Default story: four intentional gaps (change management + vulnerability). Switch to the change-record profile to clear change gaps; vuln gaps remain. Static site — scores are frozen from real app output.