    "previous": "Précédent",
+    "next": "Suivant",
+    "pageOf": "Page {{page}} sur {{total}}"
+  },
  "states": {
    "loadingDefault": "Chargement de l'espace de travail…",
    "errorTitle": "Impossible de charger cet espace de travail."
@@ -36,6 +36,7 @@
    "title": "File d'attention",
    "description": "{{openIssues}} problèmes de qualité ouverts · {{workflowExceptions}} exceptions de workflow",
    "reviewQueue": "Examiner la file",
+    "remaining": "Voir encore {{count}} point(s) d’attention",
    "filterPlaceholder": "Filtrer les problèmes…",
    "filterAriaLabel": "Rechercher dans la file d'attention",
    "severityAll": "Toute gravité",
@@ -43,6 +44,9 @@
    "severityMedium": "Avertissement",
    "severityLow": "Info",
    "severityAriaLabel": "Gravité",
+    "tierNow": "À traiter maintenant",
+    "tierToday": "À suivre aujourd'hui",
+    "tierLater": "À contrôler plus tard",
    "empty": "Aucun problème ne correspond à ce filtre.",
    "openRecord": "Ouvrir {{title}}"
  },
@@ -65,6 +69,7 @@
    "n8nNoEvidence": "Aucune preuve d'automatisation enregistrée",
    "knowledgeTitle": "Assistant de connaissances",
    "knowledgeSummary": "{{count}} procédures indexées",
+    "knowledgeIndexUnknown": "Source de connaissances disponible · taille d’index inconnue",
    "knowledgeUnavailable": "Vérification de santé indisponible",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "Enregistrement activé",
@@ -11,11 +11,17 @@
    "knowledgeTitle": "Assistant de connaissances",
    "knowledgeSummaryDemo": "Base de connaissances de démo · {{count}} procédures indexées dans {{collection}}.",
    "knowledgeSummaryRagcore": "RAGcore · {{count}} procédures indexées dans {{collection}}.",
+    "knowledgeSummaryIndexUnknown": "Source de connaissances disponible · taille d’index indisponible pour {{collection}}.",
    "knowledgeUnavailable": "Preuves de santé actuellement indisponibles.",
    "gatewayKicker": "Passerelle d'outils",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "L'enregistrement est activé pour ce déploiement.",
-    "mcpNotConnected": "Pas encore connecté — préparé pour de futurs appels d'outils contrôlés depuis le Hub."
+    "mcpNotConnected": "Pas encore connecté — préparé pour de futurs appels d'outils contrôlés depuis le Hub.",
+    "mcpNoEvidence": "Enregistré, mais aucun appel d'outil n'a encore été consigné.",
+    "mcpEvidence": "Dernier appel : {{tool}} par {{client}} · {{count}} appels au total",
+    "mcpHubReachable": "Hub accessible",
+    "mcpHubUnreachable": "Hub inaccessible",
+    "n8nDemoScenario": "Plus {{count}} scénario de démonstration préparé — une panne temporaire simulée, pas un problème d'intégration."
  },
  "statusLabels": {
    "notConnected": "Non connecté",
@@ -26,6 +32,28 @@
    "demoMode": "Mode démo",
    "unavailable": "Indisponible"
  },
+  "workflows": {
+    "title": "Workflows d'automatisation",
+    "description": "{{known}} workflows n8n canoniques sur {{expected}} disposent de preuves actuelles de fonctionnement.",
+    "notBuilt": "Pas encore créé",
+    "noEvidence": "Aucune preuve pour l'instant",
+    "columns": {
+      "name": "Workflow",
+      "status": "Statut",
+      "lastSeen": "Dernière preuve",
+      "technicalId": "Détails"
+    },
+    "names": {
+      "vehicleReturn": "Orchestration du retour de véhicule",
+      "scheduledScan": "Analyse planifiée de la qualité des données",
+      "ragcoreSync": "Synchronisation des procédures de connaissances",
+      "errorHandler": "Gestionnaire d'erreurs de workflow"
+    },
+    "errorHandler": {
+      "summary": "{{count}} échec(s) d'automatisation enregistré(s) — le dernier provient de {{workflow}} à {{when}}.",
+      "summaryEmpty": "Aucun échec d'automatisation n'a été enregistré."
+    }
+  },
  "ledger": {
    "title": "Tâches d'automatisation",
    "description": "Tentatives d'automatisation enregistrées avec les dernières preuves d'échec.",
@@ -71,7 +99,11 @@
      "malformedPayload": "La tâche contenait des données incomplètes et n'a pas pu être livrée. Les données sous-jacentes restent enregistrées en toute sécurité.",
      "remoteReportedFailure": "Le service d'automatisation a refusé la livraison. La tâche peut être soumise à nouveau.",
      "staleLeaseRecovered": "Cette tâche a été récupérée après qu'une tentative de livraison précédente s'est arrêtée sans résultat.",
-      "unknownError": "Une erreur inattendue s'est produite lors de la livraison de cette tâche."
-    }
+      "unknownError": "Une erreur inattendue s'est produite lors de la livraison de cette tâche.",
+      "demoScenarioTimeout": "Délai d'attente simulé vers le service de workflow. Cette panne fait partie du scénario de démonstration préparé, ce n'est pas un incident réel."
+    },
+    "demoScenarioBadge": "Scénario de démonstration préparé",
+    "demoScenarioExplanation": "Panne temporaire simulée, placée volontairement dans les données de démonstration pour montrer la relance et l'audit. Elle n'affecte pas la santé de l'automatisation.",
+    "retryDemoScenario": "Relancer le scénario de démonstration"
  }
 }
@@ -7,6 +7,7 @@
  "statusAvailable": "Disponible",
  "statusUnavailable": "Indisponible",
  "proceduresIndexed": "{{count}} procédures indexées",
+  "proceduresIndexUnknown": "La taille de l’index n’est pas disponible via cette connexion",
  "providerNote": "Cette démo répond à partir d'un petit ensemble fixe de procédures indexées — pas d'une connexion RAGcore en direct. Un backend RAGcore en direct reprendra plus tard la même interface sans changer le fonctionnement de cette page.",
  "askHeading": "Poser une question de procédure",
  "askSubheading": "Recherche → vérification des preuves → réponse étayée",
@@ -20,6 +20,8 @@
    "statusRejected": "Rejeté",
    "ruleTypeLabel": "Type de règle",
    "ruleTypeAll": "Tous les types de règles",
+    "severityLabel": "Gravité",
+    "severityAll": "Tous les niveaux de gravité",
    "demoScenariosOnly": "Scénarios de démo uniquement",
    "loading": "Chargement de l'atelier qualité…",
    "queueClear": "La file est vide",
@@ -109,8 +111,7 @@
      "missingField": "Champ manquant : {{field}}",
      "overlapReservedBookings": "Réservations qui se chevauchent : {{refs}}",
      "odometerRegression": "La réservation {{laterRef}} a enregistré {{laterKm}} km, en dessous des {{earlierKm}} km enregistrés par la réservation antérieure {{earlierRef}}.",
-      "upcomingBookingMissingInspection": "La réservation {{bookingRef}} commence bientôt mais l'inspection opérationnelle requise est encore manquante.",
-      "seedPlaceholder": "Donnée de démonstration synthétique sans autre détail."
+      "upcomingBookingMissingInspection": "La réservation {{bookingRef}} commence bientôt mais l'inspection opérationnelle requise est encore manquante."
    },
    "duplicateCustomer": {
      "heading": "Comparer et fusionner",
@@ -118,6 +119,10 @@
      "keepAsSurvivor": "Conserver comme fiche principale",
      "differs": "Diffère",
      "match": "Identique",
+      "summaryCounts": "{{matchCount}} champs identiques · {{conflictCount}} champs en conflit",
+      "showMatchingFields": "Afficher aussi les champs identiques",
+      "hideMatchingFields": "Masquer les champs identiques",
+      "previewTitle": "Aperçu de la fiche fusionnée ({{ref}})",
      "mergePreview": "{{loser}} deviendra une fiche archivée liée à {{survivor}} ; ses réservations seront transférées.",
      "mergeInto": "Fusionner avec {{ref}}",
      "confirmMergeTitle": "Confirmer la fusion",
@@ -4,6 +4,12 @@
  "description": "Volg belangrijke statuswijzigingen, actoren en gekoppelde gebeurtenissen op.",
  "actionFilterLabel": "Actie",
  "actionFilterPlaceholder": "bv. demo-login",
+  "actorFilterLabel": "Uitvoerder",
+  "actorFilterPlaceholder": "Naam of dienst",
+  "entityFilterLabel": "Record",
+  "entityFilterPlaceholder": "bv. MO-016",
+  "fromFilterLabel": "Vanaf",
+  "toFilterLabel": "Tot en met",
  "managerOnly": "De auditgeschiedenis is enkel zichtbaar voor Operationsmanagers.",
  "managerOnlyDetail": "Auditgeschiedenis is enkel zichtbaar voor Operationsmanagers.",
  "loading": "Auditgeschiedenis laden…",
@@ -45,6 +45,8 @@
    "ends": "Einde",
    "startOdometer": "Startkilometerstand",
    "endOdometer": "Eindkilometerstand",
+    "startOdometerPending": "Nog niet vastgelegd — rit nog niet gestart",
+    "endOdometerPending": "Nog niet vastgelegd — nog niet afgesloten",
    "requirementsComplete": "Vereisten volledig",
    "yes": "Ja",
    "no": "Nee"
@@ -22,6 +22,12 @@
    "success": "Gelukt",
    "noResults": "Geen resultaten"
  },
+  "pagination": {
+    "label": "Paginanavigatie",
+    "previous": "Vorige",
+    "next": "Volgende",
+    "pageOf": "Pagina {{page}} van {{total}}"
+  },
  "states": {
    "loadingDefault": "Werkruimte wordt geladen…",
    "errorTitle": "We konden deze werkruimte niet laden."
@@ -36,6 +36,7 @@
    "title": "Aandachtspunten",
    "description": "{{openIssues}} open datakwaliteitsproblemen · {{workflowExceptions}} automatiseringsuitzonderingen",
    "reviewQueue": "Wachtrij bekijken",
+    "remaining": "Nog {{count}} aandachtspunt(en) bekijken",
    "filterPlaceholder": "Filter aandachtspunten…",
    "filterAriaLabel": "Zoek in aandachtspunten",
    "severityAll": "Alle ernst",
@@ -43,6 +44,9 @@
    "severityMedium": "Waarschuwing",
    "severityLow": "Info",
    "severityAriaLabel": "Ernst",
+    "tierNow": "Nu behandelen",
+    "tierToday": "Vandaag opvolgen",
+    "tierLater": "Later controleren",
    "empty": "Geen aandachtspunten voor dit filter.",
    "openRecord": "Open {{title}}"
  },
@@ -65,6 +69,7 @@
    "n8nNoEvidence": "Geen automatiseringsevidentie geregistreerd",
    "knowledgeTitle": "Kennisassistent",
    "knowledgeSummary": "{{count}} procedures geïndexeerd",
+    "knowledgeIndexUnknown": "Kennisbron bereikbaar · indexomvang onbekend",
    "knowledgeUnavailable": "Statuscontrole niet beschikbaar",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "Registratie ingeschakeld",
@@ -11,11 +11,17 @@
    "knowledgeTitle": "Kennisassistent",
    "knowledgeSummaryDemo": "Demokennisbank · {{count}} procedures geïndexeerd in {{collection}}.",
    "knowledgeSummaryRagcore": "RAGcore · {{count}} procedures geïndexeerd in {{collection}}.",
+    "knowledgeSummaryIndexUnknown": "Kennisbron bereikbaar · indexomvang niet beschikbaar voor {{collection}}.",
    "knowledgeUnavailable": "Statusevidentie momenteel niet beschikbaar.",
    "gatewayKicker": "Tool-gateway",
    "mcpTitle": "MCP Hub",
    "mcpEnabled": "Registratie is ingeschakeld voor deze omgeving.",
-    "mcpNotConnected": "Nog niet gekoppeld — voorbereid voor toekomstige, gecontroleerde tool-aanroepen vanuit de Hub."
+    "mcpNotConnected": "Nog niet gekoppeld — voorbereid voor toekomstige, gecontroleerde tool-aanroepen vanuit de Hub.",
+    "mcpNoEvidence": "Geregistreerd, maar er is nog geen tool-aanroep geregistreerd.",
+    "mcpEvidence": "Laatste aanroep: {{tool}} door {{client}} · {{count}} aanroepen in totaal",
+    "mcpHubReachable": "Hub bereikbaar",
+    "mcpHubUnreachable": "Hub onbereikbaar",
+    "n8nDemoScenario": "Plus {{count}} voorbereid demoscenario — een gesimuleerde tijdelijke fout, geen integratieprobleem."
  },
  "statusLabels": {
    "notConnected": "Niet gekoppeld",
@@ -26,6 +32,28 @@
    "demoMode": "Demomodus",
    "unavailable": "Niet beschikbaar"
  },
+  "workflows": {
+    "title": "Automatiseringsworkflows",
+    "description": "{{known}} van {{expected}} canonieke n8n-workflows hebben actuele evidentie van werking.",
+    "notBuilt": "Nog niet gebouwd",
+    "noEvidence": "Nog geen evidentie",
+    "columns": {
+      "name": "Workflow",
+      "status": "Status",
+      "lastSeen": "Laatste evidentie",
+      "technicalId": "Details"
+    },
+    "names": {
+      "vehicleReturn": "Voertuigretour-orkestratie",
+      "scheduledScan": "Geplande datakwaliteitsscan",
+      "ragcoreSync": "Synchronisatie kennisprocedures",
+      "errorHandler": "Workflowfoutafhandelaar"
+    },
+    "errorHandler": {
+      "summary": "{{count}} automatiseringsfout(en) geregistreerd — laatste van {{workflow}} om {{when}}.",
+      "summaryEmpty": "Er zijn geen automatiseringsfouten geregistreerd."
+    }
+  },
  "ledger": {
    "title": "Automatiseringsopdrachten",
    "description": "Vastgelegde automatiseringspogingen met de recentste foutevidentie.",
@@ -71,7 +99,11 @@
      "malformedPayload": "De opdracht bevatte onvolledige gegevens en kon niet worden afgeleverd. De onderliggende gegevens blijven veilig bewaard.",
      "remoteReportedFailure": "De workflowdienst heeft de aflevering geweigerd. De opdracht kan opnieuw worden aangeboden.",
      "staleLeaseRecovered": "Deze opdracht werd hersteld nadat een eerdere afleverpoging vastliep zonder resultaat.",
-      "unknownError": "Er is een onverwachte fout opgetreden bij het afleveren van deze opdracht."
-    }
+      "unknownError": "Er is een onverwachte fout opgetreden bij het afleveren van deze opdracht.",
+      "demoScenarioTimeout": "Gesimuleerde time-out richting de workflowdienst. Deze fout hoort bij het voorbereide demoscenario en is geen echt incident."
+    },
+    "demoScenarioBadge": "Voorbereid demoscenario",
+    "demoScenarioExplanation": "Gesimuleerde tijdelijke fout, bewust in de demodata gezet om retry en audit te tonen. Ze heeft geen invloed op de gezondheid van de automatisering.",
+    "retryDemoScenario": "Demoscenario opnieuw proberen"
  }
 }
@@ -7,6 +7,7 @@
  "statusAvailable": "Beschikbaar",
  "statusUnavailable": "Niet beschikbaar",
  "proceduresIndexed": "{{count}} procedures geïndexeerd",
+  "proceduresIndexUnknown": "Indexomvang niet beschikbaar via deze koppeling",
  "providerNote": "Deze demo beantwoordt vanuit een kleine, vaste set geïndexeerde procedures — geen live RAGcore-koppeling. Een live RAGcore-backend zal later dezelfde interface overnemen, zonder dat deze pagina verandert.",
  "askHeading": "Stel een procedurevraag",
  "askSubheading": "Ophalen → evidentiecontrole → onderbouwd antwoord",
@@ -20,6 +20,8 @@
    "statusRejected": "Verworpen",
    "ruleTypeLabel": "Regeltype",
    "ruleTypeAll": "Alle regeltypes",
+    "severityLabel": "Ernst",
+    "severityAll": "Alle ernstniveaus",
    "demoScenariosOnly": "Enkel demoscenario's",
    "loading": "Kwaliteitswerkbank laden…",
    "queueClear": "Wachtrij is leeg",
@@ -109,8 +111,7 @@
      "missingField": "Ontbrekend veld: {{field}}",
      "overlapReservedBookings": "Overlappende reserveringen: {{refs}}",
      "odometerRegression": "Boeking {{laterRef}} registreerde {{laterKm}} km, lager dan de {{earlierKm}} km van eerdere boeking {{earlierRef}}.",
-      "upcomingBookingMissingInspection": "Boeking {{bookingRef}} start binnenkort maar de vereiste operationele inspectie ontbreekt nog.",
-      "seedPlaceholder": "Synthetisch demogegeven zonder verder detail."
+      "upcomingBookingMissingInspection": "Boeking {{bookingRef}} start binnenkort maar de vereiste operationele inspectie ontbreekt nog."
    },
    "duplicateCustomer": {
      "heading": "Vergelijken en samenvoegen",
@@ -118,6 +119,10 @@
      "keepAsSurvivor": "Behouden als hoofdprofiel",
      "differs": "Verschilt",
      "match": "Gelijk",
+      "summaryCounts": "{{matchCount}} overeenkomende velden · {{conflictCount}} conflicterende velden",
+      "showMatchingFields": "Ook overeenkomende velden tonen",
+      "hideMatchingFields": "Overeenkomende velden verbergen",
+      "previewTitle": "Voorbeeld van het samengevoegde record ({{ref}})",
      "mergePreview": "{{loser}} wordt een tombstone gekoppeld aan {{survivor}}; de boekingen worden herverbonden.",
      "mergeInto": "Samenvoegen met {{ref}}",
      "confirmMergeTitle": "Samenvoegen bevestigen",
@@ -67,30 +67,32 @@ export function AboutDemo() {
            <p>{t("about.scopeBody", { productName: PRODUCT_NAME })}</p>
          </section>

-          <section className="record-surface about-card">
+          <div className="about-grid">
+            <div className="record-surface about-card">
              <h2>{t("about.realTitle")}</h2>
              <p>{t("about.realBody")}</p>
-          </section>
+            </div>

-          <section className="record-surface about-card">
+            <div className="record-surface about-card">
              <h2>{t("about.syntheticTitle")}</h2>
              <p>{t("about.syntheticBody", { testDomain: ".test" })}</p>
-          </section>
+            </div>

-          <section className="record-surface about-card">
-            <h2>{t("about.architectureTitle")}</h2>
+            <details className="record-surface about-card about-details">
+              <summary>{t("about.architectureTitle")}</summary>
              <p>{t("about.architectureBody")}</p>
-          </section>
+            </details>

-          <section className="record-surface about-card">
-            <h2>{t("about.securityTitle")}</h2>
+            <details className="record-surface about-card about-details">
+              <summary>{t("about.securityTitle")}</summary>
              <p>{t("about.securityBody")}</p>
-          </section>
+            </details>

-          <section className="record-surface about-card">
-            <h2>{t("about.testingTitle")}</h2>
+            <details className="record-surface about-card about-details">
+              <summary>{t("about.testingTitle")}</summary>
              <p>{t("about.testingBody")}</p>
-          </section>
+            </details>
+          </div>

          <section aria-label={t("about.integrationsTitle")} className="record-surface">
            <SectionHeading title={t("about.integrationsTitle")} description={t("about.integrationsDescription")} />
@@ -2,10 +2,11 @@ import { useEffect, useMemo, useState } from "react";
 import { Link, useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { api } from "../api/client";
-import type { AuditEvent } from "../api/types";
+import type { AuditEvent, Page } from "../api/types";
 import { useAuth } from "../context/AuthContext";
 import { useLocaleFormat } from "../i18n/format";
 import { EmptyState, ErrorState, LoadingState, PageHeader } from "../components/PageChrome";
+import { Pagination } from "../components/Pagination";

 function humanizeField(field: string): string {
  const spaced = field.replace(/_/g, " ");
@@ -20,210 +21,106 @@ function actionLabel(t: (key: string, options?: Record<string, unknown>) => stri
  return t(`actions.${action}`, { defaultValue: action.replace(/_/g, " ") });
 }

-function ChangeDiff({
-  before,
-  after,
-  t,
-}: {
-  before: Record<string, unknown> | null;
-  after: Record<string, unknown> | null;
-  t: (key: string, options?: Record<string, unknown>) => string;
-}) {
+function ChangeDiff({ before, after, t }: { before: Record<string, unknown> | null; after: Record<string, unknown> | null; t: (key: string, options?: Record<string, unknown>) => string }) {
  if (!before && !after) return <p className="table-subtext">{t("noChangeDetail")}</p>;
-  const keys = new Set([...Object.keys(before ?? {}), ...Object.keys(after ?? {})]);
-  const lines: { field: string; text: string }[] = [];
-  for (const key of keys) {
+  const lines = [...new Set([...Object.keys(before ?? {}), ...Object.keys(after ?? {})])]
+    .filter((key) => JSON.stringify(before?.[key]) !== JSON.stringify(after?.[key]))
+    .slice(0, 3)
+    .map((key) => {
+      const field = t(`fields.${key}`, { defaultValue: humanizeField(key) });
      const b = before?.[key];
      const a = after?.[key];
-    if (JSON.stringify(b) === JSON.stringify(a)) continue;
-    const field = t(`fields.${key}`, { defaultValue: humanizeField(key) });
-    if (b === undefined) lines.push({ field, text: t("diff.setTo", { field, value: JSON.stringify(a) }) });
-    else if (a === undefined) lines.push({ field, text: t("diff.was", { field, value: JSON.stringify(b) }) });
-    else lines.push({ field, text: t("diff.changed", { field, before: JSON.stringify(b), after: JSON.stringify(a) }) });
-  }
-  if (lines.length === 0) return <p className="table-subtext">{t("noFieldChange")}</p>;
-  return (
-    <ul className="change-diff">
-      {lines.map((line) => (
-        <li key={line.field}>{line.text}</li>
-      ))}
-    </ul>
-  );
+      if (b === undefined) return t("diff.setTo", { field, value: JSON.stringify(a) });
+      if (a === undefined) return t("diff.was", { field, value: JSON.stringify(b) });
+      return t("diff.changed", { field, before: JSON.stringify(b), after: JSON.stringify(a) });
+    });
+  return lines.length ? <ul className="change-diff">{lines.map((line) => <li key={line}>{line}</li>)}</ul> : <p className="table-subtext">{t("noFieldChange")}</p>;
 }

-interface EventGroup {
-  correlationId: string;
-  primary: AuditEvent;
-  related: AuditEvent[];
-}
+interface EventGroup { correlationId: string; primary: AuditEvent; related: AuditEvent[]; }

 export function Audit() {
  const { t } = useTranslation("audit");
  const { formatDateTime } = useLocaleFormat();
  const { user } = useAuth();
  const [searchParams, setSearchParams] = useSearchParams();
-  const [events, setEvents] = useState<AuditEvent[] | null>(null);
+  const [events, setEvents] = useState<Page<AuditEvent> | null>(null);
  const [error, setError] = useState<string | null>(null);
-  const [action, setAction] = useState(searchParams.get("action") ?? "");
  const [expanded, setExpanded] = useState<Record<string, boolean>>({});
+  const action = searchParams.get("action") ?? "";
+  const actor = searchParams.get("actor") ?? "";
+  const entityRef = searchParams.get("entity_ref") ?? "";
+  const from = searchParams.get("from") ?? "";
+  const to = searchParams.get("to") ?? "";
  const correlationId = searchParams.get("correlation_id") ?? "";
+  const page = Math.max(1, Number(searchParams.get("page") ?? "1") || 1);
+
+  function updateParams(updates: Record<string, string | number | null>) {
+    const next = new URLSearchParams(searchParams);
+    Object.entries(updates).forEach(([key, value]) => {
+      if (value === null || value === "") next.delete(key);
+      else next.set(key, String(value));
+    });
+    setSearchParams(next);
+  }

  useEffect(() => {
    if (user?.role !== "operations_manager") return;
    setEvents(null);
    setError(null);
-    const params = new URLSearchParams();
+    const params = new URLSearchParams({ page: String(page), page_size: "25" });
    if (action) params.set("action", action);
+    if (actor) params.set("actor_label", actor);
+    if (entityRef) params.set("entity_ref", entityRef);
    if (correlationId) params.set("correlation_id", correlationId);
-    api
-      .get<AuditEvent[]>(`/api/v1/audit?${params.toString()}`)
-      .then(setEvents)
-      .catch(() => setError(t("unavailable")));
-  }, [action, correlationId, user]);
+    if (from) params.set("occurred_from", `${from}T00:00:00Z`);
+    if (to) params.set("occurred_to", `${to}T23:59:59Z`);
+    api.get<Page<AuditEvent>>(`/api/v1/audit?${params.toString()}`).then(setEvents).catch(() => setError(t("unavailable")));
+  }, [action, actor, correlationId, entityRef, from, page, t, to, user]);

  const groups = useMemo<EventGroup[]>(() => {
-    if (!events) return [];
-    const order: string[] = [];
    const byCorrelation = new Map<string, AuditEvent[]>();
-    for (const event of events) {
-      if (!byCorrelation.has(event.correlation_id)) {
-        order.push(event.correlation_id);
-        byCorrelation.set(event.correlation_id, []);
-      }
-      byCorrelation.get(event.correlation_id)!.push(event);
-    }
-    return order.map((id) => {
-      const group = byCorrelation.get(id)!;
-      return { correlationId: id, primary: group[0], related: group.slice(1) };
-    });
+    for (const event of events?.items ?? []) byCorrelation.set(event.correlation_id, [...(byCorrelation.get(event.correlation_id) ?? []), event]);
+    return [...byCorrelation.entries()].map(([id, grouped]) => ({ correlationId: id, primary: grouped[0], related: grouped.slice(1) }));
  }, [events]);

-  function showRelatedEvents(id: string) {
-    setSearchParams({ correlation_id: id });
-  }
+  if (user?.role !== "operations_manager") return <div className="page"><PageHeader eyebrow={t("eyebrow")} title={t("title")} description={t("managerOnly")} /><p>{t("managerOnlyDetail")}</p></div>;

-  function clearCorrelationFilter() {
-    setSearchParams(action ? { action } : {});
-  }
-
-  function toggleExpanded(id: string) {
-    setExpanded((prev) => ({ ...prev, [id]: !prev[id] }));
-  }
-
-  if (user?.role !== "operations_manager") {
-    return (
-      <div className="page">
-        <PageHeader eyebrow={t("eyebrow")} title={t("title")} description={t("managerOnly")} />
-        <p>{t("managerOnlyDetail")}</p>
-      </div>
-    );
-  }
-
-  return (
-    <div className="page">
+  return <div className="page">
    <PageHeader eyebrow={t("eyebrow")} title={t("title")} description={t("description")} />
-
-      <form className="filters" aria-label={t("title")}>
-        <label>
-          {t("actionFilterLabel")}
-          <input
-            type="text"
-            value={action}
-            onChange={(e) => setAction(e.target.value)}
-            placeholder={t("actionFilterPlaceholder")}
-          />
-        </label>
+    <form className="filters" aria-label={t("title")} onSubmit={(event) => event.preventDefault()}>
+      <label>{t("actionFilterLabel")}<input type="search" value={action} onChange={(e) => updateParams({ action: e.target.value, page: 1 })} placeholder={t("actionFilterPlaceholder")} /></label>
+      <label>{t("actorFilterLabel")}<input type="search" value={actor} onChange={(e) => updateParams({ actor: e.target.value, page: 1 })} placeholder={t("actorFilterPlaceholder")} /></label>
+      <label>{t("entityFilterLabel")}<input type="search" value={entityRef} onChange={(e) => updateParams({ entity_ref: e.target.value, page: 1 })} placeholder={t("entityFilterPlaceholder")} /></label>
+      <label>{t("fromFilterLabel")}<input type="date" value={from} onChange={(e) => updateParams({ from: e.target.value, page: 1 })} /></label>
+      <label>{t("toFilterLabel")}<input type="date" value={to} onChange={(e) => updateParams({ to: e.target.value, page: 1 })} /></label>
    </form>
-
-      {correlationId && (
-        <p className="quiet-empty" role="status">
-          {t("relatedFilterActive", { count: events?.length ?? 0 })}{" "}
-          <button type="button" className="link-button" onClick={clearCorrelationFilter}>
-            {t("clearFilter")}
-          </button>
-        </p>
-      )}
-
+    {correlationId && <p className="quiet-empty" role="status">{t("relatedFilterActive", { count: events?.total ?? 0 })} <button type="button" className="link-button" onClick={() => updateParams({ correlation_id: null, page: 1 })}>{t("clearFilter")}</button></p>}
    {error && <ErrorState message={error} />}
    {!error && !events && <LoadingState label={t("loading")} />}
-      {events && events.length === 0 && <EmptyState icon="audit" title={t("empty")} detail={t("emptyDetail")} />}
-
-      {groups.length > 0 && (
-        <div className="table-shell">
-          <div className="table-meta"><span>{t("count", { count: events!.length })}</span><span>{t("storedRendered")}</span></div>
+    {events && events.items.length === 0 && <EmptyState icon="audit" title={t("empty")} detail={t("emptyDetail")} />}
+    {groups.length > 0 && <div className="table-shell audit-shell">
+      <div className="table-meta"><span>{t("count", { count: events!.total })}</span><span>{t("storedRendered")}</span></div>
      <ul className="audit-group-list">
        {groups.map((group) => {
          const e = group.primary;
          const isExpanded = expanded[group.correlationId] ?? false;
-              return (
-                <li key={group.correlationId} className="audit-group panel">
+          return <li key={group.correlationId} className="audit-group panel">
            <div className="audit-group-summary">
-                    <div className="audit-group-heading">
-                      <strong>{actionLabel(t, e.action)}</strong>
-                      <span className="table-subtext">{formatDateTime(e.occurred_at)}</span>
-                    </div>
-                    <div className="audit-group-meta">
-                      <span><strong>{e.actor_label}</strong> <small className="table-subtext">{t(`actorTypes.${e.actor_type}`, { defaultValue: e.actor_type })}</small></span>
-                      {e.entity_link ? (
-                        <Link to={e.entity_link}>{e.entity_ref ?? e.entity_type}</Link>
-                      ) : (
-                        <span>{e.entity_ref ?? e.entity_type}</span>
-                      )}
-                    </div>
+              <div className="audit-group-heading"><strong>{actionLabel(t, e.action)}</strong><span className="table-subtext">{formatDateTime(e.occurred_at)}</span></div>
+              <div className="audit-group-meta"><span><strong>{e.actor_label}</strong> <small className="table-subtext">{t(`actorTypes.${e.actor_type}`, { defaultValue: e.actor_type })}</small></span>{e.entity_link ? <Link to={e.entity_link}>{e.entity_ref ?? e.entity_type}</Link> : <span>{e.entity_ref ?? e.entity_type}</span>}</div>
              <ChangeDiff before={e.before} after={e.after} t={t} />
              <div className="audit-group-actions">
-                      {group.related.length > 0 && (
-                        <button type="button" className="link-button" onClick={() => toggleExpanded(group.correlationId)}>
-                          {isExpanded
-                            ? t("hideTechnicalEvents")
-                            : t("showTechnicalEvents", { count: group.related.length })}
-                        </button>
-                      )}
-                      {!correlationId && (
-                        <button type="button" className="link-button" onClick={() => showRelatedEvents(group.correlationId)}>
-                          {t("viewRelatedEvents")}
-                        </button>
-                      )}
+                {group.related.length > 0 && <button type="button" className="link-button" onClick={() => setExpanded((current) => ({ ...current, [group.correlationId]: !current[group.correlationId] }))}>{isExpanded ? t("hideTechnicalEvents") : t("showTechnicalEvents", { count: group.related.length })}</button>}
+                {!correlationId && <button type="button" className="link-button" onClick={() => updateParams({ correlation_id: group.correlationId, page: 1 })}>{t("viewRelatedEvents")}</button>}
              </div>
            </div>
-
-                  <details className="evidence-disclosure">
-                    <summary>{t("technicalDetails")}</summary>
-                    <dl className="detail-grid audit-technical-grid">
-                      <div><dt>{t("reference")}</dt><dd>{shortRef(e.id)}</dd></div>
-                      <div><dt>{t("fullReference")}</dt><dd className="mono">{e.id}</dd></div>
-                      <div><dt>{t("correlationId")}</dt><dd className="mono">{e.correlation_id}</dd></div>
-                    </dl>
-                    <pre className="evidence-block">{JSON.stringify({ before: e.before, after: e.after, metadata: e.metadata }, null, 2)}</pre>
-                  </details>
-
-                  {isExpanded && group.related.length > 0 && (
-                    <ul className="audit-related-list">
-                      {group.related.map((related) => (
-                        <li key={related.id}>
-                          <div className="audit-group-heading">
-                            <strong>{actionLabel(t, related.action)}</strong>
-                            <span className="table-subtext">{formatDateTime(related.occurred_at)}</span>
-                          </div>
-                          <ChangeDiff before={related.before} after={related.after} t={t} />
-                          <details className="evidence-disclosure">
-                            <summary>{t("technicalDetails")}</summary>
-                            <dl className="detail-grid audit-technical-grid">
-                              <div><dt>{t("reference")}</dt><dd>{shortRef(related.id)}</dd></div>
-                              <div><dt>{t("fullReference")}</dt><dd className="mono">{related.id}</dd></div>
-                            </dl>
-                            <pre className="evidence-block">{JSON.stringify({ before: related.before, after: related.after, metadata: related.metadata }, null, 2)}</pre>
-                          </details>
-                        </li>
-                      ))}
-                    </ul>
-                  )}
-                </li>
-              );
+            <details className="evidence-disclosure"><summary>{t("technicalDetails")}</summary><dl className="detail-grid audit-technical-grid"><div><dt>{t("reference")}</dt><dd>{shortRef(e.id)}</dd></div><div><dt>{t("fullReference")}</dt><dd className="mono">{e.id}</dd></div><div><dt>{t("correlationId")}</dt><dd className="mono">{e.correlation_id}</dd></div></dl><pre className="evidence-block">{JSON.stringify({ before: e.before, after: e.after, metadata: e.metadata }, null, 2)}</pre></details>
+            {isExpanded && group.related.length > 0 && <ul className="audit-related-list">{group.related.map((related) => <li key={related.id}><div className="audit-group-heading"><strong>{actionLabel(t, related.action)}</strong><span className="table-subtext">{formatDateTime(related.occurred_at)}</span></div><ChangeDiff before={related.before} after={related.after} t={t} /><details className="evidence-disclosure"><summary>{t("technicalDetails")}</summary><pre className="evidence-block">{JSON.stringify({ before: related.before, after: related.after, metadata: related.metadata }, null, 2)}</pre></details></li>)}</ul>}
+          </li>;
        })}
      </ul>
-        </div>
-      )}
-    </div>
-  );
+      <Pagination page={events!.page} totalPages={events!.total_pages} onPageChange={(nextPage) => updateParams({ page: nextPage })} />
+    </div>}
+  </div>;
 }
@@ -7,7 +7,7 @@ import { StatusBadge } from "../components/Badge";
 import { useAuth } from "../context/AuthContext";
 import { useLocaleFormat } from "../i18n/format";
 import { ApiErrorNotice, ErrorState, IntegrationMark, LoadingState, PageHeader, SectionHeading } from "../components/PageChrome";
-import { N8N_STATE_META, MCP_STATE_META } from "../data/integrationLabels";
+import { N8N_STATE_META, MCP_STATE_META, N8N_WORKFLOW_SLUGS } from "../data/integrationLabels";

 type ViewFilter = "attention" | "recent" | "succeeded" | "all";

@@ -117,12 +117,16 @@ export function Automation() {
        <td data-label={t("ledger.columns.booking")}>{r.aggregate_ref}</td>
        <td data-label={t("ledger.columns.status")}>
          <StatusBadge status={r.status} label={t(`ledger.status${r.status.charAt(0).toUpperCase()}${r.status.slice(1)}`)} />
+          {r.is_demo_scenario && (
+            <StatusBadge status="demo_scenario" label={t("ledger.demoScenarioBadge")} />
+          )}
        </td>
        <td data-label={t("ledger.columns.attempts")}>{r.attempts}</td>
        <td data-label={t("ledger.columns.lastError")}>
          {r.last_error_code ? (
            <>
              <span>{t(`ledger.errorCodes.${r.last_error_code}`, { defaultValue: r.last_error ?? r.last_error_code })}</span>
+              {r.is_demo_scenario && <p className="table-subtext">{t("ledger.demoScenarioExplanation")}</p>}
              {r.last_error && (
                <details className="evidence-disclosure">
                  <summary>{t("common:actions.technicalDetails")}</summary>
@@ -140,7 +144,9 @@ export function Automation() {
        <td data-label={t("ledger.columns.action")}>
          {r.status === "failed" ? (
            <button type="button" onClick={() => handleRetry(r.event_id)} disabled={retrying === r.event_id}>
-              {retrying === r.event_id ? t("ledger.retrying") : t("ledger.retry")}
+              {retrying === r.event_id
+                ? t("ledger.retrying")
+                : t(r.is_demo_scenario ? "ledger.retryDemoScenario" : "ledger.retry")}
            </button>
          ) : (
            t("ledger.noAction")
@@ -164,12 +170,19 @@ export function Automation() {
              {integrationStatus
                ? t("cards.n8nSummary", {
                    succeeded: integrationStatus.n8n.succeeded,
-                    failed: integrationStatus.n8n.failed,
+                    failed: integrationStatus.n8n.unexpected_failed,
                    pending: integrationStatus.n8n.pending,
                    delivering: integrationStatus.n8n.delivering,
                  })
                : t("cards.n8nFallback")}
            </p>
+            {/* Prepared demo failures are stated separately and never folded into the
+                health count above, so the badge and the numbers tell the same story. */}
+            {integrationStatus && integrationStatus.n8n.demo_scenario_failed > 0 && (
+              <p className="table-subtext">
+                {t("cards.n8nDemoScenario", { count: integrationStatus.n8n.demo_scenario_failed })}
+              </p>
+            )}
          </div>
          {(() => {
            const meta = integrationStatus ? N8N_STATE_META[integrationStatus.n8n.state] : null;
@@ -188,7 +201,9 @@ export function Automation() {
            <h2>{t("cards.knowledgeTitle")}</h2>
            <p>
              {knowledge
-                ? t(knowledge.provider === "ragcore" ? "cards.knowledgeSummaryRagcore" : "cards.knowledgeSummaryDemo", {
+                ? knowledge.document_count === null
+                  ? t("cards.knowledgeSummaryIndexUnknown", { collection: knowledge.collection })
+                  : t(knowledge.provider === "ragcore" ? "cards.knowledgeSummaryRagcore" : "cards.knowledgeSummaryDemo", {
                      count: knowledge.document_count,
                      collection: knowledge.collection,
                    })
@@ -209,15 +224,102 @@ export function Automation() {
          <div>
            <span className="integration-kicker">{t("cards.gatewayKicker")}</span>
            <h2>{t("cards.mcpTitle")}</h2>
-            <p>{integrationStatus?.mcp_hub.registration_enabled ? t("cards.mcpEnabled") : t("cards.mcpNotConnected")}</p>
+            <p>
+              {(() => {
+                const hub = integrationStatus?.mcp_hub;
+                if (!hub?.registration_enabled) return t("cards.mcpNotConnected");
+                if (hub.total_calls > 0) {
+                  return t("cards.mcpEvidence", { tool: hub.last_tool, client: hub.last_client, count: hub.total_calls });
+                }
+                return t("cards.mcpNoEvidence");
+              })()}
+            </p>
+            {integrationStatus?.mcp_hub.last_called_at && (
+              <small>{formatDateTime(integrationStatus.mcp_hub.last_called_at)}</small>
+            )}
          </div>
+          <div className="integration-badge-stack">
            {(() => {
              const meta = integrationStatus ? MCP_STATE_META[integrationStatus.mcp_hub.state] : null;
              return <StatusBadge status={meta?.statusClass ?? "not_configured"} label={meta ? t(`statusLabels.${meta.labelKey}`) : undefined} />;
            })()}
+            {integrationStatus?.mcp_hub.hub_reachable !== null && integrationStatus?.mcp_hub.hub_reachable !== undefined && (
+              <StatusBadge
+                status={integrationStatus.mcp_hub.hub_reachable ? "available" : "unavailable"}
+                label={t(integrationStatus.mcp_hub.hub_reachable ? "cards.mcpHubReachable" : "cards.mcpHubUnreachable")}
+              />
+            )}
+          </div>
        </article>
      </section>

+      <SectionHeading
+        title={t("workflows.title")}
+        description={t("workflows.description", {
+          known: integrationStatus?.n8n.known_workflow_count ?? 0,
+          expected: integrationStatus?.n8n.expected_workflow_count ?? 4,
+        })}
+      />
+
+      {integrationStatus && (
+        <div className="table-shell">
+          <table className="data-table">
+            <caption className="visually-hidden">{t("workflows.title")}</caption>
+            <thead>
+              <tr>
+                <th scope="col">{t("workflows.columns.name")}</th>
+                <th scope="col">{t("workflows.columns.status")}</th>
+                <th scope="col">{t("workflows.columns.lastSeen")}</th>
+                <th scope="col">{t("workflows.columns.technicalId")}</th>
+              </tr>
+            </thead>
+            <tbody>
+              {integrationStatus.n8n.workflows.map((w) => {
+                const slug = N8N_WORKFLOW_SLUGS[w.name] ?? "";
+                const displayName = slug ? t(`workflows.names.${slug}`) : w.name;
+                const badge = !w.built
+                  ? { status: "not_configured", label: t("workflows.notBuilt") }
+                  : w.last_seen_at
+                    ? { status: "available", label: t("statusLabels.operational") }
+                    : { status: "no_events", label: t("workflows.noEvidence") };
+                return (
+                  <tr key={w.name}>
+                    <td data-label={t("workflows.columns.name")}>{displayName}</td>
+                    <td data-label={t("workflows.columns.status")}>
+                      <StatusBadge status={badge.status} label={badge.label} />
+                    </td>
+                    <td data-label={t("workflows.columns.lastSeen")}>
+                      {w.last_seen_at ? (
+                        <time dateTime={w.last_seen_at}>{formatDateTime(w.last_seen_at)}</time>
+                      ) : (
+                        "—"
+                      )}
+                    </td>
+                    <td data-label={t("workflows.columns.technicalId")}>
+                      <details className="evidence-disclosure">
+                        <summary>{t("common:actions.technicalDetails")}</summary>
+                        <span className="table-subtext">{w.name}</span>
+                      </details>
+                    </td>
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
+          <p className="table-meta">
+            {integrationStatus.n8n.error_handler.total_failures_registered > 0
+              ? t("workflows.errorHandler.summary", {
+                  count: integrationStatus.n8n.error_handler.total_failures_registered,
+                  workflow: integrationStatus.n8n.error_handler.latest_failure_workflow ?? "",
+                  when: integrationStatus.n8n.error_handler.latest_failure_at
+                    ? formatDateTime(integrationStatus.n8n.error_handler.latest_failure_at)
+                    : "",
+                })
+              : t("workflows.errorHandler.summaryEmpty")}
+          </p>
+        </div>
+      )}
+
      <SectionHeading title={t("ledger.title")} description={t("ledger.description")} />

      <form className="filters" aria-label={t("ledger.title")}>
@@ -68,8 +68,8 @@ export function BookingDetail() {
        <div><dt>{t("detail.vehicle")}</dt><dd><Link to={`/vehicles/${booking.vehicle_ref}`}>{booking.vehicle_ref}</Link></dd></div>
        <div><dt>{t("detail.starts")}</dt><dd>{formatDateTime(booking.starts_at)}</dd></div>
        <div><dt>{t("detail.ends")}</dt><dd>{formatDateTime(booking.ends_at)}</dd></div>
-        <div><dt>{t("detail.startOdometer")}</dt><dd>{booking.start_odometer_km !== null ? `${formatNumber(booking.start_odometer_km)} km` : "—"}</dd></div>
-        <div><dt>{t("detail.endOdometer")}</dt><dd>{booking.end_odometer_km !== null ? `${formatNumber(booking.end_odometer_km)} km` : "—"}</dd></div>
+        <div><dt>{t("detail.startOdometer")}</dt><dd>{booking.start_odometer_km !== null ? `${formatNumber(booking.start_odometer_km)} km` : t("detail.startOdometerPending")}</dd></div>
+        <div><dt>{t("detail.endOdometer")}</dt><dd>{booking.end_odometer_km !== null ? `${formatNumber(booking.end_odometer_km)} km` : t("detail.endOdometerPending")}</dd></div>
        <div><dt>{t("detail.requirementsComplete")}</dt><dd>{booking.requirements_complete ? t("detail.yes") : t("detail.no")}</dd></div>
      </dl></section>

@@ -12,6 +12,8 @@ import { SeverityBadge, StatusBadge } from "../components/Badge";
 import { Icon } from "../components/Icons";
 import { ErrorState, IntegrationMark, LoadingState, PageHeader, SectionHeading } from "../components/PageChrome";
 import { N8N_STATE_META, MCP_STATE_META } from "../data/integrationLabels";
+import { describeEvidenceSignal } from "../data/evidenceSignals";
+import type { AttentionItem } from "../api/types";

 const FLEET_METRIC_KEYS: Array<{ key: keyof DashboardData["metrics"]; labelKey: string; tone: string }> = [
  { key: "available", labelKey: "readiness.available", tone: "ready" },
@@ -29,9 +31,20 @@ function attentionItemTitle(
  return `${ruleLabel} — ${item.link_ref}`;
 }

+// The backend never emits prose here either -- only stable signal codes + params, exactly
+// like the data-quality issue detail page. Multiple signals on one item (e.g. the
+// duplicate-customer match) are joined into one readable line for this compact row.
+function attentionItemDetail(
+  t: (key: string, options?: Record<string, unknown>) => string,
+  formatNumber: (value: number) => string,
+  item: Pick<AttentionItem, "evidence_signals">,
+): string {
+  return item.evidence_signals.map((signal) => describeEvidenceSignal(t, formatNumber, signal)).join(" · ");
+}
+
 export function Dashboard() {
-  const { t } = useTranslation(["dashboard", "common", "integrations"]);
-  const { formatTime, formatShortDate } = useLocaleFormat();
+  const { t } = useTranslation(["dashboard", "common", "integrations", "quality"]);
+  const { formatTime, formatShortDate, formatNumber } = useLocaleFormat();
  const greetingPeriod = useGreetingPeriod();
  const { user } = useAuth();
  const { manifest } = useDemoManifest();
@@ -71,9 +84,24 @@ export function Dashboard() {

  const attention = useMemo(() => data?.attention_items.filter((item) => {
    const matchesSeverity = severity === "all" || item.severity === severity;
-    const haystack = `${attentionItemTitle(t, item)} ${item.detail} ${item.link_ref}`.toLowerCase();
+    const haystack = `${attentionItemTitle(t, item)} ${attentionItemDetail(t, formatNumber, item)} ${item.link_ref}`.toLowerCase();
    return matchesSeverity && haystack.includes(query.toLowerCase());
-  }) ?? [], [data, query, severity, t]);
+  }) ?? [], [data, query, severity, t, formatNumber]);
+
+  const isUnfiltered = severity === "all" && query === "";
+  const attentionTiers = useMemo(() => {
+    if (!isUnfiltered) return [{ key: "all", labelKey: "", items: attention.slice(0, 6) }];
+    // Keep the initial dashboard queue deliberately bounded. The full evidence-backed
+    // queue remains one click away in Data Quality; this view is for deciding what to
+    // do next, not for rendering the whole backlog.
+    const visible = ["high", "medium", "low"].flatMap((level) => attention.filter((item) => item.severity === level)).slice(0, 6);
+    const bySeverity = (level: string) => visible.filter((item) => item.severity === level);
+    return [
+      { key: "high", labelKey: "attention.tierNow", items: bySeverity("high") },
+      { key: "medium", labelKey: "attention.tierToday", items: bySeverity("medium") },
+      { key: "low", labelKey: "attention.tierLater", items: bySeverity("low") },
+    ].filter((tier) => tier.items.length > 0);
+  }, [attention, isUnfiltered]);

  if (error) return <ErrorState message={error} />;
  if (!data) return <LoadingState label={t("common:status.loading")} />;
@@ -129,8 +157,12 @@ export function Dashboard() {
            <label><span className="visually-hidden">{t("attention.severityAriaLabel")}</span><select value={severity} onChange={(event) => setSeverity(event.target.value)}><option value="all">{t("attention.severityAll")}</option><option value="high">{t("attention.severityHigh")}</option><option value="medium">{t("attention.severityMedium")}</option><option value="low">{t("attention.severityLow")}</option></select></label>
          </div>
          {attention.length === 0 ? <p className="quiet-empty"><Icon name="check" /> {t("attention.empty")}</p> : (
+            <>
+              {attentionTiers.map((tier) => (
+                <div key={tier.key} className="attention-tier">
+                  {attentionTiers.length > 1 && <p className="attention-tier-label">{t(tier.labelKey)}</p>}
                  <ul className="attention-list">
-              {attention.slice(0, 6).map((item, index) => {
+                    {tier.items.map((item, index) => {
                      const href = item.issue_ref && canSeeQuality
                        ? `/data-quality/${item.issue_ref}`
                        : item.link_type === "vehicle"
@@ -142,7 +174,7 @@ export function Dashboard() {
                          <SeverityBadge severity={item.severity} />
                          <div className="queue-copy">
                            <p className="attention-title">{title}</p>
-                      <p className="attention-detail">{item.detail}</p>
+                            <p className="attention-detail">{attentionItemDetail(t, formatNumber, item)}</p>
                          </div>
                          <span className="queue-ref">{item.link_ref}</span>
                          <Icon name="chevron" className="row-chevron" />
@@ -155,6 +187,12 @@ export function Dashboard() {
                      );
                    })}
                  </ul>
+                </div>
+              ))}
+              {isUnfiltered && attention.length > 6 && canSeeQuality && (
+                <p className="queue-more"><Link to="/data-quality">{t("attention.remaining", { count: attention.length - 6 })} <Icon name="chevron" /></Link></p>
+              )}
+            </>
          )}
        </section>

@@ -207,7 +245,7 @@ export function Dashboard() {
              <IntegrationMark kind="rag" />
              <div>
                <strong>{t("integrationPulse.knowledgeTitle")}</strong>
-                <span>{knowledge ? t("integrationPulse.knowledgeSummary", { count: knowledge.document_count }) : t("integrationPulse.knowledgeUnavailable")}</span>
+                <span>{knowledge ? (knowledge.document_count === null ? t("integrationPulse.knowledgeIndexUnknown") : t("integrationPulse.knowledgeSummary", { count: knowledge.document_count })) : t("integrationPulse.knowledgeUnavailable")}</span>
              </div>
              <StatusBadge
                status={knowledge?.available ? "available" : "unavailable"}
@@ -1,12 +1,13 @@
 import { useCallback, useEffect, useState } from "react";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { api } from "../api/client";
 import { describeApiError, type ApiErrorInfo } from "../api/errorMessages";
-import type { DataQualityIssue, ScanResult } from "../api/types";
+import type { DataQualityIssue, Page, ScanResult } from "../api/types";
 import { useAuth } from "../context/AuthContext";
 import { SeverityBadge, StatusBadge } from "../components/Badge";
 import { ApiErrorNotice, EmptyState, ErrorState, LoadingState, PageHeader } from "../components/PageChrome";
+import { Pagination } from "../components/Pagination";

 const RULE_TYPES = [
  "possible_duplicate_customer",
@@ -19,15 +20,27 @@ const RULE_TYPES = [
 export function DataQuality() {
  const { t } = useTranslation("quality");
  const { user } = useAuth();
-  const [issues, setIssues] = useState<DataQualityIssue[] | null>(null);
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [issues, setIssues] = useState<Page<DataQualityIssue> | null>(null);
  const [error, setError] = useState<string | null>(null);
-  const [status, setStatus] = useState("open");
-  const [ruleType, setRuleType] = useState("");
+  const status = searchParams.get("status") ?? "open";
+  const ruleType = searchParams.get("rule_type") ?? "";
+  const severity = searchParams.get("severity") ?? "";
+  const page = Math.max(1, Number(searchParams.get("page") ?? "1") || 1);
  const [scanning, setScanning] = useState(false);
  const [scanError, setScanError] = useState<ApiErrorInfo | null>(null);
  const [scanResult, setScanResult] = useState<ScanResult | null>(null);
  const [confirmingScan, setConfirmingScan] = useState(false);
-  const [demoScenariosOnly, setDemoScenariosOnly] = useState(false);
+  const [demoScenariosOnly, setDemoScenariosOnly] = useState(searchParams.get("demo") === "true");
+
+  function updateFilters(updates: Record<string, string | boolean | number | null>) {
+    const next = new URLSearchParams(searchParams);
+    Object.entries(updates).forEach(([key, value]) => {
+      if (value === null || value === "" || value === false) next.delete(key);
+      else next.set(key, String(value));
+    });
+    setSearchParams(next);
+  }

  const load = useCallback(() => {
    if (user?.role !== "operations_manager") return;
@@ -36,11 +49,14 @@ export function DataQuality() {
    const params = new URLSearchParams();
    if (status) params.set("status", status);
    if (ruleType) params.set("rule_type", ruleType);
+    if (severity) params.set("severity", severity);
+    params.set("page", String(page));
+    params.set("page_size", "25");
    api
-      .get<DataQualityIssue[]>(`/api/v1/data-quality/issues?${params.toString()}`)
+      .get<Page<DataQualityIssue>>(`/api/v1/data-quality/issues?${params.toString()}`)
      .then(setIssues)
      .catch(() => setError(t("list.unavailable")));
-  }, [status, ruleType, user]);
+  }, [status, ruleType, severity, page, user, t]);

  useEffect(() => {
    load();
@@ -73,8 +89,8 @@ export function DataQuality() {
  const scanTotal = scanResult ? Object.values(scanResult.created).reduce((a, b) => a + b, 0) : 0;
  const visibleIssues = issues
    ? demoScenariosOnly
-      ? issues.filter((i) => i.public_ref.startsWith("DQ-DEMO-"))
-      : issues
+      ? issues.items.filter((i) => i.public_ref.startsWith("DQ-DEMO-"))
+      : issues.items
    : [];

  return (
@@ -118,7 +134,7 @@ export function DataQuality() {
      <form className="filters" aria-label={t("list.title")}>
        <label>
          {t("list.statusLabel")}
-          <select value={status} onChange={(e) => setStatus(e.target.value)}>
+          <select value={status} onChange={(e) => updateFilters({ status: e.target.value, page: 1 })}>
            <option value="">{t("list.statusAll")}</option>
            <option value="open">{t("list.statusOpen")}</option>
            <option value="deferred">{t("list.statusDeferred")}</option>
@@ -128,7 +144,7 @@ export function DataQuality() {
        </label>
        <label>
          {t("list.ruleTypeLabel")}
-          <select value={ruleType} onChange={(e) => setRuleType(e.target.value)}>
+          <select value={ruleType} onChange={(e) => updateFilters({ rule_type: e.target.value, page: 1 })}>
            <option value="">{t("list.ruleTypeAll")}</option>
            {RULE_TYPES.map((r) => (
              <option key={r} value={r}>
@@ -137,11 +153,20 @@ export function DataQuality() {
            ))}
          </select>
        </label>
+        <label>
+          {t("list.severityLabel")}
+          <select value={severity} onChange={(e) => updateFilters({ severity: e.target.value, page: 1 })}>
+            <option value="">{t("list.severityAll")}</option>
+            <option value="high">{t("severities.high")}</option>
+            <option value="medium">{t("severities.medium")}</option>
+            <option value="low">{t("severities.low")}</option>
+          </select>
+        </label>
        <label className="checkbox-label">
          <input
            type="checkbox"
            checked={demoScenariosOnly}
-            onChange={(e) => setDemoScenariosOnly(e.target.checked)}
+            onChange={(e) => { setDemoScenariosOnly(e.target.checked); updateFilters({ demo: e.target.checked, page: 1 }); }}
          />
          {t("list.demoScenariosOnly")}
        </label>
@@ -149,13 +174,13 @@ export function DataQuality() {

      {error && <ErrorState message={error} />}
      {!error && !issues && <LoadingState label={t("list.loading")} />}
-      {issues && issues.length === 0 && <EmptyState icon="check" title={t("list.queueClear")} detail={t("list.noIssuesMatch")} />}
-      {issues && issues.length > 0 && visibleIssues.length === 0 && (
+      {issues && issues.items.length === 0 && <EmptyState icon="check" title={t("list.queueClear")} detail={t("list.noIssuesMatch")} />}
+      {issues && issues.items.length > 0 && visibleIssues.length === 0 && (
        <EmptyState icon="check" title={t("list.noDemoIssuesMatch")} detail={t("list.noDemoIssuesMatchDetail")} />
      )}

      {visibleIssues.length > 0 && (
-        <div className="table-shell"><div className="table-meta"><span>{t("list.count", { count: visibleIssues.length })}</span><span>{t("list.evidenceBacked")}</span></div><table className="data-table">
+        <div className="table-shell"><div className="table-meta"><span>{t("list.count", { count: issues?.total ?? visibleIssues.length })}</span><span>{t("list.evidenceBacked")}</span></div><table className="data-table">
          <caption className="visually-hidden">{t("list.title")}</caption>
          <thead>
            <tr>
@@ -184,7 +209,7 @@ export function DataQuality() {
              </tr>
            ))}
          </tbody>
-        </table></div>
+        </table>{issues && !demoScenariosOnly && <Pagination page={issues.page} totalPages={issues.total_pages} onPageChange={(nextPage) => updateFilters({ page: nextPage })} />}</div>
      )}
    </div>
  );
@@ -15,6 +15,8 @@ import { useDemoGuide } from "../context/DemoGuideContext";
 import { useDemoManifest } from "../context/DemoManifestContext";
 import { useLocaleFormat } from "../i18n/format";
 import { DEMO_GUIDE_STEPS } from "../data/demoGuideSteps";
+import { describeEvidenceSignal } from "../data/evidenceSignals";
+import type { EvidenceSignal } from "../api/types";
 import { Icon } from "../components/Icons";
 import { ApiErrorNotice, ErrorState, LoadingState, PageHeader, SectionHeading } from "../components/PageChrome";

@@ -47,74 +49,21 @@ function EvidenceDisclosure({ issue }: { issue: IssueDetail }) {
  );
 }

-interface EvidenceSignal {
-  code: string;
-  params?: Record<string, unknown>;
-}
-
 // The backend never emits prose for evidence -- only stable signal codes + raw data
-// params (see app/services/data_quality.py::_open_issue). This is the one place that
-// turns them into the operator's selected language; the legacy `evidence.summary`
-// string is a technical fallback only, shown solely inside EvidenceDisclosure above.
-// A handful of seed-only rows (generic filler, not tied to a scripted demo scenario)
-// carry no structured signals -- rather than show nothing, this known placeholder
-// summary gets a localized rendering. Any other un-signalled legacy text still falls
-// back to the raw string (better than a blank primary evidence area), but only
-// "Technical details" is meant to guarantee raw-text visibility.
-const SEED_PLACEHOLDER_SUMMARY = "Synthetic deterministic seed issue";
-
+// params (see app/services/data_quality.py::_open_issue). describeEvidenceSignal is the
+// one place that turns them into the operator's selected language; the legacy
+// `evidence.summary` string is a technical fallback only, shown solely inside
+// EvidenceDisclosure above.
 function EvidenceSignalList({ issue }: { issue: IssueDetail }) {
  const { t } = useTranslation("quality");
  const { formatNumber } = useLocaleFormat();
  const signals = (issue.evidence.signals as EvidenceSignal[] | undefined) ?? [];
-  if (signals.length === 0) {
-    const rawSummary = String(issue.evidence.summary ?? "");
-    if (!rawSummary) return null;
-    const text =
-      rawSummary === SEED_PLACEHOLDER_SUMMARY
-        ? t("detail.evidence.seedPlaceholder")
-        : rawSummary;
-    return (
-      <ul className="evidence-signal-list">
-        <li>{text}</li>
-      </ul>
-    );
-  }
-
-  function describe(signal: EvidenceSignal): string {
-    const { code, params = {} } = signal;
-    if (code.startsWith("vehicle.")) {
-      return t(`detail.vehicleStatusConflict.reasonCodes.${code}`, { defaultValue: code });
-    }
-    switch (code) {
-      case "missing_field":
-        return t("detail.evidence.missingField", {
-          field: t(`detail.missingField.fields.${params.field}`, { defaultValue: String(params.field) }),
-        });
-      case "overlap.reserved_bookings":
-        return t("detail.evidence.overlapReservedBookings", {
-          refs: Array.isArray(params.refs) ? params.refs.join(" ↔ ") : "",
-        });
-      case "odometer.regression":
-        return t("detail.evidence.odometerRegression", {
-          laterRef: params.later_ref,
-          laterKm: formatNumber(Number(params.later_km ?? 0)),
-          earlierRef: params.earlier_ref,
-          earlierKm: formatNumber(Number(params.earlier_km ?? 0)),
-        });
-      case "duplicate.similar_name":
-        return t("detail.evidence.duplicateSimilarName", { score: params.score });
-      case "attention.upcoming_booking_missing_inspection":
-        return t("detail.evidence.upcomingBookingMissingInspection", { bookingRef: params.booking_ref });
-      default:
-        return t(`detail.evidence.${code}`, { defaultValue: code });
-    }
-  }
+  if (signals.length === 0) return null;

  return (
    <ul className="evidence-signal-list">
      {signals.map((signal, index) => (
-        <li key={`${signal.code}-${index}`}>{describe(signal)}</li>
+        <li key={`${signal.code}-${index}`}>{describeEvidenceSignal(t, formatNumber, signal)}</li>
      ))}
    </ul>
  );
@@ -128,6 +77,7 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR
  const [error, setError] = useState<ApiErrorInfo | null>(null);
  const [submitting, setSubmitting] = useState(false);
  const [confirming, setConfirming] = useState(false);
+  const [showMatching, setShowMatching] = useState(false);

  if (!issue.entity_snapshot || !issue.related_snapshots[0]) {
    return <p className="error">{t("detail.duplicateCustomer.bothMissing")}</p>;
@@ -137,6 +87,9 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR

  const survivor = survivorRef === a.public_ref ? a : b;
  const loser = survivorRef === a.public_ref ? b : a;
+  const conflictingFields = MERGE_FIELDS.filter((field) => String(a[field] ?? "") !== String(b[field] ?? ""));
+  const matchingFields = MERGE_FIELDS.filter((field) => !conflictingFields.includes(field));
+  const visibleFields = showMatching ? MERGE_FIELDS : conflictingFields;

  async function handleMerge() {
    setError(null);
@@ -174,6 +127,10 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR
      <SectionHeading headingId="compare-heading" title={t("detail.duplicateCustomer.heading")} description={t("detail.duplicateCustomer.description")} />
      <ApiErrorNotice error={error} />

+      <p className="merge-summary-counts">
+        {t("detail.duplicateCustomer.summaryCounts", { matchCount: matchingFields.length, conflictCount: conflictingFields.length })}
+      </p>
+
      <fieldset className="choice-fieldset">
        <legend>{t("detail.duplicateCustomer.keepAsSurvivor")}</legend>
        <label className={`choice-card ${survivorRef === a.public_ref ? "is-selected" : ""}`}>
@@ -205,7 +162,7 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR
          </tr>
        </thead>
        <tbody>
-          {MERGE_FIELDS.map((field) => {
+          {visibleFields.map((field) => {
            const valueA = a[field] ? String(a[field]) : "—";
            const valueB = b[field] ? String(b[field]) : "—";
            const differ = valueA !== valueB;
@@ -248,10 +205,33 @@ function DuplicateCustomerPanel({ issue, onResolved }: { issue: IssueDetail; onR
        </tbody>
      </table>

+      {matchingFields.length > 0 && (
+        <button type="button" className="button button-tertiary toggle-matching-fields" onClick={() => setShowMatching((v) => !v)}>
+          {showMatching ? t("detail.duplicateCustomer.hideMatchingFields") : t("detail.duplicateCustomer.showMatchingFields")}
+        </button>
+      )}
+
      <p className="merge-preview">
        {t("detail.duplicateCustomer.mergePreview", { loser: loser.public_ref, survivor: survivor.public_ref })}
      </p>

+      <div className="merge-record-preview">
+        <p className="merge-record-preview-title">{t("detail.duplicateCustomer.previewTitle", { ref: survivor.public_ref })}</p>
+        <dl>
+          {MERGE_FIELDS.map((field) => {
+            const choice = fieldChoices[field];
+            const chosenSide = choice === "a" ? a : choice === "b" ? b : survivor;
+            const value = (chosenSide[field] ? String(chosenSide[field]) : survivor[field] ? String(survivor[field]) : "—");
+            return (
+              <div key={field}>
+                <dt>{t(`detail.duplicateCustomer.fields.${field}`)}</dt>
+                <dd>{value || "—"}</dd>
+              </div>
+            );
+          })}
+        </dl>
+      </div>
+
      {!confirming && (
        <button type="button" className="button button-primary" onClick={() => setConfirming(true)}>
          {t("detail.duplicateCustomer.mergeInto", { ref: survivor.public_ref })}
@@ -69,7 +69,7 @@ export function Knowledge() {
            <strong>{providerLabel}</strong>
            <span>
              {status.available ? t("statusAvailable") : t("statusUnavailable")} ·{" "}
-              {t("proceduresIndexed", { count: status.document_count })}
+              {status.document_count === null ? t("proceduresIndexUnknown") : t("proceduresIndexed", { count: status.document_count })}
            </span>
          </div>
          <small>{status.collection}</small>
@@ -100,7 +100,7 @@ export function VehicleDetail() {
          {vehicle.maintenance.map((m) => (
            <li key={m.public_ref}>
              <span>{t(`fleet:detail.maintenanceCategories.${m.category}`, { defaultValue: m.category })}</span>
-              <span>{m.summary}</span>
+              <span>{formatNumber(m.odometer_km)} km</span>
              <time dateTime={m.occurred_at}>{formatShortDate(m.occurred_at)}</time>
            </li>
          ))}
@@ -1,22 +1,34 @@
 import { useEffect, useState } from "react";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { api } from "../api/client";
-import type { Vehicle } from "../api/types";
+import type { Page, Vehicle } from "../api/types";
 import { useLocaleFormat } from "../i18n/format";
 import { StatusBadge } from "../components/Badge";
 import { EmptyState, ErrorState, LoadingState, PageHeader } from "../components/PageChrome";
+import { Pagination } from "../components/Pagination";

 const STATUS_OPTIONS = ["available", "rented", "cleaning", "maintenance", "blocked"];

 export function Vehicles() {
  const { t } = useTranslation("fleet");
  const { formatNumber } = useLocaleFormat();
-  const [vehicles, setVehicles] = useState<Vehicle[] | null>(null);
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [vehicles, setVehicles] = useState<Page<Vehicle> | null>(null);
  const [error, setError] = useState<string | null>(null);
-  const [status, setStatus] = useState("");
-  const [attentionOnly, setAttentionOnly] = useState(false);
-  const [query, setQuery] = useState("");
+  const status = searchParams.get("status") ?? "";
+  const attentionOnly = searchParams.get("attention_only") === "true";
+  const query = searchParams.get("q") ?? "";
+  const page = Math.max(1, Number(searchParams.get("page") ?? "1") || 1);
+
+  function updateFilters(updates: Record<string, string | boolean | number | null>) {
+    const next = new URLSearchParams(searchParams);
+    Object.entries(updates).forEach(([key, value]) => {
+      if (value === null || value === "" || value === false) next.delete(key);
+      else next.set(key, String(value));
+    });
+    setSearchParams(next);
+  }

  useEffect(() => {
    setVehicles(null);
@@ -24,11 +36,14 @@ export function Vehicles() {
    const params = new URLSearchParams();
    if (status) params.set("status", status);
    if (attentionOnly) params.set("attention_only", "true");
+    if (query) params.set("query", query);
+    params.set("page", String(page));
+    params.set("page_size", "25");
    api
-      .get<Vehicle[]>(`/api/v1/vehicles?${params.toString()}`)
+      .get<Page<Vehicle>>(`/api/v1/vehicles?${params.toString()}`)
      .then(setVehicles)
      .catch(() => setError(t("list.unavailable")));
-  }, [status, attentionOnly]);
+  }, [status, attentionOnly, query, page, t]);

  return (
    <div className="page">
@@ -37,11 +52,11 @@ export function Vehicles() {
      <form className="filters" aria-label={t("list.title")}>
        <label>
          {t("list.searchLabel")}
-          <input type="text" value={query} onChange={(e) => setQuery(e.target.value)} placeholder={t("list.searchPlaceholder")} />
+          <input type="search" value={query} onChange={(e) => updateFilters({ q: e.target.value, page: 1 })} placeholder={t("list.searchPlaceholder")} />
        </label>
        <label>
          {t("list.statusLabel")}
-          <select value={status} onChange={(e) => setStatus(e.target.value)}>
+          <select value={status} onChange={(e) => updateFilters({ status: e.target.value, page: 1 })}>
            <option value="">{t("list.statusAll")}</option>
            {STATUS_OPTIONS.map((s) => (
              <option key={s} value={s}>
@@ -54,7 +69,7 @@ export function Vehicles() {
          <input
            type="checkbox"
            checked={attentionOnly}
-            onChange={(e) => setAttentionOnly(e.target.checked)}
+            onChange={(e) => updateFilters({ attention_only: e.target.checked, page: 1 })}
          />
          {t("list.attentionOnly")}
        </label>
@@ -62,11 +77,9 @@ export function Vehicles() {

      {error && <ErrorState message={error} />}
      {!error && !vehicles && <LoadingState label={t("list.loading")} />}
-      {vehicles && vehicles.length === 0 && <EmptyState icon="fleet" title={t("list.empty")} detail={t("list.emptyDetail")} />}
+      {vehicles && vehicles.items.length === 0 && <EmptyState icon={query ? "search" : "fleet"} title={query ? t("list.noMatch") : t("list.empty")} detail={query ? t("list.noMatchDetail") : t("list.emptyDetail")} />}

-      {vehicles && vehicles.length > 0 && (() => {
-        const filtered = vehicles.filter((v) => `${v.public_ref} ${v.make} ${v.model} ${v.location}`.toLowerCase().includes(query.toLowerCase()));
-        return filtered.length === 0 ? <EmptyState icon="search" title={t("list.noMatch")} detail={t("list.noMatchDetail")} /> : <div className="table-shell"><div className="table-meta"><span>{t("list.count", { count: filtered.length })}</span><span>{t("list.persisted")}</span></div><table className="data-table">
+      {vehicles && vehicles.items.length > 0 && <div className="table-shell"><div className="table-meta"><span>{t("list.count", { count: vehicles.total })}</span><span>{t("list.persisted")}</span></div><table className="data-table">
          <caption className="visually-hidden">{t("list.title")}</caption>
          <thead>
            <tr>
@@ -79,7 +92,7 @@ export function Vehicles() {
            </tr>
          </thead>
          <tbody>
-            {filtered.map((v) => (
+            {vehicles.items.map((v) => (
              <tr key={v.public_ref} className={`row-clickable ${v.attention ? "row-attention" : ""}`}>
                <th scope="row" data-label={t("list.columns.reference")}>
                  {v.public_ref}
@@ -97,8 +110,7 @@ export function Vehicles() {
              </tr>
            ))}
          </tbody>
-        </table></div>;
-      })()}
+        </table><Pagination page={vehicles.page} totalPages={vehicles.total_pages} onPageChange={(nextPage) => updateFilters({ page: nextPage })} /></div>}
    </div>
  );
 }
@@ -28,6 +28,10 @@
  --focus: #14b8a6;
  --radius: 4px;
  --shadow-float: 0 16px 40px rgba(15, 23, 42, .12);
+  --type-body: .875rem;
+  --type-meta: .75rem;
+  --type-label: .75rem;
+  --type-badge: .75rem;
 }

 * { box-sizing: border-box; }
@@ -91,10 +95,11 @@ a:hover { color: var(--teal); }
 .search-result-copy { display: flex; flex-direction: column; min-width: 0; }
 .search-result-copy strong { font-size: .82rem; }
 .search-result-copy small { color: var(--muted); font-size: .72rem; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
-.topbar-meta { margin-left: auto; display: flex; align-items: center; gap: 18px; }
+.topbar-meta { margin-left: auto; display: flex; align-items: center; gap: 10px; }
 .timezone { display: flex; align-items: center; gap: 6px; color: var(--muted); font-size: .72rem; white-space: nowrap; }
 .timezone svg { width: 15px; }
 .operator { display: flex; align-items: center; gap: 9px; padding-left: 17px; border-left: 1px solid var(--line); }
+.operator-menu { position: relative; }.operator-menu summary { list-style: none; cursor: pointer; }.operator-menu summary::-webkit-details-marker { display: none; }.operator-menu[open] .operator { color: var(--teal-dark); }.operator-popover { position: absolute; top: calc(100% + 8px); right: 0; z-index: 31; width: 220px; display: grid; gap: 10px; padding: 12px; background: white; border: 1px solid var(--line); border-radius: var(--radius); box-shadow: var(--shadow-float); }.operator-popover .timezone { font-size: var(--type-meta); }.operator-logout { min-height: 40px; display: flex; align-items: center; gap: 8px; padding: 8px 10px; color: var(--ink-soft); background: var(--surface-subtle); border: 1px solid var(--line); border-radius: var(--radius); font-size: var(--type-meta); font-weight: 700; cursor: pointer; }.operator-logout svg { width: 16px; }
 .avatar { width: 32px; height: 32px; display: grid; place-items: center; color: white; background: var(--petrol); border-radius: 50%; font-size: .67rem; font-weight: 700; }
 .operator > span:last-child { display: grid; gap: 1px; min-width: 0; }
 .operator strong { font-size: .74rem; overflow-wrap: anywhere; }
@@ -175,6 +180,7 @@ a:hover { color: var(--teal); }
 .attention-list, .integration-list, .recent-list, .record-list, .automation-list, .today-list { list-style: none; margin: 0; padding: 0; }
 .attention-list li { min-height: 68px; display: grid; grid-template-columns: auto minmax(0,1fr) auto 16px; align-items: center; gap: 11px; padding: 10px 18px; border-bottom: 1px solid #e8edf2; transition: background .14s ease; }
 .attention-list li:last-child { border-bottom: 0; }.attention-list li:hover { background: #f9fbfc; }
+.queue-more { margin: 0; padding: 13px 18px; border-top: 1px solid var(--line); font-size: var(--type-meta); font-weight: 700; }.queue-more a { display: inline-flex; align-items: center; gap: 5px; }
 .attention-title { margin: 0; font-size: .78rem; font-weight: 700; }.attention-title a { color: var(--ink); text-decoration: none; }
 .attention-detail { max-width: 58ch; margin: 4px 0 0; color: var(--muted); font-size: .69rem; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
 .queue-ref { color: var(--muted); font-family: ui-monospace, SFMono-Regular, Menlo, monospace; font-size: .65rem; }.row-chevron { width: 14px; color: var(--muted-light); }
@@ -193,6 +199,8 @@ a:hover { color: var(--teal); }
 .row-link { position: absolute; inset: 0; z-index: 1; border-radius: inherit; }
 .row-link:focus-visible { outline: 2px solid var(--focus); outline-offset: -2px; }
 .attention-list li.row-clickable:hover .attention-title, .movement-timeline li.row-clickable:hover .movement-ref { color: var(--teal-dark); }
+.attention-tier + .attention-tier { border-top: 1px solid var(--line); }
+.attention-tier-label { margin: 0; padding: 9px 18px 5px; color: var(--muted); font-size: .62rem; font-weight: 700; text-transform: uppercase; letter-spacing: .08em; }
 .data-table tr.row-clickable:hover { background: var(--surface-subtle); }
 .data-table tr.row-clickable .cell-link { position: relative; z-index: 2; }

@@ -204,35 +212,35 @@ a:hover { color: var(--teal); }
 .activity-icon { width: 30px; height: 30px; display: grid; place-items: center; color: var(--teal-dark); background: var(--teal-pale); border-radius: 50%; }.activity-icon svg { width: 15px; }
 .recent-list time { color: var(--muted); font-size: .62rem; white-space: nowrap; }

-.badge { min-height: 20px; display: inline-flex; align-items: center; gap: 5px; padding: 2px 7px; border: 1px solid transparent; border-radius: 999px; font-size: .59rem; font-weight: 700; line-height: 1.2; text-transform: capitalize; white-space: nowrap; }
+.badge { min-height: 24px; display: inline-flex; align-items: center; gap: 5px; padding: 3px 8px; border: 1px solid transparent; border-radius: 999px; font-size: var(--type-badge); font-weight: 700; line-height: 1.2; text-transform: capitalize; white-space: nowrap; }
 .badge::before, .badge-dot { content: ""; width: 5px; height: 5px; border-radius: 50%; background: currentColor; }
 .severity-high, .status-failed, .status-blocked, .status-rejected, .status-unavailable { color: #9f2929; background: var(--critical-pale); border-color: #f3c5c5; }
 .severity-medium, .status-pending, .status-delivering, .status-needs_attention { color: #93520c; background: var(--warning-pale); border-color: #eed4aa; }
-.severity-low { color: #315f79; background: var(--info-pale); border-color: #c8dfeb; }
+.severity-low, .status-demo_scenario { color: #315f79; background: var(--info-pale); border-color: #c8dfeb; }
 .status-succeeded, .status-resolved, .status-available, .status-returned, .status-active { color: #17633f; background: var(--success-pale); border-color: #bfe3d0; }
 .status-cancelled, .status-deferred, .status-cleaning, .status-maintenance, .status-rented, .status-reserved, .status-not_configured, .status-no_events, .status-no_delivery_yet { color: #536172; background: #f0f3f6; border-color: #d8dfe6; }
 .badge-dot { display: inline-block; }

 .filters { display: flex; flex-wrap: wrap; align-items: end; gap: 12px; margin-bottom: 16px; padding: 14px 16px; background: var(--surface); border: 1px solid var(--line); border-radius: var(--radius); }
-.filters label, .return-form label { display: flex; flex-direction: column; gap: 6px; color: var(--ink-soft); font-size: .67rem; font-weight: 700; letter-spacing: .01em; }
-.filters input[type="text"], .filters select, .return-form input[type="number"], .return-form textarea, .knowledge-input-row input { min-height: 40px; padding: 8px 11px; color: var(--ink); background: white; border: 1px solid var(--line-strong); border-radius: var(--radius); font-size: .78rem; }
-.filters input[type="text"] { min-width: 230px; }.filters select { min-width: 160px; }
+.filters label, .return-form label, .form-grid label, .panel label:has(> textarea) { display: flex; flex-direction: column; gap: 6px; color: var(--ink-soft); font-size: var(--type-label); font-weight: 700; letter-spacing: .01em; }
+.filters input[type="text"], .filters input[type="search"], .filters input[type="date"], .filters select, .return-form input[type="number"], .return-form textarea, .knowledge-input-row input, .form-grid input, .form-grid select, .panel label:has(> textarea) textarea { min-height: 44px; padding: 8px 11px; color: var(--ink); background: white; border: 1px solid var(--line-strong); border-radius: var(--radius); font-size: var(--type-body); }
+.filters input[type="text"], .filters input[type="search"] { min-width: 230px; }.filters select { min-width: 160px; }
 .checkbox-label { flex-direction: row !important; align-items: center; gap: 8px !important; }
 input[type="checkbox"], input[type="radio"] { width: 17px; height: 17px; accent-color: var(--teal-dark); }

 .table-shell { overflow: hidden; }
-.table-meta { min-height: 40px; display: flex; justify-content: space-between; align-items: center; padding: 0 14px; color: var(--muted); background: var(--surface-subtle); border-bottom: 1px solid var(--line); font-size: .65rem; }
+.table-meta { min-height: 44px; display: flex; justify-content: space-between; align-items: center; padding: 0 14px; color: var(--muted); background: var(--surface-subtle); border-bottom: 1px solid var(--line); font-size: var(--type-meta); }
 .data-table { width: 100%; border-collapse: collapse; }
-.data-table th, .data-table td { height: 50px; text-align: left; padding: 9px 14px; border-bottom: 1px solid #e8edf2; font-size: .74rem; vertical-align: middle; }
+.data-table th, .data-table td { min-height: 52px; text-align: left; padding: 9px 14px; border-bottom: 1px solid #e8edf2; font-size: var(--type-body); vertical-align: middle; }
 .data-table tbody tr:last-child th, .data-table tbody tr:last-child td { border-bottom: 0; }
 .data-table tbody tr { transition: background .14s ease; }.data-table tbody tr:hover { background: #f9fbfc; }
-.data-table thead th { height: 38px; color: var(--muted); background: #f6f8fa; font-size: .61rem; font-weight: 700; text-transform: uppercase; letter-spacing: .075em; }
+.data-table thead th { height: 42px; color: var(--muted); background: #f6f8fa; font-size: var(--type-label); font-weight: 700; text-transform: uppercase; letter-spacing: .075em; }
 .data-table th[scope="row"] { color: var(--ink); font-weight: 700; }.data-table th[scope="row"] a { color: var(--teal-dark); text-decoration: none; }
 .row-attention { box-shadow: inset 2px 0 var(--warning); }.attention-flag { color: var(--warning); font-size: .67rem; font-weight: 700; }
 .data-table td button, .duplicate-compare > button, .resolution-actions button, .confirm-bar button, .pagination button { min-height: 36px; padding: 7px 12px; color: var(--ink); background: white; border: 1px solid var(--line-strong); border-radius: var(--radius); font-size: .7rem; font-weight: 700; cursor: pointer; }
 .data-table td button:hover, .pagination button:hover:not(:disabled) { background: var(--surface-subtle); }.data-table td button:disabled, .pagination button:disabled { opacity: .45; cursor: not-allowed; }
-.table-subtext { display: block; margin-top: 3px; color: var(--muted); font-size: .62rem; }.mono { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
-.pagination { min-height: 52px; display: flex; justify-content: flex-end; align-items: center; gap: 12px; padding: 8px 14px; border-top: 1px solid var(--line); color: var(--muted); font-size: .68rem; }
+.table-subtext { display: block; margin-top: 3px; color: var(--muted); font-size: var(--type-meta); }.mono { font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.pagination { min-height: 56px; display: flex; justify-content: flex-end; align-items: center; gap: 12px; padding: 8px 14px; border-top: 1px solid var(--line); color: var(--muted); font-size: var(--type-meta); }
 details summary { cursor: pointer; color: var(--teal-dark); }.data-table details pre { max-width: 280px; overflow: auto; color: var(--ink-soft); white-space: pre-wrap; }

 .tabs { display: flex; gap: 2px; margin: 0 0 16px; padding: 0 4px; overflow-x: auto; border-bottom: 1px solid var(--line); }
@@ -249,20 +257,26 @@ details summary { cursor: pointer; color: var(--teal-dark); }.data-table details
 .about-cta { display: flex; align-items: center; justify-content: space-between; gap: 16px; flex-wrap: wrap; background: var(--teal-pale); border-color: #bfe6df; }
 .about-cta strong { display: block; color: var(--ink); font-size: .85rem; }
 .about-cta p { margin: 2px 0 0; }
+.about-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(240px, 1fr)); gap: 12px; margin-bottom: 18px; }
+.about-grid .about-card { margin-bottom: 0; }
+.about-details summary { cursor: pointer; color: var(--ink); font-size: 1rem; letter-spacing: -.015em; font-weight: 700; }
+.about-details[open] summary { margin-bottom: 8px; }
+.about-details summary::-webkit-details-marker { display: none; }
+.about-details summary:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
 .detail-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 1px; margin: 0; background: var(--line); border: 1px solid var(--line); }
 .detail-grid div { min-height: 76px; padding: 13px 14px; background: white; }
-.detail-grid dt { margin: 0; color: var(--muted); font-size: .63rem; font-weight: 700; text-transform: uppercase; letter-spacing: .065em; }.detail-grid dd { margin: 7px 0 0; color: var(--ink); font-size: .82rem; font-weight: 700; }
+.detail-grid dt { margin: 0; color: var(--muted); font-size: var(--type-label); font-weight: 700; text-transform: uppercase; letter-spacing: .065em; }.detail-grid dd { margin: 7px 0 0; color: var(--ink); font-size: var(--type-body); font-weight: 700; }
 .record-list { display: grid; gap: 1px; margin-bottom: 16px; background: var(--line); border: 1px solid var(--line); border-radius: var(--radius); overflow: hidden; }
 .record-list li { min-height: 52px; display: flex; flex-wrap: wrap; align-items: center; gap: 11px; padding: 10px 14px; background: white; font-size: .75rem; }

 .return-form, .return-result { max-width: 880px; margin-top: 22px; padding: 0; overflow: hidden; }
-.return-form > .section-heading { padding: 19px 22px; }.return-progress { min-height: 54px; display: flex; align-items: center; justify-content: center; gap: 9px; padding: 10px 22px; color: var(--muted); background: var(--surface-subtle); border-bottom: 1px solid var(--line); font-size: .65rem; font-weight: 700; }
+.return-form > .section-heading { padding: 19px 22px; }.return-progress { position: sticky; top: 64px; z-index: 8; min-height: 54px; display: flex; align-items: center; justify-content: center; gap: 9px; padding: 10px 22px; color: var(--muted); background: var(--surface-subtle); border-bottom: 1px solid var(--line); font-size: var(--type-meta); font-weight: 700; }
 .return-progress span { display: flex; align-items: center; gap: 6px; white-space: nowrap; }.return-progress i { width: 22px; height: 22px; display: grid; place-items: center; border: 1px solid var(--line-strong); border-radius: 50%; font-style: normal; }
 .return-progress b { width: 54px; height: 1px; background: var(--line-strong); }.return-progress .is-active, .return-progress .is-complete { color: var(--teal-dark); }.return-progress .is-active i, .return-progress .is-complete i { color: white; background: var(--teal-dark); border-color: var(--teal-dark); }
 .return-capture, .return-review { padding: 22px; }.form-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 14px; margin-bottom: 17px; }
 .condition-fieldset { display: grid; grid-template-columns: repeat(3, 1fr); gap: 9px; margin: 0 0 17px; padding: 0; border: 0; }.condition-fieldset legend { margin-bottom: 8px; color: var(--ink-soft); font-size: .67rem; font-weight: 700; }.check-card { min-height: 48px; padding: 10px 12px; background: var(--surface-subtle); border: 1px solid var(--line); border-radius: var(--radius); }
 .return-form textarea { resize: vertical; min-height: 86px; }.form-actions { display: flex; justify-content: flex-end; gap: 9px; padding: 15px 22px; background: var(--surface-subtle); border-top: 1px solid var(--line); }
-.review-facts { display: grid; grid-template-columns: repeat(5, 1fr); gap: 1px; margin: 0 0 16px; background: var(--line); border: 1px solid var(--line); }.review-facts div { padding: 12px; background: white; }.review-facts dt { color: var(--muted); font-size: .6rem; text-transform: uppercase; }.review-facts dd { margin: 6px 0 0; font-size: .76rem; font-weight: 700; }
+.review-facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 1px; margin: 0 0 16px; background: var(--line); border: 1px solid var(--line); }.review-facts div { padding: 12px; background: white; }.review-facts dt { color: var(--muted); font-size: var(--type-label); text-transform: uppercase; }.review-facts dd { margin: 6px 0 0; font-size: var(--type-body); font-weight: 700; }
 .impact-preview { display: flex; align-items: flex-start; gap: 11px; padding: 15px; border: 1px solid; border-radius: var(--radius); }.impact-preview > svg { width: 20px; flex: 0 0 auto; }.impact-preview strong { font-size: .76rem; }.impact-preview p { margin: 4px 0 0; font-size: .72rem; line-height: 1.45; }.impact-ready { color: #185d41; background: var(--success-pale); border-color: #bfe3d0; }.impact-warning { color: #844909; background: var(--warning-pale); border-color: #eed4aa; }
 .commit-list { list-style: none; display: grid; gap: 7px; margin: 16px 0 0; padding: 0; color: var(--muted); font-size: .7rem; }.commit-list li { display: flex; gap: 7px; }.commit-list svg { width: 14px; color: var(--teal-dark); }
 .success-panel { padding: 22px; }.result-heading { display: flex; align-items: center; gap: 12px; margin-bottom: 18px; }.result-heading > span { width: 40px; height: 40px; display: grid; place-items: center; color: white; background: var(--success); border-radius: 50%; }.result-heading svg { width: 20px; }.result-heading h2 { margin: 0; font-size: 1.2rem; }
@@ -285,9 +299,17 @@ details summary { cursor: pointer; color: var(--teal-dark); }.data-table details
 .evidence-list li { margin-bottom: 2px; }
 .status-decision .button { margin-top: 16px; }

-.duplicate-compare { margin-top: 18px; }.duplicate-compare fieldset { margin: 15px 0; padding: 13px; border: 1px solid var(--line); }.duplicate-compare legend { padding: 0 5px; color: var(--ink-soft); font-size: .69rem; font-weight: 700; }.duplicate-compare fieldset label { display: inline-flex !important; margin-right: 18px; }
+.duplicate-compare { margin-top: 18px; }.duplicate-compare fieldset { margin: 15px 0; padding: 13px; border: 1px solid var(--line); }.duplicate-compare legend { padding: 0 5px; color: var(--ink-soft); font-size: var(--type-label); font-weight: 700; }.duplicate-compare fieldset label { display: inline-flex !important; margin-right: 18px; }.duplicate-compare .merge-record-preview { position: sticky; bottom: 16px; z-index: 2; box-shadow: 0 10px 24px rgba(15,23,42,.08); }
 .compare-table th, .compare-table td { vertical-align: top; }.compare-table label { display: inline-flex; flex-direction: row; align-items: center; gap: 6px; }.difference-mark, .match-mark { display: block; width: max-content; margin-top: 4px; padding: 2px 5px; font-size: .52rem; border-radius: 2px; }.difference-mark { color: var(--warning); background: var(--warning-pale); }.match-mark { color: var(--success); background: var(--success-pale); }
 .merge-preview { padding: 13px; color: var(--ink-soft); background: var(--surface-subtle); border-left: 3px solid var(--teal); font-size: .75rem; }.duplicate-compare > button { color: white; background: var(--teal-dark); border-color: var(--teal-dark); }
+.merge-summary-counts { margin: 0 0 12px; color: var(--muted); font-size: .72rem; font-weight: 700; }
+.toggle-matching-fields { display: inline-block; margin: 10px 0; padding: 6px 10px; color: var(--ink-soft); background: transparent; border: 1px solid var(--line-strong); border-radius: var(--radius); font-size: .68rem; font-weight: 700; cursor: pointer; }
+.toggle-matching-fields:hover { background: var(--surface-subtle); }
+.merge-record-preview { margin: 14px 0; padding: 13px; background: var(--surface-subtle); border: 1px solid var(--line); border-radius: var(--radius); }
+.merge-record-preview-title { margin: 0 0 8px; color: var(--ink); font-size: .72rem; font-weight: 700; }
+.merge-record-preview dl { margin: 0; display: grid; grid-template-columns: repeat(auto-fit, minmax(180px, 1fr)); gap: 6px 16px; }
+.merge-record-preview dt { margin: 0; color: var(--muted); font-size: .62rem; font-weight: 700; text-transform: uppercase; letter-spacing: .05em; }
+.merge-record-preview dd { margin: 1px 0 0; color: var(--ink); font-size: .78rem; }
 .confirm-bar { margin-top: 13px; padding: 15px; background: var(--warning-pale); border: 1px solid #eed4aa; }.confirm-bar p { margin: 0 0 11px; color: #75420c; font-size: .75rem; font-weight: 700; }.confirm-bar button:first-of-type { color: white; background: var(--critical); border-color: var(--critical); }
 .resolution-actions { display: flex; gap: 9px; }.evidence-block { max-width: 100%; padding: 13px; overflow: auto; color: #324054; background: var(--surface-subtle); border: 1px solid var(--line); font-size: .68rem; }
 .evidence-disclosure { margin-top: 14px; }.evidence-disclosure summary { font-size: .68rem; font-weight: 700; text-transform: uppercase; letter-spacing: .05em; }.evidence-disclosure .evidence-block { margin-top: 8px; }
@@ -321,7 +343,9 @@ details summary { cursor: pointer; color: var(--teal-dark); }.data-table details
 .resolution-actions .button-tertiary:hover { color: var(--ink); background: var(--surface); border-color: var(--line); }
 .resolution-actions .button-tertiary-destructive:hover { color: var(--critical); background: var(--surface); border-color: var(--line); }

-.integration-cards { display: grid; grid-template-columns: repeat(3, 1fr); gap: 12px; margin-bottom: 28px; }.integration-cards article { min-height: 170px; display: grid; grid-template-columns: auto 1fr; gap: 12px; padding: 18px; background: white; border: 1px solid var(--line); border-radius: var(--radius); }.integration-cards .badge { grid-column: 1 / -1; width: max-content; align-self: end; }.integration-cards h2 { margin: 3px 0 7px; font-size: .95rem; }.integration-cards p { margin: 0; color: var(--muted); font-size: .7rem; line-height: 1.48; }.integration-kicker { color: var(--muted); font-size: .56rem; font-weight: 700; text-transform: uppercase; letter-spacing: .09em; }
+.integration-cards { display: grid; grid-template-columns: repeat(3, 1fr); gap: 12px; margin-bottom: 28px; }.integration-cards article { min-height: 0; display: grid; grid-template-columns: auto 1fr; gap: 12px; padding: 18px; background: white; border: 1px solid var(--line); border-radius: var(--radius); }.integration-cards .badge { grid-column: 1 / -1; width: max-content; align-self: end; }
+.integration-cards .integration-badge-stack { grid-column: 1 / -1; display: flex; flex-wrap: wrap; gap: 6px; align-self: end; }
+.integration-cards small { display: block; margin-top: 4px; color: var(--muted-light); font-size: var(--type-meta); }.integration-cards h2 { margin: 3px 0 7px; font-size: 1rem; }.integration-cards p { margin: 0; color: var(--muted); font-size: var(--type-body); line-height: 1.48; }.integration-kicker { color: var(--muted); font-size: var(--type-label); font-weight: 700; text-transform: uppercase; letter-spacing: .09em; }

 .scenario-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(280px, 1fr)); gap: 14px; }
 .scenario-card { display: flex; flex-direction: column; gap: 10px; padding: 18px; background: var(--surface); border: 1px solid var(--line); border-radius: var(--radius); }
@@ -435,16 +459,16 @@ details summary { cursor: pointer; color: var(--teal-dark); }.data-table details
 .demo-guide-restart:disabled { opacity: .6; cursor: not-allowed; }

@media (max-width: 960px) {
-  .app-shell { display: block; }.app-workspace { min-height: 100vh; }.sidebar { width: min(286px, 86vw); transform: translateX(-102%); transition: transform .22s ease; box-shadow: var(--shadow-float); }.sidebar.is-open { transform: none; }.nav-scrim { display: block; position: fixed; inset: 0; z-index: 25; width: 100%; height: 100%; padding: 0; background: rgba(5, 12, 22, .48); border: 0; }.mobile-menu { display: grid; }.topbar { padding: 0 20px; }.operator > span:last-child, .global-search kbd { display: none; }.topbar-meta > .language-switcher-compact { display: none; }.sidebar-language { display: block; }.global-search { width: min(460px, 55vw); }.mobile-nav { position: fixed; inset: auto 0 0; z-index: 22; height: 65px; display: grid; grid-template-columns: repeat(6, 1fr); padding-bottom: env(safe-area-inset-bottom); background: rgba(255,255,255,.98); border-top: 1px solid var(--line); }.mobile-nav a, .mobile-nav button { min-width: 0; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 4px; color: var(--muted); background: transparent; border: 0; text-decoration: none; font-size: .55rem; font-weight: 700; cursor: pointer; }.mobile-nav svg { width: 18px; height: 18px; }.mobile-nav a.active { color: var(--teal-dark); }.mobile-nav a.active::before { content: ""; position: absolute; top: 0; width: 28px; height: 2px; background: var(--teal); }.app-footer { padding-bottom: 65px; }.operations-grid, .secondary-grid { grid-template-columns: 1fr; }.integration-cards { grid-template-columns: 1fr; }.login-shell { grid-template-columns: 1fr; }.login-story { min-height: 44vh; padding: 28px 8vw; }.login-message { margin: auto 0; }.login-message h1 { font-size: clamp(2.5rem, 9vw, 4rem); }.login-message > p:last-child { margin-top: 15px; }.control-illustration { width: 55vw; opacity: .45; right: -10vw; top: -5vw; }.login-footnote { margin-top: 20px; }.login-access { min-height: 56vh; padding: 42px 8vw 60px; }
+  .app-shell { display: block; }.app-workspace { min-height: 100vh; }.sidebar { width: min(286px, 86vw); transform: translateX(-102%); transition: transform .22s ease; box-shadow: var(--shadow-float); }.sidebar.is-open { transform: none; }.nav-scrim { display: block; position: fixed; inset: 0; z-index: 25; width: 100%; height: 100%; padding: 0; background: rgba(5, 12, 22, .48); border: 0; }.mobile-menu { display: grid; }.topbar { padding: 0 20px; }.operator > span:last-child, .global-search kbd { display: none; }.topbar-meta > .language-switcher-compact { display: none; }.sidebar-language { display: block; }.global-search { width: min(460px, 55vw); }.mobile-nav { position: fixed; inset: auto 0 0; z-index: 22; height: 68px; display: grid; grid-template-columns: repeat(6, 1fr); padding-bottom: env(safe-area-inset-bottom); background: rgba(255,255,255,.98); border-top: 1px solid var(--line); }.mobile-nav a, .mobile-nav button { min-width: 44px; min-height: 44px; display: flex; flex-direction: column; align-items: center; justify-content: center; gap: 4px; color: var(--muted); background: transparent; border: 0; text-decoration: none; font-size: .69rem; font-weight: 700; cursor: pointer; }.mobile-nav svg { width: 18px; height: 18px; }.mobile-nav a.active { color: var(--teal-dark); }.mobile-nav a.active::before { content: ""; position: absolute; top: 0; width: 28px; height: 2px; background: var(--teal); }.app-footer { padding-bottom: 68px; }.operations-grid, .secondary-grid { grid-template-columns: 1fr; }.integration-cards { grid-template-columns: 1fr; }.login-shell { grid-template-columns: 1fr; }.login-story { min-height: 44vh; padding: 28px 8vw; }.login-message { margin: auto 0; }.login-message h1 { font-size: clamp(2.5rem, 9vw, 4rem); }.login-message > p:last-child { margin-top: 15px; }.control-illustration { width: 55vw; opacity: .45; right: -10vw; top: -5vw; }.login-footnote { margin-top: 20px; }.login-access { min-height: 56vh; padding: 42px 8vw 60px; }
 }

@media (max-width: 700px) {
-  #main-content { width: min(100% - 28px, 620px); padding: 24px 0 90px; }.topbar { height: 58px; padding: 0 14px; gap: 8px; }.global-search { flex: 1; width: auto; }.topbar-meta { gap: 3px; }.operator { padding-left: 7px; border: 0; }.demo-badge-trigger { height: 28px; padding: 0 9px; font-size: .6rem; }.demo-guide-trigger span:not(.demo-guide-progress-pill) { display: none; }.demo-guide-panel { top: auto; right: 0; bottom: 65px; left: 0; width: 100%; height: min(78vh, 640px); border-left: 0; border-top: 1px solid var(--line); border-radius: 14px 14px 0 0; transition: height .2s ease; }.demo-guide-panel.sheet-full { height: min(78vh, 640px); }.demo-guide-panel.sheet-half { height: min(42vh, 340px); }.demo-guide-panel.sheet-collapsed { height: auto; gap: 4px; padding-bottom: 12px; }.demo-guide-sheet-handle { width: 100%; display: flex; justify-content: center; padding: 4px 0 2px; background: transparent; border: 0; cursor: pointer; }.demo-guide-sheet-handle span { width: 36px; height: 4px; background: var(--line-strong); border-radius: 999px; }@media (prefers-reduced-motion: reduce) { .demo-guide-panel { transition: none; } }.demo-start-panel { flex-direction: column; align-items: flex-start; padding: 14px; }.demo-start-actions { width: 100%; }.demo-start-actions .button { flex: 1; min-width: 0; white-space: normal; text-align: center; }.page-header { align-items: flex-start; margin-bottom: 20px; }.page-header h1 { font-size: 1.65rem; }.page-actions { display: none; }.page-description { font-size: .78rem; }.readiness-band { display: block; }.readiness-label { min-height: 62px; border-right: 0; border-bottom: 1px solid var(--line); }.readiness-metrics { grid-template-columns: repeat(5, minmax(66px, 1fr)); overflow-x: auto; }.metric-cell { min-width: 68px; padding: 12px 9px; }.metric-cell dd { font-size: 1.18rem; }.metric-cell dt { font-size: .53rem; }.section-heading { padding: 14px; }.section-heading > a { display: none; }.queue-controls { padding: 9px 14px; }.attention-list li { grid-template-columns: auto minmax(0,1fr) 14px; padding-inline: 14px; }.queue-ref { display: none; }.attention-detail { white-space: normal; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; }.movement-timeline { padding-inline: 14px; }.integration-list li, .recent-list li { padding-inline: 14px; }.recent-list time { display: none; }
-  .filters { display: grid; grid-template-columns: 1fr 1fr; padding: 12px; }.filters label:first-child { grid-column: 1 / -1; }.filters input[type="text"], .filters select { min-width: 0; width: 100%; }.checkbox-label { align-self: center; }
-  .table-shell { overflow: visible; border: 0; background: transparent; }.table-meta { border: 1px solid var(--line); border-radius: var(--radius); margin-bottom: 9px; }.data-table, .data-table tbody { display: block; }.data-table thead { display: none; }.data-table tr { display: block; margin-bottom: 9px; padding: 7px 0; background: white; border: 1px solid var(--line); border-radius: var(--radius); }.data-table th, .data-table td { min-height: 34px; height: auto; display: grid; grid-template-columns: minmax(90px, .8fr) minmax(0, 1.3fr); align-items: center; gap: 10px; padding: 7px 12px; border: 0; text-align: right; font-size: .71rem; }.data-table th[scope="row"] { text-align: right; }.data-table th::before, .data-table td::before { content: attr(data-label); color: var(--muted); font-size: .57rem; font-weight: 700; text-align: left; text-transform: uppercase; letter-spacing: .06em; }.compare-table th, .compare-table td { text-align: left; }.pagination { justify-content: space-between; padding-inline: 0; border: 0; }
+  #main-content { width: min(100% - 28px, 620px); padding: 24px 0 90px; }.topbar { height: 58px; padding: 0 14px; gap: 8px; }.global-search { flex: 1; width: auto; }.topbar-meta { gap: 3px; }.operator { padding-left: 7px; border: 0; }.demo-badge-trigger { height: 28px; padding: 0 9px; font-size: var(--type-meta); }.demo-guide-trigger span:not(.demo-guide-progress-pill) { display: none; }.demo-guide-panel { top: auto; right: 0; bottom: 65px; left: 0; width: 100%; height: min(78vh, 640px); border-left: 0; border-top: 1px solid var(--line); border-radius: 14px 14px 0 0; transition: height .2s ease; }.demo-guide-panel.sheet-full { height: min(78vh, 640px); }.demo-guide-panel.sheet-half { height: min(42vh, 340px); }.demo-guide-panel.sheet-collapsed { height: auto; gap: 4px; padding-bottom: 12px; }.demo-guide-sheet-handle { width: 100%; display: flex; justify-content: center; padding: 4px 0 2px; background: transparent; border: 0; cursor: pointer; }.demo-guide-sheet-handle span { width: 36px; height: 4px; background: var(--line-strong); border-radius: 999px; }@media (prefers-reduced-motion: reduce) { .demo-guide-panel { transition: none; } }.demo-start-panel { flex-direction: column; align-items: flex-start; padding: 14px; }.demo-start-actions { width: 100%; }.demo-start-actions .button { flex: 1; min-width: 0; white-space: normal; text-align: center; }.page-header { align-items: flex-start; margin-bottom: 20px; }.page-header h1 { font-size: 1.65rem; }.page-actions { width: 100%; justify-content: flex-start; }.page-description { font-size: var(--type-body); }.readiness-band { display: block; }.readiness-label { min-height: 62px; border-right: 0; border-bottom: 1px solid var(--line); }.readiness-metrics { grid-template-columns: repeat(5, minmax(66px, 1fr)); overflow-x: auto; }.metric-cell { min-width: 68px; padding: 12px 9px; }.metric-cell dd { font-size: 1.18rem; }.metric-cell dt { font-size: .65rem; }.section-heading { padding: 14px; }.section-heading > a { display: none; }.queue-controls { padding: 9px 14px; }.attention-list li { grid-template-columns: auto minmax(0,1fr) 14px; padding-inline: 14px; }.queue-ref { display: none; }.attention-detail { white-space: normal; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; }.movement-timeline { padding-inline: 14px; }.integration-list li, .recent-list li { padding-inline: 14px; }.recent-list time { display: none; }
+  .filters { display: grid; grid-template-columns: 1fr 1fr; padding: 12px; }.filters label:first-child { grid-column: 1 / -1; }.filters input[type="text"], .filters input[type="search"], .filters input[type="date"], .filters select { min-width: 0; width: 100%; }.checkbox-label { align-self: center; }
+  .table-shell { overflow: visible; border: 0; background: transparent; }.table-meta { border: 1px solid var(--line); border-radius: var(--radius); margin-bottom: 9px; }.data-table, .data-table tbody { display: block; }.data-table thead { display: none; }.data-table tr { display: block; margin-bottom: 9px; padding: 7px 0; background: white; border: 1px solid var(--line); border-radius: var(--radius); }.data-table th, .data-table td { min-height: 40px; height: auto; display: grid; grid-template-columns: minmax(92px, .8fr) minmax(0, 1.3fr); align-items: center; gap: 10px; padding: 8px 12px; border: 0; text-align: right; font-size: var(--type-body); }.data-table th[scope="row"] { text-align: right; }.data-table th::before, .data-table td::before { content: attr(data-label); color: var(--muted); font-size: var(--type-label); font-weight: 700; text-align: left; text-transform: uppercase; letter-spacing: .06em; }.compare-table th, .compare-table td { text-align: left; }.pagination { justify-content: space-between; padding-inline: 0; border: 0; }
  .tabs { margin-inline: -2px; }.record-surface { padding: 10px; }.detail-grid { grid-template-columns: 1fr 1fr; }.detail-grid div { min-height: 70px; padding: 11px; }.return-progress { padding-inline: 12px; gap: 6px; }.return-progress b { width: 20px; }.return-progress span { font-size: .58rem; }.return-form > .section-heading { padding: 16px; }.return-capture, .return-review { padding: 16px; }.form-grid, .condition-fieldset, .review-facts { grid-template-columns: 1fr; }.condition-fieldset { display: grid; }.review-facts div { display: flex; justify-content: space-between; align-items: center; }.review-facts dd { margin: 0; }.form-actions { padding: 12px 16px; }.form-actions .button { flex: 1; }.duplicate-compare { padding: 14px; }.duplicate-compare fieldset label { display: flex !important; margin-bottom: 8px; }.integration-cards article { min-height: 140px; }.knowledge-input-row { align-items: stretch; }.knowledge-input-row .button { min-width: 72px; padding-inline: 10px; }.knowledge-empty { min-height: 250px; padding: 22px 16px; }.retrieval-flow { width: 100%; gap: 4px; }.retrieval-flow span { padding: 5px; font-size: .52rem; }.retrieval-flow i { flex: 1; min-width: 5px; }.login-story { min-height: 38vh; }.login-message > p:last-child { font-size: .8rem; }.control-illustration { display: none; }.login-access { min-height: 62vh; padding: 34px 20px 50px; }.login-options button { min-height: 72px; }.app-footer { display: none; }
 }

@media (max-width: 440px) {
-  .global-search input::placeholder { color: transparent; }.global-search { max-width: 118px; }.topbar-meta { margin-left: auto; }.demo-guide-trigger { display: none; }.avatar { width: 29px; height: 29px; }.mobile-nav a span, .mobile-nav button span { max-width: 56px; overflow: hidden; text-overflow: ellipsis; }.filters { grid-template-columns: 1fr; }.filters label:first-child { grid-column: auto; }.detail-grid { grid-template-columns: 1fr; }.readiness-metrics { margin-right: -1px; }.badge { font-size: .55rem; }.page-header h1 { font-size: 1.5rem; }.login-message h1 { font-size: 2.6rem; }
+  .global-search { max-width: 144px; }.topbar-meta { margin-left: auto; }.demo-guide-trigger { display: none; }.avatar { width: 29px; height: 29px; }.mobile-nav a span, .mobile-nav button span { max-width: 58px; overflow: hidden; text-overflow: ellipsis; }.filters { grid-template-columns: 1fr; }.filters label:first-child { grid-column: auto; }.detail-grid { grid-template-columns: 1fr; }.readiness-metrics { margin-right: -1px; }.badge { font-size: var(--type-badge); }.page-header h1 { font-size: 1.5rem; }.login-message h1 { font-size: 2.6rem; }
 }
@@ -1,13 +1,19 @@
 # n8n workflows

-`mobilityops-return-processing.json` is a starter import for the required live workflow.
+Canonical, live-validated workflow definitions live under `n8n/workflows/`. Each file is a
+cleaned export (secret values replaced by named-credential references, never literal
+tokens) of the workflow actually running on `https://n8n.itworx.tech`. See
+`n8n/workflows/MANIFEST.md` for the authoritative list: canonical name, purpose, trigger,
+required credentials, live workflow ID, active status and a checksum of each file.

-Before final validation Claude must:
+The two pre-integration starter files that used to live directly under `n8n/`
+(`mobilityops-return-processing.json`, `mobilityops-scheduled-quality-scan.json`) have been
+retired — they predate the live n8n validation pass and embedded the service token as a
+literal header value instead of a Header Auth credential. Do not resurrect them; the
+`n8n/workflows/` versions are the superseding source of truth and are what
+`deploy/unraid/setup-existing-n8n.sh` / `setup-scheduled-scan.sh` import.

-1. import or provision the workflow;
-2. configure a service credential for the MobilityOps callback;
-3. activate the webhook;
-4. ensure event ID is used as the idempotency key;
-5. validate online success and offline retry behaviour.
-
-The callback URL in the starter file is intentionally environment-driven and may require an n8n expression or credential adjustment.
+Deploying a workflow from these files into a fresh or existing n8n instance still requires a
+one-time manual step: create the named Header Auth credentials in the n8n UI (see each
+workflow's `credentials` block and the manifest) before publishing. This is deliberate —
+credential values are never committed to the repository.
@@ -0,0 +1,105 @@
+# n8n workflow manifest
+
+Source of truth for the four canonical Fleet Ops n8n workflows. Definitions in this
+directory are cleaned exports of the live workflows on `https://n8n.itworx.tech` —
+credential values are never embedded; nodes reference named n8n credentials instead. Run
+`n8n/workflows/check_drift.py` to compare a live workflow against its repo definition.
+
+## 1. Fleet Ops — Vehicle Return Orchestration
+
+| Field | Value |
+|---|---|
+| File | `fleet-ops-vehicle-return.json` |
+| Purpose | Orchestrate the post-return follow-up (cleaning vs. attention-required) once Fleet Ops emits a `vehicle.returned.v1` outbox event, and report the result back to Fleet Ops. |
+| Trigger | Production webhook, `POST /webhook/mobilityops-return`, Header Auth (`Fleet Ops Webhook Trigger Token`) |
+| Event contract | `contracts/events.schema.json`, `event_type: vehicle.returned.v1` (envelope: `event_id`, `event_type`, `occurred_at`, `correlation_id`, `aggregate`, `data`) |
+| Required credentials | `Fleet Ops Webhook Trigger Token` (Header Auth, on the trigger); `Fleet Ops Service Token` (Header Auth, on the outbound HTTP call) |
+| Live workflow ID | `mobilityops-return-processing` |
+| Active status (as of 2026-08-04) | Active / Published |
+| Error Workflow | `Fleet Ops — Workflow Error Handler` (wired) |
+| Timeouts / bounded retries | `Record follow-up` HTTP node: 15s timeout, retry on fail (3 tries, 1000ms wait) |
+| Checksum (sha256) | `e5b6ba02a7824867620ceaf214224521d52de76337604b947f26f1b0b5432358` (updated 2026-08-05 — the committed file had invalid JSON, a missing `},` between two node objects; fixed, no live workflow change) |
+
+## 2. Fleet Ops — Scheduled Data Quality Scan
+
+| Field | Value |
+|---|---|
+| File | `fleet-ops-data-quality-scan.json` |
+| Purpose | Periodically (and on-demand) run the Fleet Ops data-quality scan and summarize created-issue counts per rule. |
+| Trigger | Schedule Trigger (hourly, Europe/Brussels instance timezone) + Manual Trigger for on-demand test runs |
+| Event contract | N/A — HTTP-triggered scan call, no inbound event envelope. Request: `POST /api/v1/integrations/n8n/scheduled-scan`, Header Auth. |
+| Required credentials | `Fleet Ops Service Token` (Header Auth, on the scan HTTP call) |
+| Live workflow ID | `mobilityops-scheduled-quality-scan` |
+| Active status (as of 2026-08-04) | Active / Published |
+| Error Workflow | `Fleet Ops — Workflow Error Handler` (wired) |
+| Timeouts / bounded retries | `Run quality scan` HTTP node: 15s timeout, retry on fail (3 tries, 1000ms wait) |
+| Checksum (sha256) | `c0d46e0519118e6336e35c4ea2a67edb2f14bd007909ccf9256c93733751244a` |
+
+## 3. Fleet Ops — RAGcore Procedure Sync
+
+Fully built and saved live (6 real nodes: Schedule Trigger → List procedures → Prepare
+uploads → Upload to RAGcore → Summarize sync result → Report sync result to Fleet Ops).
+
+**Published/active as of 2026-08-05**, once RAGcore itself went live (see
+`PROJECT_STATE.md`'s "RAGcore actually went live" entry): the workflow's `RAGcore Sync
+Token` credential had also gone stale from the same credential rotation, so a fresh,
+dedicated, minimally-scoped (`sources:sync` only) credential was minted before
+publishing. Verified with a real manual execution first — 33 procedures synced, 0
+failed, Fleet Ops registered the result (`execution_id` 159) — before flipping it to
+run unattended on its daily schedule.
+
+While validating this workflow (2026-08-05), found and fixed a real defect: the "Report
+sync result to Fleet Ops" node's three body-parameter expressions each had a stray
+trailing `}}` (e.g. `={{ $json.execution_id }} }}` instead of `={{ $json.execution_id
+}}`), which would have sent malformed values on every real run. Fixed via `n8n
+import:workflow` (the safe CLI path — not the REST API, which caused a prior wipe
+incident in this environment) against the same live workflow ID, keeping it inactive;
+re-exported and verified the fix applied with no other change (still 6 real nodes,
+`active: false`). Also found and fixed a second gap: `settings.errorWorkflow` was unset
+(workflows 1-2 wire `"errorWorkflow": "Xppn2rAEqUuyiCJF"`, workflow 3 did not) — wired it
+the same way via the same CLI import path, re-verified.
+
+| Field | Value |
+|---|---|
+| File | `fleet-ops-ragcore-procedure-sync.json` |
+| Purpose | Sync the trilingual procedure documents from Fleet Ops into RAGcore as source documents, keeping stable per-document IDs and skipping unchanged content. |
+| Trigger | Schedule Trigger (daily at midnight) |
+| Event contract | N/A — HTTP-triggered sync. Reads `GET /api/v1/integrations/n8n/procedures`, uploads via RAGcore's `POST /v1/uploads`, reports via `POST /api/v1/integrations/n8n/procedures-sync-result`. |
+| Required credentials | `Fleet Ops Service Token` (Header Auth, on the procedures-list and result-report calls); `RAGcore Sync Token` (Header Auth, `sources:sync` scope, on the upload call) |
+| Live workflow ID | `6wbkc4d1AouGpmWT` |
+| Active status (as of 2026-08-05) | **Active / Published** |
+| Error Workflow | `Fleet Ops — Workflow Error Handler` (wired) |
+| Checksum (sha256) | `643c0515a50fed3d35e28f0b8cb17841f6f8d91699944980b5c56e619d5bf2a6` |
+
+## 4. Fleet Ops — Workflow Error Handler
+
+Central technical workflow attached to all three other Fleet Ops workflows (1, 2, 3) via
+n8n's per-workflow "Error Workflow" setting. Receives n8n's
+standard Error Trigger payload, derives a bounded/secret-free failure report (safe error
+category, truncated summary, no stack trace, no headers/tokens), and POSTs it to Fleet
+Ops, which registers an audit event idempotently keyed on `execution_id`.
+
+| Field | Value |
+|---|---|
+| File | `fleet-ops-error-handler.json` |
+| Purpose | Central error notification target for all other Fleet Ops n8n workflows |
+| Trigger | Error Trigger (fired by n8n when an attached workflow's execution fails) |
+| Event contract | None inbound (n8n's built-in error-trigger payload); outbound `POST /api/v1/integrations/n8n/workflow-error`, Header Auth, body: `workflow_id, workflow_name, execution_id, failed_at, error_category (timeout\|authError\|connectionError\|httpError\|validationError\|unknown), error_summary, trigger_context, correlation_id, attempt, retry_action` |
+| Required credentials | `Fleet Ops Service Token` (Header Auth, on the outbound HTTP call — same credential workflows 1-2 use) |
+| Live workflow ID | `Xppn2rAEqUuyiCJF` |
+| Active status (as of 2026-08-04) | Active / Published |
+| Error Workflow (on itself) | `- No Workflow -` (deliberately unset — prevents a recursive error loop) |
+| Checksum (sha256) | `d9e2795b917a89a9b4a733e435661585f8011bc97f134d3643dee93ea05b0be6` |
+
+Validated this round: mock-data run (Error Trigger pinned to a realistic payload)
+produced a real `200 {"status":"registered", ...}` from the live Fleet Ops server;
+re-running the identical payload produced `"status":"already_registered"`, confirming
+execution_id idempotency. A genuine induced failure (temporarily pointing workflow 2's
+HTTP node at a nonexistent path, then reverting) confirmed workflow 2 itself fails
+correctly against a broken endpoint and recovers cleanly once reverted; n8n's Error
+Workflow trigger did not fire for that *manual* "Execute workflow" editor run — n8n only
+invokes Error Workflow for unattended/production trigger executions, not manual test
+runs from the editor. This is a known limitation of the live-validation evidence for this
+round: the mock-data path exercises the same nodes/logic and the real Fleet Ops
+endpoint, but a fully automatic (schedule- or webhook-triggered) failure cascading into
+this handler was not observed live.
@@ -0,0 +1,148 @@
+#!/usr/bin/env python3
+"""Report drift between the repo's cleaned workflow definitions and the live n8n instance.
+
+Read-only: this script only issues GET requests against n8n's Public API. It never writes,
+imports, activates, or otherwise modifies anything in n8n -- fixing drift is a deliberate,
+reviewed action a human takes in the n8n UI (or via a separate, explicit import step), not
+something this script does automatically.
+
+Usage:
+    N8N_BASE_URL=https://n8n.itworx.tech N8N_API_KEY=... python n8n/workflows/check_drift.py
+
+N8N_API_KEY must be an n8n Public API key (n8n UI -> Settings -> API), not a session cookie
+and not a workflow credential. It is read from the environment only and is never printed.
+
+Exit code is 0 when every checked workflow matches the live instance, 1 when any drift (or
+a fetch error) is found, so this is safe to wire into CI as a non-blocking check.
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+from pathlib import Path
+from typing import Any
+
+WORKFLOWS_DIR = Path(__file__).parent
+
+# (repo file name, live workflow ID) -- kept in sync with MANIFEST.md by hand, since the
+# manifest is the human-readable source of truth and this is just its machine-checkable echo.
+KNOWN_WORKFLOWS = [
+    ("fleet-ops-vehicle-return.json", "mobilityops-return-processing"),
+    ("fleet-ops-data-quality-scan.json", "mobilityops-scheduled-quality-scan"),
+    ("fleet-ops-error-handler.json", "Xppn2rAEqUuyiCJF"),
+    ("fleet-ops-ragcore-procedure-sync.json", "6wbkc4d1AouGpmWT"),
+]
+
+# Fields that legitimately differ between a committed definition and the live instance
+# (instance-assigned identifiers, timestamps, UI-only cosmetics) and must not be reported
+# as drift.
+_VOLATILE_TOP_LEVEL_KEYS = {
+    "versionId",
+    "createdAt",
+    "updatedAt",
+    "pinData",
+    "staticData",
+    "shared",
+    "triggerCount",
+    "isArchived",
+}
+_VOLATILE_NODE_KEYS = {"position", "webhookId"}
+
+
+def _strip_credential_ids(value: Any) -> Any:
+    """Live workflows carry instance-specific credential IDs alongside the credential name
+    (e.g. {"id": "3", "name": "Fleet Ops Service Token"}). The repo definitions intentionally
+    omit the id, since it's meaningless outside the instance that issued it. Drop it from both
+    sides so credential *references* are compared by name only."""
+    if isinstance(value, dict):
+        if set(value.keys()) <= {"id", "name"} and "name" in value:
+            return {"name": value["name"]}
+        return {k: _strip_credential_ids(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_strip_credential_ids(v) for v in value]
+    return value
+
+
+def _normalize_node(node: dict[str, Any]) -> dict[str, Any]:
+    cleaned = {k: v for k, v in node.items() if k not in _VOLATILE_NODE_KEYS}
+    return _strip_credential_ids(cleaned)
+
+
+def _normalize_workflow(doc: dict[str, Any]) -> dict[str, Any]:
+    nodes_by_name = {n["name"]: _normalize_node(n) for n in doc.get("nodes", [])}
+    return {
+        "name": doc.get("name"),
+        "active": doc.get("active"),
+        "nodes": nodes_by_name,
+        "connections": doc.get("connections", {}),
+        "settings": doc.get("settings", {}),
+    }
+
+
+def _diff(path: str, local: Any, live: Any, out: list[str]) -> None:
+    if isinstance(local, dict) and isinstance(live, dict):
+        for key in sorted(set(local) | set(live)):
+            if key in _VOLATILE_TOP_LEVEL_KEYS:
+                continue
+            if key not in live:
+                out.append(f"{path}.{key}: present in repo, missing live")
+            elif key not in local:
+                out.append(f"{path}.{key}: present live, missing in repo")
+            else:
+                _diff(f"{path}.{key}", local[key], live[key], out)
+    elif local != live:
+        out.append(f"{path}: repo={local!r} live={live!r}")
+
+
+def fetch_live_workflow(base_url: str, api_key: str, workflow_id: str) -> dict[str, Any]:
+    url = f"{base_url.rstrip('/')}/api/v1/workflows/{workflow_id}"
+    request = urllib.request.Request(url, headers={"X-N8N-API-KEY": api_key, "Accept": "application/json"})
+    with urllib.request.urlopen(request, timeout=15) as response:  # noqa: S310 (fixed https base url from env)
+        return json.load(response)
+
+
+def main() -> int:
+    base_url = os.environ.get("N8N_BASE_URL")
+    api_key = os.environ.get("N8N_API_KEY")
+    if not base_url or not api_key:
+        print(
+            "Set N8N_BASE_URL and N8N_API_KEY (an n8n Public API key) in the environment.",
+            file=sys.stderr,
+        )
+        return 1
+
+    any_drift = False
+    for filename, workflow_id in KNOWN_WORKFLOWS:
+        repo_path = WORKFLOWS_DIR / filename
+        local_doc = json.loads(repo_path.read_text(encoding="utf-8"))
+
+        try:
+            live_doc = fetch_live_workflow(base_url, api_key, workflow_id)
+        except urllib.error.HTTPError as exc:
+            print(f"[{filename}] FAILED to fetch live workflow {workflow_id}: HTTP {exc.code}")
+            any_drift = True
+            continue
+        except urllib.error.URLError as exc:
+            print(f"[{filename}] FAILED to fetch live workflow {workflow_id}: {exc.reason}")
+            any_drift = True
+            continue
+
+        differences: list[str] = []
+        _diff(filename, _normalize_workflow(local_doc), _normalize_workflow(live_doc), differences)
+
+        if differences:
+            any_drift = True
+            print(f"[{filename}] DRIFT from live workflow {workflow_id}:")
+            for line in differences:
+                print(f"  - {line}")
+        else:
+            print(f"[{filename}] matches live workflow {workflow_id}")
+
+    return 1 if any_drift else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
@@ -1,6 +1,6 @@
 {
  "id": "mobilityops-scheduled-quality-scan",
-  "name": "MobilityOps - Scheduled Quality Scan",
+  "name": "Fleet Ops — Scheduled Data Quality Scan",
  "nodes": [
    {
      "parameters": {
@@ -17,10 +17,7 @@
      "name": "Hourly schedule",
      "type": "n8n-nodes-base.scheduleTrigger",
      "typeVersion": 1.2,
-      "position": [
-        240,
-        220
-      ]
+      "position": [240, 220]
    },
    {
      "parameters": {},
@@ -28,23 +25,17 @@
      "name": "Manual test trigger",
      "type": "n8n-nodes-base.manualTrigger",
      "typeVersion": 1,
-      "position": [
-        240,
-        400
-      ]
+      "position": [240, 400]
    },
    {
      "parameters": {
        "method": "POST",
-        "url": "={{$env.MOBILITYOPS_API_URL || 'http://api:8000'}}/api/v1/integrations/n8n/scheduled-scan",
+        "url": "http://192.168.10.150:1236/api/v1/integrations/n8n/scheduled-scan",
+        "authentication": "genericCredentialType",
+        "genericAuthType": "httpHeaderAuth",
        "sendHeaders": true,
        "headerParameters": {
-          "parameters": [
-            {
-              "name": "X-Service-Token",
-              "value": "={{$env.MOBILITYOPS_CALLBACK_TOKEN}}"
-            }
-          ]
+          "parameters": []
        },
        "options": {
          "timeout": 15000
@@ -54,10 +45,15 @@
      "name": "Run quality scan",
      "type": "n8n-nodes-base.httpRequest",
      "typeVersion": 4.2,
-      "position": [
-        520,
-        300
-      ]
+      "position": [520, 300],
+      "credentials": {
+        "httpHeaderAuth": {
+          "name": "Fleet Ops Service Token"
+        }
+      },
+      "retryOnFail": true,
+      "maxTries": 3,
+      "waitBetweenTries": 1000
    },
    {
      "parameters": {
@@ -67,52 +63,24 @@
      "name": "Summarize result",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
-      "position": [
-        780,
-        300
-      ]
+      "position": [780, 300]
    }
  ],
  "connections": {
    "Hourly schedule": {
-      "main": [
-        [
-          {
-            "node": "Run quality scan",
-            "type": "main",
-            "index": 0
-          }
-        ]
-      ]
+      "main": [[{ "node": "Run quality scan", "type": "main", "index": 0 }]]
    },
    "Manual test trigger": {
-      "main": [
-        [
-          {
-            "node": "Run quality scan",
-            "type": "main",
-            "index": 0
-          }
-        ]
-      ]
+      "main": [[{ "node": "Run quality scan", "type": "main", "index": 0 }]]
    },
    "Run quality scan": {
-      "main": [
-        [
-          {
-            "node": "Summarize result",
-            "type": "main",
-            "index": 0
-          }
-        ]
-      ]
+      "main": [[{ "node": "Summarize result", "type": "main", "index": 0 }]]
    }
  },
  "settings": {
    "executionOrder": "v1"
  },
-  "active": false,
-  "versionId": "22222222-2222-4222-8222-222222222222",
+  "active": true,
  "meta": {
    "templateCredsSetupCompleted": false
  },
@@ -0,0 +1,75 @@
+{
+  "id": "Xppn2rAEqUuyiCJF",
+  "name": "Fleet Ops — Workflow Error Handler",
+  "nodes": [
+    {
+      "parameters": {},
+      "id": "error-trigger-node",
+      "name": "Error Trigger",
+      "type": "n8n-nodes-base.errorTrigger",
+      "typeVersion": 1,
+      "position": [240, 300]
+    },
+    {
+      "parameters": {
+        "mode": "each",
+        "jsCode": "const err = $json.execution?.error || {};\nconst rawMessage = String(err.message || err.description || 'Unknown error').replace(/[\\r\\n]+/g, ' ').slice(0, 490);\nconst lower = rawMessage.toLowerCase();\nlet category = 'unknown';\nif (lower.includes('timeout') || lower.includes('timed out')) category = 'timeout';\nelse if (lower.includes('401') || lower.includes('403') || lower.includes('unauthorized') || lower.includes('forbidden')) category = 'authError';\nelse if (lower.includes('econnrefused') || lower.includes('enotfound') || lower.includes('network')) category = 'connectionError';\nelse if (/\\b[45]\\d\\d\\b/.test(rawMessage)) category = 'httpError';\nelse if (lower.includes('valid')) category = 'validationError';\nconst workflow = $json.workflow || {};\nconst execution = $json.execution || {};\nreturn {\n  json: {\n    workflow_id: String(workflow.id || 'unknown'),\n    workflow_name: String(workflow.name || 'unknown'),\n    execution_id: String(execution.id || ('unknown-' + Date.now())),\n    failed_at: new Date().toISOString(),\n    error_category: category,\n    error_summary: rawMessage,\n    trigger_context: String(execution.mode || 'unknown').slice(0, 200),\n    correlation_id: null,\n    attempt: execution.retryOf ? 2 : 1,\n    retry_action: 'No automatic in-workflow retry. Check n8n execution history and the Fleet Ops Automation page for redelivery status.'\n  }\n};"
+      },
+      "id": "build-report-node",
+      "name": "Build safe error report",
+      "type": "n8n-nodes-base.code",
+      "typeVersion": 2,
+      "position": [500, 300]
+    },
+    {
+      "parameters": {
+        "method": "POST",
+        "url": "http://192.168.10.150:1236/api/v1/integrations/n8n/workflow-error",
+        "authentication": "genericCredentialType",
+        "genericAuthType": "httpHeaderAuth",
+        "sendBody": true,
+        "contentType": "json",
+        "specifyBody": "keypair",
+        "bodyParameters": {
+          "parameters": [
+            { "name": "workflow_id", "value": "={{ $json.workflow_id }}" },
+            { "name": "workflow_name", "value": "={{ $json.workflow_name }}" },
+            { "name": "execution_id", "value": "={{ $json.execution_id }}" },
+            { "name": "failed_at", "value": "={{ $json.failed_at }}" },
+            { "name": "error_category", "value": "={{ $json.error_category }}" },
+            { "name": "error_summary", "value": "={{ $json.error_summary }}" },
+            { "name": "trigger_context", "value": "={{ $json.trigger_context }}" },
+            { "name": "correlation_id", "value": "={{ $json.correlation_id }}" },
+            { "name": "attempt", "value": "={{ $json.attempt }}" },
+            { "name": "retry_action", "value": "={{ $json.retry_action }}" }
+          ]
+        },
+        "options": {}
+      },
+      "id": "report-node",
+      "name": "Report failure to Fleet Ops",
+      "type": "n8n-nodes-base.httpRequest",
+      "typeVersion": 4.2,
+      "position": [760, 300],
+      "credentials": {
+        "httpHeaderAuth": { "name": "Fleet Ops Service Token" }
+      }
+    }
+  ],
+  "connections": {
+    "Error Trigger": {
+      "main": [[{ "node": "Build safe error report", "type": "main", "index": 0 }]]
+    },
+    "Build safe error report": {
+      "main": [[{ "node": "Report failure to Fleet Ops", "type": "main", "index": 0 }]]
+    }
+  },
+  "settings": {
+    "executionOrder": "v1"
+  },
+  "active": true,
+  "meta": {
+    "templateCredsSetupCompleted": false
+  },
+  "tags": []
+}
--- a/Show More
+++ b/Show More