diff --git a/README.md b/README.md
index 6ed9875..3d55b01 100644
--- a/README.md
+++ b/README.md
@@ -2,29 +2,99 @@
 
 CivicAccess is the CivicSuite module for accessibility, plain-language, multilingual, and ADA Title II review-support workflows.
 
-Current state: **v0.4.0 standalone readiness candidate**. This repo contains a FastAPI package aligned to the published CivicCore v1.2.0 release wheel, health/root endpoints, readiness gates, WCAG-aligned review support, database-backed review records that default to the shared CivicCore PostgreSQL, accessible form planning, accessible publishing workflow checks, plain-language rewrites, multilingual draft variants, ADA Title II review-support packages, tagged-PDF expectations, records-ready export checklists, a stateless public accessibility checker at `/civicaccess`, and a staff review/export workspace at `/civicaccess/staff`. As of v0.4.0, persistent writes (saving reviews and records exports) require a trusted-write token, every write/export emits a persisted audit event, and the public surface analyzes without persisting. The previous `v1.0.0` release was published in error and remains historical evidence only.
+> **v0.4.0 · early release.** CivicAccess does **not** give legal advice, certify ADA compliance, issue official translations, or publish anything on its own — your staff, ADA coordinator, translators, and legal counsel always make the final call.
 
-CivicAccess does **not** provide legal advice, certified ADA compliance, official translation certification, live LLM calls, or final publication approval. City staff, ADA coordinators, translators, and qualified reviewers remain responsible for publication decisions.
+This README has two audiences:
 
-## What CivicAccess Does
+- **Civic staff (clerks, communicators, ADA coordinators)** — see the [User Manual, Part 1](USER-MANUAL.md#part-1--for-civic-staff) or the [landing page](docs/index.html). Short version below.
+- **IT & technical staff** — architecture, API, persistence, and security are below.
 
-- Reviews public content for actionable WCAG-aligned issues.
-- Reports local review-record persistence readiness through `/ready`.
-- Provides a staff queue for saved accessibility reviews and records-ready exports.
-- Checks accessible form publication basics: labels, required fields, validation copy, and record context.
-- Builds a staff publication workflow with accessibility, plain-language, translation-review, export, and approval steps.
-- Rewrites common municipal jargon into plainer language while preserving source/rewrite provenance.
-- Produces multilingual draft variants that are explicitly marked for human review.
-- Produces ADA Title II review-support checklists without claiming certification.
-- Checks tagged-PDF heading expectations before publication.
-- Builds records-ready export checklists that preserve source/rewrite provenance.
-- Provides a local API-backed accessibility review UI at `/civicaccess`.
+---
 
-## Release Integrity Correction
+## For civic staff (the short version)
 
-CivicAccess was previously demoted after a false `v1.0.0` release. The current branch is rebuilding that truthfully: it now has automatic local persistence, a staff workspace, and integration contracts, but it still must pass the current module-completion audit, suite integration proof, and clean-machine evidence before any finished/public-use label can be promoted. See [docs/release-integrity-correction-2026-05-21.md](docs/release-integrity-correction-2026-05-21.md).
+CivicAccess helps your office put out public notices everyone can read — and keep a record proving you checked.
 
-## Developer Quickstart
+- Paste a draft into the **public checker** to get instant, plain-language fixes. Nothing is saved — it's a safe place to try things.
+- To keep a review **on the record**, save it in the **staff workspace** and export a copy you can hand to a public-records request.
+- It also rewrites jargon, drafts translations for a human reviewer, and walks ADA Title II reviews — but never publishes anything on its own.
+
+Full walkthrough: [User Manual, Part 1](USER-MANUAL.md#part-1--for-civic-staff).
+
+---
+
+## For IT & technical staff
+
+CivicAccess is a deterministic FastAPI module (Python), pinned to the published CivicCore v1.2.0 release wheel — no model/LLM calls and no outbound network calls, so output is reproducible.
+
+### Architecture
+
+In CivicSuite Windows Local, a Tauri supervisor runs CivicAccess (and peer modules) against a bundled PostgreSQL on `127.0.0.1:15432`; CivicAccess uses a dedicated `civicaccess` schema. The supervisor's backup captures the whole data directory, so module data rides along.
+
+```mermaid
+flowchart TB
+  Resident["Resident (browser)"] -->|"public, read-only"| Pub["/civicaccess"]
+  Staff["City staff (browser)"] -->|"WebView2 UI"| StaffUI["/civicaccess/staff"]
+
+  subgraph Sup["Tauri supervisor — local machine only"]
+    CA["CivicAccess (FastAPI)"]
+    Peers["Peer modules: CivicClerk, CivicCode, CivicNotice, …"]
+    PG[("Bundled PostgreSQL :15432")]
+  end
+
+  Pub --> CA
+  StaffUI --> CA
+  CA -->|"DATABASE_URL → civicaccess schema"| PG
+  Peers --> PG
+  CA -->|"depends on"| Core["CivicCore v1.2.0"]
+  CA -. records-export .-> Records["CivicRecords AI"]
+  Sup -. "wholesale backup of Data/" .-> Backup[("Backup folder")]
+```
+
+### What it provides
+
+- A **stateless public accessibility checker** (`/civicaccess`) that flags WCAG-aligned issues with actionable, standard-referenced fixes — no persistence, no token.
+- A **token-guarded staff workspace** (`/civicaccess/staff`) for saving reviews and building records-ready exports.
+- Plain-language rewrites that preserve source/rewrite provenance.
+- Multilingual draft variants explicitly marked for human review.
+- ADA Title II review-support checklists (without claiming certification).
+- Accessible-form and tagged-PDF expectation checks, and a staff publication workflow.
+- A persisted **audit trail** of every write/export, and integration contracts for downstream publishers.
+
+### Runtime API
+
+| Method & path | Auth | Persists? | Purpose |
+|---|---|---|---|
+| `GET /` · `GET /health` | — | no | Status, boundaries, versions |
+| `GET /ready` · `GET /api/v1/civicaccess/readiness` | — | no | Persistence readiness gate |
+| `GET /civicaccess` · `GET /civicaccess/staff` | — | no | Public checker / staff workspace (UI) |
+| `POST /api/v1/civicaccess/analyze` | — | no | Stateless accessibility analysis |
+| `POST /api/v1/civicaccess/review` | **token** | **yes** | Save a review record (+ audit) |
+| `GET /api/v1/civicaccess/reviews` · `GET …/reviews/{id}` | — | no | List / retrieve saved reviews |
+| `POST /api/v1/civicaccess/reviews/{id}/records-export` | **token** | **yes** (audit) | Records-ready export (+ audit) |
+| `GET /api/v1/civicaccess/integration-contracts` | — | no | Published integration contracts |
+| `POST /api/v1/civicaccess/plain-language` · `…/language-variant` | — | no | Plain-language rewrite / multilingual draft |
+| `POST /api/v1/civicaccess/forms` · `…/publishing-workflow` | — | no | Accessible-form checks / publication workflow |
+| `POST /api/v1/civicaccess/ada-title-ii` · `…/tagged-pdf` · `…/export` | — | no | ADA Title II checklist / tagged-PDF / export checklist |
+
+Token-guarded writes require `X-CivicAccess-Write-Token` matching `CIVICACCESS_TRUSTED_WRITE_TOKEN` (constant-time compare): missing/invalid → `403`, guard not configured → `503`. The token is never embedded in served HTML — the staff page provides a field where an operator pastes it.
+
+### Persistence & configuration
+
+| Variable | Purpose |
+|---|---|
+| `DATABASE_URL` | Shared CivicCore PostgreSQL (supervisor-injected) — the production default |
+| `CIVICACCESS_REVIEW_DB_URL` | Explicit SQLAlchemy URL override |
+| `CIVICACCESS_DATA_DIR` | Directory for the SQLite dev fallback (`data/civicaccess-reviews.db`) |
+| `CIVICACCESS_TRUSTED_WRITE_TOKEN` | **Required** server secret for persistent writes |
+
+Resolution order: `CIVICACCESS_REVIEW_DB_URL` → `DATABASE_URL` (converted to a sync psycopg2 URL) → SQLite dev fallback. Use the `civicaccess-db-status` console script with an explicit URL to preflight a database.
+
+### Security
+
+Persistence-write routes require the trusted-write token (constant-time compare, fails closed); read and stateless-analysis routes are open. Every write/export persists an `audit_events` row; `review.create`'s audit is committed atomically with the record. No model/LLM or outbound network calls. Review + audit data live in the shared Postgres cluster and are captured by the supervisor's wholesale `Data/` backup. See [SECURITY.md](SECURITY.md).
+
+### Developer quickstart
 
 ```powershell
 python -m venv .venv
@@ -32,32 +102,18 @@ python -m venv .venv
 python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
 python -m pip install -e ".[dev]"
 python -m pytest -q
+# Full release gate (requires a real PostgreSQL):
+$env:CIVICACCESS_POSTGRES_TEST_URL = "postgresql+psycopg2://USER:PW@HOST:PORT/DB"
 bash scripts/verify-release.sh
 ```
 
-## Runtime API
-
-- `GET /` returns current module status and boundaries.
-- `GET /health` returns package and CivicCore version information.
-- `GET /ready` and `GET /api/v1/civicaccess/readiness` report whether local review persistence is configured and schema-ready.
-- `GET /civicaccess` returns the API-backed public accessibility review UI.
-- `GET /civicaccess/staff` returns the staff review queue and records-export workspace.
-- `POST /api/v1/civicaccess/review` returns accessibility findings and next steps.
-- `GET /api/v1/civicaccess/reviews` lists saved review records.
-- `GET /api/v1/civicaccess/reviews/{review_id}` retrieves persisted review records.
-- `POST /api/v1/civicaccess/reviews/{review_id}/records-export` builds a CivicRecords-ready retention export.
-- `GET /api/v1/civicaccess/integration-contracts` publishes upstream/downstream integration contracts.
-- `POST /api/v1/civicaccess/forms` returns accessible form publication checks.
-- `POST /api/v1/civicaccess/publishing-workflow` returns staff publication workflow blockers and steps.
-- `POST /api/v1/civicaccess/plain-language` returns a deterministic plain-language rewrite.
-- `POST /api/v1/civicaccess/language-variant` returns a multilingual draft variant requiring human review.
-- `POST /api/v1/civicaccess/ada-title-ii` returns ADA Title II review-support checklist items.
-- `POST /api/v1/civicaccess/tagged-pdf` returns tagged-PDF heading expectations.
-- `POST /api/v1/civicaccess/export` returns a records-ready accessibility export checklist.
-
-By default, CivicAccess stores review records in `data/civicaccess-reviews.db` under the process working directory. Set `CIVICACCESS_DATA_DIR` to choose a different local data directory, or set `CIVICACCESS_REVIEW_DB_URL` to use an explicit SQLAlchemy database URL. `/ready` is expected to be ready when the local schema can be created and verified.
-
-Use the `civicaccess-db-status` console script with an explicit SQLAlchemy URL when an operator wants to preflight a non-default review database.
+### Integration
+
+CivicAccess **depends on CivicCore** (CivicCore does not depend on CivicAccess). It publishes contracts at `/api/v1/civicaccess/integration-contracts`, hands records exports to **CivicRecords AI**, and supports downstream publishers (zone, plan, permit, inspect, grants, procure).
+
+### Release status
+
+`v0.4.0` is an early release; probe gaps #1–#4 (clean install, staff/public authz, audit logging, backup/restore durability) are closed with evidence — see [PROBE-PROGRESS.md](PROBE-PROGRESS.md). City-core membership (desktop registry record, 6-module profile) and a clean-VM accessibility acceptance pass are later phases. The earlier `v1.0.0` release was published in error and is retained only as historical evidence; see [docs/release-integrity-correction-2026-05-21.md](docs/release-integrity-correction-2026-05-21.md).
 
 ## License
 
diff --git a/README.txt b/README.txt
index fcb2749..89b9a24 100644
--- a/README.txt
+++ b/README.txt
@@ -1,14 +1,94 @@
 CivicAccess
 ===========
 
-CivicAccess is the CivicSuite module for accessibility, plain-language, multilingual, and ADA Title II review-support workflows.
+CivicAccess is the CivicSuite module for accessibility, plain-language,
+multilingual, and ADA Title II review-support workflows.
 
-Current state: v0.4.0 standalone readiness candidate. This repo contains a deterministic FastAPI package aligned to the published CivicCore v1.2.0 release wheel, health/root endpoints, readiness gates, WCAG-aligned review support, database-backed review records that default to the shared CivicCore PostgreSQL (with a SQLite dev fallback), accessible form planning, accessible publishing workflow checks, plain-language rewrites, multilingual draft variants, ADA Title II review-support packages, tagged-PDF expectations, records-ready export checklists, a stateless public accessibility checker at /civicaccess, and a trusted-write-token-guarded staff persistence/export surface with persisted audit events. The previous v1.0.0 release was published in error and is superseded by this honest sub-1.0.0 label.
+Status: v0.4.0 - early release. CivicAccess does NOT give legal advice, certify ADA
+compliance, issue official translations, or publish anything on its own - your staff,
+ADA coordinator, translators, and legal counsel always make the final call.
 
-CivicAccess does not provide legal advice, certified ADA compliance, official translation certification, live LLM calls, or final publication approval. City staff, ADA coordinators, translators, and qualified reviewers remain responsible for publication decisions.
+This README serves two audiences. Civic staff: see the short version below and
+USER-MANUAL.md (Part 1). IT/technical: see the technical section below.
+(For rendered architecture diagrams, read README.md / USER-MANUAL.md.)
 
-Run:
 
-python -m pip install -e ".[dev]"
-python -m pytest -q
-bash scripts/verify-release.sh
+FOR CIVIC STAFF (the short version)
+-----------------------------------
+
+CivicAccess helps your office put out public notices everyone can read - and keep
+a record proving you checked.
+- Paste a draft into the public checker to get instant, plain-language fixes.
+  Nothing is saved - it's a safe place to try things.
+- To keep a review on the record, save it in the staff workspace and export a copy
+  you can hand to a public-records request.
+- It also rewrites jargon, drafts translations for a human reviewer, and walks ADA
+  Title II reviews - but never publishes anything on its own.
+Full walkthrough: USER-MANUAL.md (Part 1).
+
+
+FOR IT & TECHNICAL STAFF
+------------------------
+
+CivicAccess is a deterministic FastAPI module (Python), pinned to the published
+CivicCore v1.2.0 release wheel - no model/LLM calls and no outbound network calls.
+
+Architecture (text sketch; see README.md for the rendered diagram):
+
+  Resident  --> /civicaccess  (public, no token) --+
+                                                    +--> CivicAccess (FastAPI) --> PostgreSQL :15432
+  City staff --> /civicaccess/staff (write token) --+        |                     (civicaccess schema)
+                                                             +-- depends on ----> CivicCore v1.2.0
+                                                             +-- records-export -> CivicRecords AI
+
+  All of the above runs inside the Tauri supervisor on the local machine. The
+  supervisor injects DATABASE_URL and backs up the whole Data/ directory (which
+  includes the PostgreSQL cluster), so CivicAccess data is captured with it.
+
+What it provides:
+- A stateless public accessibility checker (/civicaccess): WCAG-aligned issues with
+  actionable, standard-referenced fixes. No persistence, no token.
+- A token-guarded staff workspace (/civicaccess/staff): save reviews, build
+  records-ready exports.
+- Plain-language rewrites (source/rewrite provenance preserved).
+- Multilingual draft variants, explicitly marked for human review.
+- ADA Title II review-support checklists (without claiming certification).
+- Accessible-form and tagged-PDF expectation checks; a staff publication workflow.
+- A persisted audit trail of every write/export; integration contracts.
+
+Persistence & configuration:
+- DATABASE_URL ................. shared CivicCore PostgreSQL (supervisor-injected); the default
+- CIVICACCESS_REVIEW_DB_URL .... explicit SQLAlchemy URL override
+- CIVICACCESS_DATA_DIR ......... directory for the SQLite dev fallback
+- CIVICACCESS_TRUSTED_WRITE_TOKEN .. REQUIRED server secret for persistent writes
+  Resolution order: CIVICACCESS_REVIEW_DB_URL -> DATABASE_URL (converted to sync
+  psycopg2) -> SQLite dev fallback. Preflight with the civicaccess-db-status script.
+
+Security:
+- Persistence-write routes (/review, /reviews/{id}/records-export) require the
+  X-CivicAccess-Write-Token header (constant-time compare): missing/invalid -> 403,
+  guard not configured -> 503 (fails closed). Read and analyze routes are open.
+- The server token is never embedded in served HTML; the staff page provides a
+  field where an operator pastes it.
+- Every write/export persists an audit_events row; review.create is atomic with the
+  record. No model/LLM or outbound network calls.
+
+Developer quickstart:
+  python -m venv .venv
+  .\.venv\Scripts\Activate.ps1
+  python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+  python -m pip install -e ".[dev]"
+  python -m pytest -q
+  # Full release gate (requires a real PostgreSQL):
+  $env:CIVICACCESS_POSTGRES_TEST_URL = "postgresql+psycopg2://USER:PW@HOST:PORT/DB"
+  bash scripts/verify-release.sh
+
+Release status:
+v0.4.0 is an early release; probe gaps #1-#4 (clean install, staff/public authz,
+audit logging, backup/restore durability) are closed with evidence (PROBE-PROGRESS.md).
+City-core membership and a clean-VM accessibility acceptance pass are later phases.
+The earlier v1.0.0 release was published in error and is retained only as historical
+evidence.
+
+
+License: Code is Apache 2.0. Documentation is CC BY 4.0.
diff --git a/USER-MANUAL.md b/USER-MANUAL.md
index 41996b2..357763e 100644
--- a/USER-MANUAL.md
+++ b/USER-MANUAL.md
@@ -1,57 +1,216 @@
 # CivicAccess User Manual
 
-## For Residents And Municipal Decision-Makers
+**Version 0.4.0 · early release**
+CivicAccess is the accessibility, plain-language, multilingual, and ADA Title II review-support module for CivicSuite.
 
-CivicAccess helps cities make public information easier to read, reach, translate, review, and preserve. It supports accessibility review, accessible forms, public publishing workflows, plain-language rewrites, multilingual draft variants, ADA Title II review support, tagged-PDF expectations, and records-ready export checklists.
+This manual has two parts. Read the one that fits your role:
 
-Current state: `0.4.0` standalone readiness candidate. CivicAccess includes deterministic checks, database-backed review records that default to the shared CivicCore PostgreSQL (with a SQLite dev fallback), readiness gates, a stateless public accessibility checker at `/civicaccess`, a staff review/export workspace at `/civicaccess/staff`, trusted-write-token-guarded persistence with persisted audit events, and CivicCore v1.2.0 release-wheel alignment. The previous `v1.0.0` release was published in error and remains historical evidence only. CivicAccess does not provide legal advice, certified ADA compliance, official translation certification, live LLM calls, or final publication approval.
+- **[Part 1 — For Civic Staff](#part-1--for-civic-staff)** — clerks, communicators, ADA coordinators. Plain English, no setup.
+- **[Part 2 — For IT & Technical Staff](#part-2--for-it--technical-staff)** — architecture, runtime, data model, security, and operations.
 
-## For IT And Technical Staff
+---
 
-CivicAccess is a FastAPI Python package pinned to the published `CivicCore v1.2.0` release wheel. The current runtime exposes:
+## Part 1 — For Civic Staff
 
-- `GET /`
-- `GET /health`
-- `GET /ready`
-- `GET /civicaccess`
-- `GET /civicaccess/staff`
-- `GET /api/v1/civicaccess/readiness`
-- `POST /api/v1/civicaccess/review`
-- `GET /api/v1/civicaccess/reviews`
-- `GET /api/v1/civicaccess/reviews/{review_id}`
-- `POST /api/v1/civicaccess/reviews/{review_id}/records-export`
-- `GET /api/v1/civicaccess/integration-contracts`
-- `POST /api/v1/civicaccess/forms`
-- `POST /api/v1/civicaccess/publishing-workflow`
-- `POST /api/v1/civicaccess/plain-language`
-- `POST /api/v1/civicaccess/language-variant`
-- `POST /api/v1/civicaccess/ada-title-ii`
-- `POST /api/v1/civicaccess/tagged-pdf`
-- `POST /api/v1/civicaccess/export`
+### What CivicAccess is for
 
-By default, CivicAccess persists review requests, findings, WCAG references, disclaimers, and next steps in `data/civicaccess-reviews.db` under the process working directory. Set `CIVICACCESS_DATA_DIR` to choose a different local data directory, or set `CIVICACCESS_REVIEW_DB_URL` for an explicit SQLAlchemy database URL. Use `civicaccess-db-status` with the same explicit database URL when preflighting a non-default database.
+CivicAccess helps your office put out public notices, forms, and documents that **everyone can read** — and keep a clean record proving you checked. It is a staff tool that gives advice and does the busywork; **you and your ADA coordinator always make the final call.**
 
-Before public use, check `/ready` or `/api/v1/civicaccess/readiness`. The readiness gate is `ready` when the local review database schema can be created and verified.
+### What you can do with it
 
-Run local verification with:
+| You want to… | CivicAccess gives you… |
+|---|---|
+| Know if a notice is hard to read | A check that flags missing titles, images without descriptions, and dense wording — each with a specific fix |
+| Cut the jargon | A plain-language rewrite (e.g. "remit payment prior to the deadline" → "pay before the deadline") |
+| Reach non-English readers | Draft translations, clearly marked for a qualified human reviewer to approve |
+| Publish an accessible form or PDF | A checklist of what an accessible form or tagged PDF needs |
+| Handle an ADA Title II review | A step-by-step review-support checklist |
+| Answer a records request | A saved, exportable record of every review, with a time-stamp of who did what |
 
-```powershell
+### How you'll use it day to day
+
+There are two places to work, and the difference matters:
+
+- The **public checker** is for trying things out — it forgets everything when you leave.
+- The **staff workspace** is for keeping a permanent, official record you can produce later.
+
+Your IT team will give you the link to each.
+
+1. Open the **public checker**. Paste in a draft notice and run the check. You'll get a list of plain-language fixes — nothing is saved, so it's a safe place to experiment.
+2. When you're ready to keep a review on the record, open the **staff workspace** and enter the staff password your IT team gave you (a one-time setup). Save the review — it goes into your CivicSuite records with a time-stamp of who saved it and when.
+3. From the staff workspace, **export a records-ready package** for any saved review — ready to hand to a public-records request.
+
+### What CivicAccess will *not* do
+
+CivicAccess is a tool for your staff, **not a rubber stamp.** It does **not**:
+
+- give legal advice,
+- certify ADA compliance,
+- issue official translations, or
+- publish anything on its own.
+
+A qualified human — your staff, an ADA coordinator, a translator, legal counsel — always reviews and approves before anything goes public. Translations it drafts are **starting points for a human translator**, never the final word.
+
+### Where it stands today
+
+This is **v0.4.0, an early release** we're being upfront about. It's solid enough to evaluate and pilot, but it is **not a finished 1.0 and not a compliance guarantee.** (An earlier `v1.0.0` was published by mistake; we pulled it back to an honest sub-1.0 label rather than overstate where the product is.)
+
+---
+
+## Part 2 — For IT & Technical Staff
+
+### Overview
+
+CivicAccess is a deterministic **FastAPI** service, written in Python and pinned to the published **CivicCore v1.2.0** release wheel. It performs rule-based accessibility checks — **no LLM/model calls, no network calls** — so output is reproducible and the service is cheap to run. It ships as one module inside **CivicSuite Windows Local**, a Tauri/WebView2 desktop application, and is also runnable standalone for development.
+
+### Deployment architecture
+
+In CivicSuite Windows Local, a Tauri **supervisor** starts a bundled Python host (running CivicAccess alongside peer modules) and a bundled **PostgreSQL** instance on `127.0.0.1:15432`. The supervisor injects a `DATABASE_URL` into each module service; CivicAccess stores its data in a dedicated `civicaccess` schema in that shared cluster. The supervisor's backup copies the entire data directory (including the Postgres cluster), so CivicAccess data is captured with it.
+
+```mermaid
+flowchart TB
+  Resident["Resident<br/>(browser)"] -->|"public, read-only"| Pub["/civicaccess"]
+  Staff["City staff<br/>(browser)"] -->|"WebView2 UI"| StaffUI["/civicaccess/staff"]
+
+  subgraph Sup["Tauri supervisor — local machine only"]
+    CA["CivicAccess<br/>(FastAPI)"]
+    Peers["Peer modules<br/>CivicClerk · CivicCode · CivicNotice · …"]
+    PG[("Bundled PostgreSQL<br/>127.0.0.1:15432")]
+  end
+
+  Pub --> CA
+  StaffUI --> CA
+  CA -->|"DATABASE_URL → civicaccess schema"| PG
+  Peers --> PG
+  CA -->|"depends on"| Core["CivicCore v1.2.0"]
+  CA -. "records-export hand-off" .-> Records["CivicRecords AI"]
+  Sup -. "wholesale backup of Data/ (incl. Data/postgres)" .-> Backup[("Backup folder")]
+```
+
+### Request & trust model
+
+There are two surfaces with deliberately different trust levels:
+
+- **Public** (`/civicaccess` → `POST /api/v1/civicaccess/analyze`): stateless. Anyone can analyze content; **nothing is persisted and no token is required.**
+- **Staff** (`/civicaccess/staff` → `POST .../review`, `POST .../reviews/{id}/records-export`): persistent. Every write requires the **trusted-write token**.
+
+```mermaid
+sequenceDiagram
+  participant R as Resident (public)
+  participant S as City staff
+  participant CA as CivicAccess
+  participant DB as PostgreSQL (civicaccess schema)
+
+  R->>CA: POST /analyze (no token)
+  CA-->>R: findings + fixes (nothing saved)
+
+  S->>CA: POST /review + X-CivicAccess-Write-Token
+  Note over CA: constant-time token check<br/>403 if invalid · 503 if unconfigured
+  CA->>DB: insert review + audit row (one transaction)
+  CA-->>S: saved review_id + findings
+
+  S->>CA: POST /reviews/{id}/records-export + token
+  CA->>DB: write audit_events row
+  CA-->>S: records-ready export
+```
+
+### Persistence & configuration
+
+CivicAccess resolves its review store in this order:
+
+1. `CIVICACCESS_REVIEW_DB_URL` — explicit override (a dev SQLite path or a pre-built Postgres URL).
+2. `DATABASE_URL` — the supervisor-injected async URL (`postgresql+asyncpg://…:15432/…`), converted to a synchronous psycopg2 URL. **This is the default under the desktop runtime.**
+3. **SQLite dev fallback** — `data/civicaccess-reviews.db` under `CIVICACCESS_DATA_DIR` (default: `./data`), used only when neither variable is set.
+
+| Variable | Purpose |
+|---|---|
+| `DATABASE_URL` | Shared CivicCore PostgreSQL (set by the supervisor) — the production default |
+| `CIVICACCESS_REVIEW_DB_URL` | Explicit SQLAlchemy URL override |
+| `CIVICACCESS_DATA_DIR` | Directory for the SQLite dev fallback |
+| `CIVICACCESS_TRUSTED_WRITE_TOKEN` | **Required** server secret for persistent writes |
+
+`civicaccess-db-status` (console script) preflights a database with an explicit URL.
+
+### Data model
+
+Three tables live in the `civicaccess` schema (translated to the default schema on SQLite). Schema setup is non-destructive (`CREATE SCHEMA IF NOT EXISTS` + `metadata.create_all`); the applied migration id is `civicaccess-windows-local-state-v1`.
+
+```mermaid
+erDiagram
+  accessibility_review_records {
+    string   review_id PK
+    string   title
+    text     body
+    bool     has_alt_text
+    string   language
+    string   status
+    json     findings
+    text     disclaimer
+    datetime created_at
+  }
+  audit_events {
+    string   event_id PK
+    string   action
+    string   subject_id "soft ref → review_id"
+    string   actor
+    datetime created_at
+  }
+  schema_migrations {
+    string   schema_version PK
+    datetime applied_at
+  }
+```
+
+### HTTP API
+
+| Method & path | Auth | Persists? | Purpose |
+|---|---|---|---|
+| `GET /` | — | no | Module status and boundaries |
+| `GET /health` | — | no | Package + CivicCore version |
+| `GET /ready`, `GET /api/v1/civicaccess/readiness` | — | no | Persistence readiness gate |
+| `GET /civicaccess` | — | no | Public accessibility checker (UI) |
+| `GET /civicaccess/staff` | — | no | Staff workspace (UI; never embeds the token) |
+| `POST /api/v1/civicaccess/analyze` | — | no | Stateless accessibility analysis |
+| `POST /api/v1/civicaccess/review` | **token** | **yes** | Save a review record (+ audit) |
+| `GET /api/v1/civicaccess/reviews` | — | no | List saved reviews |
+| `GET /api/v1/civicaccess/reviews/{id}` | — | no | Retrieve a saved review |
+| `POST /api/v1/civicaccess/reviews/{id}/records-export` | **token** | **yes** (audit) | Records-ready export (+ audit) |
+| `GET /api/v1/civicaccess/integration-contracts` | — | no | Published integration contracts |
+| `POST /api/v1/civicaccess/plain-language` | — | no | Deterministic plain-language rewrite |
+| `POST /api/v1/civicaccess/language-variant` | — | no | Multilingual draft variant (human-review flagged) |
+| `POST /api/v1/civicaccess/forms` | — | no | Accessible form publication checks |
+| `POST /api/v1/civicaccess/publishing-workflow` | — | no | Staff publication workflow steps/blockers |
+| `POST /api/v1/civicaccess/ada-title-ii` | — | no | ADA Title II review-support checklist |
+| `POST /api/v1/civicaccess/tagged-pdf` | — | no | Tagged-PDF heading expectations |
+| `POST /api/v1/civicaccess/export` | — | no | Records-ready export checklist (stateless) |
+
+**Token-guarded writes** require the `X-CivicAccess-Write-Token` header matching `CIVICACCESS_TRUSTED_WRITE_TOKEN` (compared in constant time). Missing/invalid → `403`; guard not configured → `503` (fails closed). The server token is never embedded in served HTML — the staff page provides a field where an operator pastes it; it is kept only in the browser session.
+
+### Security
+
+- **Authentication boundary:** persistence-write routes require the trusted-write token; read and stateless-analysis routes are open. The desktop supervisor binds the service to the local machine.
+- **Audit trail:** every persistent write/export writes an `audit_events` row (action, subject, actor, timestamp). `review.create` is committed atomically with the review record.
+- **Determinism:** no model/LLM calls and no outbound network calls; checks are pure functions.
+- **Backups:** review and audit data live in the shared Postgres cluster, captured by the supervisor's wholesale `Data/` backup. Durability is covered by the test suite (a Postgres reconnect round-trip for the default store; a SQLite file backup/restore round-trip for the dev fallback).
+
+### Operations
+
+Readiness: poll `GET /ready` (or `/api/v1/civicaccess/readiness`) — `ready` when the schema can be created and verified.
+
+Local verification (mirrors CI; the release gate requires a real PostgreSQL):
+
+```bash
 python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
 python -m pip install -e ".[dev]"
-python -m pytest -q
+# Release gate (requires Postgres):
+export CIVICACCESS_POSTGRES_TEST_URL="postgresql+psycopg2://USER:PW@HOST:PORT/DB"
 bash scripts/verify-release.sh
 ```
 
-## Architecture
+### Integration
 
-```mermaid
-flowchart LR
-  PublicUser["Resident or staff publisher"] --> CivicAccess["CivicAccess"]
-  CivicAccess --> CivicCore["CivicCore v1.2.0"]
-  CivicAccess --> CivicRecords["CivicRecords AI records export"]
-  CivicClerk["CivicClerk"] -. uses accessibility support .-> CivicAccess
-  CivicCode["CivicCode"] -. uses accessibility support .-> CivicAccess
-  CivicAccess -. downstream contracts .-> LandUse["Zone / Plan / Permit / Inspect / Grants / Procure"]
-```
+CivicAccess **depends on CivicCore**; CivicCore does not depend on CivicAccess. It publishes integration contracts at `/api/v1/civicaccess/integration-contracts`, hands records exports to **CivicRecords AI**, and provides accessibility support to downstream publishers (zone, plan, permit, inspect, grants, procure).
+
+### Release status
 
-CivicAccess depends on CivicCore. CivicCore does not depend on CivicAccess.
+`v0.4.0` is an early release. Probe gaps #1–#4 (clean install, staff/public authz, audit logging, backup/restore durability) are closed with evidence (see `PROBE-PROGRESS.md`). City-core membership (desktop registry record + 6-module profile) and a clean-VM accessibility acceptance pass are later phases. The earlier `v1.0.0` tag was published in error and is retained only as historical evidence.
diff --git a/USER-MANUAL.txt b/USER-MANUAL.txt
index 1905b2d..59b123a 100644
--- a/USER-MANUAL.txt
+++ b/USER-MANUAL.txt
@@ -1,27 +1,149 @@
 CivicAccess User Manual
 =======================
 
-CivicAccess helps cities make public information easier to read, reach, translate, review, and preserve. It supports accessibility review, accessible forms, public publishing workflows, plain-language rewrites, multilingual draft variants, ADA Title II review support, tagged-PDF expectations, and records-ready export checklists.
-
-Current state: 0.4.0 standalone readiness candidate. CivicAccess includes deterministic checks, database-backed review records that default to the shared CivicCore PostgreSQL (with a SQLite dev fallback), readiness gates, a stateless public accessibility checker at /civicaccess, a staff review/export workspace at /civicaccess/staff, trusted-write-token-guarded persistence with persisted audit events, and CivicCore v1.2.0 release-wheel alignment. The previous v1.0.0 release was published in error and is superseded by this honest sub-1.0.0 label. It does not provide legal advice, certified ADA compliance, official translation certification, live LLM calls, or final publication approval.
-
-Runtime routes:
-
-- GET /
-- GET /health
-- GET /ready
-- GET /civicaccess
-- GET /api/v1/civicaccess/readiness
-- POST /api/v1/civicaccess/review
-- GET /api/v1/civicaccess/reviews/{review_id} when CIVICACCESS_REVIEW_DB_URL is configured
-- POST /api/v1/civicaccess/forms
-- POST /api/v1/civicaccess/publishing-workflow
-- POST /api/v1/civicaccess/plain-language
-- POST /api/v1/civicaccess/language-variant
-- POST /api/v1/civicaccess/ada-title-ii
-- POST /api/v1/civicaccess/tagged-pdf
-- POST /api/v1/civicaccess/export
-
-Set CIVICACCESS_REVIEW_DB_URL to persist review requests, findings, WCAG references, disclaimers, and next steps. Use civicaccess-db-status with the same database URL to initialize and verify schema. Leave persistence unset for deterministic sample behavior.
-
-Before public use, check /ready or /api/v1/civicaccess/readiness. The readiness gate is not-ready until local review persistence is configured and schema-ready.
+Version 0.4.0 - early release.
+CivicAccess is the accessibility, plain-language, multilingual, and ADA Title II
+review-support module for CivicSuite.
+
+This manual has two parts. Read the one that fits your role. (For rendered
+architecture diagrams and full tables, see USER-MANUAL.md.)
+
+
+PART 1 - FOR CIVIC STAFF
+========================
+
+What it is for
+--------------
+CivicAccess helps your office put out public notices, forms, and documents that
+everyone can read - and keep a clean record proving you checked. It is a staff
+tool that gives advice and does the busywork; you and your ADA coordinator always
+make the final call.
+
+What you can do with it
+-----------------------
+- Know if a notice is hard to read: a check that flags missing titles, images
+  without descriptions, and dense wording - each with a specific fix.
+- Cut the jargon: a plain-language rewrite ("remit payment prior to the deadline"
+  -> "pay before the deadline").
+- Reach non-English readers: draft translations, clearly marked for a qualified
+  human reviewer to approve.
+- Publish an accessible form or PDF: a checklist of what it needs.
+- Handle an ADA Title II review: a step-by-step review-support checklist.
+- Answer a records request: a saved, exportable record of every review, with a
+  time-stamp of who did what.
+
+How you'll use it day to day
+----------------------------
+1. Open the public checker at /civicaccess. Paste in a draft and run the check.
+   You'll get plain-language fixes. Nothing is saved - a safe place to try things.
+2. To keep a review on the record, open the staff workspace at /civicaccess/staff,
+   paste in your staff write token (IT sets this up once), and save the review.
+3. Export a records-ready package for any saved review when a records request comes in.
+
+What CivicAccess will NOT do
+----------------------------
+It is a tool for your staff, not a rubber stamp. It does not give legal advice,
+certify ADA compliance, issue official translations, or publish anything on its own.
+A qualified human always reviews and approves before anything goes public.
+
+Where it stands today
+---------------------
+This is v0.4.0, an early release we're being upfront about: solid enough to evaluate
+and pilot, but not a finished 1.0 and not a compliance guarantee. (An earlier v1.0.0
+was published by mistake and pulled back to an honest sub-1.0 label.)
+
+
+PART 2 - FOR IT & TECHNICAL STAFF
+=================================
+
+Overview
+--------
+A deterministic FastAPI service (Python), pinned to the published CivicCore v1.2.0
+release wheel. Rule-based checks only - no model/LLM calls, no outbound network -
+so output is reproducible. Ships as one module inside CivicSuite Windows Local (a
+Tauri/WebView2 desktop app); also runs standalone for development.
+
+Architecture (text sketch; see USER-MANUAL.md for the rendered diagrams):
+
+  Resident  --> /civicaccess  (public, no token) --+
+                                                    +--> CivicAccess (FastAPI) --> PostgreSQL :15432
+  City staff --> /civicaccess/staff (write token) --+        |                     (civicaccess schema)
+                                                             +-- depends on ----> CivicCore v1.2.0
+                                                             +-- records-export -> CivicRecords AI
+
+  Runs inside the Tauri supervisor on the local machine. The supervisor injects
+  DATABASE_URL and backs up the whole Data/ directory (incl. the Postgres cluster).
+
+Request & trust model
+---------------------
+- Public (/civicaccess -> POST /api/v1/civicaccess/analyze): stateless. No token,
+  nothing persisted.
+- Staff (/civicaccess/staff -> POST .../review, POST .../reviews/{id}/records-export):
+  every write requires the trusted-write token.
+
+Persistence & configuration
+---------------------------
+Resolution order:
+  1. CIVICACCESS_REVIEW_DB_URL  - explicit override (dev SQLite or pre-built Postgres URL)
+  2. DATABASE_URL              - supervisor async URL, converted to sync psycopg2; the default
+  3. SQLite dev fallback       - data/civicaccess-reviews.db under CIVICACCESS_DATA_DIR
+CIVICACCESS_TRUSTED_WRITE_TOKEN is the required server secret for persistent writes.
+Use civicaccess-db-status to preflight a database with an explicit URL.
+
+Data model (civicaccess schema; migration id civicaccess-windows-local-state-v1):
+- accessibility_review_records (review_id, title, body, has_alt_text, language,
+  status, findings JSON, disclaimer, created_at)
+- audit_events (event_id, action, subject_id, actor, created_at)
+- schema_migrations (schema_version, applied_at)
+
+HTTP API (auth: "token" = X-CivicAccess-Write-Token required; otherwise open):
+  GET  /                                         -> status & boundaries
+  GET  /health                                   -> versions
+  GET  /ready, /api/v1/civicaccess/readiness     -> readiness gate
+  GET  /civicaccess, /civicaccess/staff          -> UIs (token never embedded)
+  POST /api/v1/civicaccess/analyze               -> stateless analysis
+  POST /api/v1/civicaccess/review                -> token; saves a review (+ audit)
+  GET  /api/v1/civicaccess/reviews[/{id}]        -> list / retrieve saved reviews
+  POST /api/v1/civicaccess/reviews/{id}/records-export -> token; export (+ audit)
+  GET  /api/v1/civicaccess/integration-contracts -> contracts
+  POST /api/v1/civicaccess/plain-language        -> plain-language rewrite
+  POST /api/v1/civicaccess/language-variant      -> multilingual draft (human-review flagged)
+  POST /api/v1/civicaccess/forms                 -> accessible form checks
+  POST /api/v1/civicaccess/publishing-workflow   -> publication workflow
+  POST /api/v1/civicaccess/ada-title-ii          -> ADA Title II checklist
+  POST /api/v1/civicaccess/tagged-pdf            -> tagged-PDF expectations
+  POST /api/v1/civicaccess/export                -> records-ready export checklist (stateless)
+
+Token-guarded writes: missing/invalid -> 403; guard not configured -> 503 (fails
+closed). Comparison is constant-time.
+
+Security
+--------
+- Authz boundary: persistence-write routes require the token; read/analyze are open.
+- Audit: every write/export writes an audit_events row; review.create is atomic with
+  the record.
+- Determinism: no model/LLM calls, no outbound network.
+- Backups: review + audit data live in the shared Postgres cluster, captured by the
+  supervisor's wholesale Data/ backup. Durability is covered by the test suite.
+
+Operations
+----------
+Readiness: poll GET /ready (or /api/v1/civicaccess/readiness) - ready when the schema
+can be created and verified. Local verification (the release gate requires a real
+PostgreSQL):
+  python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+  python -m pip install -e ".[dev]"
+  export CIVICACCESS_POSTGRES_TEST_URL="postgresql+psycopg2://USER:PW@HOST:PORT/DB"
+  bash scripts/verify-release.sh
+
+Integration
+-----------
+CivicAccess depends on CivicCore (not vice versa). It publishes integration contracts,
+hands records exports to CivicRecords AI, and supports downstream publishers (zone,
+plan, permit, inspect, grants, procure).
+
+Release status
+--------------
+v0.4.0 is an early release; probe gaps #1-#4 are closed with evidence (PROBE-PROGRESS.md).
+City-core membership and a clean-VM accessibility acceptance pass are later phases. The
+earlier v1.0.0 tag was published in error and is retained only as historical evidence.
diff --git a/docs/github-discussions-seed.md b/docs/github-discussions-seed.md
index 5c5db1d..35a4b1a 100644
--- a/docs/github-discussions-seed.md
+++ b/docs/github-discussions-seed.md
@@ -1,13 +1,72 @@
 # GitHub Discussions Seed Posts
 
-## Welcome to CivicAccess
+Seed posts for the CivicAccess Discussions board, organized by audience. Post the **civic-staff** set in a general/community category and the **technical** set in a development category.
 
-CivicAccess is the CivicSuite module for accessibility, plain-language, multilingual, and ADA Title II review-support workflows.
+---
 
-## What should be reviewed first?
+## For civic staff
 
-Share examples of public notices, forms, agendas, PDFs, or documents where accessibility and plain-language support would help your city.
+### 👋 Welcome — what CivicAccess does for your office
 
-## Human Review Boundary
+CivicAccess helps your office put out public notices, forms, and documents that **everyone can read** — and keep a clean record proving you checked.
 
-CivicAccess outputs are advisory support. Staff reviewers, ADA coordinators, translators, and legal counsel remain responsible for official publication decisions.
+- Paste a draft into the **public checker** for instant, plain-language fixes. Nothing is saved — it's a safe place to try things.
+- Use the **staff workspace** to save a review on the record and export a records-ready package for public-records requests.
+- It also rewrites jargon, drafts translations for a human reviewer, and walks ADA Title II reviews step by step.
+
+This is an early release (v0.4.0) — great for evaluating and piloting. Tell us what would make it useful in your office.
+
+### What should we help you review first?
+
+Share examples of public notices, forms, agendas, PDFs, or documents where accessibility and plain-language support would help your city. Real examples shape what we build next.
+
+### Where CivicAccess stops (and a human takes over)
+
+CivicAccess is a tool for your staff, **not a rubber stamp.** It does not give legal advice, certify ADA compliance, or issue official translations, and it never publishes anything on its own. Staff reviewers, ADA coordinators, translators, and legal counsel always make the final call. Drafts it produces — especially translations — are starting points for a qualified human, not the final word.
+
+---
+
+## For IT & technical staff
+
+### Architecture & how it runs
+
+CivicAccess is a deterministic **FastAPI** module (no model/LLM calls, no outbound network), pinned to the published **CivicCore v1.2.0** release wheel. In CivicSuite Windows Local, a Tauri supervisor runs it against a bundled PostgreSQL on `127.0.0.1:15432` (dedicated `civicaccess` schema); the supervisor's backup captures the whole data directory.
+
+```mermaid
+flowchart TB
+  Resident["Resident (browser)"] -->|"public, read-only"| Pub["/civicaccess"]
+  Staff["City staff (browser)"] -->|"WebView2 UI"| StaffUI["/civicaccess/staff"]
+  subgraph Sup["Tauri supervisor — local machine only"]
+    CA["CivicAccess (FastAPI)"]
+    PG[("Bundled PostgreSQL :15432")]
+  end
+  Pub --> CA
+  StaffUI --> CA
+  CA -->|"DATABASE_URL → civicaccess schema"| PG
+  CA -->|"depends on"| Core["CivicCore v1.2.0"]
+  CA -. records-export .-> Records["CivicRecords AI"]
+```
+
+Full API, data model, and security details: [README](../README.md) · [User Manual, Part 2](../USER-MANUAL.md#part-2--for-it--technical-staff).
+
+### v0.4.0 — what changed
+
+City-core hardening (closes probe gaps #2/#3/#4):
+
+- **Persistence** now defaults to the shared CivicCore PostgreSQL (reads the supervisor's `DATABASE_URL`); SQLite is a dev fallback.
+- **Write authz:** persistence routes (`/review`, `/reviews/{id}/records-export`) require `X-CivicAccess-Write-Token` (constant-time; 403 invalid / 503 if unconfigured). A new stateless `POST /analyze` powers the public surface so it never writes.
+- **Audit:** every write/export persists an `audit_events` row; `review.create` is atomic with the record.
+- The earlier `v1.0.0` tag was published in error and is retained only as historical evidence.
+
+### Running it locally & the release gate
+
+```bash
+python -m pip install https://github.com/CivicSuite/civiccore/releases/download/v1.2.0/civiccore-1.2.0-py3-none-any.whl
+python -m pip install -e ".[dev]"
+python -m pytest -q
+# Full release gate requires a real PostgreSQL:
+export CIVICACCESS_POSTGRES_TEST_URL="postgresql+psycopg2://USER:PW@HOST:PORT/DB"
+bash scripts/verify-release.sh
+```
+
+Questions about the module contract, integration contracts, or the desktop runtime wiring are welcome here.
diff --git a/docs/index.html b/docs/index.html
index f9f0b37..208a3c5 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -14,13 +14,22 @@
   .badge { display:inline-block; background:#2f6b50; color:white; padding:6px 12px; border-radius:4px; font:700 13px Arial,sans-serif; }
   li { margin:10px 0; }
   code { background:#edf2f5; padding:2px 5px; border-radius:5px; }
+  .audience-rule { border:0; border-top:2px solid #d0d7de; margin:56px 0 8px; }
+  .audience-tag { color:#175b83; text-transform:uppercase; font:700 13px Arial,sans-serif; letter-spacing:.04em; }
+  .tech { font-family: Arial, "Segoe UI", sans-serif; }
+  .tech h2 { font-family: Georgia, "Times New Roman", serif; }
+  .tech table { width:100%; border-collapse:collapse; font-size:14px; margin:8px 0; }
+  .tech th, .tech td { text-align:left; padding:8px 10px; border-bottom:1px solid #e3e8ec; }
+  .tech th { color:#56606a; font-size:12px; text-transform:uppercase; }
+  .diagram { width:100%; height:auto; background:#fbfcfd; border:1px solid #e3e8ec; border-radius:8px; }
+  .caption { color:#56606a; font:13px Arial,sans-serif; margin-top:8px; }
 </style>
 </head>
 <body>
 <main>
   <p class="eyebrow">CivicSuite / CivicAccess</p>
   <h1>Public notices everyone can read &mdash; and you can stand behind.</h1>
-  <p class="lede">CivicAccess helps your office catch accessibility problems <em>before</em> a notice goes out, trade jargon for plain language, draft other-language versions for review, and keep a clean, exportable record of every check. So when a resident &mdash; or an auditor &mdash; asks, you can show your work in seconds.</p>
+  <p class="lede">CivicAccess helps your office catch accessibility problems <em>before</em> a notice goes out, trade jargon for plain language, draft other-language versions for review, and keep a clean, exportable record of every review you save. So when a resident &mdash; or an auditor &mdash; asks, you can show your work in seconds.</p>
   <section class="panel">
     <span class="badge">Early release &middot; v0.4.0</span>
     <h2>What it does for your office</h2>
@@ -42,6 +51,70 @@ <h2>What it won&rsquo;t do</h2>
     <p>CivicAccess is a tool for your staff, not a rubber stamp. It doesn&rsquo;t give legal advice, certify ADA compliance, or issue official translations, and it never publishes anything on its own &mdash; you and your ADA coordinator always make the final call.</p>
     <p>We version honestly: this is <strong>v0.4.0</strong>, an early release we stand behind for evaluation and pilots &mdash; not a finished 1.0, and not a compliance guarantee.</p>
   </section>
+
+  <hr class="audience-rule">
+  <p class="audience-tag">For IT &amp; technical staff</p>
+  <section class="panel tech">
+    <h2>How it runs</h2>
+    <p>CivicAccess is a deterministic <strong>FastAPI</strong> service (Python), pinned to the published <strong>CivicCore v1.2.0</strong> release wheel. It performs rule-based checks &mdash; no model/LLM calls and no outbound network calls &mdash; so output is reproducible. It ships as one module inside <strong>CivicSuite Windows Local</strong> (a Tauri/WebView2 desktop app) and also runs standalone for development.</p>
+    <svg class="diagram" viewBox="0 0 860 520" role="img" aria-label="CivicAccess deployment architecture diagram">
+      <defs>
+        <marker id="ah" markerWidth="10" markerHeight="10" refX="8" refY="3" orient="auto" markerUnits="strokeWidth">
+          <path d="M0,0 L8,3 L0,6 z" fill="#56606a"/>
+        </marker>
+      </defs>
+      <!-- users -->
+      <rect x="90" y="24" width="200" height="48" rx="8" fill="#fff" stroke="#56606a" stroke-width="2"/>
+      <text x="190" y="53" text-anchor="middle" font-family="Arial,sans-serif" font-size="15" fill="#17202a">Resident (browser)</text>
+      <rect x="570" y="24" width="200" height="48" rx="8" fill="#fff" stroke="#56606a" stroke-width="2"/>
+      <text x="670" y="53" text-anchor="middle" font-family="Arial,sans-serif" font-size="15" fill="#17202a">City staff (browser)</text>
+      <!-- surfaces -->
+      <rect x="70" y="104" width="240" height="52" rx="8" fill="#fff" stroke="#175b83" stroke-width="2"/>
+      <text x="190" y="126" text-anchor="middle" font-family="Arial,sans-serif" font-size="14" fill="#175b83" font-weight="700">/civicaccess</text>
+      <text x="190" y="144" text-anchor="middle" font-family="Arial,sans-serif" font-size="12.5" fill="#56606a">public &middot; no token</text>
+      <rect x="550" y="104" width="240" height="52" rx="8" fill="#fff" stroke="#175b83" stroke-width="2"/>
+      <text x="670" y="126" text-anchor="middle" font-family="Arial,sans-serif" font-size="14" fill="#175b83" font-weight="700">/civicaccess/staff</text>
+      <text x="670" y="144" text-anchor="middle" font-family="Arial,sans-serif" font-size="12.5" fill="#56606a">staff &middot; write token</text>
+      <!-- supervisor -->
+      <rect x="30" y="190" width="800" height="240" rx="12" fill="none" stroke="#9aa5ad" stroke-width="2" stroke-dasharray="6 5"/>
+      <text x="48" y="214" font-family="Arial,sans-serif" font-size="13" fill="#56606a" font-weight="700">Tauri supervisor &mdash; local machine only</text>
+      <rect x="210" y="244" width="230" height="64" rx="8" fill="#eef4f8" stroke="#175b83" stroke-width="2"/>
+      <text x="325" y="272" text-anchor="middle" font-family="Arial,sans-serif" font-size="15" fill="#175b83" font-weight="700">CivicAccess</text>
+      <text x="325" y="291" text-anchor="middle" font-family="Arial,sans-serif" font-size="12.5" fill="#56606a">FastAPI service</text>
+      <rect x="560" y="244" width="240" height="64" rx="8" fill="#eef6f0" stroke="#2f6b50" stroke-width="2"/>
+      <text x="680" y="272" text-anchor="middle" font-family="Arial,sans-serif" font-size="14" fill="#2f6b50" font-weight="700">PostgreSQL &middot; :15432</text>
+      <text x="680" y="291" text-anchor="middle" font-family="Arial,sans-serif" font-size="12.5" fill="#56606a">civicaccess schema</text>
+      <rect x="210" y="344" width="230" height="48" rx="8" fill="#fff" stroke="#9aa5ad" stroke-width="2"/>
+      <text x="325" y="366" text-anchor="middle" font-family="Arial,sans-serif" font-size="13" fill="#17202a">Peer modules</text>
+      <text x="325" y="383" text-anchor="middle" font-family="Arial,sans-serif" font-size="12" fill="#56606a">CivicClerk &middot; CivicCode &middot; &hellip;</text>
+      <!-- dependencies -->
+      <rect x="120" y="452" width="280" height="48" rx="8" fill="#fff" stroke="#56606a" stroke-width="2"/>
+      <text x="260" y="481" text-anchor="middle" font-family="Arial,sans-serif" font-size="13.5" fill="#17202a">depends on CivicCore v1.2.0</text>
+      <rect x="460" y="452" width="300" height="48" rx="8" fill="#fff" stroke="#56606a" stroke-width="2" stroke-dasharray="5 4"/>
+      <text x="610" y="481" text-anchor="middle" font-family="Arial,sans-serif" font-size="13.5" fill="#17202a">records-export &rarr; CivicRecords AI</text>
+      <!-- arrows -->
+      <line x1="190" y1="72" x2="190" y2="102" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <line x1="670" y1="72" x2="670" y2="102" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <line x1="190" y1="156" x2="285" y2="244" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <line x1="670" y1="156" x2="375" y2="244" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <line x1="440" y1="276" x2="558" y2="276" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <text x="499" y="268" text-anchor="middle" font-family="Arial,sans-serif" font-size="11.5" fill="#56606a">DATABASE_URL</text>
+      <line x1="440" y1="368" x2="558" y2="300" stroke="#9aa5ad" stroke-width="2" stroke-dasharray="5 4" marker-end="url(#ah)"/>
+      <line x1="260" y1="430" x2="260" y2="450" stroke="#56606a" stroke-width="2" marker-end="url(#ah)"/>
+      <line x1="610" y1="430" x2="610" y2="450" stroke="#9aa5ad" stroke-width="2" stroke-dasharray="5 4" marker-end="url(#ah)"/>
+    </svg>
+    <p class="caption">Solid = request / data path &middot; dashed = hand-off. Persistent writes (save, records-export) require the <code>X-CivicAccess-Write-Token</code> and emit an audit row; the public surface analyzes statelessly.</p>
+    <h2>At a glance</h2>
+    <table>
+      <tr><th>Concern</th><th>Detail</th></tr>
+      <tr><td>Persistence</td><td>Defaults to the shared CivicCore PostgreSQL (reads supervisor <code>DATABASE_URL</code>); SQLite is a dev fallback</td></tr>
+      <tr><td>Auth</td><td>Trusted-write token on persistence routes (constant-time; 403 invalid / 503 if unconfigured); read &amp; analyze are open</td></tr>
+      <tr><td>Audit</td><td><code>audit_events</code> row on every write/export; <code>review.create</code> is atomic with the record</td></tr>
+      <tr><td>Backups</td><td>Data rides the supervisor&rsquo;s wholesale <code>Data/</code> backup (incl. the Postgres cluster)</td></tr>
+      <tr><td>Determinism</td><td>Rule-based checks; no model/LLM calls, no outbound network</td></tr>
+    </table>
+    <p>Full API, data model, security, and operations details are in the <a href="../USER-MANUAL.md">User Manual</a> and <a href="../README.md">README</a>.</p>
+  </section>
 </main>
 </body>
 </html>