diff --git a/application/cli/seed_stakeholder_activities.php b/application/cli/seed_stakeholder_activities.php
index 9586f7e..f9bcb77 100644
--- a/application/cli/seed_stakeholder_activities.php
+++ b/application/cli/seed_stakeholder_activities.php
@@ -122,6 +122,13 @@ try {
     fwrite(STDERR, "WARN ALTER review_schedule: " . $e->getMessage() . "\n");
 }
 
+// mig.054 — scadenza magic-link (idempotente: ignora 1060 colonna già esistente).
+try {
+    $pdo->exec("ALTER TABLE stk_activity_targets ADD COLUMN token_expires_at DATETIME NULL DEFAULT NULL AFTER access_token_hash");
+} catch (PDOException $e) {
+    if (($e->errorInfo[1] ?? 0) !== 1060) { fwrite(STDERR, "WARN ALTER stk_activity_targets: " . $e->getMessage() . "\n"); }
+}
+
 $counts = [];
 foreach (['stk_questionnaire_templates','stk_template_procedures','stk_template_misure','stk_template_requisiti',
           'stk_activities','stk_activity_targets','stk_activity_procedures',
diff --git a/application/controllers/StakeholderActivityController.php b/application/controllers/StakeholderActivityController.php
index 0f0a29e..fb3460d 100644
--- a/application/controllers/StakeholderActivityController.php
+++ b/application/controllers/StakeholderActivityController.php
@@ -285,7 +285,7 @@ class StakeholderActivityController extends BaseController
         $orgId = $this->getCurrentOrgId();
         $b = $this->getJsonBody();
 
-        $a = Database::fetchOne('SELECT id, title, due_date FROM stk_activities WHERE id = ? AND organization_id = ?', [$id, $orgId]);
+        $a = Database::fetchOne('SELECT id, title, due_date, assign_mode, stak_code FROM stk_activities WHERE id = ? AND organization_id = ?', [$id, $orgId]);
         if (!$a) { $this->jsonError('Attività non trovata', 404, 'NOT_FOUND'); }
 
         $updates = [];
@@ -298,7 +298,10 @@ class StakeholderActivityController extends BaseController
         if ($this->hasParam('template_id')) { $updates['template_id'] = $this->validateTemplate($b['template_id'] ?? null, $orgId); }
         if ($this->hasParam('description')) { $updates['description'] = $this->nullableStr($b['description'] ?? null); }
         if ($this->hasParam('assign_mode') || $this->hasParam('stak_code')) {
-            [$assignMode, $stakCode] = $this->validateAssign($b, $orgId);
+            $bb = $b;
+            // se cambia solo lo stak_code, conserva la modalità esistente (non forzare 'individual')
+            if (!$this->hasParam('assign_mode')) { $bb['assign_mode'] = $a['assign_mode']; }
+            [$assignMode, $stakCode] = $this->validateAssign($bb, $orgId);
             $updates['assign_mode'] = $assignMode;
             $updates['stak_code'] = $assignMode === 'by_code' ? $stakCode : null;
         }
@@ -358,6 +361,7 @@ class StakeholderActivityController extends BaseController
             $raw = $b['stakeholder_ids'] ?? null;
             if (!is_array($raw) || !$raw) { $this->jsonError('Seleziona almeno uno stakeholder', 422, 'NO_TARGETS'); }
             $ids = array_values(array_unique(array_filter(array_map('intval', $raw), static fn($i) => $i > 0)));
+            if (!$ids) { $this->jsonError('Seleziona almeno uno stakeholder valido', 422, 'NO_TARGETS'); }
             $place = implode(',', array_fill(0, count($ids), '?'));
             $stakeholderIds = $this->valCol(
                 "SELECT id FROM stakeholders WHERE organization_id = ? AND id IN ($place)",
@@ -367,6 +371,18 @@ class StakeholderActivityController extends BaseController
         }
         if (!$stakeholderIds) { $this->jsonError('Nessuno stakeholder da assegnare per questo criterio', 422, 'EMPTY_TARGETS'); }
 
+        $stakeholderIds = array_map('intval', $stakeholderIds);
+        // Modalità individuale = sincronizzazione "replace": rimuovi i destinatari deselezionati
+        // che NON hanno ancora risposto/firmato (gli esiti raccolti non si perdono).
+        if ($a['assign_mode'] === 'individual') {
+            $keep = implode(',', array_fill(0, count($stakeholderIds), '?'));
+            Database::query(
+                "DELETE FROM stk_activity_targets
+                 WHERE activity_id = ? AND state NOT IN ('responded','acknowledged') AND stakeholder_id NOT IN ($keep)",
+                array_merge([$id], $stakeholderIds)
+            );
+        }
+
         $added = 0;
         foreach ($stakeholderIds as $sid) {
             try {
@@ -393,13 +409,20 @@ class StakeholderActivityController extends BaseController
         $a = Database::fetchOne('SELECT id, due_date, title FROM stk_activities WHERE id = ? AND organization_id = ?', [$id, $orgId]);
         if (!$a) { $this->jsonError('Attività non trovata', 404, 'NOT_FOUND'); }
 
+        // Solo i destinatari NON ancora conclusi: NON rigenerare token né azzerare lo stato
+        // di chi ha già risposto/firmato (altrimenti se ne perderebbe l'esito).
         $targets = Database::fetchAll(
-            'SELECT g.id, g.stakeholder_id, s.name AS stakeholder_name, s.contact_email, g.access_token_hash
+            "SELECT g.id, g.stakeholder_id, s.name AS stakeholder_name, s.contact_email, g.access_token_hash
              FROM stk_activity_targets g JOIN stakeholders s ON s.id = g.stakeholder_id
-             WHERE g.activity_id = ?',
+             WHERE g.activity_id = ? AND g.state NOT IN ('responded','acknowledged')",
             [$id]
         );
-        if (!$targets) { $this->jsonError('Nessun destinatario: assegna prima gli stakeholder', 422, 'NO_TARGETS'); }
+        if (!$targets) { $this->jsonError('Nessun destinatario da inviare (assegna stakeholder o tutti hanno già risposto)', 422, 'NO_TARGETS'); }
+
+        // Scadenza del magic-link: scadenza attività + 30gg, altrimenti 90gg da oggi.
+        $expires = $a['due_date']
+            ? date('Y-m-d H:i:s', strtotime($a['due_date'] . ' +30 days'))
+            : date('Y-m-d H:i:s', strtotime('+90 days'));
 
         $links = [];
         foreach ($targets as $g) {
@@ -408,6 +431,7 @@ class StakeholderActivityController extends BaseController
                 'access_token_hash' => hash('sha256', $token),
                 'state'             => 'sent',
                 'sent_at'           => date('Y-m-d H:i:s'),
+                'token_expires_at'  => $expires,
             ], 'id = ?', [(int) $g['id']]);
             $links[] = [
                 'target_id'        => (int) $g['id'],
@@ -563,12 +587,13 @@ class StakeholderActivityController extends BaseController
         if ($file['size'] > 10 * 1024 * 1024) { $this->jsonError('File troppo grande (max 10MB)', 400, 'FILE_TOO_LARGE'); }
 
         $ext = strtolower(preg_replace('/[^a-zA-Z0-9]/', '', pathinfo($file['name'], PATHINFO_EXTENSION)));
-        $blocked = ['php','phtml','phar','php3','php4','php5','phps','cgi','pl','sh','exe','htaccess'];
-        if ($ext === '' || in_array($ext, $blocked, true)) { $this->jsonError('Tipo di file non consentito', 422, 'BAD_FILE_TYPE'); }
+        // ALLOWLIST (niente html/svg/js eseguibili same-origin): allineata a StakeholderPortalController::ALLOWED_EXT
+        $allowed = ['pdf','png','jpg','jpeg','gif','webp','txt','csv','xlsx','xls','docx','doc','pptx','ppt','odt','ods','zip'];
+        if ($ext === '' || !in_array($ext, $allowed, true)) { $this->jsonError('Tipo di file non consentito', 422, 'BAD_FILE_TYPE'); }
 
         $uploadDir = UPLOAD_PATH . "/stk_activity/{$orgId}";
         if (!is_dir($uploadDir)) { mkdir($uploadDir, 0755, true); }
-        $filename = uniqid('sa_') . '.' . $ext;
+        $filename = 'sa_' . bin2hex(random_bytes(16)) . '.' . $ext;
         if (!move_uploaded_file($file['tmp_name'], $uploadDir . '/' . $filename)) {
             $this->jsonError('Errore caricamento file', 500, 'UPLOAD_ERROR');
         }
diff --git a/application/controllers/StakeholderPortalController.php b/application/controllers/StakeholderPortalController.php
index 5e47a97..b6924dc 100644
--- a/application/controllers/StakeholderPortalController.php
+++ b/application/controllers/StakeholderPortalController.php
@@ -18,12 +18,19 @@
  */
 
 require_once __DIR__ . '/BaseController.php';
+require_once APP_PATH . '/services/RateLimitService.php';
 
 class StakeholderPortalController extends BaseController
 {
+    // Estensioni consentite per gli allegati (ALLOWLIST: niente html/svg/js eseguibili same-origin)
+    private const ALLOWED_EXT = ['pdf','png','jpg','jpeg','gif','webp','txt','csv','xlsx','xls','docx','doc','pptx','ppt','odt','ods','zip'];
+    private const RL_READ  = [['max' => 30, 'window_seconds' => 60], ['max' => 200, 'window_seconds' => 3600]];
+    private const RL_WRITE = [['max' => 10, 'window_seconds' => 60], ['max' => 60, 'window_seconds' => 3600]];
+
     /** GET /api/stakeholder-portal/access?t=<token> */
     public function access(): void
     {
+        $this->rateLimit('read');
         $tg = $this->resolveTarget();
         $template = $this->loadTemplate($tg);
         $resp = Database::fetchOne(
@@ -52,6 +59,7 @@ class StakeholderPortalController extends BaseController
     /** POST /api/stakeholder-portal/respond  Body: {t*, answers*, respondent_name?} */
     public function respond(): void
     {
+        $this->rateLimit('write');
         $tg = $this->resolveTarget();
         if ($tg['type'] === 'read_ack') { $this->jsonError('Questa attività richiede una firma di avvenuta lettura, non un questionario.', 422, 'WRONG_TYPE'); }
         if (in_array($tg['state'], ['responded', 'acknowledged'], true)) { $this->jsonError('Risposta già inviata: non è più modificabile.', 409, 'ALREADY_SUBMITTED'); }
@@ -83,6 +91,7 @@ class StakeholderPortalController extends BaseController
     /** POST /api/stakeholder-portal/acknowledge  Body: {t*, respondent_name?} */
     public function acknowledge(): void
     {
+        $this->rateLimit('write');
         $tg = $this->resolveTarget();
         if ($tg['type'] !== 'read_ack') { $this->jsonError('Questa attività è un questionario da compilare.', 422, 'WRONG_TYPE'); }
         if (in_array($tg['state'], ['responded', 'acknowledged'], true)) { $this->jsonError('Firma già registrata.', 409, 'ALREADY_SUBMITTED'); }
@@ -98,7 +107,9 @@ class StakeholderPortalController extends BaseController
     /** POST /api/stakeholder-portal/comment  Body: {t*, body*} */
     public function comment(): void
     {
+        $this->rateLimit('write');
         $tg = $this->resolveTarget();
+        $this->assertWritable($tg);
         $body = trim((string) ($this->getJsonBody()['body'] ?? ''));
         if ($body === '') { $this->jsonError('Commento vuoto', 422, 'EMPTY_COMMENT'); }
         Database::insert('stk_activity_comments', [
@@ -113,20 +124,21 @@ class StakeholderPortalController extends BaseController
     /** POST /api/stakeholder-portal/attachment?t=<token>  (multipart: file) */
     public function attachment(): void
     {
+        $this->rateLimit('write');
         $tg = $this->resolveTarget();
+        $this->assertWritable($tg);
         if (!isset($_FILES['file']) || ($_FILES['file']['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
             $this->jsonError('File non fornito', 400, 'NO_FILE');
         }
         $file = $_FILES['file'];
         if ($file['size'] > 10 * 1024 * 1024) { $this->jsonError('File troppo grande (max 10MB)', 400, 'FILE_TOO_LARGE'); }
         $ext = strtolower(preg_replace('/[^a-zA-Z0-9]/', '', pathinfo($file['name'], PATHINFO_EXTENSION)));
-        $blocked = ['php','phtml','phar','php3','php4','php5','phps','cgi','pl','sh','exe','htaccess'];
-        if ($ext === '' || in_array($ext, $blocked, true)) { $this->jsonError('Tipo di file non consentito', 422, 'BAD_FILE_TYPE'); }
+        if ($ext === '' || !in_array($ext, self::ALLOWED_EXT, true)) { $this->jsonError('Tipo di file non consentito', 422, 'BAD_FILE_TYPE'); }
 
         $orgId = (int) $tg['organization_id'];
         $dir = UPLOAD_PATH . "/stk_activity/{$orgId}";
         if (!is_dir($dir)) { mkdir($dir, 0755, true); }
-        $filename = uniqid('sa_') . '.' . $ext;
+        $filename = 'sa_' . bin2hex(random_bytes(16)) . '.' . $ext;
         if (!move_uploaded_file($file['tmp_name'], $dir . '/' . $filename)) { $this->jsonError('Errore caricamento', 500, 'UPLOAD_ERROR'); }
         Database::insert('evidence_files', [
             'organization_id' => $orgId,
@@ -153,8 +165,8 @@ class StakeholderPortalController extends BaseController
             $this->jsonError('Link di accesso mancante o non valido.', 401, 'MISSING_TOKEN');
         }
         $row = Database::fetchOne(
-            'SELECT g.id AS target_id, g.activity_id, g.state, s.name AS stakeholder_name,
-                    a.organization_id, a.title, a.type, a.description, a.template_id
+            'SELECT g.id AS target_id, g.activity_id, g.state, g.token_expires_at, s.name AS stakeholder_name,
+                    a.organization_id, a.title, a.type, a.description, a.template_id, a.status AS activity_status
              FROM stk_activity_targets g
              JOIN stk_activities a ON a.id = g.activity_id
              JOIN stakeholders s ON s.id = g.stakeholder_id
@@ -162,9 +174,39 @@ class StakeholderPortalController extends BaseController
             [hash('sha256', $token)]
         );
         if (!$row) { $this->jsonError('Link di accesso non valido o scaduto.', 404, 'INVALID_TOKEN'); }
+        if (!empty($row['token_expires_at']) && strtotime($row['token_expires_at']) < time()) {
+            $this->jsonError('Link di accesso scaduto. Richiedi un nuovo invio all\'organizzazione.', 410, 'TOKEN_EXPIRED');
+        }
         return $row;
     }
 
+    /** Le scritture (commenti/allegati) sono bloccate se l'attività è chiusa. */
+    private function assertWritable(array $tg): void
+    {
+        if (in_array($tg['activity_status'] ?? '', ['completed', 'cancelled'], true)) {
+            $this->jsonError('Attività chiusa: non sono più ammessi contributi.', 409, 'ACTIVITY_CLOSED');
+        }
+    }
+
+    /** Rate limit per-IP sugli endpoint pubblici del portale. */
+    private function rateLimit(string $kind): void
+    {
+        $ip = $this->getClientIP();
+        $limits = $kind === 'write' ? self::RL_WRITE : self::RL_READ;
+        RateLimitService::check("stkp_{$kind}_ip:" . $ip, $limits);
+        RateLimitService::increment("stkp_{$kind}_ip:" . $ip);
+    }
+
+    private function getClientIP(): string
+    {
+        $xff = $_SERVER['HTTP_X_FORWARDED_FOR'] ?? '';
+        if ($xff !== '') {
+            $first = trim(explode(',', $xff)[0]);
+            if (filter_var($first, FILTER_VALIDATE_IP)) { return $first; }
+        }
+        return $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
+    }
+
     private function loadTemplate(array $tg): ?array
     {
         if (empty($tg['template_id'])) { return null; }
diff --git a/docs/sql/054_stakeholder_token_expiry.sql b/docs/sql/054_stakeholder_token_expiry.sql
new file mode 100644
index 0000000..63a3c84
--- /dev/null
+++ b/docs/sql/054_stakeholder_token_expiry.sql
@@ -0,0 +1,17 @@
+-- =====================================================================
+-- 054 — Scadenza dei magic-link del portale stakeholder (Epic C / C5.2 hardening)
+-- =====================================================================
+-- Aggiunge stk_activity_targets.token_expires_at: i magic-link generati da
+-- StakeholderActivityController::send() ricevono una scadenza (scadenza attività
+-- +30gg, altrimenti +90gg). StakeholderPortalController::resolveTarget() rifiuta
+-- i token scaduti (410 TOKEN_EXPIRED). Mitiga il riuso indefinito di un link
+-- eventualmente trapelato (finding flotta di verifica C5).
+--
+-- Additivo, reversibile. Runner-safe: ALTER nuda; idempotenza garantita dal
+-- try/catch su errno 1060 nel CLI seed_stakeholder_activities.php.
+-- =====================================================================
+
+ALTER TABLE stk_activity_targets ADD COLUMN token_expires_at DATETIME NULL DEFAULT NULL AFTER access_token_hash;
+
+-- ROLLBACK (manuale):
+-- ALTER TABLE stk_activity_targets DROP COLUMN token_expires_at
diff --git a/public/_app-bi-demo.html b/public/_app-bi-demo.html
index f575569..3751e59 100644
--- a/public/_app-bi-demo.html
+++ b/public/_app-bi-demo.html
@@ -70,9 +70,9 @@
     </script>
 
     <!-- Stessa logica della app: api.js + common.js (helper) + common-bi.js (override BI) -->
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
-    <script src="js/common-bi.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
+    <script src="js/common-bi.js?v=20260629"></script>
     <script>
         // Renderizza la sidebar BI (loadSidebar è stato ridefinito da common-bi.js)
         document.addEventListener('DOMContentLoaded', function () {
diff --git a/public/architecture.html b/public/architecture.html
index 7e24b3e..9c50391 100644
--- a/public/architecture.html
+++ b/public/architecture.html
@@ -1088,10 +1088,10 @@
         </main>
     </div>
 
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
-    <script src="js/i18n.js?v=20260628"></script>
-    <script src="js/help.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
+    <script src="js/i18n.js?v=20260629"></script>
+    <script src="js/help.js?v=20260629"></script>
     <script>
         if (!checkAuth()) throw new Error('Not authenticated');
         loadSidebar();
diff --git a/public/assessment.html b/public/assessment.html
index 5ffe417..d6d3ed6 100644
--- a/public/assessment.html
+++ b/public/assessment.html
@@ -154,8 +154,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -165,9 +165,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth check ───────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/assets.html b/public/assets.html
index c8cdfb9..c536835 100644
--- a/public/assets.html
+++ b/public/assets.html
@@ -361,8 +361,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -372,9 +372,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ─────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/companies.html b/public/companies.html
index 1424a73..18316b0 100644
--- a/public/companies.html
+++ b/public/companies.html
@@ -349,14 +349,14 @@
         </main>
     </div>
 
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle + override sidebar BI (common-bi.js dopo common.js: ridefinisce solo loadSidebar) -->
     <script src="vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
     <script>if (window.bootstrap && bootstrap.loadFonts) { bootstrap.loadFonts('vendor/bootstrap-italia/dist/fonts'); }</script>
-    <script src="js/common-bi.js?v=20260628"></script>
-    <script src="js/i18n.js?v=20260628"></script>
-    <script src="js/help.js?v=20260628"></script>
+    <script src="js/common-bi.js?v=20260629"></script>
+    <script src="js/i18n.js?v=20260629"></script>
+    <script src="js/help.js?v=20260629"></script>
     <script>
         if (!checkAuth()) throw new Error('Not authenticated');
 
diff --git a/public/competenze.html b/public/competenze.html
index f286551..b883dc5 100644
--- a/public/competenze.html
+++ b/public/competenze.html
@@ -183,12 +183,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script src="/js/competenze.js?v=20260617"></script>
 </body>
 </html>
diff --git a/public/cross-analysis.html b/public/cross-analysis.html
index d785029..65a78ea 100644
--- a/public/cross-analysis.html
+++ b/public/cross-analysis.html
@@ -382,8 +382,8 @@
     </main>
 </div>
 
-<script src="/js/api.js?v=20260628"></script>
-<script src="/js/common.js?v=20260628"></script>
+<script src="/js/api.js?v=20260629"></script>
+<script src="/js/common.js?v=20260629"></script>
 <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
      common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
      riusando tutti gli helper di common.js (zero backend). -->
@@ -393,8 +393,8 @@
         bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
     }
 </script>
-<script src="/js/common-bi.js?v=20260628"></script>
-<script src="/js/i18n.js?v=20260628"></script>
+<script src="/js/common-bi.js?v=20260629"></script>
+<script src="/js/i18n.js?v=20260629"></script>
 <script>
 const SPRITE = '/vendor/bootstrap-italia/dist/svg/sprites.svg';
 function ico(name, cls) { return `<svg class="ico ${cls||''}" aria-hidden="true"><use href="${SPRITE}#${name}"></use></svg>`; }
diff --git a/public/dashboard.html b/public/dashboard.html
index 89db20a..87d2417 100644
--- a/public/dashboard.html
+++ b/public/dashboard.html
@@ -143,8 +143,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -154,9 +154,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth check ───────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/forgot-password.html b/public/forgot-password.html
index 7da6291..987ce9d 100644
--- a/public/forgot-password.html
+++ b/public/forgot-password.html
@@ -73,7 +73,7 @@
     </script>
 
     <!-- Stessa logica della forgot-password.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
     <script>
         const form  = document.getElementById('forgot-form');
         const err   = document.getElementById('err');
diff --git a/public/guida.html b/public/guida.html
index 6d4124f..c33d3c5 100644
--- a/public/guida.html
+++ b/public/guida.html
@@ -1142,8 +1142,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (accordion) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI. -->
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
@@ -1152,9 +1152,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // La guida è accessibile anche da non autenticati (utile per onboarding)
         // ma se sei loggato carichi sidebar + i18n normalmente. Stessa logica
diff --git a/public/incidents.html b/public/incidents.html
index d99ed51..b0f0bfd 100644
--- a/public/incidents.html
+++ b/public/incidents.html
@@ -351,8 +351,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -362,9 +362,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ──────────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/integrazioniext.html b/public/integrazioniext.html
index 1c79773..710895b 100644
--- a/public/integrazioniext.html
+++ b/public/integrazioniext.html
@@ -910,8 +910,8 @@ curl -H <span class="str">"X-API-Key: nis2_TUA_CHIAVE"</span> \
 
 </main>
 
-<script src="js/common.js?v=20260628"></script>
-<script src="js/i18n.js?v=20260628"></script>
+<script src="js/common.js?v=20260629"></script>
+<script src="js/i18n.js?v=20260629"></script>
 <script>
 function showTab(id) {
     document.querySelectorAll('.tab-btn').forEach((b, i) => {
diff --git a/public/isms.html b/public/isms.html
index a062698..3fa0940 100644
--- a/public/isms.html
+++ b/public/isms.html
@@ -184,8 +184,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -195,9 +195,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script src="/js/isms.js"></script>
 </body>
 </html>
diff --git a/public/js/common.js b/public/js/common.js
index 51c6227..eb023d6 100644
--- a/public/js/common.js
+++ b/public/js/common.js
@@ -204,6 +204,7 @@ function loadSidebar() {
                 { name: 'Policy',       href: 'policies.html',       icon: iconDocumentText(),      i18nKey: 'nav.policies' },
                 { name: 'Supply Chain', href: 'supply-chain.html',   icon: iconLink(),              i18nKey: 'nav.supply_chain' },
                 { name: 'Stakeholder',  href: 'stakeholders.html',   icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M10 9a3 3 0 100-6 3 3 0 000 6zm-7 9a7 7 0 1114 0H3z" clip-rule="evenodd"/><path d="M5.5 7.5a2 2 0 11-2.999.001A2 2 0 015.5 7.5zM17.5 7.5a2 2 0 11-2.999.001A2 2 0 0117.5 7.5z"/></svg>`, i18nKey: 'nav.stakeholders' },
+                { name: 'Attività stakeholder', href: 'stakeholder-activities.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M9 2a1 1 0 000 2h2a1 1 0 100-2H9z" clip-rule="evenodd"/><path fill-rule="evenodd" d="M4 5a2 2 0 012-2 3 3 0 003 3h2a3 3 0 003-3 2 2 0 012 2v11a2 2 0 01-2 2H6a2 2 0 01-2-2V5zm3 4a1 1 0 000 2h.01a1 1 0 100-2H7zm3 0a1 1 0 000 2h3a1 1 0 100-2h-3zm-3 4a1 1 0 100 2h.01a1 1 0 100-2H7zm3 0a1 1 0 100 2h3a1 1 0 100-2h-3z" clip-rule="evenodd"/></svg>`, i18nKey: 'nav.stk_activities' },
                 { name: 'Segnalazioni', href: 'whistleblowing.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M5 9V7a5 5 0 0110 0v2a2 2 0 012 2v5a2 2 0 01-2 2H5a2 2 0 01-2-2v-5a2 2 0 012-2zm8-2v2H7V7a3 3 0 016 0z" clip-rule="evenodd"/></svg>` },
                 { name: 'Normative',    href: 'normative.html',      icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path fill-rule="evenodd" d="M4 4a2 2 0 012-2h4.586A2 2 0 0112 2.586L15.414 6A2 2 0 0116 7.414V16a2 2 0 01-2 2H6a2 2 0 01-2-2V4zm2 6a1 1 0 011-1h6a1 1 0 110 2H7a1 1 0 01-1-1zm1 3a1 1 0 100 2h6a1 1 0 100-2H7z" clip-rule="evenodd"/></svg>` },
                 { name: 'AI Cross-Analysis', href: 'cross-analysis.html', icon: `<svg viewBox="0 0 20 20" fill="currentColor"><path d="M13 6a3 3 0 11-6 0 3 3 0 016 0zM18 8a2 2 0 11-4 0 2 2 0 014 0zM14 15a4 4 0 00-8 0v3h8v-3zM6 8a2 2 0 11-4 0 2 2 0 014 0zM16 18v-3a5.972 5.972 0 00-.75-2.906A3.005 3.005 0 0119 15v3h-3zM4.75 12.094A5.973 5.973 0 004 15v3H1v-3a3 3 0 013.75-2.906z"/></svg>` },
diff --git a/public/kb.html b/public/kb.html
index 82f56a1..a8a6082 100644
--- a/public/kb.html
+++ b/public/kb.html
@@ -151,8 +151,8 @@
     </div>
 
     <!-- Stessa logica JS della pagina live (parita' funzionale assoluta, zero backend). -->
-    <script src="/js/common.js?v=20260628"></script>
-    <script src="/js/api.js?v=20260628"></script>
+    <script src="/js/common.js?v=20260629"></script>
+    <script src="/js/api.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI. -->
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
@@ -161,9 +161,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script src="/js/kb.js"></script>
     <script>
         // Gate auth + chrome come le altre pagine -bi.
diff --git a/public/licenseExt.html b/public/licenseExt.html
index 967fb80..3376063 100644
--- a/public/licenseExt.html
+++ b/public/licenseExt.html
@@ -515,7 +515,7 @@ body { background: var(--bg-main); }
 
 <div id="toast"></div>
 
-<script src="js/api.js?v=20260628"></script>
+<script src="js/api.js?v=20260629"></script>
 <script>
 // ══════════════════════════════════════════════════════
 // CONFIG
diff --git a/public/login.html b/public/login.html
index a6ff439..9ef9337 100644
--- a/public/login.html
+++ b/public/login.html
@@ -94,8 +94,8 @@
     </script>
 
     <!-- Stessa logica della login attuale: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
     <script>
         if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }
 
diff --git a/public/misure-requisiti.html b/public/misure-requisiti.html
index 4bec847..f7fdbff 100644
--- a/public/misure-requisiti.html
+++ b/public/misure-requisiti.html
@@ -6,7 +6,7 @@
     <title>Misure e Requisiti - NIS2 Agile</title>
     <!-- Bootstrap Italia v2.18.1 self-hostato (regola: MAI CDN). Caricato PRIMA di style.css. -->
     <link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
-    <link rel="stylesheet" href="/css/style.css?v=20260628">
+    <link rel="stylesheet" href="/css/style.css?v=20260629">
     <style>
         .mr-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:14px; font-size:.92rem; line-height:1.6; }
         .mr-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 16px; }
@@ -162,12 +162,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
     'use strict';
     /*
diff --git a/public/mktg-api-doc.html b/public/mktg-api-doc.html
index c7dfdde..a5b763a 100644
--- a/public/mktg-api-doc.html
+++ b/public/mktg-api-doc.html
@@ -424,6 +424,6 @@ curl https://nis2.agile.software/api/services/status</pre>
 </div>
 
 </div>
-<script src="js/common.js?v=20260628"></script>
+<script src="js/common.js?v=20260629"></script>
 </body>
 </html>
diff --git a/public/normative.html b/public/normative.html
index 03671bb..192dd33 100644
--- a/public/normative.html
+++ b/public/normative.html
@@ -112,8 +112,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -123,9 +123,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         if (!checkAuth()) throw new Error('Not authenticated');
         loadSidebar();
diff --git a/public/onboarding.html b/public/onboarding.html
index c27fc93..25617ff 100644
--- a/public/onboarding.html
+++ b/public/onboarding.html
@@ -494,8 +494,8 @@
     </script>
 
     <!-- Stessa logica della onboarding.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
     <script>
         // ── Auth check ──────────────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/organigramma.html b/public/organigramma.html
index d471e54..a41afef 100644
--- a/public/organigramma.html
+++ b/public/organigramma.html
@@ -138,12 +138,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script src="/js/organigramma.js?v=20260617"></script>
 </body>
 </html>
diff --git a/public/policies.html b/public/policies.html
index 02fd052..36c40fc 100644
--- a/public/policies.html
+++ b/public/policies.html
@@ -333,8 +333,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -344,9 +344,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ─────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/raci.html b/public/raci.html
index b841b83..ecf4c08 100644
--- a/public/raci.html
+++ b/public/raci.html
@@ -131,12 +131,12 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script src="/js/raci.js?v=20260619"></script>
 </body>
 </html>
diff --git a/public/register.html b/public/register.html
index 1f01cad..cbf5409 100644
--- a/public/register.html
+++ b/public/register.html
@@ -268,8 +268,8 @@
     </script>
 
     <!-- Stessa logica della register.html: ZERO modifiche backend -->
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
     <script>
         if (api.isAuthenticated()) { window.location.href = 'dashboard.html'; }
 
diff --git a/public/reports.html b/public/reports.html
index 78e6887..1939838 100644
--- a/public/reports.html
+++ b/public/reports.html
@@ -443,8 +443,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -454,9 +454,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ─────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/review-schedule.html b/public/review-schedule.html
index bd71096..b6609cf 100644
--- a/public/review-schedule.html
+++ b/public/review-schedule.html
@@ -141,12 +141,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
     'use strict';
     /*
diff --git a/public/risks.html b/public/risks.html
index 24acb9f..471c49e 100644
--- a/public/risks.html
+++ b/public/risks.html
@@ -494,8 +494,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -505,9 +505,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ──────────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/settings.html b/public/settings.html
index 9a98880..5b7d3cb 100644
--- a/public/settings.html
+++ b/public/settings.html
@@ -672,8 +672,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -683,9 +683,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth check ───────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/setup-org.html b/public/setup-org.html
index 7a0c8a7..47d4d93 100644
--- a/public/setup-org.html
+++ b/public/setup-org.html
@@ -165,8 +165,8 @@
         </main>
     </div>
 
-    <script src="js/api.js?v=20260628"></script>
-    <script src="js/common.js?v=20260628"></script>
+    <script src="js/api.js?v=20260629"></script>
+    <script src="js/common.js?v=20260629"></script>
     <script>
         // ── Auth check ───────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/stakeholder-activities.html b/public/stakeholder-activities.html
index 31a8cda..defac52 100644
--- a/public/stakeholder-activities.html
+++ b/public/stakeholder-activities.html
@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
     <title>Attività stakeholder - NIS2 Agile</title>
     <link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
-    <link rel="stylesheet" href="/css/style.css?v=20260628">
+    <link rel="stylesheet" href="/css/style.css?v=20260629">
     <style>
         .sa-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:12px; font-size:.92rem; line-height:1.6; }
         .sa-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 16px; }
@@ -86,19 +86,19 @@
                     obblighi ai sensi dell'<strong>art. 24 D.Lgs. 138/2024</strong>. L'invio email è disattivato: i questionari si condividono tramite magic-link.
                 </div>
 
-                <div class="sa-tabs">
-                    <button class="sa-tab active" id="tab-act" onclick="saTab('act')">Attività</button>
-                    <button class="sa-tab" id="tab-tpl" onclick="saTab('tpl')">Questionari tipo</button>
+                <div class="sa-tabs" role="tablist" aria-label="Sezioni attività">
+                    <button class="sa-tab active" id="tab-act" role="tab" aria-selected="true" aria-controls="pane-act" onclick="saTab('act')">Attività</button>
+                    <button class="sa-tab" id="tab-tpl" role="tab" aria-selected="false" aria-controls="pane-tpl" onclick="saTab('tpl')">Questionari tipo</button>
                 </div>
 
                 <!-- ATTIVITÀ -->
-                <section id="pane-act">
+                <section id="pane-act" role="tabpanel" aria-labelledby="tab-act">
                     <div class="sa-toolbar"><button class="btn btn-primary btn-sm" onclick="actOpen()">+ Nuova attività</button></div>
                     <div id="act-list" aria-live="polite"></div>
                 </section>
 
                 <!-- QUESTIONARI TIPO -->
-                <section id="pane-tpl" class="hidden">
+                <section id="pane-tpl" class="hidden" role="tabpanel" aria-labelledby="tab-tpl">
                     <div class="sa-toolbar"><button class="btn btn-primary btn-sm" onclick="tplOpen()">+ Nuovo questionario tipo</button></div>
                     <div id="tpl-list" aria-live="polite"></div>
                 </section>
@@ -107,9 +107,9 @@
     </div>
 
     <!-- Modale questionario tipo -->
-    <div class="sm-overlay" id="tpl-modal" role="dialog" aria-modal="true">
+    <div class="sm-overlay" id="tpl-modal" role="dialog" aria-modal="true" aria-labelledby="tpl-modal-title">
         <div class="sm-dialog">
-            <div class="sm-head"><h3 id="tpl-modal-title">Nuovo questionario tipo</h3><button class="sm-close" type="button" onclick="tplClose()">&times;</button></div>
+            <div class="sm-head"><h3 id="tpl-modal-title">Nuovo questionario tipo</h3><button class="sm-close" type="button" aria-label="Chiudi" onclick="tplClose()">&times;</button></div>
             <div class="sm-body">
                 <input type="hidden" id="tpl-id">
                 <div class="sm-row">
@@ -140,9 +140,9 @@
     </div>
 
     <!-- Modale attività -->
-    <div class="sm-overlay" id="act-modal" role="dialog" aria-modal="true">
+    <div class="sm-overlay" id="act-modal" role="dialog" aria-modal="true" aria-labelledby="act-modal-title">
         <div class="sm-dialog">
-            <div class="sm-head"><h3 id="act-modal-title">Nuova attività</h3><button class="sm-close" type="button" onclick="actClose()">&times;</button></div>
+            <div class="sm-head"><h3 id="act-modal-title">Nuova attività</h3><button class="sm-close" type="button" aria-label="Chiudi" onclick="actClose()">&times;</button></div>
             <div class="sm-body">
                 <input type="hidden" id="act-id">
                 <div class="sm-row">
@@ -179,9 +179,9 @@
     </div>
 
     <!-- Modale dettaglio attività (target + invio) -->
-    <div class="sm-overlay" id="det-modal" role="dialog" aria-modal="true">
+    <div class="sm-overlay" id="det-modal" role="dialog" aria-modal="true" aria-labelledby="det-title">
         <div class="sm-dialog">
-            <div class="sm-head"><h3 id="det-title">Dettaglio attività</h3><button class="sm-close" type="button" onclick="detClose()">&times;</button></div>
+            <div class="sm-head"><h3 id="det-title">Dettaglio attività</h3><button class="sm-close" type="button" aria-label="Chiudi" onclick="detClose()">&times;</button></div>
             <div class="sm-body" id="det-body"></div>
             <div class="sm-foot">
                 <button class="btn btn-outline" type="button" onclick="detClose()">Chiudi</button>
@@ -191,12 +191,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
     'use strict';
     /*
@@ -205,6 +205,8 @@
      * con magic-link (email disattivate). Sotto-dashboard feedback completa in C5.2b.
      */
     let SA = { activities: [], templates: [], pickers: { policies: [], misure: [], requisiti: [] }, types: [], stakeholders: [], detail: null };
+    const ST_LABELS = { draft: 'Bozza', scheduled: 'Pianificata', sent: 'Inviata', in_progress: 'In corso', completed: 'Completata', cancelled: 'Annullata' };
+    const TYPE_LABELS = { questionnaire: 'Questionario', read_ack: 'Firma lettura', action: 'Azione' };
 
     function el(id) { return document.getElementById(id); }
     function esc(s) { const d = document.createElement('div'); d.textContent = (s == null ? '' : String(s)); return d.innerHTML; }
@@ -222,6 +224,8 @@
     function saTab(which) {
         el('tab-act').classList.toggle('active', which === 'act');
         el('tab-tpl').classList.toggle('active', which === 'tpl');
+        el('tab-act').setAttribute('aria-selected', which === 'act' ? 'true' : 'false');
+        el('tab-tpl').setAttribute('aria-selected', which === 'tpl' ? 'true' : 'false');
         el('pane-act').classList.toggle('hidden', which !== 'act');
         el('pane-tpl').classList.toggle('hidden', which !== 'tpl');
     }
@@ -271,16 +275,22 @@
         el('tpl-list').innerHTML = '<table class="sa-table"><thead><tr><th>Nome</th><th>Tipo</th><th>Domande</th><th>Collegamenti</th><th>Azioni</th></tr></thead><tbody>' + rows + '</tbody></table>';
     }
 
-    function qAdd(text, type, required) {
+    function qAdd(text, type, required, options) {
         const allowed = ['text','yes_no','single_choice','multi_choice','scale_1_5','number'];
         const t = allowed.indexOf(type) !== -1 ? type : 'text';
-        const div = document.createElement('div'); div.className = 'q-row';
-        div.innerHTML = '<input type="text" placeholder="Testo della domanda" maxlength="500" value="' + esc(text || '').replace(/"/g,'&quot;') + '">'
-            + '<select>' + allowed.map(a => '<option value="' + a + '"' + (a === t ? ' selected' : '') + '>' + ({text:'Testo',yes_no:'Sì/No',single_choice:'Scelta singola',multi_choice:'Scelta multipla',scale_1_5:'Scala 1-5',number:'Numero'})[a] + '</option>').join('') + '</select>'
-            + '<label style="font-size:.78rem;display:flex;align-items:center;gap:4px;white-space:nowrap;"><input type="checkbox"' + (required ? ' checked' : '') + '> obbl.</label>'
-            + '<button type="button" class="q-del" onclick="this.parentNode.remove()">✕</button>';
+        const isChoice = (t === 'single_choice' || t === 'multi_choice');
+        const div = document.createElement('div'); div.className = 'q-row'; div.style.flexWrap = 'wrap';
+        div.innerHTML = '<input type="text" class="q-text-in" placeholder="Testo della domanda" maxlength="500" value="' + esc(text || '').replace(/"/g,'&quot;') + '">'
+            + '<select class="q-type-in" onchange="qToggleOpts(this)">' + allowed.map(a => '<option value="' + a + '"' + (a === t ? ' selected' : '') + '>' + ({text:'Testo',yes_no:'Sì/No',single_choice:'Scelta singola',multi_choice:'Scelta multipla',scale_1_5:'Scala 1-5',number:'Numero'})[a] + '</option>').join('') + '</select>'
+            + '<label style="font-size:.78rem;display:flex;align-items:center;gap:4px;white-space:nowrap;"><input type="checkbox" class="q-req-in"' + (required ? ' checked' : '') + '> obbl.</label>'
+            + '<button type="button" class="q-del" onclick="this.closest(\'.q-row\').remove()">✕</button>'
+            + '<input type="text" class="q-opts-in" placeholder="Opzioni separate da |  (es. Sì | No | In parte)" maxlength="500" style="flex:1 1 100%;margin-top:6px;' + (isChoice ? '' : 'display:none;') + '" value="' + esc((options || []).join(' | ')).replace(/"/g,'&quot;') + '">';
         el('tpl-questions').appendChild(div);
     }
+    function qToggleOpts(sel) {
+        const row = sel.closest('.q-row'); const o = row.querySelector('.q-opts-in');
+        o.style.display = (sel.value === 'single_choice' || sel.value === 'multi_choice') ? '' : 'none';
+    }
 
     function tplOnKind() {
         const k = el('tpl-kind').value;
@@ -299,7 +309,7 @@
                 const t = await api.stkActGetTemplate(id);
                 el('tpl-name').value = t.name || ''; el('tpl-kind').value = t.kind || 'questionnaire';
                 el('tpl-descr').value = t.description || ''; el('tpl-content').value = t.content || '';
-                (t.questions || []).forEach(q => qAdd(q.text, q.type, q.required));
+                (t.questions || []).forEach(q => qAdd(q.text, q.type, q.required, q.options));
                 selMulti('tpl-proc', t.policy_ids || []); selMulti('tpl-mis', t.misura_codes || []); selMulti('tpl-req', t.requisito_ids || []);
             } catch (e) { el('tpl-err').textContent = e.message || 'Errore'; }
         } else {
@@ -312,8 +322,14 @@
 
     function collectQuestions() {
         return Array.prototype.map.call(el('tpl-questions').children, (row, i) => {
-            const inp = row.querySelector('input[type=text]'); const sel = row.querySelector('select'); const chk = row.querySelector('input[type=checkbox]');
-            return { code: 'Q' + (i + 1), text: inp.value.trim(), type: sel.value, required: chk.checked };
+            const text = row.querySelector('.q-text-in').value.trim();
+            const type = row.querySelector('.q-type-in').value;
+            const required = row.querySelector('.q-req-in').checked;
+            const q = { code: 'Q' + (i + 1), text: text, type: type, required: required };
+            if (type === 'single_choice' || type === 'multi_choice') {
+                q.options = (row.querySelector('.q-opts-in').value || '').split('|').map(s => s.trim()).filter(Boolean);
+            }
+            return q;
         }).filter(q => q.text !== '');
     }
 
@@ -348,10 +364,10 @@
         if (!SA.activities.length) { el('act-list').innerHTML = '<div class="sa-empty">Nessuna attività. Creane una con "+ Nuova attività".</div>'; return; }
         const rows = SA.activities.map(a =>
             '<tr><td><strong>' + esc(a.title) + '</strong>' + (a.template_name ? '<div style="font-size:.78rem;color:#6b7280;">' + esc(a.template_name) + '</div>' : '') + '</td>'
-            + '<td><span class="sa-badge k-' + a.type + '">' + ({questionnaire:'Questionario',read_ack:'Firma lettura',action:'Azione'})[a.type] + '</span></td>'
+            + '<td><span class="sa-badge k-' + a.type + '">' + (TYPE_LABELS[a.type] || a.type) + '</span></td>'
             + '<td style="font-size:.82rem;">' + (a.assign_mode === 'by_code' ? ('Codice ' + esc(a.stak_code || '?')) : 'Singoli') + '</td>'
             + '<td style="font-size:.82rem;">' + (a.due_date ? esc(a.due_date) : '—') + '</td>'
-            + '<td><span class="sa-badge s-' + a.status + '">' + esc(a.status) + '</span></td>'
+            + '<td><span class="sa-badge s-' + a.status + '">' + esc(ST_LABELS[a.status] || a.status) + '</span></td>'
             + '<td style="font-size:.82rem;">' + a.n_done + '/' + a.n_targets + '</td>'
             + '<td style="white-space:nowrap;"><button class="btn btn-outline" style="padding:3px 8px;font-size:.74rem;" onclick="detOpen(' + a.id + ')">Dettaglio</button> '
             + '<button class="btn btn-outline" style="padding:3px 8px;font-size:.74rem;" onclick="actOpen(' + a.id + ')">Modifica</button> '
@@ -445,7 +461,7 @@
         const fb = SA.feedback || { template: null, targets: [] };
         const tmap = {}; (fb.targets || []).forEach(t => { tmap[t.target_id] = t; });
         const targets = a.targets || [];
-        let html = '<div style="font-size:.85rem;margin-bottom:10px;color:#374151;">Tipo: <strong>' + esc(a.type) + '</strong> · Scadenza: ' + esc(a.due_date || '—') + ' · Stato: ' + esc(a.status) + '</div>';
+        let html = '<div id="det-answers"></div><div style="font-size:.85rem;margin-bottom:10px;color:#374151;">Tipo: <strong>' + esc(TYPE_LABELS[a.type] || a.type) + '</strong> · Scadenza: ' + esc(a.due_date || '—') + ' · Stato: ' + esc(ST_LABELS[a.status] || a.status) + '</div>';
 
         // Destinatari + esito
         if (!targets.length) {
@@ -489,12 +505,19 @@
 
     function detAnswers(targetId) {
         const fb = SA.feedback || {}; const t = (fb.targets || []).find(x => x.target_id === targetId);
-        if (!t || !t.answers) { showNotification('Nessuna risposta.', 'info'); return; }
+        const box = el('det-answers'); if (!box) return;
+        if (!t || !t.answers) { box.innerHTML = ''; showNotification('Nessuna risposta.', 'info'); return; }
         const qs = (fb.template && fb.template.questions) || [];
         const label = {}; qs.forEach(q => { label[q.code] = q.text; });
-        let txt = 'Risposte di ' + (t.respondent_name || t.stakeholder_name) + ':\n\n';
-        Object.keys(t.answers).forEach(k => { txt += (label[k] || k) + '\n→ ' + (Array.isArray(t.answers[k]) ? t.answers[k].join(', ') : t.answers[k]) + '\n\n'; });
-        alert(txt);
+        const rows = Object.keys(t.answers).map(k => {
+            const v = t.answers[k]; const sv = Array.isArray(v) ? v.join(', ') : (v == null ? '' : v);
+            return '<div style="padding:4px 0;border-top:1px solid #eef2ff;"><div style="font-weight:600;font-size:.82rem;">' + esc(label[k] || k) + '</div><div style="font-size:.86rem;">' + esc(sv || '—') + '</div></div>';
+        }).join('');
+        box.innerHTML = '<div style="background:#f8fafc;border:1px solid #e5e7eb;border-radius:8px;padding:10px 12px;margin-bottom:12px;">'
+            + '<div style="display:flex;justify-content:space-between;align-items:center;"><strong style="font-size:.85rem;">Risposte di ' + esc(t.respondent_name || t.stakeholder_name) + '</strong>'
+            + '<button class="btn btn-outline" style="padding:1px 8px;font-size:.72rem;" onclick="el(\'det-answers\').innerHTML=\'\'">Chiudi</button></div>'
+            + rows + '</div>';
+        box.scrollIntoView({ block: 'nearest' });
     }
 
     async function detComment() {
diff --git a/public/stakeholders.html b/public/stakeholders.html
index 06745b9..65c5549 100644
--- a/public/stakeholders.html
+++ b/public/stakeholders.html
@@ -6,7 +6,7 @@
     <title>Stakeholder - NIS2 Agile</title>
     <!-- Bootstrap Italia v2.18.1 self-hostato (regola: MAI CDN). Caricato PRIMA di style.css. -->
     <link rel="stylesheet" href="/vendor/bootstrap-italia/dist/css/bootstrap-italia.min.css">
-    <link rel="stylesheet" href="/css/style.css?v=20260628">
+    <link rel="stylesheet" href="/css/style.css?v=20260629">
     <style>
         .stk-intro { background:#eff6ff; border-left:4px solid var(--primary,#2563eb); padding:14px 18px; border-radius:8px; margin-bottom:12px; font-size:.92rem; line-height:1.6; }
         .stk-note { font-size:.82rem; color:#92400e; background:#fffbeb; border:1px solid #fde68a; border-radius:8px; padding:10px 12px; margin:0 0 16px; }
@@ -191,12 +191,12 @@
         </div>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <script src="/vendor/bootstrap-italia/dist/js/bootstrap-italia.bundle.min.js"></script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
     'use strict';
     /*
diff --git a/public/stk-portal.html b/public/stk-portal.html
index dee1dd6..8e4da31 100644
--- a/public/stk-portal.html
+++ b/public/stk-portal.html
@@ -46,6 +46,7 @@
 
     function el(id) { return document.getElementById(id); }
     function esc(s) { var d = document.createElement('div'); d.textContent = (s == null ? '' : String(s)); return d.innerHTML; }
+    function escAttr(s) { return esc(s).replace(/"/g, '&quot;'); }
     function app() { return el('pw-app'); }
 
     async function apiGet(path) {
@@ -98,7 +99,7 @@
     }
 
     function qHtml(q, i) {
-        var code = esc(q.code || ('Q' + (i + 1)));
+        var code = escAttr(q.code || ('Q' + (i + 1)));
         var req = q.required ? ' <span class="q-req">*</span>' : '';
         var inner = '';
         if (q.type === 'yes_no') {
@@ -106,15 +107,15 @@
         } else if (q.type === 'scale_1_5') {
             inner = [1,2,3,4,5].map(function (n) { return '<label class="q-opt" style="display:inline-flex;margin-right:14px;"><input type="radio" name="' + code + '" value="' + n + '"> ' + n + '</label>'; }).join('');
         } else if (q.type === 'single_choice' && q.options) {
-            inner = q.options.map(function (o) { return '<label class="q-opt"><input type="radio" name="' + code + '" value="' + esc(o) + '"> ' + esc(o) + '</label>'; }).join('');
+            inner = q.options.map(function (o) { return '<label class="q-opt"><input type="radio" name="' + code + '" value="' + escAttr(o) + '"> ' + esc(o) + '</label>'; }).join('');
         } else if (q.type === 'multi_choice' && q.options) {
-            inner = q.options.map(function (o) { return '<label class="q-opt"><input type="checkbox" name="' + code + '" value="' + esc(o) + '"> ' + esc(o) + '</label>'; }).join('');
+            inner = q.options.map(function (o) { return '<label class="q-opt"><input type="checkbox" name="' + code + '" value="' + escAttr(o) + '"> ' + esc(o) + '</label>'; }).join('');
         } else if (q.type === 'number') {
             inner = '<input type="number" name="' + code + '">';
         } else {
             inner = '<textarea name="' + code + '" rows="2"></textarea>';
         }
-        return '<div class="q-block" data-code="' + code + '" data-type="' + esc(q.type || 'text') + '"><div class="q-text">' + esc(q.text) + req + '</div>' + inner + '</div>';
+        return '<div class="q-block" data-code="' + code + '" data-type="' + escAttr(q.type || 'text') + '"><div class="q-text">' + esc(q.text) + req + '</div>' + inner + '</div>';
     }
 
     function collectAnswers() {
@@ -136,6 +137,20 @@
 
     async function doRespond() {
         var answers = collectAnswers();
+        // pre-check campi obbligatori lato client (evidenzia i blocchi mancanti)
+        var qs = (DATA.template && DATA.template.questions) || [];
+        var missing = [];
+        document.querySelectorAll('.q-block').forEach(function (b) { b.style.borderLeft = ''; });
+        qs.forEach(function (q) {
+            if (!q.required) return;
+            var v = answers[q.code];
+            if (v == null || v === '' || (Array.isArray(v) && !v.length)) {
+                missing.push(q.text);
+                var b = document.querySelector('.q-block[data-code="' + (q.code || '') + '"]');
+                if (b) b.style.borderLeft = '3px solid #dc2626';
+            }
+        });
+        if (missing.length) { flash('Rispondi alle domande obbligatorie: ' + missing.join('; '), false); window.scrollTo(0, 0); return; }
         var res = await apiPost('/stakeholder-portal/respond', { t: TOKEN, answers: answers, respondent_name: (el('pw-name') || {}).value });
         if (!res.success) { flash(res.message || 'Errore', false); return; }
         DATA.submitted = true; render(); window.scrollTo(0, 0);
diff --git a/public/supply-chain.html b/public/supply-chain.html
index e9da7ef..5e041de 100644
--- a/public/supply-chain.html
+++ b/public/supply-chain.html
@@ -477,8 +477,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -488,9 +488,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ─────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/sw.js b/public/sw.js
index d5e7c4e..a998db3 100644
--- a/public/sw.js
+++ b/public/sw.js
@@ -13,7 +13,7 @@
  * Il nome cache include la release: va BUMPATO ad ogni rilascio (vedi version.json),
  * cosi' activate elimina automaticamente la shell vecchia.
  */
-const CACHE = 'nis2-shell-v1.21.0';
+const CACHE = 'nis2-shell-v1.21.1';
 
 const PRECACHE = [
   '/offline.html',
diff --git a/public/training.html b/public/training.html
index a9b250d..dc4e703 100644
--- a/public/training.html
+++ b/public/training.html
@@ -292,8 +292,8 @@
         </main>
     </div>
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -303,9 +303,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         // ── Auth & Init ─────────────────────────────────────────
         if (!checkAuth()) throw new Error('Not authenticated');
diff --git a/public/version.json b/public/version.json
index 0418096..c038b49 100644
--- a/public/version.json
+++ b/public/version.json
@@ -1 +1 @@
-{"version": "1.21.0", "build": "2026-06-16-v1.21.0", "date": "2026-06-16", "changelog": "Epic C / C5.2b - Portale esterno stakeholder (token magic-link, no account/JWT) + sotto-dashboard feedback: i destinatari rispondono al questionario o firmano l'avvenuta lettura, commentano e allegano file dal portale; il compliance manager vede esiti, commenti e allegati nel dettaglio attivita'. mig.053: stk_activity_responses, stk_activity_comments (allegati su evidence_files). StakeholderPortalController (non-JWT) + StakeholderActivityController feedback/comments/attachments; stk-portal.html pubblica. Completa C5.2/Epic C. Additivo."}
+{"version": "1.21.1", "build": "2026-06-16-v1.21.1", "date": "2026-06-16", "changelog": "Epic C / C5 hardening (post-verifica flotta): upload allegati con ALLOWLIST estensioni (no html/svg/js same-origin) + nome file random; scadenza magic-link (mig.054 token_expires_at, 410 TOKEN_EXPIRED) + rate-limit endpoint portale + guard scritture su attivita' chiuse; send() non azzera piu' i destinatari gia' responded/acknowledged; assign individuale con semantica replace + guard lista vuota; update conserva assign_mode esistente; editor opzioni per domande a scelta singola/multipla; etichette stato localizzate; risposte mostrate inline (no alert); ARIA su modali/tab; escAttr nel portale; voce sidebar in common.js. Additivo."}
diff --git a/public/whistleblowing.html b/public/whistleblowing.html
index aaed9d8..72057ee 100644
--- a/public/whistleblowing.html
+++ b/public/whistleblowing.html
@@ -207,8 +207,8 @@
 
     <!-- Report Detail Modal handled by common.js showModal -->
 
-    <script src="/js/api.js?v=20260628"></script>
-    <script src="/js/common.js?v=20260628"></script>
+    <script src="/js/api.js?v=20260629"></script>
+    <script src="/js/common.js?v=20260629"></script>
     <!-- Bootstrap Italia bundle (componenti) + override sidebar BI (common-bi.js).
          common-bi.js va DOPO common.js: ridefinisce solo loadSidebar() con markup BI,
          riusando tutti gli helper di common.js (zero backend). -->
@@ -218,9 +218,9 @@
             bootstrap.loadFonts('/vendor/bootstrap-italia/dist/fonts');
         }
     </script>
-    <script src="/js/common-bi.js?v=20260628"></script>
-    <script src="/js/i18n.js?v=20260628"></script>
-    <script src="/js/help.js?v=20260628"></script>
+    <script src="/js/common-bi.js?v=20260629"></script>
+    <script src="/js/i18n.js?v=20260629"></script>
+    <script src="/js/help.js?v=20260629"></script>
     <script>
         if (!checkAuth()) throw new Error('Not authenticated');
         loadSidebar();
diff --git a/public/workflow.html b/public/workflow.html
index 4cc854c..62540f3 100644
--- a/public/workflow.html
+++ b/public/workflow.html
@@ -319,9 +319,9 @@
     </main>
 </div>
 
-<script src="js/api.js?v=20260628"></script>
-<script src="js/common.js?v=20260628"></script>
-<script src="js/i18n.js?v=20260628"></script>
+<script src="js/api.js?v=20260629"></script>
+<script src="js/common.js?v=20260629"></script>
+<script src="js/i18n.js?v=20260629"></script>
 <script>
 if (!checkAuth()) throw new Error('Not authenticated');
 loadSidebar();