Growth & configuration

1 · Four nav entries, one page, four separated sections. Marketplace, Advisor pipeline, Branding and Integrations are configuration and growth, not queue work. Keeping them out of Action Required is what lets that group stay trustworthy. Section separation is a rule and a heading — never four different accent hues, because colour on this product means hub wayfinding or status, and inventing a fifth meaning breaks both.
2 · Exactly one primary emphasis, and it earns the colour. One offering is visible to exchangers while its qualification review says Unqualified. That is the only btn-primary on the surface. Every other action — connect, upload, sync, hide, show — is a neutral button. If a second thing ever deserves primary, the first has stopped deserving it.
3 · Status is derived from two or more facts, never one flag. A marketplace row carries publication and qualification as separate axes, each with its decision date and decider. YourListingsTab currently renders green Published whenever publishedVersionId exists regardless of qualifiedStatus; that collapse must go. A pipeline row derives its clocks from the stored identification and exchange deadlines and its escrow line from confirmed wire receipts — a closed sale holding funds can never render as “nothing submitted”.
4 · A passed statutory deadline never renders as satisfied. It stays red, it keeps the word passed, and no adjacent column — complete documents, cleared KYC, funds safely held — is allowed to make the row look healthy. Green means a signed designation exists on or before the date; nothing else earns it.
5 · Waiting-on is attribution, not decoration. Every row that two parties can act on names whose move it is: you, the exchanger, the title company, your IT admin, or Open1031 platform review. “Locked” rows say who holds the decision and that you cannot override it.
6 · The 506(c) ladder is four rungs and the fourth is shut. Public tombstone → self-attestation unlocks reading → documentary or third-party verification is required before any subscription → subscription is not available on this platform. No console control attests or verifies on an exchanger's behalf: accreditation is the investor's own statement and the issuer's verification duty, the same principle that forbids marking identity verified by proxy or signing a document for someone else. Accreditation sits after KYC and never substitutes for it.
7 · Branding is two bindings and the second one is locked. The branded org is bound to the software platform; the Qualified Intermediary of record is bound separately and today resolves to the constant PLATFORM_QI_OF_RECORD_NAME for every org. The exchanger footer sentence — “<org> is the software platform. The licensed Qualified Intermediary of record is Open1031 under IRC §1031.” — is not editable and no branding setting removes it. Two follow-ups fall out of this: the marketing pages that promise “you stay the QI of record” contradict the product and one of the two must change; and the slug hint in the console prints /org/{slug} when the only branded route is /o/:slug/login.
8 · Brand colour is token-driven, and the token has to be measured. BrandingProvider writes the partner hex into --primary and its ramp, so no component ever hardcodes a colour and both themes follow. But foregroundFor() flips the label at luminance 0.5 where sRGB flips near 0.18, so mid-tone brands ship a white label at roughly 3:1 on their own primary button. Pick the foreground with the higher measured ratio and block a save that clears 4.5:1 in neither direction.
9 · Integrations are brokered, and health is evidence. Connect emits a Vectr event; the browser never holds a token; every state change is audit-logged. The catalog is keyed by capability so a partner never sees a competitor's name in their own console. Health means last successful call, credential expiry and 24-hour error rate — not a badge that somebody once pressed Connect. All of it depends on a persisted connection-status endpoint, which is why the column is dashed: today status is React state that resets to Not connected on reload. CRM intake appears once here as a row and links to surfaces/qi-crm-sync-settings.html; its settings are not duplicated.
10 · Nothing on this surface can move money or satisfy a deadline. No approval control, no disbursement path, no exchanger-facing authorisation. Fund movement stays where the firewall is: two authorised officers, the approver never the proposer, and the exchanger never in the path at all.
Light and dark are both designed. All names, orgs, amounts, references and dates are synthetic.