chore(ui): claim app shell and sync staged-workspace decision

CHANGELOG.md

@@ -1,3 +1,61 @@
+## 2026-08-08 Europe/Amsterdam — SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — staged workspace architecture candidate
+
+Status: `IMPLEMENTATION_IN_PROGRESS`; exact-head CI and independent assurance required before merge.
+
+Purpose:
+- convert the coordinator-approved first-principles comparison of three routed screens versus a one-page staged workspace into a binding Premium UI architecture decision;
+- intervene before PR #85 enters production `presidio_streamlit.py` integration;
+- make the Premium staged-workspace sequence the authoritative active execution queue.
+
+Decision:
+```text
+One document. One workspace. Three stages. One active task.
+
+Toevoegen → Controleren → Downloaden
+```
+
+Binding Standard behavior:
+- all three stage headers remain in one persistent page/workspace;
+- exactly one stage is expanded/dominant at a time;
+- completed stages collapse to compact status summaries;
+- future stages remain visible but passive;
+- successful completion auto-advances to the next stage;
+- deliberate return to an earlier stage remains possible;
+- processing-affecting earlier changes invalidate processed/review/export lineage fail-closed;
+- three separate routed pages are rejected for these core stages;
+- a classic nested-expander form is also rejected as the default Standard pattern.
+
+First-principles rationale:
+- Scrub is an iterative document-review workflow, not a strictly linear checkout;
+- the interface should represent document state rather than page navigation;
+- the staged workspace preserves one-task-at-a-time focus while retaining document identity, progress, correction context and visible trust state;
+- it aligns directly with the merged `premium_core_flow_state.py` generation/invalidation model and reduces routing/state-restoration complexity in Streamlit.
+
+Current PR #85 consequence:
+- PR #85 is amended, not discarded;
+- current pure `premium_app_shell.py` helper work remains reusable;
+- production Streamlit integration is gated until this decision is independently assured and incorporated;
+- PR #85 must add/test completed/future/active panels, compact summaries, auto-progression hooks, prior-stage return/edit and no-three-page semantics before production integration.
+
+Files added/changed in the candidate:
+- added `PREMIUM_STAGED_WORKSPACE_DECISION.md`;
+- updated `ROADMAP.md`;
+- updated `WORKPACKAGES.md` with an authoritative current Premium queue while retaining older content as historical records;
+- updated `DECISION_LOG.md` with D043;
+- updated `CHANGELOG.md`;
+- added `tests/test_premium_staged_workspace_decision.py`;
+- added implementation claim and handover administration.
+
+Validation boundary:
+- documentation/architecture/contract-only package;
+- no production Streamlit or runtime product behavior changes;
+- no recognizer, threshold, replacement, review authority, export bytes/names/MIME, Scrub Key, reinsert, audit, dependency or Hugging Face behavior changes;
+- Hugging Face sync: not applicable;
+- app verification: not applicable;
+- exact-head GitHub Actions and independent `governance_release_assurance` remain required before merge.
+
+---
+
 ## 2026-08-07 Europe/Amsterdam — Issue #70 Actions evidence recovery repair
 
 Status: `RELEASE_CANDIDATE_READY`; independent exact-head assurance pending.

DECISION_LOG.md

@@ -1,3 +1,59 @@
+## 2026-08-08 — D043 — Freeze Premium Standard as a single-page staged document workspace
+
+Status: accepted product/UX architecture direction; implementation candidate subject to normal independent assurance.
+
+Decision:
+
+```text
+For the Standard anonymization core flow, use one persistent document workspace containing Toevoegen → Controleren → Downloaden. Keep all three stage headers visible, allow exactly one expanded/dominant stage at a time, collapse completed stages to compact summaries, keep future stages passive, auto-advance after successful completion, and allow explicit return to an earlier stage with fail-closed downstream invalidation.
+```
+
+Explicitly rejected for Standard:
+
+```text
+Toevoegen page → Controleren page → Downloaden page
+```
+
+The three core stages are states of the same document, not three separate routed screens. Also reject a conventional long Streamlit form rebuilt as a tree of independent or nested expanders.
+
+First-principles reason:
+- the scarce resource is user attention during a privacy-sensitive review task;
+- Scrub is iterative: review can legitimately send the user back to input/profile correction;
+- the interface must preserve confidence about source identity, completed work and whether downstream state is still current;
+- page routing maximizes isolation but removes spatial workflow context and adds state-restoration/routing complexity;
+- one staged workspace preserves the cognitive benefit of one task at a time while representing document state directly;
+- the model maps naturally to the merged source/processed/review/export generation lineage in `premium_core_flow_state.py`.
+
+Binding interaction consequences:
+- one dominant primary action per active stage;
+- no permanent configuration sidebar in Standard;
+- completed stage summaries contain orientation/trust information only, not mini-forms;
+- future stages show status rather than disabled control forests;
+- successful processing opens Controleren automatically;
+- explicit review completion opens Downloaden automatically;
+- earlier processing-affecting edits invalidate downstream review/export state before those results can be presented as current;
+- no nested core-flow accordion hierarchy in Standard;
+- stage surfaces should read as application panels even when Streamlit primitives are used internally.
+
+Current workpackage consequence:
+- insert `SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE` before further production integration in `SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION`;
+- retain PR #85's compatible pure helper/test work;
+- require PR #85 to incorporate the staged-workspace semantics before touching/merging production `presidio_streamlit.py` integration;
+- continue sequentially with Input, Review, Export, Expert parity and live app closeout packages.
+
+Safety boundary:
+- this decision changes presentation architecture, not anonymization semantics;
+- recognizers, thresholds, review authority, direct masking, export bytes/names/MIME, Scrub Key, reinsert, audit and human-review requirements remain unchanged;
+- Standard is lower cognitive load, not lower safety.
+
+Evidence:
+- coordinator/user approval on 2026-08-08 Europe/Amsterdam after explicit first-principles comparison;
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`;
+- `PREMIUM_CORE_FLOW_UI_REALIGNMENT_PLAN.md`;
+- merged Premium UI contract and state model.
+
+---
+
 ## 2026-08-06 — D042 — Separate implementation from blind independent release assurance
 
 Status: accepted project-governance and release-control decision

PREMIUM_STAGED_WORKSPACE_DECISION.md

@@ -0,0 +1,493 @@
+# Premium Staged Workspace Decision
+
+Status: `APPROVED_DIRECTION — RELEASE_CANDIDATE`
+
+Coordinator approval: 2026-08-08 Europe/Amsterdam  
+Repository: `solidprivacy-nl/scrub`  
+Workpackage: `SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE`
+
+## 1. Decision
+
+The Premium Standard interface for the Scrub anonymization core flow will use a **single-page staged document workspace**.
+
+The three core stages remain persistently represented in the same workspace:
+
+```text
+1. Toevoegen
+2. Controleren
+3. Downloaden
+```
+
+Exactly one of those stages is expanded and dominant at any moment.
+
+This is deliberately **not** a three-page wizard and deliberately **not** a conventional form with multiple independent expanders.
+
+The governing product principle is:
+
+```text
+One document. One workspace. Three stages. One active task.
+```
+
+## 2. Problem being solved
+
+The current verified functional baseline still reads visually as a long Streamlit form. Input, settings, review, manual corrections, downloads, Scrub Key controls and audit evidence compete for attention in one vertical page.
+
+Earlier decluttering improved individual surfaces but did not solve the structural problem: the UI still exposes too much workflow state simultaneously and therefore asks the user to understand the implementation rather than the task.
+
+The Premium line must reduce cognitive load without reducing review, privacy, auditability or control.
+
+## 3. First-principles analysis
+
+### 3.1 What is the user actually trying to accomplish?
+
+The user's primary job is not to navigate pages or configure an anonymization engine. It is:
+
+```text
+safely transform one confidential document
+→ inspect the result
+→ obtain the right output
+```
+
+The interface should therefore model the **state of the document**, not a collection of pages or forms.
+
+The minimum state story is:
+
+```text
+source supplied
+→ processing result exists
+→ result reviewed
+→ current export is eligible
+```
+
+### 3.2 What information must remain visible?
+
+At any moment the user needs to know:
+
+1. what document/text is being worked on;
+2. where they are in the workflow;
+3. whether prior work is complete and still current;
+4. what action is required next;
+5. whether a later result has become stale after an earlier change.
+
+A good UI should answer these questions without forcing navigation or exposing every control.
+
+### 3.3 Why one active task matters
+
+Human attention is the scarce resource in Scrub review. Displaying input, settings, review helpers, export choices, Scrub Key and audit controls at the same visual level increases decision surface without increasing safety.
+
+Premium Standard therefore optimizes for:
+
+```text
+one dominant task
++ one dominant primary action
++ compact context from completed work
++ visible but non-competing future stages
+```
+
+This is lower cognitive load, not lower safety.
+
+## 4. Alternatives considered
+
+### Model A — three separate screens/pages
+
+Concept:
+
+```text
+Toevoegen → separate page
+Controleren → separate page
+Downloaden → separate page
+```
+
+#### Advantages
+
+- maximal visual isolation;
+- very low per-screen control density;
+- strong linear progress cue;
+- naturally suppresses irrelevant controls;
+- can feel polished when the process is strictly linear.
+
+#### Disadvantages for Scrub
+
+- loses document/workflow context when moving between stages;
+- makes review-to-input correction feel like backward navigation rather than normal document iteration;
+- creates more routing/state-restoration responsibility in Streamlit;
+- increases the risk that users do not know whether a previous source/profile/result is still current;
+- can encourage hidden reprocessing or stale-state bugs if navigation and processing state become coupled;
+- makes the complete state of the document workflow less observable.
+
+### Model B — single-page staged workspace
+
+Concept:
+
+```text
+✓ Toevoegen — compact summary
+▼ Controleren — active workspace
+  Downloaden — visible, passive
+```
+
+#### Advantages
+
+- preserves one-task-at-a-time focus;
+- keeps the document workflow spatially coherent;
+- makes progress and previous-state summaries visible without reopening full controls;
+- makes deliberate return to an earlier stage natural;
+- maps directly to the existing state-model concept of source/processed/review/export lineage;
+- fits Streamlit without requiring page routing as the primary state mechanism;
+- supports automatic progression while preserving explicit user control;
+- allows stale downstream state to be represented clearly after earlier changes.
+
+#### Risks
+
+- can regress into the current form-like experience if implemented as generic/nested expanders;
+- collapsed sections can become visually noisy if summaries contain too much detail;
+- careless accordion controls can make the interface feel like a website FAQ rather than an application.
+
+These risks are addressed through the rules below.
+
+## 5. Decision rationale
+
+Scrub is not a strictly linear checkout flow. Human review is central, and review can legitimately cause a return to earlier work. The product must therefore preserve both **focus** and **workflow context**.
+
+The staged workspace wins because it treats the source, review and output as states of one document rather than unrelated destinations.
+
+The decision is especially strong for the current Streamlit architecture because it minimizes routing complexity while allowing the already merged `premium_core_flow_state.py` invariants to remain authoritative.
+
+The design preference is approximately:
+
+```text
+single-page staged workspace: strong preference
+three separate core-flow pages: rejected for Standard
+```
+
+Separate top-level workflows such as `Anonimiseren | Terugzetten` remain valid. The rejection applies to turning the three anonymization core stages into routed pages.
+
+## 6. Binding Standard-mode interaction contract
+
+### 6.1 Persistent stage rail/workspace
+
+All three stage headers remain present in the same page/workspace:
+
+```text
+1. Toevoegen
+2. Controleren
+3. Downloaden
+```
+
+They must not all expose their full internals simultaneously.
+
+### 6.2 Exactly one expanded stage
+
+At all times exactly one core stage is dominant and expanded.
+
+Opening a different eligible stage collapses the currently expanded stage.
+
+There is no Standard-mode state where two core stages expose their full working surfaces at once.
+
+### 6.3 Completed-stage summaries
+
+A completed prior stage collapses into a compact summary that gives only the information needed for trust and orientation.
+
+Examples:
+
+```text
+✓ Toevoegen — contract.docx · Juridisch
+✓ Controleren — 14 gecontroleerd · 1 handmatig toegevoegd
+```
+
+Summary content must not become a second mini-form.
+
+### 6.4 Future-stage visibility
+
+Future stages remain visible so the complete workflow is understandable, but they are passive until prerequisites are satisfied.
+
+Example:
+
+```text
+Downloaden — beschikbaar na controle
+```
+
+A passive future stage must not expose disabled forests of controls.
+
+### 6.5 Automatic progression
+
+After successful processing:
+
+```text
+Toevoegen collapses
+→ Controleren opens automatically
+```
+
+After explicit review completion:
+
+```text
+Controleren collapses
+→ Downloaden opens automatically
+```
+
+The transition should feel like the workspace advancing, not a page reload/navigation event.
+
+### 6.6 Explicit return/edit
+
+A user may deliberately return to an earlier eligible stage.
+
+The action must be explicit, understandable and reversible where appropriate.
+
+If the user changes input or a processing-affecting setting, downstream review/export lineage is invalidated according to `premium_core_flow_state.py`. Stale output must never remain visually presented as current.
+
+### 6.7 One dominant primary action
+
+Each active stage has one visually dominant primary action.
+
+Target examples:
+
+```text
+Toevoegen:     Document verwerken
+Controleren:   Controle afronden
+Downloaden:    Document downloaden
+```
+
+Secondary actions remain subordinate and should not compete visually.
+
+### 6.8 No nested core-flow accordion hierarchy
+
+Standard must not re-create form complexity through nested expanders inside the active stage.
+
+Where secondary disclosure is necessary, prefer:
+
+- inline contextual reveal;
+- a compact secondary action;
+- a modal/popover where technically appropriate and safe;
+- Expert mode for genuinely technical controls.
+
+Do not build an accordion inside an accordion as the default Standard interaction pattern.
+
+### 6.9 Stage panels, not generic Streamlit expanders
+
+The interaction may use Streamlit primitives internally, but the user-facing presentation should read as a staged application workspace.
+
+The stage header should communicate:
+
+- stage number/name;
+- status: active/completed/future;
+- compact summary when completed;
+- explicit edit/return affordance where allowed.
+
+Avoid generic `st.expander` visual language when it reinforces a settings-form feeling.
+
+## 7. Standard and Expert relationship
+
+`Standaard` and `Expert` are presentation modes over the same processing state.
+
+Standard:
+
+- staged workspace is the dominant interaction model;
+- no permanent configuration sidebar;
+- one primary task/action at a time;
+- advanced settings, alternate output formats, Scrub Key and detailed audit are progressively disclosed.
+
+Expert:
+
+- may expose additional inspection/tuning surfaces;
+- may retain the configuration sidebar or equivalent advanced controls;
+- must preserve the same authoritative document lineage and review semantics;
+- may not silently process a different document state from Standard.
+
+Switching Standard ↔ Expert is presentation-only unless an explicitly changed expert setting affects processing; such a setting change must then invalidate downstream state according to the state model.
+
+## 8. Top-level workflows
+
+The staged-workspace decision does not collapse `Anonimiseren` and `Terugzetten` into one ambiguous flow.
+
+Top level remains:
+
+```text
+Anonimiseren | Terugzetten
+```
+
+The three-stage staged workspace is the binding Standard pattern for the anonymization core flow.
+
+The Reinsert/Terugzetten flow should follow the same Premium principles — one task at a time, minimal controls, clear source/key/output state — but its exact staged structure remains governed by its own existing behavior and future dedicated UI work. This decision must not silently alter reinsert semantics.
+
+## 9. Safety and state invariants
+
+This UI decision must not change:
+
+- recognizers or thresholds;
+- replacement decisions;
+- review-table authority;
+- direct missed-value masking semantics;
+- export bytes, filenames or MIME types;
+- Scrub Key schema, binding, warning or lifecycle;
+- reinsert semantics;
+- audit evidence;
+- local-processing boundaries;
+- human-review requirement.
+
+The UI must fail closed on stale state:
+
+```text
+source/profile/threshold change affecting processing
+→ processed lineage invalid
+→ reviewed lineage invalid
+→ export lineage invalid
+→ user returned to appropriate earlier stage
+```
+
+## 10. Visual hierarchy principles
+
+Premium does not mean decoration. It means controlled hierarchy.
+
+Standard should prioritize:
+
+1. document identity/context;
+2. current stage/task;
+3. current primary action;
+4. required review information;
+5. secondary safety/audit controls only when relevant.
+
+Avoid:
+
+- multiple equally prominent buttons;
+- permanent explanatory text blocks;
+- repeated labels already implied by stage context;
+- technical variable-like terms;
+- duplicated upload/input surfaces;
+- default-open diagnostics;
+- stacked download buttons of equal weight;
+- nested accordion trees.
+
+## 11. Workpackage realignment
+
+This decision intervenes in the current Premium sequence before production integration in PR #85.
+
+### Immediate package
+
+`SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE`
+
+Deliverables:
+
+- this decision document;
+- roadmap update;
+- workpackage queue update;
+- changelog entry;
+- binding note on active App Shell issue/PR.
+
+No runtime product behavior changes.
+
+### Current package — amended, not discarded
+
+`SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION`
+
+PR #85's existing pure presentation helpers/tests remain reusable.
+
+Before production Streamlit integration, extend/freeze its acceptance criteria so the shell represents:
+
+- all three persistent stage headers;
+- exactly one active/expanded stage;
+- completed/future/active stage presentation states;
+- compact completed summaries;
+- passive future states;
+- automatic next-stage progression hooks;
+- explicit prior-stage return/edit affordances;
+- no permanent Standard configuration sidebar;
+- no three-page routing for the core stages.
+
+Only after these shell semantics are testable should `presidio_streamlit.py` production integration proceed.
+
+### Subsequent stage packages
+
+`SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION`
+
+- reduce Toevoegen to source + essential profile/context + one primary process action;
+- hide nonessential tuning in Standard;
+- preserve ingestion and processing semantics.
+
+`SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION`
+
+- make side-by-side/document review dominant;
+- retain review table as authoritative fallback/source of truth;
+- keep direct missed-value masking accessible;
+- move technical review controls out of the primary visual hierarchy.
+
+`SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION`
+
+- present one recommended cleaned-document download as dominant;
+- make alternate formats, Scrub Key and audit evidence secondary but accessible;
+- do not alter export semantics.
+
+`SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION`
+
+- prove Standard hides complexity without removing capability;
+- prove Standard/Expert switching preserves valid state;
+- prove processing-affecting Expert changes invalidate downstream state correctly;
+- prove no safety/export/reinsert capabilities disappeared.
+
+`SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT`
+
+- verify deployment and actual live staged-workspace behavior;
+- require coordinator/user UX confirmation because UI behavior changed;
+- close only after exact GitHub Actions, Hugging Face synchronization and app verification evidence.
+
+## 12. Acceptance criteria for the final Premium Standard core flow
+
+The final Premium Standard line is not complete until live app verification confirms all of the following:
+
+1. The first impression is a task workspace, not a long form.
+2. `Toevoegen`, `Controleren`, `Downloaden` remain visible as the workflow structure.
+3. Only one stage exposes its full contents at a time.
+4. Successful stage completion automatically advances the active workspace.
+5. Completed stages collapse to useful one-line/compact summaries.
+6. Future stages do not compete for attention.
+7. Returning to an earlier stage is obvious.
+8. Processing-affecting earlier changes visibly invalidate stale downstream results.
+9. There is one dominant primary action per active stage.
+10. Standard has no permanent configuration sidebar.
+11. The review surface remains sufficiently powerful for mandatory human review.
+12. The recommended cleaned-document download is dominant in the final stage.
+13. Scrub Key, alternate formats and audit remain accessible but secondary.
+14. No nested-expander form hierarchy has replaced the old long form.
+15. No export, Scrub Key, reinsert, recognition or audit semantics changed unintentionally.
+
+## 13. Non-goals
+
+This decision does not authorize:
+
+- a frontend framework migration;
+- cloud document processing;
+- a full document editor;
+- occurrence-specific replacement;
+- redesign of anonymization algorithms;
+- new export formats;
+- Scrub Key semantic changes;
+- reinsert semantic changes;
+- packaging/installer work.
+
+## 14. Governance and execution boundary
+
+The Premium UI is consequential production-facing work.
+
+Implementation workers create identifiable candidates and machine evidence. Separate `governance_release_assurance` workers issue `PASS | FAIL | INDETERMINATE` and may not silently repair candidates.
+
+The current PR #85 must not be merged merely because its primitive helper tests are green. It must first incorporate this approved staged-workspace direction, complete its production integration, pass exact-head regression, and receive independent assurance.
+
+## 15. Short design test
+
+When uncertain whether a control belongs in Standard, ask:
+
+```text
+Does the user need this to complete the current stage safely?
+```
+
+If no:
+
+```text
+hide it, defer it, summarize it, or move it to Expert/secondary disclosure.
+```
+
+When uncertain whether a new screen is needed, ask:
+
+```text
+Is this a different top-level job, or merely another state of the same document?
+```
+
+For `Toevoegen → Controleren → Downloaden`, the answer is: another state of the same document. Therefore it remains one staged workspace.

ROADMAP.md

@@ -11,13 +11,13 @@ Use it together with:
 - `DECISION_LOG.md` for accepted strategic and architecture decisions;
 - `PROJECT_PROMPT.md` for worker rules and project governance.
 
-Last roadmap strategy update: 2026-08-06 — the Weekly ETF donor's canonical implementation-versus-release-assurance model is adopted for consequential Scrub work, strengthened with blind review before the initial assurance decision; the premium single-task app-shell line remains gated by independent governance passes after the cross-flow safety regression.
+Last roadmap strategy update: 2026-08-08 — the Premium UI direction is now explicitly frozen as a **single-page staged document workspace**: `Toevoegen → Controleren → Downloaden` remain persistently represented in one workspace, exactly one stage is expanded at a time, completed stages collapse to compact summaries, future stages remain passive, and successful completion auto-advances. Three separate routed pages for these core stages are rejected for Standard. This urgent decision intervenes before production Streamlit integration in PR #85 and preserves its reusable pure helper work.
 
 ---
 
 ## Operational governance — implementation and blind release assurance
 
-Consequential Scrub work now follows the canonical cross-project two-role standard used by the Weekly ETF donor architecture:
+Consequential Scrub work follows the canonical cross-project two-role standard used by the Weekly ETF donor architecture:
 
 ```text
 implementation_operations
@@ -30,7 +30,9 @@ implementation_operations
 
 The user remains the single coordinator-facing principal. Implementation cannot certify its own candidate, and governance cannot silently repair it. Scrub adds a blind-review boundary: before its initial decision, governance may inspect source, criteria and raw machine evidence but not implementation handovers, self-assessments or conclusions.
 
-The current maturity is `LEVEL_1_CHECKLIST`, with a later target of `LEVEL_2_MACHINE_EVIDENCE`. This adoption does not claim a hard CI gate. The next premium UI package remains blocked until independent assurance passes both the governance-adoption candidate and the processed-text cross-flow regression candidate.
+The current maturity is `LEVEL_1_CHECKLIST`, with a later target of `LEVEL_2_MACHINE_EVIDENCE`.
+
+The governance/cross-flow gate that previously blocked the Premium UI line is closed. Issue #70 is closed, PR #73 is merged, the Premium UI contract is merged through PR #80, and the pure Premium core-flow state model is merged through PR #82. The active line is therefore Premium UI implementation, subject to independent assurance for each consequential candidate.
 
 Governed by:
 - `control/PROJECT_GOVERNANCE_BOOTSTRAP.md`;
@@ -139,6 +141,11 @@ SCRUB-WP_MVP_SCRUB_KEY_BINDING_MODEL_IMPLEMENTATION — completed with pure bind
 SCRUB-WP_MVP_SCRUB_KEY_BINDING_EXPORT_INTEGRATION — completed with bound placeholders and schema-1.1 key export.
 SCRUB-WP_MVP_SCRUB_KEY_BINDING_REINSERT_INTEGRATION — implemented with dual-read import, fail-closed binding enforcement and explicit legacy compatibility; app verification pending.
 SCRUB-WP_AI_FIRST_DESKTOP_PACKAGING_ROADMAP_ALIGNMENT — completed as a documentation-only Phase 9 execution-model refinement; installer implementation remains gated.
+SCRUB-WP_PROCESSED_TEXT_SELECTION_CROSS_FLOW_REGRESSION — independently assured and governance gate closed through issue #70/#73 recovery.
+SCRUB-WP_PREMIUM_CORE_FLOW_UI_CONTRACT — merged through PR #80; contract only, no production UI behavior.
+SCRUB-WP_PREMIUM_CORE_FLOW_STATE_MODEL — merged through PR #82; pure state model only, no production UI behavior.
+SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION — active in draft PR #85; current candidate contains reusable presentation primitives/tests but production `presidio_streamlit.py` integration has not started.
+SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — urgent architecture/queue intervention approved by the coordinator on 2026-08-08; must be incorporated before PR #85 proceeds to production UI integration.
 ```
 
 Important UX status:
@@ -147,8 +154,8 @@ Important UX status:
 The review table remains source of truth and fallback.
 The old replacement decision helper panel must not return as normal user-facing UI.
 The unified side-by-side review, manual missed-value entry, compact placeholder display and grouped export flow form the verified functional baseline.
-Direct live-app evidence now confirms that this baseline still presents too much of the workflow as one long form.
-The next approved UI direction is a global Standard/Expert presentation model and a one-active-stage document workspace, not another isolated expander-cleanup pass.
+Direct live-app evidence confirms that this baseline still presents too much of the workflow as one long form.
+The Premium Standard target is one document workspace with three persistent stages and one active task, not another isolated expander-cleanup pass and not three routed core-flow pages.
 ```
 
 ---
@@ -204,7 +211,8 @@ This is governed by:
 - `SIDE_BY_SIDE_REVIEW_UX_DIRECTION.md`;
 - `REPLACE_LOGIC_UI_REDESIGN_PLAN.md`;
 - `MVP_UI_CLEANUP_AND_EXPORT_REDESIGN_PLAN.md`;
-- `PREMIUM_CORE_FLOW_UI_REALIGNMENT_PLAN.md`.
+- `PREMIUM_CORE_FLOW_UI_REALIGNMENT_PLAN.md`;
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`.
 
 UX principles:
 
@@ -217,45 +225,103 @@ UX principles:
 - no Scrub Key/export/reinsert behavior changes from review UX work without separate approval;
 - technical/debug-like details should move to secondary audit/advanced layers, not disappear.
 
+### Premium core-flow UI realignment — binding staged-workspace decision
 
-### Premium core-flow UI realignment
-
-Direct coordinator/user evidence on 2026-08-05 establishes that the remaining interface problem is structural:
+Direct coordinator/user evidence on 2026-08-05 established that the remaining interface problem is structural:
 
 ```text
 The app still behaves visually as one long Streamlit form.
 Input, settings, review, corrections, downloads, Scrub Key and audit controls compete on the same page.
 ```
 
-The approved target is:
+The approved target remains:
 
 ```text
 Top-level workflow: Anonimiseren | Terugzetten
 Global presentation: Standaard | Expert
-One active stage: Toevoegen → Controleren → Downloaden
+Core stages: Toevoegen → Controleren → Downloaden
 One primary action per active stage
 Progressive and conditional disclosure for settings, other formats, Scrub Key and audit evidence
 ```
 
-`Standaard` is lower cognitive load, not lower safety. `Expert` preserves full inspection, tuning, audit and troubleshooting. The current permanent settings sidebar is not part of the Standard target. Completed stages collapse into compact summaries rather than remaining open above the current task.
+On 2026-08-08 the coordinator explicitly chose how those three core stages must be presented. The Standard anonymization flow is a **single-page staged document workspace**, not three separate routed screens.
+
+Binding interaction model:
+
+```text
+One document
+→ one persistent workspace
+→ three persistent stage headers
+→ exactly one expanded/active stage
+→ completed stages collapse to compact summaries
+→ future stages remain visible but passive
+→ successful completion auto-opens the next stage
+→ explicit return to an earlier stage is allowed
+→ processing-affecting earlier changes invalidate downstream state fail-closed
+```
+
+The first-principles reason is that Scrub is an iterative document-review workflow rather than a strictly linear checkout wizard. The interface should represent the **state of one document** rather than force the user to navigate separate pages. A staged workspace keeps the cognitive benefit of one task at a time while preserving context, progress, confidence and easy return from review to input.
+
+The rejected Standard pattern is:
+
+```text
+Toevoegen page → Controleren page → Downloaden page
+```
+
+The rejected implementation shortcut is also:
+
+```text
+classic long Streamlit form
++ multiple independent/nested expanders
+```
+
+Stage sections must read as application panels, not as a FAQ/settings accordion. There must be no default nested core-flow expander hierarchy in Standard.
+
+`Standaard` is lower cognitive load, not lower safety. `Expert` preserves full inspection, tuning, audit and troubleshooting. The permanent settings sidebar is not part of the Standard target. Completed stages show only compact orientation/trust summaries rather than full controls.
+
+Target progression example:
+
+```text
+Initial:
+▼ 1 Toevoegen
+  2 Controleren — beschikbaar na verwerking
+  3 Downloaden — beschikbaar na controle
+
+After processing:
+✓ 1 Toevoegen — contract.docx · Juridisch
+▼ 2 Controleren
+  3 Downloaden — beschikbaar na controle
+
+After review:
+✓ 1 Toevoegen — contract.docx · Juridisch
+✓ 2 Controleren — 14 gecontroleerd · 1 handmatig toegevoegd
+▼ 3 Downloaden
+```
 
 The implementation remains within Streamlit first, but must approximate a single-task application shell. It must not change recognizers, replacement decisions, export bytes, filenames, MIME types, Scrub Key semantics, reinsert behavior, audit evidence or the human-review requirement.
 
-Sequential execution:
+The detailed decision, alternative comparison, interaction rules, safety invariants and acceptance criteria are frozen in `PREMIUM_STAGED_WORKSPACE_DECISION.md`.
+
+### Premium execution sequence — urgent realignment
+
+The previous Premium sequence is amended before production UI integration in PR #85:
 
 ```text
-0. SCRUB-WP_PROCESSED_TEXT_SELECTION_CROSS_FLOW_REGRESSION
-1. SCRUB-WP_PREMIUM_CORE_FLOW_UI_CONTRACT
-2. SCRUB-WP_PREMIUM_CORE_FLOW_STATE_MODEL
-3. SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION
-4. SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION
-5. SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION
-6. SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION
-7. SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION
-8. SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT
+0. SCRUB-WP_PROCESSED_TEXT_SELECTION_CROSS_FLOW_REGRESSION — completed / gate closed
+1. SCRUB-WP_PREMIUM_CORE_FLOW_UI_CONTRACT — completed / PR #80 merged
+2. SCRUB-WP_PREMIUM_CORE_FLOW_STATE_MODEL — completed / PR #82 merged
+3. SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — URGENT CURRENT PACKAGE
+4. SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION — active draft PR #85; production integration paused until package 3 is incorporated
+5. SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION
+6. SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION
+7. SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION
+8. SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION
+9. SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT
 ```
 
-Do not combine the input, review and export restructuring into one patch. Do not run shared Streamlit UI packages in parallel.
+PR #85 is **amended, not discarded**. Its current pure `premium_app_shell.py` helpers/tests are consistent with the one-active-stage direction and may be retained. Before production `presidio_streamlit.py` integration, the candidate must additionally freeze/test active/completed/future stage presentation, compact completed summaries, passive future stages, explicit return/edit affordances, auto-progression hooks and the no-three-page-routing rule.
+
+Do not combine input, review and export restructuring into one patch. Do not run shared Streamlit UI packages in parallel. Each consequential production UI candidate receives separate `governance_release_assurance` under the enforced contract.
 
 ### Phase 6 — MVP workflow validation and trust hardening
 
@@ -288,38 +354,37 @@ Phase 7 may reopen when the coordinator confirms the MVP product quality gate ha
 
 ## 7. Active next work direction
 
-The verified MVP UI baseline is now stable enough to move the active line into Phase 6 validation and trust hardening.
+The coordinator has explicitly prioritized the Premium interface. The Premium staged-workspace line is therefore the dominant execution queue until its live closeout, unless a privacy/safety blocker requires interruption.
 
-Current execution queue:
+Current dominant queue:
 
 ```text
-1. SCRUB-WP_MVP_E2E_SYNTHETIC_VALIDATION_MATRIX — completed
-2. SCRUB-WP_MVP_FALSE_NEGATIVE_GAP_TRIAGE — completed
-3. SCRUB-WP_MVP_DOCUMENT_HYGIENE_FIDELITY_HARDENING — completed and app-verified
-4. SCRUB-WP_MVP_REINSERT_AUTO_FLOW_SIMPLIFICATION_IMPLEMENTATION — completed and app-verified
-5. SCRUB-WP_MVP_SCRUB_KEY_ROUNDTRIP_VALIDATION — completed
-6. SCRUB-WP_MVP_SCRUB_KEY_DOCUMENT_BINDING_GAP_TRIAGE — completed
-7. SCRUB-WP_MVP_SCRUB_KEY_BINDING_CONTRACT_TESTS — completed
-8. SCRUB-WP_MVP_SCRUB_KEY_BINDING_MODEL_IMPLEMENTATION — completed
-9. SCRUB-WP_MVP_SCRUB_KEY_BINDING_EXPORT_INTEGRATION — completed
-10. SCRUB-WP_MVP_SCRUB_KEY_BINDING_REINSERT_INTEGRATION — implemented
-11. SCRUB-WP_MVP_SCRUB_KEY_BINDING_APP_VERIFY — active
-12. SCRUB-WP_MVP_AUDIT_RESIDUAL_RISK_EVIDENCE
-13. SCRUB-WP_MVP_PHASE6_QUALITY_GATE_CLOSEOUT
+1. SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — current; architecture/roadmap/workpackage binding
+2. SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION — draft PR #85; resume production integration only after #1 is incorporated
+3. SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION
+4. SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION
+5. SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION
+6. SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION
+7. SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT
 ```
 
+The earlier Phase 6 trust-hardening packages remain part of project history and may be reopened when required by evidence, but they are not allowed to dilute the current Premium UI focus by default.
+
 Execution principles:
 
 - use synthetic data only;
-- validate the full supported workflow before adding new features;
-- create recognizer or document-processing fixes only from reproducible evidence;
 - preserve legal meaning and keep human review mandatory;
-- direct live-app evidence on 2026-08-05 establishes a concrete usability blocker: the functional baseline remains a long, form-like page; reopen UI work only through the approved premium core-flow sequence;
+- the Premium shell is presentation/state orchestration, not a license to change recognition or export semantics;
+- one document, one workspace, three persistent stages, one active task;
+- no three routed pages for `Toevoegen → Controleren → Downloaden` in Standard;
+- no nested-expander recreation of the current long form;
+- create recognizer or document-processing fixes only from reproducible safety evidence;
+- live UI work must be sequential where it touches shared Streamlit/review/export surfaces;
 - do not make production-readiness claims from prototype evidence.
 
 ### Candidate document-centric manual-correction line
 
-Direct usability evidence supports a future correction path in the main processed-text pane:
+Direct usability evidence supports correction in the main processed-text pane:
 
 ```text
 select an unmasked value
@@ -328,9 +393,9 @@ select an unmasked value
 → add through the existing manual replacement path
 ```
 
-The recommended first version is bounded to all exact occurrences of the selected value. It must create a normal document-scoped manual row, keep the replacement table authoritative and preserve current bound export, Scrub Key and reinsert semantics. Occurrence-specific replacement, a rich editor and a combined Streamlit upgrade are excluded.
+The first version is bounded to all exact occurrences of the selected value. It creates a normal document-scoped manual row, keeps the replacement table authoritative and preserves current bound export, Scrub Key and reinsert semantics. Occurrence-specific replacement, a rich editor and a combined Streamlit upgrade are excluded.
 
-The proposed sequence is:
+The sequence was:
 
 ```text
 1. SCRUB-WP_PROCESSED_TEXT_SELECTION_MASKING_CONTRACT
@@ -341,9 +406,9 @@ The proposed sequence is:
 6. SCRUB-WP_PROCESSED_TEXT_SELECTION_APP_VERIFY
 ```
 
-The coordinator approved the direction and all-exact version-one boundary at 2026-08-04 00:09 Europe/Amsterdam. The contract, action model, component and production table integration are complete. The integration adds one normal bound manual row, reruns before exports, keeps the review table authoritative, retains the manual/static rollback path and changes no export/Scrub Key/reinsert semantics. GitHub-to-Hugging-Face synchronization and live app verification are green. The display-only placeholder compaction is also deployed and app-verified without changing binding grammar, entropy, export, Scrub Key or reinsert semantics. `SCRUB-WP_PROCESSED_TEXT_SELECTION_CROSS_FLOW_REGRESSION` is now the final safety baseline before the premium core-flow UI contract line starts.
+The coordinator approved the direction and all-exact version-one boundary at 2026-08-04 00:09 Europe/Amsterdam. The contract, action model, component and production table integration are complete. GitHub-to-Hugging-Face synchronization and live app verification are green. Display-only placeholder compaction is deployed and app-verified without changing binding grammar, entropy, export, Scrub Key or reinsert semantics. The cross-flow safety/governance gate is now closed and no longer blocks Premium UI work.
 
-Recall/benchmark work is reopened only where the synthetic validation matrix exposes a concrete false-negative, misclassification or over-masking gap.
+Recall/benchmark work is reopened only where reproducible safety evidence requires it.
 
 Do not start local packaging next steps such as `WP48B` or `WP49B` by default. They require explicit coordinator approval.
 
@@ -392,7 +457,13 @@ Streamlit app + helper modules + GitHub Actions + Hugging Face Space demo.
 MVP architecture target:
 
 ```text
-Thin helper-driven Streamlit application shell; one active document stage at a time; global Standard/Expert presentation; tested safety boundaries; local-first direction; and a clear primary export with secondary restore/audit layers.
+Thin helper-driven Streamlit application shell;
+one persistent document workspace;
+three core Standard stages with exactly one active at a time;
+global Standard/Expert presentation;
+tested safety/state boundaries;
+local-first direction;
+and a clear primary export with secondary restore/audit layers.
 ```
 
 Do not migrate frontend, add a full document editor, introduce cloud document processing, or alter export/Scrub Key/reinsert semantics without a dedicated approved package.
@@ -608,4 +679,4 @@ Safety boundaries:
 - no change to Scrub Key, export or reinsert semantics without a separate package;
 - human review remains required;
 - corpus or benchmark success does not prove production readiness;
-- no cloud document processing is introduced.
+- no cloud document processing is introduced.

WORKPACKAGES.md

@@ -1,3 +1,261 @@
+# SolidPrivacy Scrub — Current authoritative execution queue
+
+> **Current status override — 2026-08-08 Europe/Amsterdam**  
+> This section is the authoritative current execution queue. Older queue/status sections retained below are historical records and must not override this section.
+
+## Premium UI priority
+
+The coordinator has explicitly prioritized the Premium interface. The active Standard target is a **single-page staged document workspace**, not three separate routed core-flow pages and not a long form with nested expanders.
+
+Binding principle:
+
+```text
+One document. One workspace. Three stages. One active task.
+
+Toevoegen → Controleren → Downloaden
+```
+
+All three stage headers remain present in one workspace. Exactly one stage is expanded/dominant at a time. Completed stages collapse to compact summaries, future stages remain visible but passive, successful completion auto-advances, and explicit return to an earlier stage is allowed. Processing-affecting earlier changes invalidate downstream state fail-closed.
+
+Governing design:
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`;
+- `PREMIUM_CORE_FLOW_UI_REALIGNMENT_PLAN.md`;
+- merged `premium_core_flow_state.py` state invariants;
+- ROADMAP Premium core-flow section.
+
+Historical prerequisites now completed:
+- `SCRUB-WP_PREMIUM_CORE_FLOW_UI_REALIGNMENT_PLAN` — planning completed;
+- `SCRUB-WP_PROCESSED_TEXT_SELECTION_CROSS_FLOW_REGRESSION` — independent governance gate closed;
+- `SCRUB-WP_PREMIUM_CORE_FLOW_UI_CONTRACT` — merged through PR #80;
+- `SCRUB-WP_PREMIUM_CORE_FLOW_STATE_MODEL` — merged through PR #82.
+
+### 1. SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — urgent architecture gate
+
+Status: `IMPLEMENTATION_IN_PROGRESS` until exact-head CI and independent assurance.  
+Role: `implementation_operations`  
+Issue: #86  
+Dependency: merged PR #80 UI contract + merged PR #82 state model.  
+Parallelization: documentation/contract-only; production Streamlit integration in PR #85 must wait for this decision to be incorporated.
+
+Goal:
+- freeze the approved staged-workspace interaction model before the active App Shell package enters `presidio_streamlit.py`;
+- remove ambiguity between three routed screens versus one persistent staged workspace;
+- make the Premium line the dominant execution queue.
+
+Required output:
+- detailed first-principles design decision;
+- roadmap realignment;
+- this authoritative workpackage queue;
+- changelog and decision-log record;
+- contract tests;
+- explicit binding note on issue #84 / PR #85;
+- implementation claim and handover.
+
+Acceptance:
+- Standard explicitly means one persistent page/workspace with three persistent stage headers;
+- exactly one stage exposes its full surface at a time;
+- completed stages summarize, future stages remain passive;
+- successful stage completion advances automatically;
+- explicit prior-stage return is allowed;
+- processing-affecting changes invalidate downstream state;
+- three isolated routed pages are rejected for the Standard core flow;
+- nested core-flow expanders are rejected as the default Standard pattern;
+- no runtime/UI product semantics change in this package;
+- exact-head GitHub Actions passes;
+- fresh independent `governance_release_assurance` is required before merge.
+
+Intentionally excluded:
+- recognizers, thresholds, replacement logic, review authority;
+- export bytes/names/MIME;
+- Scrub Key/reinsert/audit semantics;
+- production Streamlit integration;
+- dependencies, runtime, deployment or Hugging Face behavior.
+
+### 2. SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION — active draft PR #85, amended
+
+Status: active draft; **production integration gated by package 1**.  
+Issue: #84  
+PR: #85  
+Dependency: `SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE` merged after independent PASS.
+
+Existing reusable work:
+- `premium_app_shell.py` presentation primitives;
+- `tests/test_premium_app_shell.py`;
+- top-level `Anonimiseren | Terugzetten` labels;
+- global `Standaard | Expert` labels;
+- stage labels and one-active-stage primitive;
+- Standard sidebar-hidden / Expert sidebar-available primitive.
+
+Required before production integration:
+- model active / completed / future stage presentation explicitly;
+- compact completed-stage summary contract;
+- passive future-stage contract;
+- automatic progression hooks from Add → Review → Download;
+- explicit prior-stage return/edit affordance;
+- no routed-page interpretation for the three anonymization stages;
+- no generic nested-expander hierarchy in Standard;
+- bind to `premium_core_flow_state.py` lineage/invalidation rules.
+
+Production integration acceptance:
+- integrate the staged shell in the existing Streamlit application without changing processing semantics;
+- all three stage headers remain persistently represented;
+- exactly one stage is dominant;
+- no permanent Standard configuration sidebar;
+- no stale review/export remains presented as current;
+- current review table/include authority, direct masking, export, Scrub Key, reinsert and audit semantics remain intact;
+- full exact-head regression green;
+- independent assurance PASS before merge.
+
+Do not merge PR #85 merely because helper tests are green.
+
+### 3. SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION
+
+Status: queued after App Shell PASS/merge.  
+Dependency: package 2 merged.  
+Shared UI rule: sequential; do not edit `presidio_streamlit.py` in parallel with another Premium production package.
+
+Goal:
+- make `Toevoegen` feel like one clear acquisition task rather than a settings form.
+
+Target Standard surface:
+- upload document OR paste text through one coherent source surface;
+- essential recognition profile/context visible and understandable;
+- one dominant action: `Document verwerken`;
+- nonessential tuning hidden or moved to Expert/secondary disclosure;
+- source identity survives into the compact completed-stage summary.
+
+Acceptance:
+- no duplicate input surfaces;
+- no forest of default-open settings;
+- one dominant processing action;
+- profile never changes silently;
+- ingestion, recognizer selection and processing semantics unchanged;
+- processing-affecting edits invalidate downstream state;
+- full regression + independent assurance before merge;
+- live app verification after deployment because UI behavior changes.
+
+### 4. SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION
+
+Status: queued after Input Stage PASS/merge.  
+Dependency: package 3.  
+Conflict boundary: exclusive ownership of shared review/Streamlit surfaces while active.
+
+Goal:
+- make `Controleren` the main document-review workspace rather than a collection of helper panels.
+
+Target Standard surface:
+- source and processed/checked text form the dominant review surface;
+- direct missed-value masking remains accessible where the user notices a miss;
+- review table remains authoritative source of truth and fallback, but not necessarily the visually dominant first surface;
+- technical filters, diagnostics and tuning move out of the primary hierarchy;
+- one dominant completion action: `Controle afronden`.
+
+Acceptance:
+- mandatory human review is not weakened;
+- include/exclude state remains authoritative;
+- direct masking produces normal document-bound manual rows;
+- no recognizer/export/Scrub Key/reinsert semantic drift;
+- compact completed review summary is trustworthy and nontechnical;
+- full regression + independent assurance before merge;
+- live app verification required.
+
+### 5. SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION
+
+Status: queued after Review Stage PASS/merge.  
+Dependency: package 4.  
+Conflict boundary: exclusive ownership of shared export/Streamlit surfaces while active.
+
+Goal:
+- make `Downloaden` end with one obvious recommended cleaned-document action instead of multiple equal-weight download controls.
+
+Target Standard surface:
+- one dominant recommended document download selected only from already eligible outputs;
+- alternate formats secondary;
+- Scrub Key clearly separated as sensitive restoration material;
+- audit/residual-risk evidence accessible but secondary;
+- one dominant action: `Document downloaden`.
+
+Acceptance:
+- export bytes, eligibility, filenames and MIME types unchanged;
+- Scrub Key lifecycle/warning/binding unchanged;
+- audit evidence not removed;
+- current-generation guard prevents stale downloads;
+- full regression + independent assurance before merge;
+- live app verification required.
+
+### 6. SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION
+
+Status: queued after Export Stage PASS/merge.  
+Dependency: packages 2–5.
+
+Goal:
+- prove that Standard removes visual complexity without removing capability or safety.
+
+Required evidence:
+- Standard ↔ Expert presentation switch preserves valid source/review state;
+- presentation-only changes do not reprocess;
+- processing-affecting Expert changes invalidate downstream lineage correctly;
+- all advanced review, audit and troubleshooting capabilities remain available where intended;
+- no review/export/Scrub Key/reinsert capability is silently lost;
+- Standard cannot expose stale current-looking output.
+
+Acceptance:
+- deterministic parity/regression tests;
+- full suite green;
+- independent assurance PASS.
+
+### 7. SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT
+
+Status: final queued Premium gate.  
+Dependency: packages 2–6 independently passed and merged.
+
+Goal:
+- verify the deployed Premium Standard flow end-to-end in the actual app.
+
+Required live acceptance:
+1. first impression is a task workspace, not a long form;
+2. `Toevoegen`, `Controleren`, `Downloaden` remain visibly the workflow structure;
+3. only one stage is fully open at once;
+4. successful completion auto-advances;
+5. completed stages collapse into compact meaningful summaries;
+6. future stages remain passive and non-competing;
+7. returning to an earlier stage is obvious;
+8. stale downstream state is invalidated visibly and safely;
+9. one dominant primary action per active stage;
+10. Standard has no permanent configuration sidebar;
+11. review remains sufficient for mandatory human review;
+12. one recommended cleaned-document download dominates the final stage;
+13. Scrub Key, alternate formats and audit remain accessible but secondary;
+14. no nested-expander form hierarchy replaces the old long form;
+15. no recognizer/export/Scrub Key/reinsert/audit semantics changed unintentionally.
+
+Validation:
+- exact GitHub Actions evidence;
+- GitHub → Hugging Face synchronization for the exact runtime candidate;
+- runtime health/smoke evidence;
+- coordinator/user subjective UX verification;
+- final governance closeout.
+
+## Binding execution order
+
+```text
+SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE
+→ SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION
+→ SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION
+→ SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION
+→ SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION
+→ SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION
+→ SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT
+```
+
+Safety/coordination rule:
+- **do not run the shared Streamlit UI packages in parallel**;
+- specifically avoid parallel edits to `presidio_streamlit.py`, `fix_streamlit_nested_expanders.py`, review-table flow and export/download flow;
+- helper/spec/test work can proceed separately only when it does not create conflicting implementation authority;
+- privacy/safety blockers may interrupt this sequence, but generic backlog work must not dilute the current Premium UI focus by default.
+
+---
+
 ## 2026-08-07 Europe/Amsterdam — SCRUB-WP_ISSUE70_POST_MERGE_ACTIONS_EVIDENCE_RECOVERY — repaired candidate
 
 Status: `RELEASE_CANDIDATE_READY`; fresh exact-head blind assurance required before merge.

handover/workpackages/20260808_1255_premium_staged_workspace_decision_freeze.md

@@ -0,0 +1,131 @@
+# Handover — SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE
+
+Repository: `solidprivacy-nl/scrub`  
+Workpackage title: `SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — bind single-page three-stage workspace`  
+Role: `implementation_operations`  
+Status: `RELEASE_CANDIDATE_READY — independent governance_release_assurance required before merge`
+
+## Summary
+
+The coordinator-approved Premium Standard interaction decision has been translated into a binding architecture specification, roadmap realignment, authoritative execution queue, decision-log record and regression contract.
+
+The governing principle is:
+
+```text
+One document. One workspace. Three stages. One active task.
+
+Toevoegen → Controleren → Downloaden
+```
+
+For Standard anonymization, the three stages remain represented in one persistent page/workspace. Exactly one stage is expanded/dominant at a time. Completed stages collapse to compact summaries, future stages remain visible but passive, successful completion auto-advances, explicit return to an earlier stage is allowed, and processing-affecting earlier changes invalidate downstream state fail-closed.
+
+Three separate routed core-flow pages and a generic nested-expander form hierarchy are explicitly rejected for Standard.
+
+This package deliberately intervenes before active PR #85 enters production `presidio_streamlit.py` integration. PR #85 is amended, not discarded: its existing pure `premium_app_shell.py` and test work remains reusable, but the production shell must first incorporate this staged-workspace contract.
+
+## Files added
+
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`
+- `tests/test_premium_staged_workspace_decision.py`
+- `workpackage_claims/scrub_wp_premium_staged_workspace_decision_freeze.md`
+- `handover/workpackages/20260808_1255_premium_staged_workspace_decision_freeze.md`
+
+## Files changed
+
+- `ROADMAP.md`
+  - Premium staged workspace made the explicit strategic UI direction;
+  - Premium UI made the dominant execution line;
+  - new urgent architecture gate inserted before production PR #85 integration;
+  - current governance/contract/state-model status aligned with merged PRs #73, #80 and #82.
+- `WORKPACKAGES.md`
+  - authoritative current Premium execution queue prepended without deleting historical workpackage records;
+  - detailed sequential packages and acceptance criteria frozen.
+- `CHANGELOG.md`
+  - architecture-candidate entry added.
+- `DECISION_LOG.md`
+  - D043 records the single-page staged workspace decision and rejected alternatives.
+
+Issue #84 and PR #85 also contain binding comments pointing to issue #86 / PR #87.
+
+## Tests added / updated
+
+Added `tests/test_premium_staged_workspace_decision.py` covering:
+
+- one persistent document workspace;
+- `Toevoegen | Controleren | Downloaden` stage contract;
+- exactly one expanded/dominant stage;
+- compact completed-stage summaries;
+- passive future-stage visibility;
+- automatic progression;
+- rejection of three routed core-flow pages;
+- rejection of nested core-flow accordion hierarchy;
+- preservation of review/export/Scrub Key/reinsert/human-review safety boundaries;
+- roadmap urgency and exact workpackage execution order;
+- D043 decision-log binding.
+
+One initial new-test assertion was overly literal about Markdown emphasis (`not a three-page wizard` versus `**not** a three-page wizard`). Raw run #2143 therefore produced `1 failed, 1189 passed`. The assertion was narrowed to the durable semantic contract without weakening the routed-page/nested-expander prohibitions.
+
+Pre-final administrative candidate validation:
+
+```text
+GitHub Actions Tests run #2145 / ID 31253772414
+python -m pytest -q tests
+1190 passed in 12.23s
+conclusion: success
+```
+
+After that green run, a scope-cleanup commit only restored unrelated historical ROADMAP status wording and removed its temporary self-cleaning workflow. No product/runtime code changed.
+
+The final handover/claim commits intentionally move the PR head once more. A fresh full `Tests` run on that final exact head is required before the candidate is handed to assurance. No further candidate edits are permitted after that exact-head run unless the candidate returns to implementation for repair.
+
+## Validation status
+
+- GitHub Actions: `GREEN` on pre-final administrative candidate (`1190 passed in 12.23s`); fresh exact-final-head run required after this handover/claim commit.
+- Hugging Face sync: `NOT APPLICABLE` — no runtime/deployment/Hugging Face product files are changed.
+- App verification: `NOT APPLICABLE` — this package changes architecture/roadmap/contracts only; it does not change the live UI.
+- Production Streamlit integration: deliberately not included.
+
+## GitHub Actions status
+
+Pre-final green evidence:
+
+- workflow: `Tests`
+- run: #2145 / `31253772414`
+- tested branch head: `6c72d87700683215bacf7115c82f72418d6da38e`
+- tested PR merge candidate: `d72686b585a137adb9000c4457b262eecb0679e6`
+- command: `python -m pytest -q tests`
+- raw result: `1190 passed in 12.23s`
+- conclusion: `success`
+
+The exact final PR head and its fresh run must be recorded in PR #87 / issue #86 after this file and the final claim are committed.
+
+## Hugging Face sync status
+
+`NOT APPLICABLE`.
+
+This workpackage contains no production/runtime file intended for Hugging Face synchronization.
+
+## App verification status
+
+`NOT APPLICABLE` for this package.
+
+Actual staged-workspace behavior must be verified later in `SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT` after the App Shell, Input, Review and Export implementation packages have been independently assured, merged and synchronized.
+
+## Remaining risks
+
+1. **Independent assurance not yet completed.** Implementation may not certify or merge its own PR #87.
+2. **PR #85 must remain aligned.** Its current helpers are reusable, but production integration must not proceed using three routed pages or a generic nested-expander hierarchy.
+3. **Streamlit implementation risk remains future work.** The staged workspace must feel like application panels, not cosmetically renamed `st.expander` form sections.
+4. **Standard must not become less safe.** Review-table/include authority, direct masking, Scrub Key, export, reinsert, audit and mandatory human review remain binding.
+5. **Final exact-head evidence is still required after this administrative closeout commit.** A failure returns to implementation; no inference of PASS is allowed.
+
+## Next recommended step
+
+1. Commit the final claim with `RELEASE_CANDIDATE_READY` status.
+2. Run/observe the normal full GitHub Actions `Tests` workflow on the exact final PR #87 head.
+3. If and only if that exact-head run is green, freeze the candidate and route PR #87 to a fresh independent `governance_release_assurance` reviewer for `PASS | FAIL | INDETERMINATE`.
+4. On independent PASS, merge PR #87 unchanged.
+5. Only then resume `SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION` in PR #85 under the new staged-workspace contract.
+6. Continue sequentially: App Shell → Input → Review → Export → Expert parity → live app verification.
+
+Implementation must not self-merge PR #87 and must not claim live Premium UI completion from this architecture package.

tests/test_premium_staged_workspace_decision.py

@@ -0,0 +1,88 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+DECISION = ROOT / "PREMIUM_STAGED_WORKSPACE_DECISION.md"
+ROADMAP = ROOT / "ROADMAP.md"
+WORKPACKAGES = ROOT / "WORKPACKAGES.md"
+DECISION_LOG = ROOT / "DECISION_LOG.md"
+
+
+def test_decision_freezes_one_document_one_workspace_model() -> None:
+    text = DECISION.read_text(encoding="utf-8")
+
+    for required in [
+        "single-page staged document workspace",
+        "One document. One workspace. Three stages. One active task.",
+        "1. Toevoegen",
+        "2. Controleren",
+        "3. Downloaden",
+        "Exactly one of those stages is expanded and dominant",
+        "completed prior stage collapses into a compact summary",
+        "Future stages remain visible",
+        "After successful processing",
+        "Controleren opens automatically",
+        "After explicit review completion",
+        "Downloaden opens automatically",
+    ]:
+        assert required in text
+
+
+def test_decision_rejects_routed_pages_and_nested_form_accordion() -> None:
+    text = DECISION.read_text(encoding="utf-8")
+
+    for required in [
+        "three-page wizard",
+        "three separate core-flow pages: rejected for Standard",
+        "No nested core-flow accordion hierarchy",
+        "Do not build an accordion inside an accordion",
+        "Stage panels, not generic Streamlit expanders",
+    ]:
+        assert required in text
+
+
+def test_decision_preserves_state_safety_and_product_semantics() -> None:
+    text = DECISION.read_text(encoding="utf-8")
+
+    for required in [
+        "review-table authority",
+        "export bytes, filenames or MIME types",
+        "Scrub Key schema, binding, warning or lifecycle",
+        "reinsert semantics",
+        "human-review requirement",
+        "processed lineage invalid",
+        "reviewed lineage invalid",
+        "export lineage invalid",
+    ]:
+        assert required in text
+
+
+def test_roadmap_makes_staged_workspace_the_urgent_premium_gate() -> None:
+    text = ROADMAP.read_text(encoding="utf-8")
+
+    assert "PREMIUM_STAGED_WORKSPACE_DECISION.md" in text
+    assert "SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE — URGENT CURRENT PACKAGE" in text
+    assert "production integration paused until package 3 is incorporated" in text
+    assert "PR #85 is **amended, not discarded**" in text
+    assert "one persistent document workspace" in text
+    assert "no three routed pages" in text
+
+
+def test_workpackages_and_decision_log_bind_the_execution_order() -> None:
+    workpackages = WORKPACKAGES.read_text(encoding="utf-8")
+    decisions = DECISION_LOG.read_text(encoding="utf-8")
+
+    assert "SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE" in workpackages
+    assert "SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION" in workpackages
+    assert "SCRUB-WP_PREMIUM_INPUT_STAGE_SIMPLIFICATION" in workpackages
+    assert "SCRUB-WP_PREMIUM_REVIEW_STAGE_SIMPLIFICATION" in workpackages
+    assert "SCRUB-WP_PREMIUM_EXPORT_STAGE_SIMPLIFICATION" in workpackages
+    assert "SCRUB-WP_PREMIUM_EXPERT_PARITY_REGRESSION" in workpackages
+    assert "SCRUB-WP_PREMIUM_CORE_FLOW_APP_VERIFY_CLOSEOUT" in workpackages
+    assert "do not run the shared Streamlit UI packages in parallel" in workpackages
+
+    assert "D043" in decisions
+    assert "single-page staged document workspace" in decisions
+    assert "three separate routed screens" in decisions

workpackage_claims/scrub_wp_premium_app_shell_implementation.md

@@ -0,0 +1,50 @@
+# Workpackage Claim — SCRUB-WP_PREMIUM_APP_SHELL_IMPLEMENTATION
+
+Repository: `solidprivacy-nl/scrub`  
+Role: `implementation_operations`  
+Status: `IMPLEMENTATION_IN_PROGRESS`  
+Issue: #84  
+PR: #85  
+Branch: `wp/premium-app-shell-implementation`  
+Claimed: 2026-08-08 14:47 Europe/Amsterdam
+
+## Dependency check
+
+The upstream staged-workspace architecture gate is satisfied:
+
+- `SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE_VERIFY: PASS` was recorded independently for PR #87 exact head `4d99430225f5086a84f2db33089e19688ca7793f`;
+- PR #87 merged unchanged as `d54eb06f9c6fea7c1f36cdb082b475c0d4666507`;
+- the binding Standard model is therefore `One document. One workspace. Three stages. One active task.`
+
+## Scope
+
+Implement the shared Premium App Shell only:
+
+- top-level `Anonimiseren | Terugzetten`;
+- global `Standaard | Expert`;
+- persistent `Toevoegen → Controleren → Downloaden` stage presentation;
+- exactly one dominant stage in Standard;
+- explicit active/completed/future stage states;
+- compact completed-stage summaries and passive future stages;
+- explicit return/edit affordance;
+- automatic progression hooks tied to current processing/review lineage;
+- Standard without a permanent configuration sidebar;
+- production integration into `presidio_streamlit.py` without redesigning stage internals beyond shell/grouping needs.
+
+## Safety boundary
+
+Do not change recognizers, thresholds, replacement semantics, review-table/include authority, direct masking semantics, export bytes/names/MIME, Scrub Key schema/binding/lifecycle, reinsert semantics, audit semantics, dependencies, cloud/local-processing boundary, or the mandatory human-review requirement.
+
+## Coordination
+
+Exclusive ownership is claimed for the shared Streamlit shell surface while this package is active. Do not run another package that edits `presidio_streamlit.py`, `fix_streamlit_nested_expanders.py`, review-table flow, export/download flow, or shared workflow state in parallel.
+
+## Validation plan
+
+- focused pure shell/state tests first;
+- production integration contract tests;
+- full GitHub Actions regression on the exact candidate head;
+- fresh independent `governance_release_assurance` before merge;
+- after merge, exact-main Actions + GitHub→Hugging Face sync + live app verification because UI behavior changes.
+
+Implementation will not self-certify or self-merge.

workpackage_claims/scrub_wp_premium_staged_workspace_decision_freeze.md

@@ -0,0 +1,82 @@
+# Workpackage Claim — SCRUB-WP_PREMIUM_STAGED_WORKSPACE_DECISION_FREEZE
+
+Repository: `solidprivacy-nl/scrub`  
+Role: `implementation_operations`  
+Status: `RELEASE_CANDIDATE_READY`  
+Issue: #86  
+PR: #87  
+Base main: `d5fcd8d6019f136e82877b646af2d085f9eb1720`  
+Branch: `wp/premium-staged-workspace-decision`
+
+## Goal
+
+Freeze the coordinator-approved Premium Standard interaction architecture before production Streamlit integration continues in PR #85.
+
+Binding direction:
+
+```text
+One document. One workspace. Three stages. One active task.
+
+Toevoegen → Controleren → Downloaden
+```
+
+The three stage headers remain in one persistent page/workspace. Exactly one stage is expanded at a time; completed stages collapse to compact summaries; future stages remain visible but passive; successful completion auto-advances; deliberate return to an earlier stage is allowed; processing-affecting changes invalidate downstream state fail-closed.
+
+## Scope
+
+Planning, architecture, execution-order and contract-test changes only:
+
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`;
+- `ROADMAP.md`;
+- `WORKPACKAGES.md`;
+- `CHANGELOG.md`;
+- `DECISION_LOG.md`;
+- `tests/test_premium_staged_workspace_decision.py`;
+- issue/PR binding notes for active PR #85;
+- this claim and the final handover.
+
+## Explicit intervention in active Premium work
+
+PR #85 is amended, not discarded. Its current `premium_app_shell.py` and `tests/test_premium_app_shell.py` helper work is reusable. Production `presidio_streamlit.py` integration must not proceed under a three-page or generic nested-expander interpretation; it must incorporate this staged-workspace decision after the decision candidate is independently assured and merged.
+
+## Administrative finalization
+
+The large historical control files were updated through temporary self-cleaning PR workflows so their existing history was prepended to, not replaced or truncated. Those workflows and temporary helper files removed themselves and are absent from the persistent PR diff.
+
+Persistent candidate paths are:
+
+- `CHANGELOG.md`;
+- `DECISION_LOG.md`;
+- `PREMIUM_STAGED_WORKSPACE_DECISION.md`;
+- `ROADMAP.md`;
+- `WORKPACKAGES.md`;
+- `tests/test_premium_staged_workspace_decision.py`;
+- `workpackage_claims/scrub_wp_premium_staged_workspace_decision_freeze.md`;
+- `handover/workpackages/20260808_1255_premium_staged_workspace_decision_freeze.md`.
+
+## Safety boundary
+
+No production Streamlit/UI behavior changes in this package. No recognizer, threshold, replacement, review-table authority, direct masking, export bytes/names/MIME, Scrub Key, reinsert, audit, document-processing, dependency, hosting or Hugging Face behavior changes.
+
+Human review remains mandatory. Synthetic/test content only.
+
+## Validation
+
+One initial new-test assertion was overly literal about Markdown emphasis and produced `1 failed, 1189 passed` on run #2143. It was repaired without weakening the architecture contract.
+
+Pre-final administrative candidate:
+
+```text
+GitHub Actions Tests run #2145 / ID 31253772414
+python -m pytest -q tests
+1190 passed in 12.23s
+conclusion: success
+```
+
+After that run, only roadmap scope cleanup plus this claim/handover administration changed. A fresh normal full `Tests` run on the exact final PR head is mandatory before assurance may treat this claim as machine-evidence-complete. No further candidate edits are permitted after that exact-head run unless the candidate returns to implementation for repair.
+
+- Hugging Face sync: `NOT APPLICABLE` — no runtime/deployment files changed.
+- App verification: `NOT APPLICABLE` — no live UI behavior changed.
+- Independent `governance_release_assurance`: `REQUIRED` before merge.
+
+Implementation does not self-certify or self-merge.