From a71d1a096d3418d3f989f1e4eb224e19b6d042b8 Mon Sep 17 00:00:00 2001
From: DevEnv nis2-agile <dev@certisource.it>
Date: Sat, 27 Jun 2026 17:57:21 +0200
Subject: [PATCH] [FIX] V3 polish: spotlight ARIA su top-nav + CSP font
 segnala-anonimo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- aria-guide "Mostrami dov'è": ora aggancia le voci del menu IN ALTO V3
  (data-nav aggiunto in topnav-v3.js su voci dirette + mega-link). Se la voce è
  in un mega-menu, lo apre (.aria-guide-open) e ci punta lo spotlight; coach
  "menu in alto". Fallback navigazione invariato. (Prima cercava .sidebar-nav V2.)
- segnala-anonimo.html: CSP font-src 'self' → 'self' data: (sbloccato il font
  data: embeddato, niente più violazione CSP).
- Cache-buster: topnav-v3.js/common.js ?v=20260627t, aria-guide.js ?v=20260627t.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 public/admin/index.html            |  4 ++--
 public/admin/organizations.html    |  4 ++--
 public/admin/users.html            |  4 ++--
 public/architecture.html           |  4 ++--
 public/assessment.html             |  4 ++--
 public/assets.html                 |  4 ++--
 public/calendario.html             |  4 ++--
 public/companies.html              |  4 ++--
 public/competenze.html             |  4 ++--
 public/connettori-discovery.html   |  4 ++--
 public/controlli-periodici.html    |  4 ++--
 public/cross-analysis.html         |  4 ++--
 public/dashboard.html              |  4 ++--
 public/guida.html                  |  4 ++--
 public/incidents.html              |  4 ++--
 public/integrazioniext.html        |  4 ++--
 public/internal-audits.html        |  4 ++--
 public/isms.html                   |  4 ++--
 public/js/aria-guide.js            | 29 +++++++++++++++++++++--------
 public/js/common.js                |  2 +-
 public/js/topnav-v3.js             |  8 +++++---
 public/kb.html                     |  4 ++--
 public/management-review.html      |  4 ++--
 public/misure-requisiti.html       |  4 ++--
 public/normative.html              |  4 ++--
 public/organigramma.html           |  4 ++--
 public/policies.html               |  4 ++--
 public/raci.html                   |  4 ++--
 public/reports.html                |  4 ++--
 public/review-schedule.html        |  4 ++--
 public/risks.html                  |  4 ++--
 public/segnala-anonimo.html        |  2 +-
 public/settings.html               |  4 ++--
 public/stakeholder-activities.html |  4 ++--
 public/stakeholders.html           |  4 ++--
 public/supply-chain.html           |  4 ++--
 public/training.html               |  4 ++--
 public/whistleblowing.html         |  4 ++--
 public/workflow.html               |  4 ++--
 39 files changed, 98 insertions(+), 83 deletions(-)

diff --git a/public/admin/index.html b/public/admin/index.html
index aa8fe12..d819a87 100644
--- a/public/admin/index.html
+++ b/public/admin/index.html
@@ -163,9 +163,9 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/admin/organizations.html b/public/admin/organizations.html
index 3486812..94c2ff8 100644
--- a/public/admin/organizations.html
+++ b/public/admin/organizations.html
@@ -86,9 +86,9 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/admin/users.html b/public/admin/users.html
index 09ad26d..7abbdd3 100644
--- a/public/admin/users.html
+++ b/public/admin/users.html
@@ -93,9 +93,9 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/architecture.html b/public/architecture.html
index 4a0e521..1eeea85 100644
--- a/public/architecture.html
+++ b/public/architecture.html
@@ -1123,9 +1123,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/assessment.html b/public/assessment.html
index ec23886..f1e0607 100644
--- a/public/assessment.html
+++ b/public/assessment.html
@@ -271,9 +271,9 @@
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help. La logica
          pagina (wizard GAP) resta inline: usa gli stessi id/funzioni di prima. -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/assets.html b/public/assets.html
index b57881f..fd98d70 100644
--- a/public/assets.html
+++ b/public/assets.html
@@ -378,9 +378,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/calendario.html b/public/calendario.html
index ed63f6f..70db9ce 100644
--- a/public/calendario.html
+++ b/public/calendario.html
@@ -191,9 +191,9 @@
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help. La logica del
          calendario (aggregatore read-only) resta inline e usa gli stessi id/funzioni. -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/companies.html b/public/companies.html
index b837af5..c43e901 100644
--- a/public/companies.html
+++ b/public/companies.html
@@ -140,9 +140,9 @@
 
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide → topnav-v3.js (chrome) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/competenze.html b/public/competenze.html
index c23e6eb..541369c 100644
--- a/public/competenze.html
+++ b/public/competenze.html
@@ -193,9 +193,9 @@
 
     <!-- Scripts V3. competenze.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/competenze.js?v=20260627"></script>
diff --git a/public/connettori-discovery.html b/public/connettori-discovery.html
index 4c28646..e222f94 100644
--- a/public/connettori-discovery.html
+++ b/public/connettori-discovery.html
@@ -99,9 +99,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/connettori-discovery.js?v=20260627"></script>
diff --git a/public/controlli-periodici.html b/public/controlli-periodici.html
index f3105db..fcd8dd4 100644
--- a/public/controlli-periodici.html
+++ b/public/controlli-periodici.html
@@ -156,9 +156,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/cross-analysis.html b/public/cross-analysis.html
index 1a698f6..387f0c2 100644
--- a/public/cross-analysis.html
+++ b/public/cross-analysis.html
@@ -223,9 +223,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/dashboard.html b/public/dashboard.html
index ac6a4ca..73fb3c8 100644
--- a/public/dashboard.html
+++ b/public/dashboard.html
@@ -113,9 +113,9 @@
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) →
          i18n → help → dashboard.js -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/dashboard.js?v=20260627"></script>
diff --git a/public/guida.html b/public/guida.html
index fea85d4..99107a1 100644
--- a/public/guida.html
+++ b/public/guida.html
@@ -1178,9 +1178,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/incidents.html b/public/incidents.html
index da451d2..e12c9f7 100644
--- a/public/incidents.html
+++ b/public/incidents.html
@@ -360,9 +360,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/integrazioniext.html b/public/integrazioniext.html
index f7a0563..6f53e6a 100644
--- a/public/integrazioniext.html
+++ b/public/integrazioniext.html
@@ -932,9 +932,9 @@ curl -H <span class="str">"X-API-Key: nis2_TUA_CHIAVE"</span> \
 <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
      topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help -->
 <script src="/js/api.js?v=20260625d"></script>
-<script src="/js/common.js?v=20260627v3"></script>
+<script src="/js/common.js?v=20260627t"></script>
 <script src="/vendor/lucide/lucide.min.js"></script>
-<script src="/js/topnav-v3.js?v=20260627n"></script>
+<script src="/js/topnav-v3.js?v=20260627t"></script>
 <script src="/js/i18n.js?v=20260627p"></script>
 <script src="/js/help.js?v=20260627n"></script>
 <script>
diff --git a/public/internal-audits.html b/public/internal-audits.html
index d6e86cb..8ecd6c7 100644
--- a/public/internal-audits.html
+++ b/public/internal-audits.html
@@ -161,9 +161,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/isms.html b/public/isms.html
index 6f38b25..48006e2 100644
--- a/public/isms.html
+++ b/public/isms.html
@@ -200,9 +200,9 @@
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → isms.js.
          isms.js si auto-inizializza su DOMContentLoaded (checkAuth/I18n/loadSidebar/Help/render). -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/isms.js?v=20260627v3"></script>
diff --git a/public/js/aria-guide.js b/public/js/aria-guide.js
index 6235701..424daa0 100644
--- a/public/js/aria-guide.js
+++ b/public/js/aria-guide.js
@@ -79,13 +79,15 @@
             '.aria-guide-coach .row{margin-top:8px;display:flex;gap:8px;justify-content:flex-end}',
             '.aria-guide-coach button{border:none;border-radius:7px;padding:6px 12px;font:600 12px system-ui;cursor:pointer}',
             '.aria-guide-go{background:#0066CC;color:#fff}.aria-guide-x{background:#1e3a5f;color:#cbd5e1}',
+            '.nav-item.aria-guide-open .mega,.nav-item.aria-guide-open .mega.no-promo{display:flex!important}',
             '@media (prefers-reduced-motion:reduce){.aria-guide-spot,.aria-guide-ptr{transition:none;animation:none}}'
         ].join('\n');
         document.head.appendChild(s);
     }
 
-    var _open = null;
+    var _open = null, _openMega = null;
     function dismiss() {
+        if (_openMega) { _openMega.classList.remove('aria-guide-open'); _openMega = null; }
         if (!_open) return;
         _open.forEach(function (el) { if (el && el.parentNode) el.parentNode.removeChild(el); });
         document.removeEventListener('keydown', onKey, true);
@@ -100,19 +102,29 @@
      */
     function pointTo(nav, label) {
         dismiss();
-        var el = document.querySelector('.sidebar-nav a[data-nav="' + nav + '"]');
-        var href = el ? el.getAttribute('href') : (nav + '.html');
-        var rect = el && el.getBoundingClientRect();
-        // fallback: niente sidebar visibile → vai diretto
-        if (!el || !rect || rect.width === 0 || rect.height === 0) { window.location.href = href; return false; }
-
         injectCss();
+        // V3: menu IN ALTO (data-nav su voci dirette e mega-link). Fallback compat sidebar V2.
+        var el = document.querySelector('.bar-nav [data-nav="' + nav + '"]')
+              || document.querySelector('[data-nav="' + nav + '"]')
+              || document.querySelector('.sidebar-nav a[data-nav="' + nav + '"]');
+        var href = el ? (el.getAttribute('href') || (nav + '.html')) : (nav + '.html');
+        // Se la voce è dentro un mega-menu (dropdown chiuso), aprilo per renderla visibile.
+        var megaItem = (el && el.closest && el.closest('.mega')) ? el.closest('.nav-item') : null;
+        if (megaItem) megaItem.classList.add('aria-guide-open');
+        try { window.scrollTo({ top: 0, behavior: 'auto' }); } catch (e) {}
+        var rect = el && el.getBoundingClientRect();
+        // fallback: voce non trovata/visibile → vai diretto
+        if (!el || !rect || rect.width === 0 || rect.height === 0) {
+            if (megaItem) megaItem.classList.remove('aria-guide-open');
+            window.location.href = href; return false;
+        }
+
         var ov = document.createElement('div'); ov.className = 'aria-guide-ov';
         var spot = document.createElement('div'); spot.className = 'aria-guide-spot';
         var ptr = document.createElement('div'); ptr.className = 'aria-guide-ptr';
         ptr.innerHTML = '<svg viewBox="0 0 24 24" fill="#0066CC" stroke="#fff" stroke-width="1.2"><path d="M5 3l14 8-6 1.5L9.5 19 5 3z"/></svg>';
         var coach = document.createElement('div'); coach.className = 'aria-guide-coach';
-        coach.innerHTML = 'Eccolo: <b>' + (label || nav) + '</b><br><span style="opacity:.85">È nel menu a sinistra. Vuoi che ti ci porti?</span>'
+        coach.innerHTML = 'Eccolo: <b>' + (label || nav) + '</b><br><span style="opacity:.85">È nel menu in alto. Vuoi che ti ci porti?</span>'
             + '<div class="row"><button class="aria-guide-x" type="button">Chiudi</button><button class="aria-guide-go" type="button">Vai →</button></div>';
 
         document.body.appendChild(ov);
@@ -137,6 +149,7 @@
         coach.querySelector('.aria-guide-go').addEventListener('click', function () { window.location.href = href; });
         document.addEventListener('keydown', onKey, true);
         _open = [ov, spot, ptr, coach];
+        _openMega = megaItem;
         return true;
     }
 
diff --git a/public/js/common.js b/public/js/common.js
index 58cc981..86df077 100644
--- a/public/js/common.js
+++ b/public/js/common.js
@@ -985,7 +985,7 @@ function switchLang(lang) {
     if (!window.__ariaGuideLoaded) {
         window.__ariaGuideLoaded = true;
         var ag = document.createElement('script');
-        ag.src = 'js/aria-guide.js?v=20260624f';
+        ag.src = 'js/aria-guide.js?v=20260627t';
         ag.async = true;
         document.body.appendChild(ag);
     }
diff --git a/public/js/topnav-v3.js b/public/js/topnav-v3.js
index 4acba7e..75438ca 100644
--- a/public/js/topnav-v3.js
+++ b/public/js/topnav-v3.js
@@ -110,6 +110,8 @@
         'Monitoraggio': 'nav.grp_monitoring', 'Lex e ISO': 'nav.grp_lexiso', 'AI': 'nav.grp_ai', 'Guida': 'nav.grp_guide'
     };
     function i18nAttr(key) { return key ? ' data-i18n="' + key + '"' : ''; }
+    // data-nav = href senza .html → aggancio per il puntatore guida ARIA (aria-guide.js).
+    function navAttr(href) { return ' data-nav="' + esc(String(href).replace(/\.html$/, '')) + '"'; }
 
     function esc(s) {
         return String(s == null ? '' : s).replace(/[&<>"']/g, function (c) {
@@ -136,7 +138,7 @@
     function renderMega(g) {
         var colsHtml = g.cols.map(function (col) {
             var links = col.links.map(function (l) {
-                return '<a class="mega-link" href="' + esc(l.href) + '">' +
+                return '<a class="mega-link"' + navAttr(l.href) + ' href="' + esc(l.href) + '">' +
                     '<span class="mega-ic"><i data-lucide="' + esc(l.ic) + '" class="ic"></i></span>' +
                     '<span><b' + i18nAttr(I18N_BY_HREF[l.href]) + '>' + esc(l.b) + '</b><span>' + esc(l.s) + '</span></span></a>';
             }).join('');
@@ -154,14 +156,14 @@
         if (g.href && !g.cols) {
             // Voce diretta (Dashboard, Calendario)
             return '<div class="nav-item">' +
-                '<a class="' + cls + '"' + aria + ' href="' + esc(g.href) + '">' +
+                '<a class="' + cls + '"' + aria + navAttr(g.href) + ' href="' + esc(g.href) + '">' +
                 '<i data-lucide="' + esc(g.icon) + '" class="ic"></i>' +
                 '<span' + i18n + '>' + esc(g.label) + '</span></a></div>';
         }
         // Gruppo con mega-menu. Il link "testa" punta alla prima voce del gruppo.
         var firstHref = g.cols[0].links[0].href;
         return '<div class="nav-item">' +
-            '<a class="' + cls + '"' + aria + ' href="' + esc(firstHref) + '">' +
+            '<a class="' + cls + '"' + aria + navAttr(firstHref) + ' href="' + esc(firstHref) + '">' +
             '<i data-lucide="' + esc(g.icon) + '" class="ic"></i>' +
             '<span' + i18n + '>' + esc(g.label) + '</span>' +
             '<i data-lucide="chevron-down" class="caret"></i></a>' +
diff --git a/public/kb.html b/public/kb.html
index d5da98b..74d6c49 100644
--- a/public/kb.html
+++ b/public/kb.html
@@ -176,9 +176,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → kb.js -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/kb.js"></script>
diff --git a/public/management-review.html b/public/management-review.html
index 6ab2510..fc4ac66 100644
--- a/public/management-review.html
+++ b/public/management-review.html
@@ -148,9 +148,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/misure-requisiti.html b/public/misure-requisiti.html
index 6a53b3c..a8eb56f 100644
--- a/public/misure-requisiti.html
+++ b/public/misure-requisiti.html
@@ -176,9 +176,9 @@
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/normative.html b/public/normative.html
index d26a409..0e670c3 100644
--- a/public/normative.html
+++ b/public/normative.html
@@ -138,9 +138,9 @@
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/organigramma.html b/public/organigramma.html
index 75445a4..fbf1491 100644
--- a/public/organigramma.html
+++ b/public/organigramma.html
@@ -152,9 +152,9 @@
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → organigramma.js.
          organigramma.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/organigramma.js?v=20260627"></script>
diff --git a/public/policies.html b/public/policies.html
index c90922e..4c48eae 100644
--- a/public/policies.html
+++ b/public/policies.html
@@ -341,9 +341,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/raci.html b/public/raci.html
index 17155f5..3af485a 100644
--- a/public/raci.html
+++ b/public/raci.html
@@ -142,9 +142,9 @@
 
     <!-- Scripts V3. raci.js si auto-inizializza su DOMContentLoaded (checkAuth/loadSidebar/I18n/Help). -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script src="/js/raci.js?v=20260627"></script>
diff --git a/public/reports.html b/public/reports.html
index 3aad233..3a3e5ac 100644
--- a/public/reports.html
+++ b/public/reports.html
@@ -233,9 +233,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/review-schedule.html b/public/review-schedule.html
index 87f7866..abcc85f 100644
--- a/public/review-schedule.html
+++ b/public/review-schedule.html
@@ -158,9 +158,9 @@
 
     <!-- Scripts V3 (ordine ESATTO come dashboard.html) -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/risks.html b/public/risks.html
index 8d9d8ab..6d1b234 100644
--- a/public/risks.html
+++ b/public/risks.html
@@ -503,9 +503,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/segnala-anonimo.html b/public/segnala-anonimo.html
index a542c42..41717eb 100644
--- a/public/segnala-anonimo.html
+++ b/public/segnala-anonimo.html
@@ -7,7 +7,7 @@
     <!-- ANONIMATO (StarGateWB/Vocea): niente referrer, niente analytics, niente login, niente tracciamento. -->
     <meta name="referrer" content="no-referrer">
     <meta http-equiv="Content-Security-Policy"
-          content="default-src 'self'; frame-src https://app.vocea.cloud; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'">
+          content="default-src 'self'; frame-src https://app.vocea.cloud; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; base-uri 'none'; form-action 'none'">
     <link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
     <link rel="stylesheet" href="/css/style.css?v=20260618">
     <style>
diff --git a/public/settings.html b/public/settings.html
index b2e91e5..f973ef9 100644
--- a/public/settings.html
+++ b/public/settings.html
@@ -736,9 +736,9 @@
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) →
          i18n → help → init pagina (inline, invariato). -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/stakeholder-activities.html b/public/stakeholder-activities.html
index 8c4fa77..927b524 100644
--- a/public/stakeholder-activities.html
+++ b/public/stakeholder-activities.html
@@ -216,9 +216,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/stakeholders.html b/public/stakeholders.html
index 5512641..aeff7ec 100644
--- a/public/stakeholders.html
+++ b/public/stakeholders.html
@@ -211,9 +211,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/supply-chain.html b/public/supply-chain.html
index 44ad5e4..07f2c89 100644
--- a/public/supply-chain.html
+++ b/public/supply-chain.html
@@ -543,9 +543,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/training.html b/public/training.html
index ba28ec7..65dc15e 100644
--- a/public/training.html
+++ b/public/training.html
@@ -191,9 +191,9 @@
          Lucide self-host → topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help.
          La logica della pagina e' inline (nessun training.js): preservata invariata. -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/whistleblowing.html b/public/whistleblowing.html
index d230e87..38077f6 100644
--- a/public/whistleblowing.html
+++ b/public/whistleblowing.html
@@ -259,9 +259,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>
diff --git a/public/workflow.html b/public/workflow.html
index 8d554d4..4e1fa1d 100644
--- a/public/workflow.html
+++ b/public/workflow.html
@@ -144,9 +144,9 @@
     <!-- Scripts V3: api.js → common.js (helper+FAB reali) → Lucide self-host →
          topnav-v3.js (chrome, ridefinisce loadSidebar) → i18n → help → init pagina. -->
     <script src="/js/api.js?v=20260625d"></script>
-    <script src="/js/common.js?v=20260627v3"></script>
+    <script src="/js/common.js?v=20260627t"></script>
     <script src="/vendor/lucide/lucide.min.js"></script>
-    <script src="/js/topnav-v3.js?v=20260627n"></script>
+    <script src="/js/topnav-v3.js?v=20260627t"></script>
     <script src="/js/i18n.js?v=20260627p"></script>
     <script src="/js/help.js?v=20260627n"></script>
     <script>