:root {
  --bg: #f5f6f8; --panel: #ffffff; --ink: #1b2430; --muted: #66707d; --line: #e2e6ec;
  --accent: #2563eb; --accent-ink: #ffffff;
  --online: #15803d; --online-bg: #dcfce7; --stale: #b45309; --stale-bg: #fef3c7;
  --offline: #b91c1c; --offline-bg: #fee2e2; --pending: #1d4ed8; --pending-bg: #dbeafe; --expired: #475569; --expired-bg: #e2e8f0;
  --shadow: 0 1px 2px rgba(15, 23, 42, .06), 0 4px 16px rgba(15, 23, 42, .04);
}
@media (prefers-color-scheme: dark) {
  :root {
    --bg: #0f141a; --panel: #171e26; --ink: #e6ebf1; --muted: #93a0af; --line: #263140;
    --accent: #5b8def; --accent-ink: #0b1220;
    --online: #4ade80; --online-bg: #123524; --stale: #fbbf24; --stale-bg: #3a2c0b;
    --offline: #f87171; --offline-bg: #3d1717; --pending: #7aa7ff; --pending-bg: #15264a; --expired: #a3b0c2; --expired-bg: #243040;
    --shadow: none;
  }
}
* { box-sizing: border-box; }
html { color-scheme: light dark; }
body { margin: 0; background: var(--bg); color: var(--ink); font: 14px/1.5 system-ui, -apple-system, "Segoe UI", "Microsoft YaHei", sans-serif; }
a { color: var(--accent); text-decoration: none; }
a:hover { text-decoration: underline; }
header.top { display: flex; align-items: center; gap: 16px; padding: 12px 24px; background: var(--panel); border-bottom: 1px solid var(--line); position: sticky; top: 0; z-index: 2; }
header.top .brand { font-weight: 700; letter-spacing: .2px; color: var(--ink); }
header.top .brand small { color: var(--muted); font-weight: 500; margin-left: 8px; }
header.top .spacer { flex: 1; }
header.top .clock { color: var(--muted); font-variant-numeric: tabular-nums; }
main { max-width: 1280px; margin: 0 auto; padding: 24px; }
h1 { font-size: 22px; margin: 0 0 16px; }
h2 { font-size: 15px; margin: 28px 0 10px; text-transform: uppercase; letter-spacing: .6px; color: var(--muted); }
.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(128px, 1fr)); gap: 12px; }
.card { background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 14px 16px; box-shadow: var(--shadow); }
.card .label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .6px; }
.card .num { font-size: 32px; font-weight: 700; font-variant-numeric: tabular-nums; line-height: 1.2; }
.card.online .num { color: var(--online); } .card.stale .num { color: var(--stale); }
.card.offline .num { color: var(--offline); } .card.pending .num { color: var(--pending); }
.panel { background: var(--panel); border: 1px solid var(--line); border-radius: 12px; box-shadow: var(--shadow); overflow-x: auto; }
table { width: 100%; border-collapse: collapse; font-variant-numeric: tabular-nums; }
th, td { text-align: left; padding: 9px 11px; border-bottom: 1px solid var(--line); white-space: nowrap; }
th { color: var(--muted); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: .5px; }
tr:last-child td { border-bottom: 0; }
td.num, th.num { text-align: right; }
.badge { display: inline-block; padding: 2px 10px; border-radius: 999px; font-size: 12px; font-weight: 700; letter-spacing: .3px; }
.badge.online { color: var(--online); background: var(--online-bg); } .badge.stale { color: var(--stale); background: var(--stale-bg); }
.badge.offline { color: var(--offline); background: var(--offline-bg); } .badge.pending { color: var(--pending); background: var(--pending-bg); }
.badge.expired { color: var(--expired); background: var(--expired-bg); }
.btn { white-space: nowrap; font: inherit; cursor: pointer; border: 1px solid var(--accent); background: var(--accent); color: var(--accent-ink); padding: 5px 14px; border-radius: 8px; font-weight: 600; }
.btn.ghost { background: transparent; color: var(--accent); }
.btn:hover { filter: brightness(1.08); }
.muted { color: var(--muted); }
.empty { padding: 22px; color: var(--muted); text-align: center; }
.tabs { display: flex; gap: 4px; margin: 18px 0 14px; border-bottom: 1px solid var(--line); }
.tabs a { padding: 8px 16px; border-radius: 8px 8px 0 0; color: var(--muted); font-weight: 600; }
.tabs a.on { color: var(--ink); background: var(--panel); border: 1px solid var(--line); border-bottom-color: var(--panel); margin-bottom: -1px; }
.facts { display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: 0 32px; padding: 6px 16px; }
.facts div { display: flex; justify-content: space-between; gap: 16px; padding: 8px 0; border-bottom: 1px solid var(--line); }
.facts dt { color: var(--muted); } .facts dd { margin: 0; text-align: right; word-break: break-all; }
.gauges { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px, 1fr)); gap: 12px; }
.gauge { background: var(--panel); border: 1px solid var(--line); border-radius: 12px; padding: 14px 16px; }
.gauge .label { color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .6px; }
.gauge .val { font-size: 20px; font-weight: 700; font-variant-numeric: tabular-nums; overflow-wrap: anywhere; }
.gauge progress { width: 100%; height: 8px; margin-top: 6px; accent-color: var(--accent); }
.spark { width: 100%; height: 60px; color: var(--accent); margin-top: 6px; display: block; }
.spark .grid { stroke: var(--line); stroke-width: 1; }
.spark .line { fill: none; stroke: currentColor; stroke-width: 1.8; stroke-linejoin: round; }
.flash { padding: 10px 14px; border-radius: 10px; margin-bottom: 16px; background: var(--online-bg); color: var(--online); font-weight: 600; }
.flash.err { background: var(--offline-bg); color: var(--offline); }
.login { max-width: 420px; margin: 12vh auto; }
.login input[type=password] { width: 100%; font: inherit; padding: 10px 12px; border-radius: 8px; border: 1px solid var(--line); background: var(--bg); color: var(--ink); margin: 8px 0 14px; }
code, .mono { font-family: ui-monospace, "Cascadia Mono", Consolas, monospace; font-size: 12.5px; }
.inline { display: inline; margin: 0; }
@media (max-width: 720px) { main { padding: 14px; } header.top { padding: 10px 14px; gap: 10px; } header.top .clock { display: none; } header.top .brand small { display: none; } }

/* ---- Milestone 3: roles, navigation, diagnostics, certificates, audit ---- */
:root { --danger: #b91c1c; --danger-bg: #fee2e2; --run: #7c3aed; --run-bg: #ede9fe; --ok: #15803d; --ok-bg: #dcfce7; }
@media (prefers-color-scheme: dark) { :root { --danger: #f87171; --danger-bg: #3d1717; --run: #c4b5fd; --run-bg: #2a2150; --ok: #4ade80; --ok-bg: #123524; } }
header.top .mainnav { display: flex; gap: 4px; margin-left: 8px; }
header.top .mainnav a { padding: 5px 12px; border-radius: 8px; color: var(--muted); font-weight: 600; }
header.top .mainnav a:hover { background: var(--bg); text-decoration: none; }
header.top .mainnav a.on { color: var(--ink); background: var(--bg); }
header.top .who { color: var(--muted); }
.role { font-size: 11px; font-weight: 700; letter-spacing: .4px; padding: 1px 8px; border-radius: 999px; background: var(--pending-bg); color: var(--pending); margin-left: 4px; }
.role.admin { background: var(--danger-bg); color: var(--danger); } .role.engineer { background: var(--stale-bg); color: var(--stale); }
.card.revoked .num { color: var(--danger); }
.badge.revoked, .badge.failed, .badge.cert-revoked, .badge.cert-expired { color: var(--danger); background: var(--danger-bg); }
.badge.queued, .badge.cancelled, .badge.cert-expiring { color: var(--stale); background: var(--stale-bg); }
.badge.running { color: var(--run); background: var(--run-bg); }
.badge.success, .badge.cert-valid { color: var(--ok); background: var(--ok-bg); }
.badge.timeout { color: var(--stale); background: var(--stale-bg); }
.btn.danger { background: var(--danger); border-color: var(--danger); color: #fff; display: inline-block; }
.btn.small { padding: 2px 10px; font-size: 12.5px; }
a.btn { display: inline-block; text-decoration: none; } a.btn:hover { text-decoration: none; }
.btn[disabled] { opacity: .5; cursor: not-allowed; filter: none; }
.actions, .toolbar { display: flex; align-items: center; gap: 12px; flex-wrap: wrap; margin: 10px 0 4px; }
.toolbar { margin: 4px 0 12px; }
td.wrap { white-space: normal; word-break: break-all; max-width: 520px; }
.chain { padding: 8px 14px; border-radius: 10px; font-weight: 600; }
.chain.ok { background: var(--ok-bg); color: var(--ok); } .chain.bad { background: var(--danger-bg); color: var(--danger); }
.filters { display: flex; gap: 12px; align-items: end; flex-wrap: wrap; margin: 12px 0; }
.filters label, dialog label { display: flex; flex-direction: column; gap: 4px; color: var(--muted); font-size: 12px; text-transform: uppercase; letter-spacing: .4px; }
input[type=text], input[type=number], select { font: inherit; padding: 7px 10px; border-radius: 8px; border: 1px solid var(--line); background: var(--bg); color: var(--ink); text-transform: none; letter-spacing: 0; }
.login.wide { max-width: 560px; margin: 8vh auto; }
.login input[type=text] { width: 100%; margin: 8px 0 14px; }
dialog { border: 1px solid var(--line); border-radius: 14px; background: var(--panel); color: var(--ink); padding: 20px 22px; width: min(640px, calc(100vw - 32px)); box-shadow: 0 20px 60px rgba(0,0,0,.35); }
dialog::backdrop { background: rgba(10, 14, 20, .55); }
dialog h2 { margin-top: 0; }
dialog form > label, #diag-fields label { margin-bottom: 10px; }
#diag-fields { display: grid; gap: 4px; }
.dialog-actions { display: flex; gap: 10px; justify-content: flex-end; margin-top: 14px; }
pre.result { background: var(--bg); border: 1px solid var(--line); border-radius: 10px; padding: 12px; max-height: 340px; overflow: auto; white-space: pre-wrap; word-break: break-word; font-size: 12.5px; }
.diag-status { display: flex; align-items: center; gap: 10px; margin: 12px 0; }
[hidden] { display: none !important; }
dialog h2 { text-transform: none; letter-spacing: 0; color: var(--ink); font-size: 18px; margin: 0 0 14px; }
dialog p { margin: 8px 0; }
dialog select, dialog input[type=text], dialog input[type=number] { width: 100%; }
header.top { flex-wrap: wrap; }
.tabs { overflow-x: auto; scrollbar-width: thin; }
.tabs a { white-space: nowrap; }
.actions .muted { font-size: 13px; }
ul { padding-left: 20px; }
.login.card { background: var(--panel); border: 1px solid var(--line); border-radius: 14px; padding: 22px 24px; box-shadow: var(--shadow); }
.login.card h1 { margin-bottom: 10px; }
@media (max-width: 720px) {
  header.top .mainnav { order: 5; width: 100%; margin-left: 0; overflow-x: auto; }
  header.top .who { font-size: 13px; }
  th, td { padding: 8px 9px; }
  .dialog-actions { flex-wrap: wrap; }
}