Identifications & Deadlines

1 · Status is derived from evidence, never from one flag. A row's headline comes from the identified-property count, the signature record, the notice generation date and the elected rule's server-side re-check — not from hub_submissions.identification.submitted. A file with three properties and a signed notice reads satisfied even though its clock has passed; a file with a live clock and nothing identified reads at risk even though nobody has pressed anything. The exchanger's submission flag is one input among several and is never the headline on its own.
2 · An overdue clock never renders as satisfied, met, or green. It stays red, stays on the board, and stays actionable until a disposition is recorded. A missed date is not a completed step, and an override does not turn it into one — an override records an authorized correction or federally-authorized relief; it never creates a new identification period. Copy must say window closed or days past, never done.
3 · The original date is retained, never overwritten. previous_date is snapshotted at request time and re-snapshotted at apply time from the value actually replaced. Every surface that shows an adjusted deadline shows both: the controlling date, an Adjusted pill, and the superseded date struck through. A deadline that renders as a single date with no history is a rejection.
4 · Four eyes, two people, one transaction. The proposer's own submission is not an approval and is never rendered or counted as one — the approve control is disabled for the requester with the reason stated, the API returns 403 self_approval_blocked and audits the attempt, and the table's check constraint refuses it at the database. The exchanger is not in this path at all: no client party proposes, approves, or acknowledges an override as a condition of it taking effect, and no surface may add one.
5 · Waiting-on attribution on every row. Whose move it is, by name where a person is knowable: you, exchanger, a second QI officer, or the third party. Red is ours, amber is theirs, neutral is a third party, green is settled. At ~200 files per coordinator this is the highest value line on the page.
6 · Exactly one "Next step" marker on the surface. Here it is EX-2026-000212 — three days to the 45th day with an unsigned notice. Never zero, never two. Other rows still carry their real action; only the marker is unique.
7 · Every row carries its action inline and deep-links to the section it concerns. Open → Identification, Open → Purchases, Open → Deadlines each resolve to their own view. Never drop a coordinator on an overview to hunt for the thing the row just told them about.
8 · Two locks, two reasons, never one grey "read only". Locked · submitted is a legal disability — a QI is a disqualified party and cannot alter the taxpayer's signed instrument; the taxpayer must revoke and re-identify. Frozen · window closed is the statute. The shipped API collapses both into mutable; the UI must not.
9 · No affordance signs, verifies, or clears a gate on another party's behalf. The identification notice is signed by the exchanger — no "sign on behalf" control exists anywhere on this surface. Identity and AML are the first gate on every file and a coordinator can never mark them verified by proxy; this surface only reports their state.
10 · Refusals are visible, not silent. Blocked self-approval, blocked impersonation, ordering violations, the 366-day cap and rule denials all appear in the ledger as rows with a Refused outcome. A control that fired is evidence; hiding it makes the log read as though it never had to.
11 · Role truth in the chrome. Requesting or approving an override needs org_owner or org_admin. A coordinator sees the request read-only, with the controls rendered disabled and the reason named — not hidden, so nobody wonders whether the page is broken.
12 · Token contract and both themes. No colour literal survives to the implementation: every colour resolves through docs/mockups/tokens.css. Filled controls take the flipping foreground — --admin-on, --good-on, --bad-on — because the fill lightens in dark. --ink-4 is icons, rules, strike-through marks and disabled glyphs only, never body text. Hub hues are wayfinding (which clock), status stays on good/warn/bad with a label and an icon so colour is never the only carrier. Transitions run at --duration-fast and animate colour, border and elevation only; the loading pulse is the one loop and it stops under prefers-reduced-motion.
13 · Honest provenance stays in the markup. The book-wide identification table and the cross-file override queue carry Proposed pills until the list endpoint exists; the Adjusted annotation carries one until it is rendered outside the override dialog; and the forty-five-day-id-watcher notice stays until the workflow is live. Remove each pill in the same pull request that ships the capability — never before.
Light and dark are both designed here. All names, addresses, amounts, dates and references are synthetic demo data.