diff --git a/frontend/src/components/AttackResults/attackAttemptFormatting.test.ts b/frontend/src/components/AttackResults/attackAttemptFormatting.test.ts
index 7d7e20833d..e40824e624 100644
--- a/frontend/src/components/AttackResults/attackAttemptFormatting.test.ts
+++ b/frontend/src/components/AttackResults/attackAttemptFormatting.test.ts
@@ -1,4 +1,4 @@
-import { objectivePreview } from './attackAttemptFormatting'
+import { formatAttemptTiming, formatRetries, formatTimestamp, objectivePreview } from './attackAttemptFormatting'
 
 const LONE_SURROGATE_REGEX = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/
 
@@ -45,3 +45,21 @@ describe('objectivePreview', () => {
     expect(objectivePreview('', 'seed-456')).toBe('Objective unavailable (seed-456)')
   })
 })
+
+describe('formatRetries', () => {
+  it('says when there were no retries and pluralizes the rest', () => {
+    expect(formatRetries(0)).toBe('No retries')
+    expect(formatRetries(1)).toBe('1 retry')
+    expect(formatRetries(3)).toBe('3 retries')
+  })
+})
+
+describe('formatAttemptTiming', () => {
+  it('joins duration, retries, and timestamp on one line', () => {
+    const timestamp = '2026-01-01T00:04:30Z'
+    expect(formatAttemptTiming({ execution_time_ms: 270_000, total_retries: 0, timestamp }))
+      .toBe(`4m 30s · No retries · ${formatTimestamp(timestamp)}`)
+    expect(formatAttemptTiming({ execution_time_ms: 5_000, total_retries: 2, timestamp }))
+      .toBe(`5s · 2 retries · ${formatTimestamp(timestamp)}`)
+  })
+})
diff --git a/frontend/src/components/AttackResults/attackAttemptFormatting.ts b/frontend/src/components/AttackResults/attackAttemptFormatting.ts
index 65862007f9..f57a083b62 100644
--- a/frontend/src/components/AttackResults/attackAttemptFormatting.ts
+++ b/frontend/src/components/AttackResults/attackAttemptFormatting.ts
@@ -76,6 +76,22 @@ export function formatDuration(milliseconds: number): string {
   return `${seconds}s`
 }
 
+export function formatRetries(retries: number): string {
+  if (retries === 0) return 'No retries'
+  return `${retries} ${retries === 1 ? 'retry' : 'retries'}`
+}
+
+/** One line of attempt timing, such as "4m 30s · No retries · Jan 1, 2026, 12:00:05 AM". */
+export function formatAttemptTiming(
+  attempt: Pick<ScenarioProgressResult, 'execution_time_ms' | 'total_retries' | 'timestamp'>,
+): string {
+  return [
+    formatDuration(attempt.execution_time_ms),
+    formatRetries(attempt.total_retries),
+    formatTimestamp(attempt.timestamp),
+  ].join(' · ')
+}
+
 export function objectivePreview(objective: string | null, fallbackId: string): string {
   if (!objective) {
     return `Objective unavailable (${fallbackId})`
diff --git a/frontend/src/components/Chat/AttachToFindingsButton.styles.ts b/frontend/src/components/Chat/AttachToFindingsButton.styles.ts
new file mode 100644
index 0000000000..76db3b84dd
--- /dev/null
+++ b/frontend/src/components/Chat/AttachToFindingsButton.styles.ts
@@ -0,0 +1,9 @@
+import { makeStyles } from '@fluentui/react-components'
+
+import { mobileTouchTargetHeight } from '@/styles/touchTargets'
+
+export const useAttachToFindingsButtonStyles = makeStyles({
+  button: {
+    ...mobileTouchTargetHeight,
+  },
+})
diff --git a/frontend/src/components/Chat/AttachToFindingsButton.test.tsx b/frontend/src/components/Chat/AttachToFindingsButton.test.tsx
new file mode 100644
index 0000000000..e40b4677d1
--- /dev/null
+++ b/frontend/src/components/Chat/AttachToFindingsButton.test.tsx
@@ -0,0 +1,75 @@
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen, waitFor } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+import { MemoryRouter } from 'react-router'
+
+import { attacksApi, operationsApi } from '@/services/api'
+
+import AttachToFindingsButton from './AttachToFindingsButton'
+
+jest.mock('@/services/api', () => ({
+  attacksApi: { getAttack: jest.fn() },
+  operationsApi: {
+    get: jest.fn(), list: jest.fn(), listFindings: jest.fn(), attachFindingEvidence: jest.fn(), createFinding: jest.fn(),
+    getFindingOptions: jest.fn(),
+  },
+}))
+
+const OPERATION = { id: 'scan-operation', name: 'Scan operation', created_at: '2026-10-08T12:00:00Z' }
+const FINDING = {
+  id: 'finding', operation_id: OPERATION.id, title: 'Proof', severity: 'low', description: '',
+  created_at: '2026-10-08T12:00:00Z', evidence_count: 0,
+}
+
+function TestWrapper({ children }: { readonly children: React.ReactNode }) {
+  return <FluentProvider theme={webLightTheme}><MemoryRouter>{children}</MemoryRouter></FluentProvider>
+}
+
+describe('AttachToFindingsButton', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+    jest.mocked(attacksApi.getAttack).mockResolvedValue({ operation_id: null } as never)
+    jest.mocked(operationsApi.get).mockResolvedValue(OPERATION as never)
+    jest.mocked(operationsApi.list).mockResolvedValue({ items: [{ ...OPERATION, finding_counts: {} }] } as never)
+    jest.mocked(operationsApi.listFindings).mockResolvedValue({ items: [FINDING], has_more: false, next_offset: null } as never)
+    jest.mocked(operationsApi.attachFindingEvidence).mockResolvedValue({ item: { id: 'evidence' }, created: true } as never)
+  })
+
+  it('should attach the attack to a finding in the default operation and report it', async () => {
+    const user = userEvent.setup()
+    const onAttached = jest.fn()
+    render(<TestWrapper>
+      <AttachToFindingsButton attackResultId="attack-1" defaultOperationId={OPERATION.id} onAttached={onAttached} />
+    </TestWrapper>)
+
+    const button = screen.getByRole('button', { name: 'Attach to findings' })
+    await user.click(button)
+    expect(await screen.findByRole('dialog')).toBeInTheDocument()
+    expect(operationsApi.get).toHaveBeenCalledWith(OPERATION.id)
+    await user.click(await screen.findByRole('radio', { name: /Proof/ }))
+    await user.click(screen.getByRole('button', { name: 'Attach attack' }))
+
+    await waitFor(() => { expect(onAttached).toHaveBeenCalledTimes(1) })
+    expect(operationsApi.attachFindingEvidence).toHaveBeenCalledWith(OPERATION.id, FINDING.id, { attack_result_id: 'attack-1' })
+    await waitFor(() => { expect(button).toHaveFocus() })
+  })
+
+  it('should not report an attachment when the dialog is cancelled', async () => {
+    const user = userEvent.setup()
+    const onAttached = jest.fn()
+    render(<TestWrapper><AttachToFindingsButton attackResultId="attack-1" onAttached={onAttached} /></TestWrapper>)
+
+    await user.click(screen.getByRole('button', { name: 'Attach to findings' }))
+    await user.click(await screen.findByRole('button', { name: 'Cancel' }))
+
+    await waitFor(() => { expect(screen.queryByRole('dialog')).not.toBeInTheDocument() })
+    expect(onAttached).not.toHaveBeenCalled()
+  })
+
+  it('should explain why a running attack cannot be attached yet', () => {
+    render(<TestWrapper><AttachToFindingsButton attackResultId="attack-1" disabled /></TestWrapper>)
+    const button = screen.getByRole('button', { name: 'Attach to findings' })
+    expect(button).toBeDisabled()
+    expect(button).toHaveAttribute('title', 'Available after the attack finishes')
+  })
+})
diff --git a/frontend/src/components/Chat/AttachToFindingsButton.tsx b/frontend/src/components/Chat/AttachToFindingsButton.tsx
new file mode 100644
index 0000000000..8f5e06688a
--- /dev/null
+++ b/frontend/src/components/Chat/AttachToFindingsButton.tsx
@@ -0,0 +1,37 @@
+import { useRef, useState } from 'react'
+
+import { Button } from '@fluentui/react-components'
+import { AttachRegular } from '@fluentui/react-icons'
+
+import { useAttachToFindingsButtonStyles } from './AttachToFindingsButton.styles'
+import FindingEvidenceDialog from './FindingEvidenceDialog'
+
+interface AttachToFindingsButtonProps {
+  readonly attackResultId: string
+  /** The Operation offered first when the attack has no Operation of its own. */
+  readonly defaultOperationId?: string | null
+  /** Running attacks cannot be attached until they are saved. */
+  readonly disabled?: boolean
+  /** Called after the attack is attached, such as to refresh `useAttackFindings`. */
+  readonly onAttached?: () => void
+}
+
+/** Opens the finding picker to attach one attack as evidence, returning focus to the button. */
+export default function AttachToFindingsButton({
+  attackResultId, defaultOperationId = null, disabled = false, onAttached,
+}: AttachToFindingsButtonProps) {
+  const styles = useAttachToFindingsButtonStyles()
+  const [open, setOpen] = useState(false)
+  const trigger = useRef<HTMLButtonElement>(null)
+  return (
+    <>
+      <Button ref={trigger} className={styles.button} icon={<AttachRegular />} disabled={disabled}
+        title={disabled ? 'Available after the attack finishes' : 'Attach this attack as evidence to a finding'}
+        onClick={() => { setOpen(true) }}>
+        Attach to findings
+      </Button>
+      <FindingEvidenceDialog attackResultId={attackResultId} disabled={disabled} defaultOperationId={defaultOperationId}
+        open={open} onOpenChange={setOpen} returnFocusRef={trigger} onAttached={onAttached} />
+    </>
+  )
+}
diff --git a/frontend/src/components/Chat/FindingEvidenceDialog.tsx b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
index d38aa2e7eb..4162ee49c4 100644
--- a/frontend/src/components/Chat/FindingEvidenceDialog.tsx
+++ b/frontend/src/components/Chat/FindingEvidenceDialog.tsx
@@ -28,6 +28,8 @@ interface FindingEvidenceDialogProps {
   onOpenChange: (open: boolean) => void
   /** Receives focus when the dialog closes, such as the control that opened it. */
   returnFocusRef?: React.RefObject<HTMLElement | null>
+  /** Called after the attack is linked to a finding, new or existing. */
+  onAttached?: () => void
 }
 
 interface AttachmentSource {
@@ -36,7 +38,7 @@ interface AttachmentSource {
 }
 
 export default function FindingEvidenceDialog({
-  attackResultId, disabled, defaultOperationId = null, open, onOpenChange, returnFocusRef,
+  attackResultId, disabled, defaultOperationId = null, open, onOpenChange, returnFocusRef, onAttached,
 }: FindingEvidenceDialogProps) {
   const styles = useFindingEvidenceDialogStyles()
   const viewKey = attackResultId
@@ -144,6 +146,7 @@ export default function FindingEvidenceDialog({
     setCreating(false)
     onOpenChange(false)
     setNotice({ key: viewKey, text: `Finding created and attack attached: ${finding.title}` })
+    onAttached?.()
   }
 
   const attach = async (): Promise<void> => {
@@ -158,6 +161,7 @@ export default function FindingEvidenceDialog({
       })
       setNotice({ key: viewKey, text: response.created ? 'Attached' : 'Already attached' })
       onOpenChange(false)
+      onAttached?.()
     } catch (cause: unknown) {
       setAttachError(toApiError(cause).detail)
     } finally {
diff --git a/frontend/src/components/Chat/MessageList.styles.ts b/frontend/src/components/Chat/MessageList.styles.ts
index 5499dadbbc..3a8b59b384 100644
--- a/frontend/src/components/Chat/MessageList.styles.ts
+++ b/frontend/src/components/Chat/MessageList.styles.ts
@@ -235,50 +235,6 @@ export const useMessageListStyles = makeStyles({
     textOverflow: 'ellipsis',
     whiteSpace: 'nowrap',
   },
-  scoreSurface: {
-    display: 'flex',
-    flexDirection: 'column',
-    rowGap: tokens.spacingVerticalXS,
-    width: 'min(360px, calc(100vw - 64px))',
-    minWidth: 0,
-    maxWidth: '100%',
-  },
-  scoreRow: {
-    display: 'flex',
-    alignItems: 'flex-start',
-    columnGap: tokens.spacingHorizontalS,
-    width: '100%',
-    minWidth: 0,
-  },
-  scoreLabel: {
-    flex: '0 0 72px',
-    color: tokens.colorNeutralForeground2,
-  },
-  scoreValue: {
-    display: 'block',
-    flex: '0 1 auto',
-    minWidth: 0,
-    maxWidth: '100%',
-    height: 'auto',
-    whiteSpace: 'normal',
-    overflowWrap: 'anywhere',
-    wordBreak: 'break-word',
-  },
-  scoreRationale: {
-    display: 'flex',
-    flexDirection: 'column',
-    rowGap: tokens.spacingVerticalXXS,
-    marginTop: tokens.spacingVerticalXS,
-    paddingTop: tokens.spacingVerticalXS,
-    borderTop: `1px solid ${tokens.colorNeutralStroke2}`,
-  },
-  scoreRationaleText: {
-    color: tokens.colorNeutralForeground2,
-    whiteSpace: 'pre-wrap',
-    wordBreak: 'break-word',
-    maxHeight: '30vh',
-    overflowY: 'auto',
-  },
   loadingEllipsis: {
     fontSize: tokens.fontSizeBase500,
     animationName: {
diff --git a/frontend/src/components/Chat/MessageList.tsx b/frontend/src/components/Chat/MessageList.tsx
index 2d0c1f3650..82a29abbc3 100644
--- a/frontend/src/components/Chat/MessageList.tsx
+++ b/frontend/src/components/Chat/MessageList.tsx
@@ -31,9 +31,11 @@ import MarkdownContent from '@/components/Markdown/MarkdownContent'
 import MediaPreview from '@/components/Media/MediaPreview'
 
 import type { DisplayScore, Message, MessageAttachment } from '@/types'
+import { scoreSummaryFromBackendScore, scoreSummaryValue } from '@/utils/scoreSummary'
 
 import { useMessageListStyles } from './MessageList.styles'
 import { formatStructuredMessage, getRenderMessagePieces } from './messageViewModel'
+import ScoreDetails from './ScoreDetails'
 
 interface MessageListProps {
   onEditConversation?: () => void
@@ -60,51 +62,13 @@ interface MessageListProps {
 }
 
 function scoreDisplayValue(score: DisplayScore): string {
-  // An undetermined score has no value, so name its status instead.
-  return score.score_value ?? score.status ?? ''
+  return scoreSummaryValue(scoreSummaryFromBackendScore(score))
 }
 
 function scoreDisplayLabel(score: DisplayScore): string {
   return `${score.is_objective_score ? 'Final score' : 'Score'}: ${scoreDisplayValue(score)}`
 }
 
-function ScoreDetails({ score, testId }: { score: DisplayScore; testId: string }) {
-  const styles = useMessageListStyles()
-  const categories = score.score_category?.filter(Boolean) ?? []
-
-  return (
-    <div className={styles.scoreSurface} data-testid={testId}>
-      <Text weight="semibold">Score details</Text>
-      <div className={styles.scoreRow}>
-        <Text size={200} weight="semibold" className={styles.scoreLabel}>Score</Text>
-        <Badge appearance="tint" color="brand" size="small" className={styles.scoreValue}>{scoreDisplayValue(score)}</Badge>
-      </div>
-      <div className={styles.scoreRow}>
-        <Text size={200} weight="semibold" className={styles.scoreLabel}>Scorer</Text>
-        <Text size={200} className={styles.scoreValue}>{score.scorer_type}</Text>
-      </div>
-      <div className={styles.scoreRow}>
-        <Text size={200} weight="semibold" className={styles.scoreLabel}>Result role</Text>
-        <Text size={200} className={styles.scoreValue}>
-          {score.is_objective_score ? 'Final score' : 'Supporting score'}
-        </Text>
-      </div>
-      {categories.length > 0 && (
-        <div className={styles.scoreRow}>
-          <Text size={200} weight="semibold" className={styles.scoreLabel}>Category</Text>
-          <Text size={200} className={styles.scoreValue}>{categories.join(', ')}</Text>
-        </div>
-      )}
-      {score.score_rationale && (
-        <div className={styles.scoreRationale}>
-          <Text size={200} weight="semibold">Rationale</Text>
-          <Text size={200} className={styles.scoreRationaleText}>{score.score_rationale}</Text>
-        </div>
-      )}
-    </div>
-  )
-}
-
 function MessageScore({ score, groupId, scoreIndex }: { score: DisplayScore; groupId: string | number; scoreIndex: number }) {
   const styles = useMessageListStyles()
   const displayValue = scoreDisplayValue(score)
@@ -128,7 +92,7 @@ function MessageScore({ score, groupId, scoreIndex }: { score: DisplayScore; gro
         </PopoverTrigger>
       </Tooltip>
       <PopoverSurface>
-        <ScoreDetails score={score} testId={`message-score-details-${groupId}-${scoreIndex}`} />
+        <ScoreDetails score={scoreSummaryFromBackendScore(score)} testId={`message-score-details-${groupId}-${scoreIndex}`} />
       </PopoverSurface>
     </Popover>
   )
@@ -427,7 +391,7 @@ function MessageScores({ scores, groupId }: { scores: DisplayScore[]; groupId: s
             id={`message-score-panel-${groupId}`}
             aria-labelledby={`message-score-tab-${groupId}-${selectedIndex}`}
           >
-            <ScoreDetails score={selectedScore} testId={`message-score-details-${groupId}-${selectedIndex}`} />
+            <ScoreDetails score={scoreSummaryFromBackendScore(selectedScore)} testId={`message-score-details-${groupId}-${selectedIndex}`} />
           </div>
         </PopoverSurface>
       </Popover>
diff --git a/frontend/src/components/Chat/ScoreDetails.styles.ts b/frontend/src/components/Chat/ScoreDetails.styles.ts
new file mode 100644
index 0000000000..c47dccc28d
--- /dev/null
+++ b/frontend/src/components/Chat/ScoreDetails.styles.ts
@@ -0,0 +1,48 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+export const useScoreDetailsStyles = makeStyles({
+  surface: {
+    display: 'flex',
+    flexDirection: 'column',
+    rowGap: tokens.spacingVerticalXS,
+    width: 'min(360px, calc(100vw - 64px))',
+    minWidth: 0,
+    maxWidth: '100%',
+  },
+  row: {
+    display: 'flex',
+    alignItems: 'flex-start',
+    columnGap: tokens.spacingHorizontalS,
+    width: '100%',
+    minWidth: 0,
+  },
+  label: {
+    flex: '0 0 72px',
+    color: tokens.colorNeutralForeground2,
+  },
+  value: {
+    display: 'block',
+    flex: '0 1 auto',
+    minWidth: 0,
+    maxWidth: '100%',
+    height: 'auto',
+    whiteSpace: 'normal',
+    overflowWrap: 'anywhere',
+    wordBreak: 'break-word',
+  },
+  rationale: {
+    display: 'flex',
+    flexDirection: 'column',
+    rowGap: tokens.spacingVerticalXXS,
+    marginTop: tokens.spacingVerticalXS,
+    paddingTop: tokens.spacingVerticalXS,
+    borderTop: `1px solid ${tokens.colorNeutralStroke2}`,
+  },
+  rationaleText: {
+    color: tokens.colorNeutralForeground2,
+    whiteSpace: 'pre-wrap',
+    wordBreak: 'break-word',
+    maxHeight: '30vh',
+    overflowY: 'auto',
+  },
+})
diff --git a/frontend/src/components/Chat/ScoreDetails.test.tsx b/frontend/src/components/Chat/ScoreDetails.test.tsx
new file mode 100644
index 0000000000..e162cc3bd0
--- /dev/null
+++ b/frontend/src/components/Chat/ScoreDetails.test.tsx
@@ -0,0 +1,36 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+
+import ScoreDetails from './ScoreDetails'
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('ScoreDetails', () => {
+  it('should show the value, scorer, role, categories, and rationale', () => {
+    render(<TestWrapper><ScoreDetails testId="details" score={{
+      scorer: 'SelfAskRefusalScorer', scoreType: 'true_false', value: 'true', status: 'complete',
+      rationale: 'The target complied.', categories: ['jailbreak', '', 'harm'], isObjective: true,
+    }} /></TestWrapper>)
+
+    const details = screen.getByTestId('details')
+    expect(details).toHaveTextContent('Score details')
+    expect(screen.getByText('true')).toBeInTheDocument()
+    expect(screen.getByText('SelfAskRefusalScorer')).toBeInTheDocument()
+    expect(screen.getByText('Final score')).toBeInTheDocument()
+    expect(screen.getByText('jailbreak, harm')).toBeInTheDocument()
+    expect(screen.getByText('The target complied.')).toBeInTheDocument()
+  })
+
+  it('should name an undetermined score by its status and omit empty sections', () => {
+    render(<TestWrapper><ScoreDetails score={{ scorer: 'Judge', scoreType: 'float_scale', status: 'undetermined' }} /></TestWrapper>)
+
+    expect(screen.getByText('undetermined')).toBeInTheDocument()
+    expect(screen.getByText('Supporting score')).toBeInTheDocument()
+    expect(screen.queryByText('Category')).not.toBeInTheDocument()
+    expect(screen.queryByText('Rationale')).not.toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/components/Chat/ScoreDetails.tsx b/frontend/src/components/Chat/ScoreDetails.tsx
new file mode 100644
index 0000000000..49a721e5d1
--- /dev/null
+++ b/frontend/src/components/Chat/ScoreDetails.tsx
@@ -0,0 +1,49 @@
+import { Badge, Text } from '@fluentui/react-components'
+
+import type { ScoreSummary } from '@/types'
+import { scoreSummaryValue } from '@/utils/scoreSummary'
+
+import { useScoreDetailsStyles } from './ScoreDetails.styles'
+
+interface ScoreDetailsProps {
+  readonly score: ScoreSummary
+  readonly testId?: string
+}
+
+/** One score's value, scorer, role, categories, and rationale, as shown in a score popover. */
+export default function ScoreDetails({ score, testId }: ScoreDetailsProps) {
+  const styles = useScoreDetailsStyles()
+  const categories = score.categories?.filter(Boolean) ?? []
+
+  return (
+    <div className={styles.surface} data-testid={testId}>
+      <Text weight="semibold">Score details</Text>
+      <div className={styles.row}>
+        <Text size={200} weight="semibold" className={styles.label}>Score</Text>
+        <Badge appearance="tint" color="brand" size="small" className={styles.value}>{scoreSummaryValue(score)}</Badge>
+      </div>
+      <div className={styles.row}>
+        <Text size={200} weight="semibold" className={styles.label}>Scorer</Text>
+        <Text size={200} className={styles.value}>{score.scorer}</Text>
+      </div>
+      <div className={styles.row}>
+        <Text size={200} weight="semibold" className={styles.label}>Result role</Text>
+        <Text size={200} className={styles.value}>
+          {score.isObjective ? 'Final score' : 'Supporting score'}
+        </Text>
+      </div>
+      {categories.length > 0 && (
+        <div className={styles.row}>
+          <Text size={200} weight="semibold" className={styles.label}>Category</Text>
+          <Text size={200} className={styles.value}>{categories.join(', ')}</Text>
+        </div>
+      )}
+      {score.rationale && (
+        <div className={styles.rationale}>
+          <Text size={200} weight="semibold">Rationale</Text>
+          <Text size={200} className={styles.rationaleText}>{score.rationale}</Text>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/frontend/src/components/DetailFacts.styles.ts b/frontend/src/components/DetailFacts.styles.ts
new file mode 100644
index 0000000000..a9af12e1ec
--- /dev/null
+++ b/frontend/src/components/DetailFacts.styles.ts
@@ -0,0 +1,39 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import { NARROW_VIEWPORT_QUERY } from '@/styles/touchTargets'
+
+export const useDetailFactsStyles = makeStyles({
+  facts: {
+    display: 'grid',
+    gridTemplateColumns: '9rem minmax(0, 1fr)',
+    alignItems: 'baseline',
+    gap: `${tokens.spacingVerticalL} ${tokens.spacingHorizontalXL}`,
+    margin: 0,
+    fontSize: tokens.fontSizeBase300,
+    lineHeight: tokens.lineHeightBase300,
+    [NARROW_VIEWPORT_QUERY]: {
+      gridTemplateColumns: 'minmax(0, 1fr)',
+      rowGap: tokens.spacingVerticalXS,
+    },
+  },
+  primaryLabel: {
+    margin: 0,
+    color: tokens.colorNeutralForeground1,
+  },
+  secondaryLabel: {
+    margin: 0,
+    color: tokens.colorNeutralForeground3,
+  },
+  value: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'flex-start',
+    gap: tokens.spacingVerticalS,
+    minWidth: 0,
+    margin: 0,
+    overflowWrap: 'anywhere',
+    [NARROW_VIEWPORT_QUERY]: {
+      paddingBottom: tokens.spacingVerticalM,
+    },
+  },
+})
diff --git a/frontend/src/components/DetailFacts.test.tsx b/frontend/src/components/DetailFacts.test.tsx
new file mode 100644
index 0000000000..e03d2d14b9
--- /dev/null
+++ b/frontend/src/components/DetailFacts.test.tsx
@@ -0,0 +1,28 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, Text, webLightTheme } from '@fluentui/react-components'
+import { render, screen, within } from '@testing-library/react'
+
+import DetailFacts, { DetailFact } from './DetailFacts'
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('DetailFacts', () => {
+  it('should pair each label with its value in a named description list', () => {
+    render(<TestWrapper>
+      <DetailFacts label="Attack outcome">
+        <DetailFact label="Objective:" tone="primary">Extract the system prompt</DetailFact>
+        <DetailFact label="Technique"><Text>Crescendo</Text></DetailFact>
+      </DetailFacts>
+    </TestWrapper>)
+
+    const list = screen.getByLabelText('Attack outcome')
+    expect(list.tagName).toBe('DL')
+    expect(within(list).getAllByRole('term').map((term) => term.textContent)).toEqual(['Objective:', 'Technique'])
+    expect(within(list).getAllByRole('definition').map((value) => value.textContent)).toEqual([
+      'Extract the system prompt', 'Crescendo',
+    ])
+  })
+})
diff --git a/frontend/src/components/DetailFacts.tsx b/frontend/src/components/DetailFacts.tsx
new file mode 100644
index 0000000000..91bb5c2b9d
--- /dev/null
+++ b/frontend/src/components/DetailFacts.tsx
@@ -0,0 +1,39 @@
+import type { ReactNode } from 'react'
+
+import { Text, mergeClasses } from '@fluentui/react-components'
+
+import { useDetailFactsStyles } from './DetailFacts.styles'
+
+interface DetailFactsProps {
+  /** Accessible name of the list, when its heading is not visible. */
+  readonly label?: string
+  readonly className?: string
+  readonly children: ReactNode
+}
+
+/** An aligned label/value list that stacks labels above values on narrow viewports. */
+export default function DetailFacts({ label, className, children }: DetailFactsProps) {
+  const styles = useDetailFactsStyles()
+  return <dl aria-label={label} className={mergeClasses(styles.facts, className)}>{children}</dl>
+}
+
+interface DetailFactProps {
+  readonly label: string
+  /** Primary facts are the subject of the list; secondary facts describe it. */
+  readonly tone?: 'primary' | 'secondary'
+  readonly valueClassName?: string
+  readonly children: ReactNode
+}
+
+// Fluent Text's `as` does not accept dt/dd, so the native elements wrap Text.
+export function DetailFact({ label, tone = 'secondary', valueClassName, children }: DetailFactProps) {
+  const styles = useDetailFactsStyles()
+  return (
+    <>
+      <dt className={tone === 'primary' ? styles.primaryLabel : styles.secondaryLabel}>
+        <Text weight={tone === 'primary' ? 'semibold' : 'regular'}>{label}</Text>
+      </dt>
+      <dd className={mergeClasses(styles.value, valueClassName)}>{children}</dd>
+    </>
+  )
+}
diff --git a/frontend/src/components/Home/Home.tsx b/frontend/src/components/Home/Home.tsx
index 3b7b9daf0c..a645952097 100644
--- a/frontend/src/components/Home/Home.tsx
+++ b/frontend/src/components/Home/Home.tsx
@@ -2,7 +2,6 @@ import { useEffect, useState } from 'react'
 import type { ReactNode } from 'react'
 import { useNavigate } from 'react-router'
 import {
-  Badge,
   Button,
   MessageBar,
   MessageBarBody,
@@ -11,7 +10,6 @@ import {
   TabList,
   Text,
 } from '@fluentui/react-components'
-import type { BadgeProps } from '@fluentui/react-components'
 import {
   AddRegular,
   ArrowRightRegular,
@@ -24,26 +22,19 @@ import {
 } from '@fluentui/react-icons'
 
 import OutcomeBadge from '@/components/OutcomeBadge'
+import ScanStatusBadge from '@/components/ScanStatusBadge'
 import type { ViewName } from '@/components/Sidebar/Navigation'
 import { useRuntime } from '@/hooks/useRuntime'
 import { useAutoRefresh } from '@/hooks/useAutoRefresh'
 import { attacksApi, operationsApi, scenariosApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
-import type { AttackSummary, Operation, OperationListItem, ScenarioRunListItem, ScenarioRunState } from '@/types'
+import type { AttackSummary, Operation, OperationListItem, ScenarioRunListItem } from '@/types'
 import { scenarioRunRoutePath } from '@/utils/routeParams'
 
 import { useHomeStyles } from './Home.styles'
 
 const RECENT_WORK_LIMIT = 5
 const VISIBLE_OPERATIONS_LIMIT = 3
-const SCAN_STATUS_LABELS: Record<ScenarioRunState, string> = {
-  CREATED: 'Created', QUEUED: 'Queued', IN_PROGRESS: 'Executing',
-  COMPLETED: 'Completed', FAILED: 'Failed', CANCELLED: 'Cancelled',
-}
-const SCAN_STATUS_COLORS: Record<ScenarioRunState, BadgeProps['color']> = {
-  CREATED: 'informative', QUEUED: 'informative', IN_PROGRESS: 'brand',
-  COMPLETED: 'success', FAILED: 'danger', CANCELLED: 'warning',
-}
 
 interface HomeProps {
   readonly selectedOperation: Operation | null
@@ -165,7 +156,7 @@ export default function Home({
       title: scan.scenario_registry_name || scan.scenario_name,
       operationName: scan.operation_name,
       updatedAt: scan.updated_at,
-      badge: <Badge appearance="tint" color={SCAN_STATUS_COLORS[scan.status]}>{SCAN_STATUS_LABELS[scan.status]}</Badge>,
+      badge: <ScanStatusBadge status={scan.status} />,
       open: () => { void navigate(scenarioRunRoutePath(scan.scenario_result_id)) },
     })),
   ].filter((item: RecentItem) => filter === 'all' || (filter === 'attacks' ? item.kind === 'Attack' : item.kind === 'Scan'))
diff --git a/frontend/src/components/Operations/OperationParentLink.styles.ts b/frontend/src/components/Operations/OperationParentLink.styles.ts
new file mode 100644
index 0000000000..dcc2326b29
--- /dev/null
+++ b/frontend/src/components/Operations/OperationParentLink.styles.ts
@@ -0,0 +1,32 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import { mobileTouchTargetHeight } from '@/styles/touchTargets'
+
+export const useOperationParentLinkStyles = makeStyles({
+  link: {
+    ...mobileTouchTargetHeight,
+    display: 'inline-flex',
+    alignItems: 'center',
+    alignSelf: 'flex-start',
+    gap: tokens.spacingHorizontalXS,
+    maxWidth: '100%',
+    color: tokens.colorNeutralForeground2,
+    fontSize: tokens.fontSizeBase200,
+    lineHeight: tokens.lineHeightBase200,
+    fontWeight: tokens.fontWeightSemibold,
+    textDecorationLine: 'none',
+    overflowWrap: 'anywhere',
+    ':hover': {
+      color: tokens.colorBrandForegroundLinkHover,
+      textDecorationLine: 'underline',
+    },
+    ':focus-visible': {
+      outline: `${tokens.strokeWidthThick} solid ${tokens.colorStrokeFocus2}`,
+      borderRadius: tokens.borderRadiusSmall,
+    },
+  },
+  icon: {
+    flexShrink: 0,
+    fontSize: tokens.fontSizeBase400,
+  },
+})
diff --git a/frontend/src/components/Operations/OperationParentLink.test.tsx b/frontend/src/components/Operations/OperationParentLink.test.tsx
new file mode 100644
index 0000000000..ff88704f72
--- /dev/null
+++ b/frontend/src/components/Operations/OperationParentLink.test.tsx
@@ -0,0 +1,30 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import { MemoryRouter } from 'react-router'
+
+import OperationParentLink from './OperationParentLink'
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}><MemoryRouter>{children}</MemoryRouter></FluentProvider>
+}
+
+describe('OperationParentLink', () => {
+  it('should link to the operation by name', () => {
+    render(<TestWrapper><OperationParentLink id="operation/1" name="Spring review" /></TestWrapper>)
+    const link = screen.getByRole('link', { name: 'Operation: Spring review' })
+    expect(link).toHaveAttribute('href', '/operations/operation%2F1')
+    expect(link).toHaveTextContent('Spring review')
+  })
+
+  it('should still link when the operation name is unknown', () => {
+    render(<TestWrapper><OperationParentLink id="operation-1" name={null} /></TestWrapper>)
+    expect(screen.getByRole('link', { name: 'Operation: View operation' })).toHaveAttribute('href', '/operations/operation-1')
+  })
+
+  it.each([undefined, null, ''])('should render nothing without an operation id (%p)', (id: string | null | undefined) => {
+    render(<TestWrapper><OperationParentLink id={id} name="Spring review" /></TestWrapper>)
+    expect(screen.queryByRole('link')).not.toBeInTheDocument()
+  })
+})
diff --git a/frontend/src/components/Operations/OperationParentLink.tsx b/frontend/src/components/Operations/OperationParentLink.tsx
new file mode 100644
index 0000000000..a70d8958d7
--- /dev/null
+++ b/frontend/src/components/Operations/OperationParentLink.tsx
@@ -0,0 +1,22 @@
+import { BriefcaseRegular } from '@fluentui/react-icons'
+import { Link } from 'react-router'
+
+import { useOperationParentLinkStyles } from './OperationParentLink.styles'
+
+interface OperationParentLinkProps {
+  readonly id?: string | null
+  readonly name?: string | null
+}
+
+/** The Operation an item belongs to, shown as small parent context above its title. */
+export default function OperationParentLink({ id, name }: OperationParentLinkProps) {
+  const styles = useOperationParentLinkStyles()
+  if (!id) return null
+  const label = name || 'View operation'
+  return (
+    <Link className={styles.link} to={`/operations/${encodeURIComponent(id)}`} aria-label={`Operation: ${label}`}>
+      <BriefcaseRegular className={styles.icon} aria-hidden="true" />
+      {label}
+    </Link>
+  )
+}
diff --git a/frontend/src/components/OutcomeBadge.styles.ts b/frontend/src/components/OutcomeBadge.styles.ts
index 361965fdb5..291afbbadb 100644
--- a/frontend/src/components/OutcomeBadge.styles.ts
+++ b/frontend/src/components/OutcomeBadge.styles.ts
@@ -1,6 +1,7 @@
 import { makeStyles, shorthands, tokens } from '@fluentui/react-components'
 
 import { OUTCOME_PALETTE } from '@/styles/outcomePalette'
+import { mobileTouchTargetHeight } from '@/styles/touchTargets'
 
 export const useOutcomeBadgeStyles = makeStyles({
   success: {
@@ -19,6 +20,14 @@ export const useOutcomeBadgeStyles = makeStyles({
     '--pyrit-outcome-color': OUTCOME_PALETTE.undetermined.color,
     '--pyrit-outcome-tint': OUTCOME_PALETTE.undetermined.tint,
   },
+  in_progress: {
+    '--pyrit-outcome-color': tokens.colorBrandForeground1,
+    '--pyrit-outcome-tint': tokens.colorBrandBackground2,
+  },
+  preparing: {
+    '--pyrit-outcome-color': tokens.colorNeutralForeground2,
+    '--pyrit-outcome-tint': tokens.colorNeutralBackground3,
+  },
   filled: {
     backgroundColor: 'var(--pyrit-outcome-color)',
     ...shorthands.borderColor('var(--pyrit-outcome-color)'),
@@ -44,4 +53,10 @@ export const useOutcomeBadgeStyles = makeStyles({
     flexShrink: 0,
     color: 'var(--pyrit-outcome-color)',
   },
+  scoreTrigger: {
+    ...mobileTouchTargetHeight,
+    minWidth: 0,
+    minHeight: 0,
+    padding: 0,
+  },
 })
diff --git a/frontend/src/components/OutcomeBadge.test.tsx b/frontend/src/components/OutcomeBadge.test.tsx
index 7d35ef8ca1..3a56b1f7f0 100644
--- a/frontend/src/components/OutcomeBadge.test.tsx
+++ b/frontend/src/components/OutcomeBadge.test.tsx
@@ -2,8 +2,9 @@ import type { ReactNode } from 'react'
 
 import { FluentProvider, webLightTheme } from '@fluentui/react-components'
 import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
 
-import type { AttackOutcome } from '@/types'
+import type { AttackDisplayOutcome, AttackOutcome } from '@/types'
 
 import OutcomeBadge, { OutcomeIcon } from './OutcomeBadge'
 
@@ -36,9 +37,78 @@ describe('OutcomeBadge', () => {
     expect(screen.getByTestId('verdict')).toHaveTextContent('No')
     expect(screen.getByTestId('verdict')).toHaveClass('custom')
   })
+
+  it.each<[AttackDisplayOutcome, 'outcome' | 'success', string]>([
+    ['success', 'success', 'True'],
+    ['failure', 'success', 'False'],
+    ['error', 'success', 'Error'],
+    ['success', 'outcome', 'Success'],
+    ['undetermined', 'outcome', 'Undetermined'],
+    ['in_progress', 'success', 'In progress'],
+    ['preparing', 'outcome', 'Preparing'],
+  ])('labels %s in %s style as %s', (outcome: AttackDisplayOutcome, labelStyle: 'outcome' | 'success', label: string) => {
+    render(<TestWrapper><OutcomeBadge outcome={outcome} labelStyle={labelStyle} testId="verdict" /></TestWrapper>)
+    expect(screen.getByTestId('verdict')).toHaveTextContent(label)
+  })
+
+  it('stays a plain badge without a score', () => {
+    render(<TestWrapper><OutcomeBadge outcome="success" /></TestWrapper>)
+    expect(screen.queryByRole('button')).not.toBeInTheDocument()
+  })
+
+  it('opens the score behind the outcome from the badge', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <OutcomeBadge outcome="success" labelStyle="success" scoreButtonLabel="View score for First objective" score={{
+        scorer: 'objective', scoreType: 'true_false', value: 'true', rationale: 'The objective was met.', isObjective: true,
+      }} />
+    </TestWrapper>)
+    await user.click(screen.getByRole('button', { name: 'True: View score for First objective' }))
+    expect(await screen.findByText('Score details')).toBeInTheDocument()
+    expect(screen.getByText('The objective was met.')).toBeInTheDocument()
+  })
+
+  it('explains a missing score in the popover', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper>
+      <OutcomeBadge outcome="error" score={null} scoreFallback="The attack ended before a score was saved." />
+    </TestWrapper>)
+    await user.click(screen.getByRole('button', { name: 'error: View score' }))
+    expect(await screen.findByText('The attack ended before a score was saved.')).toBeInTheDocument()
+  })
+
+  it.each<[AttackDisplayOutcome | null | undefined, string]>([
+    ['success', 'Success'],
+    ['failure', 'Failure'],
+    ['error', 'Error'],
+    ['undetermined', 'Undetermined'],
+    ['in_progress', 'In progress'],
+    ['preparing', 'Preparing'],
+    [null, 'Undetermined'],
+    [undefined, 'Undetermined'],
+  ])('keeps the displayed %s outcome in the score action name', (
+    outcome: AttackDisplayOutcome | null | undefined, label: string,
+  ) => {
+    render(<TestWrapper>
+      <OutcomeBadge outcome={outcome} labelStyle="outcome" scoreFallback="No score saved." />
+    </TestWrapper>)
+    expect(screen.getByRole('button', { name: `${label}: View score`, exact: true })).toHaveTextContent(label)
+  })
+
+  it('keeps a custom displayed outcome in the score action name', () => {
+    render(<TestWrapper>
+      <OutcomeBadge outcome="failure" label="Not achieved" scoreFallback="No score saved." />
+    </TestWrapper>)
+    expect(screen.getByRole('button', { name: 'Not achieved: View score', exact: true })).toHaveTextContent('Not achieved')
+  })
 })
 
 describe('OutcomeIcon', () => {
+  it('names a pending outcome in words', () => {
+    render(<TestWrapper><OutcomeIcon outcome="in_progress" /></TestWrapper>)
+    expect(screen.getByRole('img', { name: 'in progress' })).toBeVisible()
+  })
+
   it.each<AttackOutcome>(['success', 'failure', 'error', 'undetermined'])(
     'provides a non-color label for the %s icon',
     (outcome: AttackOutcome) => {
diff --git a/frontend/src/components/OutcomeBadge.tsx b/frontend/src/components/OutcomeBadge.tsx
index 33199b74e2..e2585aacd4 100644
--- a/frontend/src/components/OutcomeBadge.tsx
+++ b/frontend/src/components/OutcomeBadge.tsx
@@ -1,43 +1,78 @@
 import type { ReactElement } from 'react'
 
-import { Badge, mergeClasses } from '@fluentui/react-components'
+import { Badge, Button, Popover, PopoverSurface, PopoverTrigger, Text, mergeClasses } from '@fluentui/react-components'
 import type { BadgeProps } from '@fluentui/react-components'
 import {
+  ArrowSyncCircleRegular,
   CheckmarkCircleRegular,
+  ClockRegular,
   DismissCircleRegular,
   ErrorCircleRegular,
   QuestionCircleRegular,
 } from '@fluentui/react-icons'
 
-import type { AttackOutcome } from '@/types'
+import { formatAttackOutcome, formatAttackSuccess } from '@/components/AttackResults/attackAttemptFormatting'
+import ScoreDetails from '@/components/Chat/ScoreDetails'
+import type { AttackDisplayOutcome, ScoreSummary } from '@/types'
 
 import { useOutcomeBadgeStyles } from './OutcomeBadge.styles'
 
-const OUTCOME_ICONS: Record<AttackOutcome, ReactElement> = {
+const OUTCOME_ICONS: Record<AttackDisplayOutcome, ReactElement> = {
   success: <CheckmarkCircleRegular />,
   failure: <DismissCircleRegular />,
   error: <ErrorCircleRegular />,
   undetermined: <QuestionCircleRegular />,
+  in_progress: <ArrowSyncCircleRegular />,
+  preparing: <ClockRegular />,
+}
+
+const PENDING_OUTCOME_LABELS = {
+  in_progress: 'In progress',
+  preparing: 'Preparing',
+} as const
+
+/**
+ * How a saved outcome is worded: `outcome` capitalizes it ("Success"), `success`
+ * answers "Attack success?" ("True"/"False"). Omitted keeps the raw outcome word.
+ */
+type OutcomeLabelStyle = 'outcome' | 'success'
+
+function outcomeLabel(outcome: AttackDisplayOutcome, labelStyle: OutcomeLabelStyle | undefined): string {
+  if (outcome === 'in_progress' || outcome === 'preparing') return PENDING_OUTCOME_LABELS[outcome]
+  if (labelStyle === 'success') return formatAttackSuccess(outcome)
+  if (labelStyle === 'outcome') return formatAttackOutcome(outcome)
+  return outcome
 }
 
 interface OutcomeBadgeProps {
-  readonly outcome?: AttackOutcome | null
+  readonly outcome?: AttackDisplayOutcome | null
   readonly testId?: string
   readonly className?: string
   readonly appearance?: BadgeProps['appearance']
   readonly size?: BadgeProps['size']
   readonly label?: string
+  readonly labelStyle?: OutcomeLabelStyle
+  /** Opens the score behind the outcome from the badge. */
+  readonly score?: ScoreSummary | null
+  /** Shown in the score popover when no score was saved; also enables the popover without a score. */
+  readonly scoreFallback?: string
+  /** Score action label, combined with the displayed outcome in the button's accessible name. */
+  readonly scoreButtonLabel?: string
 }
 
 interface OutcomeIconProps {
-  readonly outcome?: AttackOutcome | null
+  readonly outcome?: AttackDisplayOutcome | null
 }
 
 export function OutcomeIcon({ outcome }: OutcomeIconProps) {
   const styles = useOutcomeBadgeStyles()
   const normalizedOutcome = outcome ?? 'undetermined'
   return (
-    <span className={mergeClasses(styles.icon, styles[normalizedOutcome])} role="img" aria-label={normalizedOutcome}>
+    <span
+      className={mergeClasses(styles.icon, styles[normalizedOutcome])}
+      role="img"
+      aria-label={normalizedOutcome.replace('_', ' ')}
+    >
       {OUTCOME_ICONS[normalizedOutcome]}
     </span>
   )
@@ -50,11 +85,16 @@ export default function OutcomeBadge({
   appearance = 'filled',
   size,
   label,
+  labelStyle,
+  score,
+  scoreFallback,
+  scoreButtonLabel = 'View score',
 }: OutcomeBadgeProps) {
   const styles = useOutcomeBadgeStyles()
   const normalizedOutcome = outcome ?? 'undetermined'
+  const displayLabel = label ?? outcomeLabel(normalizedOutcome, labelStyle)
 
-  return (
+  const badge = (
     <Badge
       appearance={appearance}
       icon={OUTCOME_ICONS[normalizedOutcome]}
@@ -62,7 +102,21 @@ export default function OutcomeBadge({
       className={mergeClasses(styles[normalizedOutcome], styles[appearance], className)}
       data-testid={testId}
     >
-      {label ?? normalizedOutcome}
+      {displayLabel}
     </Badge>
   )
+  if (!score && !scoreFallback) return badge
+
+  return (
+    <Popover withArrow>
+      <PopoverTrigger disableButtonEnhancement>
+        <Button appearance="transparent" className={styles.scoreTrigger} aria-label={`${displayLabel}: ${scoreButtonLabel}`}>
+          {badge}
+        </Button>
+      </PopoverTrigger>
+      <PopoverSurface>
+        {score ? <ScoreDetails score={score} /> : <Text>{scoreFallback}</Text>}
+      </PopoverSurface>
+    </Popover>
+  )
 }
diff --git a/frontend/src/components/Registry/IdentityDisclosure.styles.ts b/frontend/src/components/Registry/IdentityDisclosure.styles.ts
new file mode 100644
index 0000000000..8b72d628d7
--- /dev/null
+++ b/frontend/src/components/Registry/IdentityDisclosure.styles.ts
@@ -0,0 +1,44 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import { mobileTouchTargetHeight } from '@/styles/touchTargets'
+
+export const useIdentityDisclosureStyles = makeStyles({
+  toggle: {
+    ...mobileTouchTargetHeight,
+    justifyContent: 'flex-start',
+    textAlign: 'left',
+    overflowWrap: 'anywhere',
+    fontFamily: tokens.fontFamilyBase,
+    fontSize: tokens.fontSizeBase300,
+    fontWeight: tokens.fontWeightRegular,
+    lineHeight: tokens.lineHeightBase300,
+  },
+  inlineToggle: {
+    minWidth: 0,
+    minHeight: 0,
+    padding: 0,
+    color: tokens.colorNeutralForeground1,
+  },
+  details: {
+    paddingBlock: tokens.spacingVerticalM,
+  },
+  json: {
+    margin: 0,
+    padding: `${tokens.spacingVerticalM} ${tokens.spacingHorizontalM}`,
+    backgroundColor: tokens.colorNeutralBackground2,
+    fontFamily: tokens.fontFamilyMonospace,
+    fontSize: tokens.fontSizeBase200,
+    lineHeight: tokens.lineHeightBase200,
+    whiteSpace: 'pre-wrap',
+    overflowWrap: 'anywhere',
+  },
+  disclosure: {
+    display: 'flex',
+    flexDirection: 'column',
+    alignItems: 'flex-start',
+    minWidth: 0,
+  },
+  inlineDetails: {
+    alignSelf: 'stretch',
+  },
+})
diff --git a/frontend/src/components/Registry/IdentityDisclosure.test.tsx b/frontend/src/components/Registry/IdentityDisclosure.test.tsx
new file mode 100644
index 0000000000..1c2a7f1485
--- /dev/null
+++ b/frontend/src/components/Registry/IdentityDisclosure.test.tsx
@@ -0,0 +1,55 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+import userEvent from '@testing-library/user-event'
+
+import IdentityDisclosure from './IdentityDisclosure'
+
+const IDENTITY = { class_name: 'Crescendo', parameters: { max_turns: 5 } }
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('IdentityDisclosure', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('should reveal and hide the identity JSON from the name', async () => {
+    const user = userEvent.setup()
+    render(<TestWrapper><IdentityDisclosure name="Crescendo" identity={IDENTITY} /></TestWrapper>)
+
+    const toggle = screen.getByRole('button', { name: 'Identity for Crescendo' })
+    expect(toggle).toHaveTextContent('Crescendo')
+    expect(toggle).toHaveAttribute('aria-expanded', 'false')
+    expect(screen.queryByRole('region')).not.toBeInTheDocument()
+
+    await user.click(toggle)
+    const details = screen.getByRole('region', { name: 'Identity for Crescendo' })
+    expect(toggle).toHaveAttribute('aria-expanded', 'true')
+    expect(toggle).toHaveAttribute('aria-controls', details.id)
+    expect(JSON.parse(details.textContent ?? '')).toEqual(IDENTITY)
+
+    await user.click(toggle)
+    expect(screen.queryByRole('region')).not.toBeInTheDocument()
+    expect(toggle).toHaveFocus()
+  })
+
+  it.each([null, undefined])('should show only the name without an identity (%p)', (identity: null | undefined) => {
+    render(<TestWrapper><IdentityDisclosure name="Not recorded" identity={identity} /></TestWrapper>)
+    expect(screen.getByText('Not recorded')).toBeInTheDocument()
+    expect(screen.queryByRole('button')).not.toBeInTheDocument()
+  })
+
+  it('should not trigger an enclosing row when toggled', async () => {
+    const user = userEvent.setup()
+    const onRowClick = jest.fn()
+    render(<TestWrapper>
+      <div onClick={onRowClick}><IdentityDisclosure name="Crescendo" identity={IDENTITY} /></div>
+    </TestWrapper>)
+    await user.click(screen.getByRole('button', { name: 'Identity for Crescendo' }))
+    expect(onRowClick).not.toHaveBeenCalled()
+  })
+})
diff --git a/frontend/src/components/Registry/IdentityDisclosure.tsx b/frontend/src/components/Registry/IdentityDisclosure.tsx
new file mode 100644
index 0000000000..e29ac1709f
--- /dev/null
+++ b/frontend/src/components/Registry/IdentityDisclosure.tsx
@@ -0,0 +1,80 @@
+import { useCallback, useId, useState, type MouseEvent } from 'react'
+
+import { Button, Text, mergeClasses } from '@fluentui/react-components'
+import { ChevronDownRegular, ChevronRightRegular } from '@fluentui/react-icons'
+
+import { useIdentityDisclosureStyles } from './IdentityDisclosure.styles'
+
+interface IdentityDisclosureButtonProps {
+  readonly name: string
+  readonly expanded: boolean
+  readonly controlsId: string
+  readonly onToggle: () => void
+  readonly chevronPosition?: 'before' | 'after'
+  readonly className?: string
+}
+
+/** The component name that reveals its saved identity JSON. */
+export function IdentityDisclosureButton({
+  name, expanded, controlsId, onToggle, chevronPosition = 'before', className,
+}: IdentityDisclosureButtonProps) {
+  const styles = useIdentityDisclosureStyles()
+  return (
+    <Button
+      appearance="transparent"
+      className={mergeClasses(styles.toggle, className)}
+      icon={expanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
+      iconPosition={chevronPosition}
+      aria-expanded={expanded}
+      aria-controls={controlsId}
+      aria-label={`Identity for ${name}`}
+      onClick={(event: MouseEvent<HTMLButtonElement>) => {
+        // Disclosures sit inside clickable rows; toggling must not also open the row.
+        event.stopPropagation()
+        onToggle()
+      }}
+    >
+      {name}
+    </Button>
+  )
+}
+
+interface IdentityJsonProps {
+  readonly id: string
+  readonly name: string
+  readonly identity: object
+  readonly className?: string
+}
+
+/** The saved identity JSON, scrolled into view when it is revealed. */
+export function IdentityJson({ id, name, identity, className }: IdentityJsonProps) {
+  const styles = useIdentityDisclosureStyles()
+  const reveal = useCallback((element: HTMLDivElement | null): void => {
+    element?.scrollIntoView({ block: 'nearest', inline: 'start' })
+  }, [])
+  return (
+    <div ref={reveal} id={id} role="region" aria-label={`Identity for ${name}`} className={mergeClasses(styles.details, className)}>
+      <pre className={styles.json}>{JSON.stringify(identity, null, 2)}</pre>
+    </div>
+  )
+}
+
+interface IdentityDisclosureProps {
+  readonly name: string
+  readonly identity?: object | null
+}
+
+/** A component name with a trailing chevron that expands its identity JSON in place; plain text without one. */
+export default function IdentityDisclosure({ name, identity }: IdentityDisclosureProps) {
+  const styles = useIdentityDisclosureStyles()
+  const detailsId = useId()
+  const [expanded, setExpanded] = useState(false)
+  if (!identity) return <Text>{name}</Text>
+  return (
+    <div className={styles.disclosure}>
+      <IdentityDisclosureButton name={name} expanded={expanded} controlsId={detailsId} chevronPosition="after"
+        className={styles.inlineToggle} onToggle={() => { setExpanded((current: boolean) => !current) }} />
+      {expanded && <IdentityJson id={detailsId} name={name} identity={identity} className={styles.inlineDetails} />}
+    </div>
+  )
+}
diff --git a/frontend/src/components/Registry/RegistryIdentityRow.styles.ts b/frontend/src/components/Registry/RegistryIdentityRow.styles.ts
index 60b13ec1e3..73c7e3415b 100644
--- a/frontend/src/components/Registry/RegistryIdentityRow.styles.ts
+++ b/frontend/src/components/Registry/RegistryIdentityRow.styles.ts
@@ -1,33 +1,10 @@
 import { makeStyles, tokens } from '@fluentui/react-components'
 
-import { mobileTouchTargetHeight } from '@/styles/touchTargets'
-
 export const useRegistryIdentityRowStyles = makeStyles({
   row: {
     backgroundColor: tokens.colorNeutralBackground1,
   },
   name: {
-    ...mobileTouchTargetHeight,
     paddingBlock: tokens.spacingVerticalS,
-    justifyContent: 'flex-start',
-    textAlign: 'left',
-    overflowWrap: 'anywhere',
-    fontFamily: tokens.fontFamilyBase,
-    fontSize: tokens.fontSizeBase300,
-    fontWeight: tokens.fontWeightRegular,
-    lineHeight: tokens.lineHeightBase300,
-  },
-  details: {
-    paddingBlock: tokens.spacingVerticalM,
-  },
-  json: {
-    margin: 0,
-    padding: `${tokens.spacingVerticalM} ${tokens.spacingHorizontalM}`,
-    backgroundColor: tokens.colorNeutralBackground2,
-    fontFamily: tokens.fontFamilyMonospace,
-    fontSize: tokens.fontSizeBase200,
-    lineHeight: tokens.lineHeightBase200,
-    whiteSpace: 'pre-wrap',
-    overflowWrap: 'anywhere',
   },
 })
diff --git a/frontend/src/components/Registry/RegistryIdentityRow.tsx b/frontend/src/components/Registry/RegistryIdentityRow.tsx
index 06bcf23bf8..5811f452cb 100644
--- a/frontend/src/components/Registry/RegistryIdentityRow.tsx
+++ b/frontend/src/components/Registry/RegistryIdentityRow.tsx
@@ -1,8 +1,8 @@
-import { useCallback, useId, type MouseEvent, type ReactNode } from 'react'
+import { useId, type ReactNode } from 'react'
 
-import { Button, TableCell, TableRow, Text, mergeClasses, type TableRowProps } from '@fluentui/react-components'
-import { ChevronDownRegular, ChevronRightRegular } from '@fluentui/react-icons'
+import { TableCell, TableRow, Text, mergeClasses, type TableRowProps } from '@fluentui/react-components'
 
+import { IdentityDisclosureButton, IdentityJson } from './IdentityDisclosure'
 import { useRegistryIdentityRowStyles } from './RegistryIdentityRow.styles'
 
 interface RegistryIdentityRowProps {
@@ -27,33 +27,21 @@ export default function RegistryIdentityRow({
 }: RegistryIdentityRowProps) {
   const styles = useRegistryIdentityRowStyles()
   const detailsId = useId()
-  const revealDetails = useCallback((element: HTMLDivElement | null): void => {
-    element?.scrollIntoView({ block: 'nearest', inline: 'start' })
-  }, [])
 
   return (
     <>
       <TableRow {...rowProps} className={mergeClasses(styles.row, rowClassName)} data-testid={rowTestId}>
         {leadingCell}
         <TableCell className={nameCellClassName}>
-          {identity ? <Button appearance="transparent" className={styles.name}
-            icon={expanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
-            aria-expanded={expanded} aria-controls={detailsId}
-            aria-label={`Identity for ${name}`} onClick={(event: MouseEvent<HTMLButtonElement>) => {
-              event.stopPropagation()
-              onToggle()
-            }}>
-            {name}
-          </Button> : <Text size={200}>{name}</Text>}
+          {identity ? <IdentityDisclosureButton name={name} expanded={expanded} controlsId={detailsId}
+            className={styles.name} onToggle={onToggle} /> : <Text size={200}>{name}</Text>}
           {nameContent}
         </TableCell>
         {children}
       </TableRow>
       {expanded && identity && <TableRow className={styles.row}>
         <TableCell colSpan={columns}>
-          <div ref={revealDetails} id={detailsId} role="region" aria-label={`Identity for ${name}`} className={styles.details}>
-            <pre className={styles.json}>{JSON.stringify(identity, null, 2)}</pre>
-          </div>
+          <IdentityJson id={detailsId} name={name} identity={identity} />
         </TableCell>
       </TableRow>}
       {additionalRows}
diff --git a/frontend/src/components/ScanStatusBadge.test.tsx b/frontend/src/components/ScanStatusBadge.test.tsx
new file mode 100644
index 0000000000..8fdc13542d
--- /dev/null
+++ b/frontend/src/components/ScanStatusBadge.test.tsx
@@ -0,0 +1,42 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+
+import ScanStatusBadge from './ScanStatusBadge'
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('ScanStatusBadge', () => {
+  it.each([
+    ['CREATED', 'Created'],
+    ['QUEUED', 'Queued'],
+    ['IN_PROGRESS', 'Executing'],
+    ['COMPLETED', 'Completed'],
+    ['FAILED', 'Failed'],
+    ['CANCELLED', 'Cancelled'],
+    ['QUEUING', 'Queuing'],
+    ['PENDING', 'Pending'],
+    ['SUBMITTING', 'Submitting'],
+    ['SUBMISSION_FAILED', 'Submission failed'],
+  ] as const)('should label %s as %s', (status, label) => {
+    render(<TestWrapper><ScanStatusBadge status={status} testId="status" /></TestWrapper>)
+    expect(screen.getByTestId('status')).toHaveTextContent(label)
+  })
+
+  it('should let a caller reword the label', () => {
+    render(<TestWrapper><ScanStatusBadge status="IN_PROGRESS" label="In progress" testId="status" /></TestWrapper>)
+    expect(screen.getByTestId('status')).toHaveTextContent('In progress')
+  })
+
+  it('should mark terminal states with an icon only when asked', () => {
+    const view = render(<TestWrapper><ScanStatusBadge status="COMPLETED" testId="status" /></TestWrapper>)
+    expect(screen.getByTestId('status').querySelector('svg')).toBeNull()
+    view.rerender(<TestWrapper><ScanStatusBadge status="COMPLETED" withIcon testId="status" /></TestWrapper>)
+    expect(screen.getByTestId('status').querySelector('svg')).not.toBeNull()
+    view.rerender(<TestWrapper><ScanStatusBadge status="IN_PROGRESS" withIcon testId="status" /></TestWrapper>)
+    expect(screen.getByTestId('status').querySelector('svg')).toBeNull()
+  })
+})
diff --git a/frontend/src/components/ScanStatusBadge.tsx b/frontend/src/components/ScanStatusBadge.tsx
new file mode 100644
index 0000000000..ce703b80b7
--- /dev/null
+++ b/frontend/src/components/ScanStatusBadge.tsx
@@ -0,0 +1,73 @@
+import type { ReactElement } from 'react'
+
+import { Badge } from '@fluentui/react-components'
+import type { BadgeProps } from '@fluentui/react-components'
+import { CheckmarkCircleRegular, DismissCircleRegular, ErrorCircleRegular } from '@fluentui/react-icons'
+
+import type { ScenarioRunState, ScenarioSuiteExecutionEntryState, ScenarioSuiteExecutionStatus } from '@/types'
+
+type ScanStatus = ScenarioRunState | ScenarioSuiteExecutionStatus | ScenarioSuiteExecutionEntryState
+type ScanStatusColor = 'informative' | 'brand' | 'success' | 'danger' | 'warning'
+
+const SCAN_STATUS_COLORS: Record<ScanStatus, ScanStatusColor> = {
+  PENDING: 'informative',
+  SUBMITTING: 'informative',
+  QUEUING: 'informative',
+  CREATED: 'informative',
+  QUEUED: 'informative',
+  IN_PROGRESS: 'brand',
+  COMPLETED: 'success',
+  SUBMISSION_FAILED: 'danger',
+  FAILED: 'danger',
+  CANCELLED: 'warning',
+}
+
+const SCAN_STATUS_LABELS: Record<ScanStatus, string> = {
+  PENDING: 'Pending',
+  SUBMITTING: 'Submitting',
+  QUEUING: 'Queuing',
+  CREATED: 'Created',
+  QUEUED: 'Queued',
+  IN_PROGRESS: 'Executing',
+  COMPLETED: 'Completed',
+  SUBMISSION_FAILED: 'Submission failed',
+  FAILED: 'Failed',
+  CANCELLED: 'Cancelled',
+}
+
+function scanStatusIcon(status: ScanStatus): ReactElement | undefined {
+  if (status === 'COMPLETED') return <CheckmarkCircleRegular />
+  if (status === 'FAILED' || status === 'SUBMISSION_FAILED') return <ErrorCircleRegular />
+  if (status === 'CANCELLED') return <DismissCircleRegular />
+  return undefined
+}
+
+interface ScanStatusBadgeProps {
+  readonly status: ScanStatus
+  readonly appearance?: Extract<BadgeProps['appearance'], 'tint' | 'filled'>
+  /** Mark terminal states with an icon as well as color. */
+  readonly withIcon?: boolean
+  /** Replaces the standard status label, such as a suite's wording for a running entry. */
+  readonly label?: string
+  readonly testId?: string
+}
+
+/** The lifecycle state of a scan, suite, or suite entry, with one color per state everywhere. */
+export default function ScanStatusBadge({
+  status,
+  appearance = 'tint',
+  withIcon = false,
+  label,
+  testId,
+}: ScanStatusBadgeProps) {
+  return (
+    <Badge
+      appearance={appearance}
+      color={SCAN_STATUS_COLORS[status]}
+      icon={withIcon ? scanStatusIcon(status) : undefined}
+      data-testid={testId}
+    >
+      {label ?? SCAN_STATUS_LABELS[status]}
+    </Badge>
+  )
+}
diff --git a/frontend/src/components/ScenarioSuites/ScenarioSuiteExecutionPage.tsx b/frontend/src/components/ScenarioSuites/ScenarioSuiteExecutionPage.tsx
index 8f2121939b..54bf70b5d1 100644
--- a/frontend/src/components/ScenarioSuites/ScenarioSuiteExecutionPage.tsx
+++ b/frontend/src/components/ScenarioSuites/ScenarioSuiteExecutionPage.tsx
@@ -1,7 +1,6 @@
-import { type ReactElement, useState } from 'react'
+import { useState } from 'react'
 
 import {
-  Badge,
   Button,
   Dialog,
   DialogActions,
@@ -24,14 +23,13 @@ import {
 import {
   ArrowLeftRegular,
   ArrowSyncRegular,
-  CheckmarkCircleRegular,
-  DismissCircleRegular,
   ErrorCircleRegular,
   StopRegular,
 } from '@fluentui/react-icons'
 import { Link, useParams } from 'react-router'
 
 import { formatTimestamp } from '@/components/AttackResults/attackAttemptFormatting'
+import ScanStatusBadge from '@/components/ScanStatusBadge'
 import {
   isTerminalSuiteExecutionStatus,
   useScenarioSuiteExecution,
@@ -39,40 +37,12 @@ import {
 import { scenarioSuitesApi } from '@/services/api'
 import { toApiError } from '@/services/errors'
 import type {
-  ScenarioSuiteExecutionEntryState,
   ScenarioSuiteExecutionEntrySummary,
-  ScenarioSuiteExecutionStatus,
 } from '@/types'
 import { routerPathParamValue, scenarioRunRoutePath } from '@/utils/routeParams'
 
 import { useScenarioSuiteExecutionPageStyles } from './ScenarioSuiteExecutionPage.styles'
 
-const EXECUTION_BADGE_COLORS: Record<
-  ScenarioSuiteExecutionStatus,
-  'informative' | 'brand' | 'success' | 'danger' | 'warning'
-> = {
-  QUEUING: 'informative',
-  IN_PROGRESS: 'brand',
-  COMPLETED: 'success',
-  FAILED: 'danger',
-  CANCELLED: 'warning',
-}
-
-const ENTRY_BADGE_COLORS: Record<
-  ScenarioSuiteExecutionEntryState,
-  'informative' | 'brand' | 'success' | 'danger' | 'warning'
-> = {
-  PENDING: 'informative',
-  SUBMITTING: 'informative',
-  SUBMISSION_FAILED: 'danger',
-  CREATED: 'informative',
-  QUEUED: 'informative',
-  IN_PROGRESS: 'brand',
-  COMPLETED: 'success',
-  FAILED: 'danger',
-  CANCELLED: 'warning',
-}
-
 const ENTRY_SUBMISSION_FAILURE_MESSAGE = (
   'The scenario run could not be created. Check server logs before retrying.'
 )
@@ -212,14 +182,13 @@ function ScenarioSuiteExecutionPageContent({
               <Text as="h2" size={700} weight="semibold">
                 {execution.suite_name}
               </Text>
-              <Badge
+              <ScanStatusBadge
+                status={execution.status}
                 appearance="filled"
-                color={EXECUTION_BADGE_COLORS[execution.status]}
-                icon={statusIcon(execution.status)}
-                data-testid="suite-execution-state-badge"
-              >
-                {formatState(execution.status)}
-              </Badge>
+                withIcon
+                label={formatState(execution.status)}
+                testId="suite-execution-state-badge"
+              />
             </div>
             <Text size={200} className={styles.executionId}>
               Suite execution ID: <code>{execution.suite_execution_id}</code>
@@ -312,13 +281,7 @@ function ScenarioSuiteExecutionPageContent({
                       </div>
                     </TableCell>
                     <TableCell>
-                      <Badge
-                        appearance="tint"
-                        color={ENTRY_BADGE_COLORS[entry.state]}
-                        icon={statusIcon(entry.state)}
-                      >
-                        {formatState(entry.state)}
-                      </Badge>
+                      <ScanStatusBadge status={entry.state} withIcon label={formatState(entry.state)} />
                     </TableCell>
                     <TableCell>
                       {entry.run ? (
@@ -420,21 +383,6 @@ function entryErrorMessage(entry: ScenarioSuiteExecutionEntrySummary): string {
     : ENTRY_STATUS_FAILURE_MESSAGE
 }
 
-function statusIcon(
-  status: ScenarioSuiteExecutionStatus | ScenarioSuiteExecutionEntryState,
-): ReactElement | undefined {
-  if (status === 'COMPLETED') {
-    return <CheckmarkCircleRegular />
-  }
-  if (status === 'FAILED' || status === 'SUBMISSION_FAILED') {
-    return <ErrorCircleRegular />
-  }
-  if (status === 'CANCELLED') {
-    return <DismissCircleRegular />
-  }
-  return undefined
-}
-
 function formatState(status: string): string {
   return status.toLowerCase().replace(/_/g, ' ').replace(
     /^\w/,
diff --git a/frontend/src/components/Scenarios/AtomicAttackGroupsSection.tsx b/frontend/src/components/Scenarios/AtomicAttackGroupsSection.tsx
new file mode 100644
index 0000000000..1bc2f186c8
--- /dev/null
+++ b/frontend/src/components/Scenarios/AtomicAttackGroupsSection.tsx
@@ -0,0 +1,177 @@
+import { useMemo, useState, type Ref } from 'react'
+
+import { Button, Text } from '@fluentui/react-components'
+import { ChevronDownRegular, ChevronRightRegular } from '@fluentui/react-icons'
+
+import type { UseScenarioResultHierarchyResult } from '@/hooks/useScenarioResultHierarchy'
+import type { ScenarioHierarchyNode, ScenarioProgressResult, ScenarioProgressSummary, ScenarioRunState } from '@/types'
+
+import AttackExecutionTable from './AttackExecutionTable'
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+import ScenarioResultHierarchy from './ScenarioResultHierarchy'
+import { hierarchyDisplayGroups } from './scenarioHierarchy'
+
+const MAX_VISIBLE_ATTEMPTS_PER_GROUP = 100
+const AUTO_EXPAND_GROUP_LIMIT = 20
+
+interface AtomicAttackGroupsSectionProps {
+  readonly scenarioResultId: string
+  readonly runStatus: ScenarioRunState
+  readonly summary: ScenarioProgressSummary
+  readonly results: readonly ScenarioProgressResult[]
+  readonly hierarchy: UseScenarioResultHierarchyResult
+  readonly seedObjectives: Map<string, string>
+  readonly onOpenDetails: (attempt: ScenarioProgressResult | ScenarioHierarchyNode, trigger: HTMLElement) => void
+  /** The section toggle, which receives focus when an opened attack is no longer on the page. */
+  readonly toggleRef: Ref<HTMLButtonElement>
+}
+
+/** Every display group's progress, expandable to its attack executions. */
+export default function AtomicAttackGroupsSection({
+  scenarioResultId, runStatus, summary, results, hierarchy, seedObjectives, onOpenDetails, toggleRef,
+}: AtomicAttackGroupsSectionProps) {
+  const styles = useScenarioRunPageStyles()
+  const [sectionExpandedChoice, setSectionExpandedChoice] = useState<boolean | null>(null)
+  const [expandedGroupChoices, setExpandedGroupChoices] = useState<Map<string, boolean>>(new Map())
+  // Attempts are grouped by atomic group id, then truncated per group, so expanding an
+  // older group still shows its own executions rather than an empty table.
+  const attemptsByGroupId = useMemo(() => {
+    const groupedAttempts = new Map<string, ScenarioProgressResult[]>()
+    for (let index = results.length - 1; index >= 0; index -= 1) {
+      const attempt = results[index]
+      if (!attempt) continue
+      const existing = groupedAttempts.get(attempt.atomic_group_id)
+      if (existing) {
+        existing.push(attempt)
+      } else {
+        groupedAttempts.set(attempt.atomic_group_id, [attempt])
+      }
+    }
+    return groupedAttempts
+  }, [results])
+
+  const displayGroups = hierarchyDisplayGroups(summary.display_groups ?? summary.techniques, hierarchy.roots.groups)
+  const producerCounts = summary.overall.producer_counts
+  const executionCount = producerCounts
+    ? producerCounts.target_facing.attempts + producerCounts.orchestration.attempts + producerCounts.unknown.attempts
+    : results.length
+  const defaultExpanded = displayGroups.length <= AUTO_EXPAND_GROUP_LIMIT
+  const sectionExpanded = sectionExpandedChoice ?? defaultExpanded
+
+  const toggleDisplayGroup = (groupId: string): void => {
+    setExpandedGroupChoices((current) => new Map(current).set(groupId, !(current.get(groupId) ?? defaultExpanded)))
+  }
+
+  return (
+    <section className={styles.section} aria-labelledby="atomic-groups-heading">
+      <div className={styles.sectionHeading}>
+        <div className={styles.objectivesHeading}>
+          <Text as="h2" id="atomic-groups-heading" size={500} weight="semibold">
+            Atomic attack groups
+          </Text>
+          <Button
+            appearance="subtle"
+            className={styles.touchTarget}
+            icon={sectionExpanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
+            aria-expanded={sectionExpanded}
+            aria-controls="atomic-groups-panel"
+            aria-label={`${sectionExpanded ? 'Collapse' : 'Expand'} atomic attack groups`}
+            data-testid="toggle-atomic-groups-btn"
+            ref={toggleRef}
+            onClick={() => setSectionExpandedChoice(!sectionExpanded)}
+          >
+          </Button>
+        </div>
+        <Text className={styles.sectionHint}>
+          {`${displayGroups.length.toLocaleString()} group${displayGroups.length === 1 ? '' : 's'}, ${executionCount.toLocaleString()} ${producerCounts ? '' : 'loaded '}execution${executionCount === 1 ? '' : 's'}`}
+        </Text>
+      </div>
+      <div id="atomic-groups-panel" hidden={!sectionExpanded}>
+        {sectionExpanded && (
+          <ScenarioResultHierarchy hierarchy={hierarchy} runStatus={runStatus}>
+            {displayGroups.length === 0 ? (
+              <Text className={styles.sectionHint}>No atomic attack groups have been persisted yet.</Text>
+            ) : (
+              <div className={styles.displayGroupList}>
+                {displayGroups.map((group) => {
+                  const attempts = (group.atomic_group_ids ?? [])
+                    .flatMap((atomicGroupId) => attemptsByGroupId.get(atomicGroupId) ?? [])
+                    .sort((left, right) => Date.parse(right.timestamp) - Date.parse(left.timestamp))
+                  const expanded = expandedGroupChoices.get(group.id) ?? defaultExpanded
+                  const panelId = `atomic-group-${group.id.replace(/[^a-zA-Z0-9_-]/g, '-')}`
+                  return (
+                    <article key={group.id} className={styles.displayGroup}>
+                      <div className={styles.displayGroupSummary}>
+                        <Button
+                          appearance="subtle"
+                          className={styles.expandButton}
+                          icon={expanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
+                          aria-expanded={expanded}
+                          aria-controls={panelId}
+                          aria-label={`${expanded ? 'Collapse' : 'Expand'} attacks in ${group.display_group}`}
+                          onClick={() => toggleDisplayGroup(group.id)}
+                        />
+                        <span className={styles.displayGroupIdentity}>
+                          <Text size={400} weight="semibold">{group.display_group}</Text>
+                          <Text size={200} className={styles.sectionHint}>
+                            {group.atomic_attack_names.join(', ')}
+                          </Text>
+                        </span>
+                        <span className={styles.displayGroupMetrics}>
+                          <DisplayGroupMetric label="Completed" value={formatCompletion(group.completed, group.planned)} />
+                          <DisplayGroupMetric
+                            label="Attack success"
+                            value={formatSuccess(group.succeeded, group.completed, group.success_percentage)}
+                          />
+                          <DisplayGroupMetric label="Errors" value={String(group.errors)} />
+                          <DisplayGroupMetric label="Retries" value={String(group.retries)} />
+                        </span>
+                      </div>
+                      {expanded && (
+                        <div id={panelId} className={styles.displayGroupPanel} aria-label={`${group.display_group} attack executions`}>
+                          <AttackExecutionTable
+                            scenarioResultId={scenarioResultId}
+                            label={`${group.display_group} attack results`}
+                            attempts={attempts.slice(0, MAX_VISIBLE_ATTEMPTS_PER_GROUP)}
+                            totalAttempts={attempts.length}
+                            roots={hierarchy.roots.groups
+                              .filter((savedGroup) => group.atomic_group_ids.includes(savedGroup.atomic_group_id))
+                              .flatMap((savedGroup) => savedGroup.roots)}
+                            hierarchy={hierarchy}
+                            seedObjectives={seedObjectives}
+                            onOpenDetails={onOpenDetails}
+                            showTimestamp={false}
+                            showConversationLink
+                            booleanOutcome
+                          />
+                        </div>
+                      )}
+                    </article>
+                  )
+                })}
+              </div>
+            )}
+          </ScenarioResultHierarchy>
+        )}
+      </div>
+    </section>
+  )
+}
+
+function DisplayGroupMetric({ label, value }: { readonly label: string; readonly value: string }) {
+  return (
+    <div>
+      <Text size={200}>{label}</Text>
+      <Text weight="semibold">{value}</Text>
+    </div>
+  )
+}
+
+function formatCompletion(completed: number, planned: number | null): string {
+  return planned === null ? `${completed}/total unavailable` : `${completed}/${planned}`
+}
+
+function formatSuccess(succeeded: number, completed: number, percentage: number | null): string {
+  if (percentage === null) return completed === 0 ? 'Unavailable' : `${succeeded}/${completed}`
+  return `${percentage}%`
+}
diff --git a/frontend/src/components/Scenarios/AttackActivity.styles.ts b/frontend/src/components/Scenarios/AttackActivity.styles.ts
new file mode 100644
index 0000000000..999c8a8472
--- /dev/null
+++ b/frontend/src/components/Scenarios/AttackActivity.styles.ts
@@ -0,0 +1,41 @@
+import { makeStyles, tokens } from '@fluentui/react-components'
+
+import { NARROW_VIEWPORT_QUERY } from '@/styles/touchTargets'
+
+export const useAttackActivityStyles = makeStyles({
+  root: {
+    display: 'flex',
+    alignItems: 'center',
+    flexWrap: 'wrap',
+    gap: tokens.spacingHorizontalL,
+    paddingBlock: tokens.spacingVerticalM,
+  },
+  flow: {
+    display: 'flex',
+    alignItems: 'center',
+    gap: tokens.spacingHorizontalS,
+    color: tokens.colorBrandForeground1,
+    fontSize: tokens.fontSizeBase500,
+    flexShrink: 0,
+  },
+  connection: {
+    display: 'inline-flex',
+    animationName: {
+      '0%, 100%': { opacity: 0.35, transform: 'translateX(-2px)' },
+      '50%': { opacity: 1, transform: 'translateX(2px)' },
+    },
+    animationDuration: '1800ms',
+    animationIterationCount: 'infinite',
+    animationTimingFunction: 'ease-in-out',
+    '@media (prefers-reduced-motion: reduce)': { animationName: 'none' },
+  },
+  copy: {
+    display: 'flex',
+    flexDirection: 'column',
+    gap: tokens.spacingVerticalXXS,
+    [NARROW_VIEWPORT_QUERY]: { flexBasis: '100%' },
+  },
+  hint: {
+    color: tokens.colorNeutralForeground2,
+  },
+})
diff --git a/frontend/src/components/Scenarios/AttackActivity.test.tsx b/frontend/src/components/Scenarios/AttackActivity.test.tsx
new file mode 100644
index 0000000000..9d37e67af8
--- /dev/null
+++ b/frontend/src/components/Scenarios/AttackActivity.test.tsx
@@ -0,0 +1,30 @@
+import type { ReactNode } from 'react'
+
+import { FluentProvider, webLightTheme } from '@fluentui/react-components'
+import { render, screen } from '@testing-library/react'
+
+import AttackActivity from './AttackActivity'
+
+function TestWrapper({ children }: { readonly children: ReactNode }) {
+  return <FluentProvider theme={webLightTheme}>{children}</FluentProvider>
+}
+
+describe('AttackActivity', () => {
+  it('should describe an attack in progress by default', () => {
+    render(<TestWrapper><AttackActivity /></TestWrapper>)
+    const status = screen.getByRole('status')
+    expect(status).toHaveTextContent('Attack in progress')
+    expect(status).toHaveTextContent('Prompt, target response, evaluation')
+  })
+
+  it('should describe loading a scan', () => {
+    render(<TestWrapper><AttackActivity loading /></TestWrapper>)
+    expect(screen.getByRole('status')).toHaveTextContent('Loading scan')
+    expect(screen.getByRole('status')).toHaveTextContent('Retrieving configuration, conversations and scores')
+  })
+
+  it('should use a caller label', () => {
+    render(<TestWrapper><AttackActivity label="Waiting to start" /></TestWrapper>)
+    expect(screen.getByRole('status')).toHaveTextContent('Waiting to start')
+  })
+})
diff --git a/frontend/src/components/Scenarios/AttackActivity.tsx b/frontend/src/components/Scenarios/AttackActivity.tsx
new file mode 100644
index 0000000000..c5550e7831
--- /dev/null
+++ b/frontend/src/components/Scenarios/AttackActivity.tsx
@@ -0,0 +1,32 @@
+import { Text } from '@fluentui/react-components'
+import { ArrowRightRegular, ChatRegular, CheckmarkCircleRegular, SparkleRegular } from '@fluentui/react-icons'
+
+import { useAttackActivityStyles } from './AttackActivity.styles'
+
+interface AttackActivityProps {
+  /** Describe loading a scan rather than an attack that is running. */
+  readonly loading?: boolean
+  readonly label?: string
+}
+
+/** Animated prompt → response → evaluation graphic for work that is still underway. */
+export default function AttackActivity({ loading = false, label }: AttackActivityProps) {
+  const styles = useAttackActivityStyles()
+  return (
+    <div className={styles.root} role="status">
+      <div className={styles.flow} aria-hidden="true">
+        <ChatRegular />
+        <span className={styles.connection}><ArrowRightRegular /></span>
+        <SparkleRegular />
+        <span className={styles.connection}><ArrowRightRegular /></span>
+        <CheckmarkCircleRegular />
+      </div>
+      <div className={styles.copy}>
+        <Text weight="semibold">{label ?? (loading ? 'Loading scan' : 'Attack in progress')}</Text>
+        <Text size={200} className={styles.hint}>
+          {loading ? 'Retrieving configuration, conversations and scores' : 'Prompt, target response, evaluation'}
+        </Text>
+      </div>
+    </div>
+  )
+}
diff --git a/frontend/src/components/Scenarios/AttackDetailsDialog.tsx b/frontend/src/components/Scenarios/AttackDetailsDialog.tsx
new file mode 100644
index 0000000000..4eee2a6b5a
--- /dev/null
+++ b/frontend/src/components/Scenarios/AttackDetailsDialog.tsx
@@ -0,0 +1,88 @@
+import { useMemo } from 'react'
+
+import { Button, Dialog, DialogActions, DialogBody, DialogContent, DialogSurface, DialogTitle } from '@fluentui/react-components'
+import { DismissRegular } from '@fluentui/react-icons'
+
+import AttackAttemptDetails from '@/components/AttackResults/AttackAttemptDetails'
+import type { ScenarioRunAttempt } from '@/hooks/useScenarioRunAttackDetails'
+import type {
+  ScenarioActiveConversation,
+  ScenarioHierarchyNode,
+  ScenarioProgressSummary,
+  ScenarioRunPlan,
+} from '@/types'
+import { attackConversationRoutePath, scenarioConversationRoutePath } from '@/utils/routeParams'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface AttackDetailsDialogProps {
+  readonly scenarioResultId: string
+  readonly attempt: ScenarioRunAttempt | null
+  /** The hierarchy node the dialog was opened from, which may carry the objective. */
+  readonly hierarchySelection: ScenarioHierarchyNode | null
+  readonly plan: ScenarioRunPlan | null
+  readonly summary: ScenarioProgressSummary
+  readonly activeConversations: readonly ScenarioActiveConversation[]
+  readonly seedObjectives: Map<string, string>
+  /** Router state carried to the conversation, so its back link returns here. */
+  readonly conversationState: unknown
+  readonly onClose: () => void
+}
+
+/** One attack's objective, outcome, technique, scorer, and conversation, opened from anywhere on the run page. */
+export default function AttackDetailsDialog({
+  scenarioResultId, attempt, hierarchySelection, plan, summary, activeConversations, seedObjectives, conversationState, onClose,
+}: AttackDetailsDialogProps) {
+  const styles = useScenarioRunPageStyles()
+  const plannedAtomicGroups = useMemo(
+    () => new Map(plan?.atomic_groups.map((group) => [group.id, group]) ?? []),
+    [plan],
+  )
+  const progressAtomicGroups = useMemo(
+    () => new Map(summary.atomic_groups.map((group) => [group.id, group])),
+    [summary],
+  )
+  const atomicGroupId = attempt && 'atomic_group_id' in attempt ? attempt.atomic_group_id : null
+  const active = attempt ? activeConversations.find((conversation) => conversation.attack_result_id === attempt.attack_result_id) : undefined
+  const objective = attempt
+    ? (hierarchySelection?.attack_result_id === attempt.attack_result_id ? hierarchySelection.objective : null) ??
+      ('objective' in attempt ? attempt.objective : null) ??
+      (attempt.seed_group_id ? seedObjectives.get(attempt.seed_group_id) : null) ??
+      null
+    : null
+  const conversationPath = !attempt ? null
+    : active ? scenarioConversationRoutePath(scenarioResultId, active.conversation_id)
+    : attempt.conversation_id ? attackConversationRoutePath(attempt.attack_result_id, attempt.conversation_id, scenarioResultId)
+    : null
+
+  return (
+    <Dialog open={attempt !== null} onOpenChange={(_, data) => { if (!data.open) onClose() }}>
+      <DialogSurface className={styles.attackDetailDialogSurface}>
+        <DialogBody className={styles.attackDetailDialogBody}>
+          <DialogTitle action={(
+            <Button appearance="subtle" icon={<DismissRegular />} aria-label="Close attack details" onClick={onClose} />
+          )}>
+            {attempt?.atomic_attack_name || 'Attack attempt'}
+          </DialogTitle>
+          {attempt && (
+            <DialogContent className={styles.attackDetailDialogContent}>
+              <AttackAttemptDetails
+                attempt={attempt}
+                objective={objective}
+                atomicGroup={atomicGroupId ? plannedAtomicGroups.get(atomicGroupId) : undefined}
+                techniqueDetails={active?.technique_details
+                  ?? (atomicGroupId ? progressAtomicGroups.get(atomicGroupId)?.technique_details : null)}
+                objectiveScorer={summary.objective_scorer}
+                conversationPath={conversationPath}
+                conversationState={conversationState}
+              />
+            </DialogContent>
+          )}
+          <DialogActions>
+            <Button appearance="primary" onClick={onClose}>Close</Button>
+          </DialogActions>
+        </DialogBody>
+      </DialogSurface>
+    </Dialog>
+  )
+}
diff --git a/frontend/src/components/Scenarios/AttackExecutionTable.tsx b/frontend/src/components/Scenarios/AttackExecutionTable.tsx
index 8152b4b8be..bcede3870b 100644
--- a/frontend/src/components/Scenarios/AttackExecutionTable.tsx
+++ b/frontend/src/components/Scenarios/AttackExecutionTable.tsx
@@ -18,8 +18,6 @@ import { ChevronDownRegular, ChevronRightRegular } from '@fluentui/react-icons'
 import { Link, useLocation, useNavigate } from 'react-router'
 
 import {
-  formatAttackOutcome,
-  formatAttackSuccess,
   formatDuration,
   formatTimestamp,
   objectivePreview,
@@ -221,7 +219,7 @@ function ResultRows({
           <OutcomeBadge
             appearance="tint"
             outcome={result.outcome}
-            label={booleanOutcome ? formatAttackSuccess(result.outcome) : formatAttackOutcome(result.outcome)}
+            labelStyle={booleanOutcome ? 'success' : 'outcome'}
           />
         </TableCell>
         <TableCell className={styles.nowrap}>{formatDuration(result.execution_time_ms)}</TableCell>
diff --git a/frontend/src/components/Scenarios/ScenarioRunConfigurationSection.tsx b/frontend/src/components/Scenarios/ScenarioRunConfigurationSection.tsx
new file mode 100644
index 0000000000..462fb460d6
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunConfigurationSection.tsx
@@ -0,0 +1,27 @@
+import { useState } from 'react'
+
+import { Table, TableBody, Text } from '@fluentui/react-components'
+
+import RegistryIdentityRow from '@/components/Registry/RegistryIdentityRow'
+import type { ScenarioProgressHeader } from '@/types'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface ScenarioRunConfigurationSectionProps {
+  readonly run: ScenarioProgressHeader
+}
+
+/** The saved scenario identity the scan ran with. */
+export default function ScenarioRunConfigurationSection({ run }: ScenarioRunConfigurationSectionProps) {
+  const styles = useScenarioRunPageStyles()
+  const [identityExpanded, setIdentityExpanded] = useState(false)
+  return (
+    <section className={styles.section} aria-labelledby="configuration-heading">
+      <Text as="h2" id="configuration-heading" size={500} weight="semibold">Scenario configuration</Text>
+      {run.scenario_identity ? <Table size="small" aria-label="Scenario configuration"><TableBody>
+        <RegistryIdentityRow name={run.scenario_registry_name ?? run.scenario_name} identity={run.scenario_identity}
+          columns={1} expanded={identityExpanded} onToggle={() => { setIdentityExpanded((value: boolean) => !value) }} />
+      </TableBody></Table> : <Text className={styles.sectionHint}>No saved scenario identity.</Text>}
+    </section>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunConversations.tsx b/frontend/src/components/Scenarios/ScenarioRunConversations.tsx
new file mode 100644
index 0000000000..9f282d0d12
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunConversations.tsx
@@ -0,0 +1,64 @@
+import { useMemo } from 'react'
+
+import { Button, Text } from '@fluentui/react-components'
+import { Link } from 'react-router'
+
+import type { ScenarioActiveConversation, ScenarioProgressResult } from '@/types'
+import { scenarioConversationRoutePath } from '@/utils/routeParams'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface ScenarioRunConversationsProps {
+  readonly scenarioResultId: string
+  readonly results: readonly ScenarioProgressResult[]
+  readonly activeConversations: readonly ScenarioActiveConversation[]
+  readonly recordedConversations: readonly ScenarioActiveConversation[]
+  readonly onOpenAttempt: (conversation: ScenarioActiveConversation, trigger: HTMLElement) => void
+}
+
+/** Conversations still executing, and interrupted ones saved without a completed result. */
+export default function ScenarioRunConversations({
+  scenarioResultId, results, activeConversations, recordedConversations, onOpenAttempt,
+}: ScenarioRunConversationsProps) {
+  const styles = useScenarioRunPageStyles()
+  const savedConversations = useMemo(() => {
+    const completedConversationIds = new Set(results.flatMap((attempt) => [
+      attempt.conversation_id,
+      ...(attempt.related_conversation_ids ?? []),
+    ]))
+    const recorded = new Map<string, ScenarioActiveConversation>()
+    for (const conversation of recordedConversations) {
+      if (!completedConversationIds.has(conversation.conversation_id)) {
+        recorded.set(`${conversation.attack_result_id}:${conversation.conversation_id}`, conversation)
+      }
+    }
+    return [...recorded.values()]
+  }, [results, recordedConversations])
+
+  return (
+    <>
+      {activeConversations.length > 0 && <section className={styles.section} aria-labelledby="live-conversations-heading">
+        <Text as="h2" id="live-conversations-heading" size={500} weight="semibold">Executing</Text>
+        {activeConversations.map((conversation) => (
+          <div key={conversation.conversation_id} className={styles.liveConversation}>
+            <Button appearance="transparent" onClick={(event) => { onOpenAttempt(conversation, event.currentTarget) }}>
+              {conversation.atomic_attack_name}
+            </Button>
+            <Text className={styles.preview}>{conversation.objective}</Text>
+            <Link to={scenarioConversationRoutePath(scenarioResultId, conversation.conversation_id)}>Watch live conversation</Link>
+          </div>
+        ))}
+      </section>}
+      {savedConversations.length > 0 && <section className={styles.section} aria-label="Saved conversations">
+        <Text as="h2" size={500} weight="semibold">Saved conversations</Text>
+        {savedConversations.map((conversation) => (
+          <div key={`${conversation.attack_result_id}:${conversation.conversation_id}`} className={styles.liveConversation}>
+            <Text>{conversation.atomic_attack_name}</Text>
+            <Text className={styles.preview}>{conversation.objective}</Text>
+            <Link to={scenarioConversationRoutePath(scenarioResultId, conversation.conversation_id)}>Open saved conversation</Link>
+          </div>
+        ))}
+      </section>}
+    </>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunDialogs.tsx b/frontend/src/components/Scenarios/ScenarioRunDialogs.tsx
index 7ddf7848e9..2332850cdd 100644
--- a/frontend/src/components/Scenarios/ScenarioRunDialogs.tsx
+++ b/frontend/src/components/Scenarios/ScenarioRunDialogs.tsx
@@ -7,6 +7,8 @@ import {
   DialogContent,
   DialogSurface,
   DialogTitle,
+  MessageBar,
+  MessageBarBody,
   Text,
   mergeClasses,
 } from '@fluentui/react-components'
@@ -102,3 +104,25 @@ export function ObjectiveDetailsDialog({ objective, onClose, attempts, onOpenAtt
     </Dialog>
   )
 }
+
+interface CancelScanDialogProps {
+  readonly open: boolean
+  readonly cancelling: boolean
+  readonly error: string | null
+  readonly onOpenChange: (open: boolean) => void
+  readonly onConfirm: () => void
+}
+
+export function CancelScanDialog({ open, cancelling, error, onOpenChange, onConfirm }: CancelScanDialogProps) {
+  const styles = useScenarioRunPageStyles()
+  return (
+    <Dialog open={open} onOpenChange={(_, data) => { onOpenChange(data.open) }}>
+      <DialogSurface><DialogBody><DialogTitle>Cancel scan?</DialogTitle><DialogContent className={styles.dialogContent}>
+        <Text>Stop remaining attacks. Saved conversations and results stay available.</Text>
+        {error && <MessageBar intent="error"><MessageBarBody>{error}</MessageBarBody></MessageBar>}
+      </DialogContent><DialogActions><Button disabled={cancelling} onClick={() => { onOpenChange(false) }}>Keep running</Button>
+        <Button appearance="primary" disabled={cancelling} onClick={onConfirm}>{cancelling ? 'Cancelling...' : 'Cancel scan'}</Button>
+      </DialogActions></DialogBody></DialogSurface>
+    </Dialog>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunHeader.tsx b/frontend/src/components/Scenarios/ScenarioRunHeader.tsx
new file mode 100644
index 0000000000..d8d66ac34c
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunHeader.tsx
@@ -0,0 +1,56 @@
+import type { Ref } from 'react'
+
+import { Button, MessageBar, MessageBarBody, Text } from '@fluentui/react-components'
+import { ArrowClockwiseRegular, PlayRegular, StopRegular } from '@fluentui/react-icons'
+import { Link } from 'react-router'
+
+import ScanStatusBadge from '@/components/ScanStatusBadge'
+import type { ScenarioRunControls } from '@/hooks/useScenarioRunControls'
+import type { ScenarioProgressHeader } from '@/types'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface ScenarioRunHeaderProps {
+  readonly run: ScenarioProgressHeader
+  readonly active: boolean
+  readonly controls: ScenarioRunControls
+  /** Focus target for returning to the run overview. */
+  readonly headerRef: Ref<HTMLElement>
+}
+
+/** The scan's title, state, and run controls, with any control failure below them. */
+export default function ScenarioRunHeader({ run, active, controls, headerRef }: ScenarioRunHeaderProps) {
+  const styles = useScenarioRunPageStyles()
+  const resumable = run.status === 'FAILED' || run.status === 'CANCELLED'
+  return (
+    <>
+      <header className={styles.header} ref={headerRef} tabIndex={-1}>
+        <div className={styles.headerIdentity}>
+          <div className={styles.titleRow}>
+            <Text as="h1" size={700} weight="semibold">{run.scenario_registry_name ?? run.scenario_name}</Text>
+            <ScanStatusBadge status={run.status} testId="run-state-badge" />
+          </div>
+          {run.description && <Text className={styles.sectionHint}>{run.description}</Text>}
+        </div>
+        <div className={styles.headerActions}>
+          {active && <Link className={styles.backLink} to="/scanner/queue">View queue</Link>}
+          <Button icon={<ArrowClockwiseRegular />} disabled={controls.rerunPending} onClick={controls.rerun}>
+            {controls.rerunPending ? 'Loading...' : 'Rerun'}
+          </Button>
+          {active ? (
+            <Button icon={<StopRegular />} className={styles.touchTarget} onClick={() => { controls.setCancelOpen(true) }}>
+              Cancel
+            </Button>
+          ) : resumable && (
+            <Button appearance="primary" icon={<PlayRegular />} disabled={controls.resumePending} onClick={controls.resume}>
+              Resume
+            </Button>
+          )}
+        </div>
+      </header>
+      {controls.controlError && <MessageBar intent="error"><MessageBarBody>
+        {controls.controlError}
+      </MessageBarBody></MessageBar>}
+    </>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunNotices.tsx b/frontend/src/components/Scenarios/ScenarioRunNotices.tsx
new file mode 100644
index 0000000000..11c24fe331
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunNotices.tsx
@@ -0,0 +1,69 @@
+import { Accordion, AccordionHeader, AccordionItem, AccordionPanel, Button, MessageBar, MessageBarBody, Text } from '@fluentui/react-components'
+
+import type { ScenarioOverloadSummary, ScenarioProgressHeader, ScenarioProgressResult, ScenarioProgressSummary } from '@/types'
+import type { ScenarioRunProgressState } from '@/utils/scenarioRunProgress'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface ScenarioRunNoticesProps {
+  readonly run: ScenarioProgressHeader
+  readonly summary: ScenarioProgressSummary
+  readonly state: ScenarioRunProgressState
+  readonly onRetry: () => void
+  readonly onOpenAttempt: (attempt: ScenarioProgressResult, trigger: HTMLElement) => void
+}
+
+/** Run failures, paused live updates, and conditions that limit how far the totals can be trusted. */
+export default function ScenarioRunNotices({ run, summary, state, onRetry, onOpenAttempt }: ScenarioRunNoticesProps) {
+  const styles = useScenarioRunPageStyles()
+  const overall = summary.overall
+  const firstError = state.results.find((attempt) => attempt.outcome === 'error')
+  const unmatched = summary.unattributed_attempts ?? 0
+  const overloaded = state.overloadSummaries.length > 0
+  const notices: string[] = []
+  if (overloaded) notices.push('Service overload detected.')
+  if (unmatched > 0) notices.push(`${unmatched} execution${unmatched === 1 ? '' : 's'} could not be matched to the saved plan.`)
+  if (!state.planComplete) notices.push('The saved execution plan is incomplete; some totals cannot be verified.')
+  const runIntent = run.status === 'FAILED' ? 'error' : run.status === 'CANCELLED' && overall.errors === 0 ? 'info' : 'warning'
+
+  return (
+    <>
+      {(run.status === 'FAILED' || run.error || overall.errors > 0) && <MessageBar intent={runIntent}>
+        <MessageBarBody>{run.status === 'FAILED' ? 'Scan failed. Resume to continue remaining attacks.'
+          : run.status === 'CANCELLED' ? 'Scan cancelled.'
+          : `${overall.errors} attack${overall.errors === 1 ? '' : 's'} ended with an error.`}
+          {firstError && <Button appearance="transparent" onClick={(event) => { onOpenAttempt(firstError, event.currentTarget) }}>
+            View attack
+          </Button>}
+          {run.error && <Accordion collapsible><AccordionItem value="error">
+            <AccordionHeader>Error details</AccordionHeader>
+            <AccordionPanel><Text className={styles.objective}>{run.error_type ? `${run.error_type}: ` : ''}{run.error}</Text></AccordionPanel>
+          </AccordionItem></Accordion>}
+        </MessageBarBody>
+      </MessageBar>}
+      {state.stale && <MessageBar intent="warning"><MessageBarBody>
+        Live updates paused. {state.error} <Button onClick={onRetry}>Retry</Button>
+      </MessageBarBody></MessageBar>}
+      {notices.length > 0 && <MessageBar aria-label="Scan notices" intent={overloaded || unmatched > 0 ? 'warning' : 'info'}>
+        <MessageBarBody>
+          {notices.join(' ')}
+          {overloaded && <OverloadDetails overloads={state.overloadSummaries} />}
+        </MessageBarBody>
+      </MessageBar>}
+    </>
+  )
+}
+
+function OverloadDetails({ overloads }: { readonly overloads: readonly ScenarioOverloadSummary[] }) {
+  return (
+    <Accordion collapsible><AccordionItem value="overload">
+      <AccordionHeader>Overload details</AccordionHeader>
+      <AccordionPanel>{overloads.map((overload) => (
+        <Text block key={overload.component_role}>
+          {overload.component_role.replace(/_/g, ' ')}: {overload.count}
+          {overload.status_codes.length > 0 ? ` (HTTP ${overload.status_codes.join(', ')})` : ''}
+        </Text>
+      ))}</AccordionPanel>
+    </AccordionItem></Accordion>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunObjectivesSection.tsx b/frontend/src/components/Scenarios/ScenarioRunObjectivesSection.tsx
new file mode 100644
index 0000000000..9a6ec7dbff
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunObjectivesSection.tsx
@@ -0,0 +1,76 @@
+import { useMemo } from 'react'
+
+import { Button, Table, TableBody, TableCell, TableHeader, TableHeaderCell, TableRow, Text } from '@fluentui/react-components'
+
+import { formatProgressSuccess, objectivePreview } from '@/components/AttackResults/attackAttemptFormatting'
+import type {
+  ScenarioActiveConversation,
+  ScenarioComponentIdentity,
+  ScenarioProgressResult,
+  ScenarioProgressSummary,
+  ScenarioRunPlan,
+  ScenarioRunPlanSeedGroup,
+} from '@/types'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+
+interface ScenarioRunObjectivesSectionProps {
+  readonly summary: ScenarioProgressSummary
+  readonly plan: ScenarioRunPlan | null
+  readonly results: readonly ScenarioProgressResult[]
+  readonly activeConversations: readonly ScenarioActiveConversation[]
+  readonly onOpenObjective: (objective: ScenarioRunPlanSeedGroup, trigger: HTMLElement) => void
+}
+
+function seedDatasetNames(identities: ScenarioComponentIdentity[]): string {
+  return [...new Set(identities.flatMap((identity: ScenarioComponentIdentity) =>
+    typeof identity.parameters.dataset_name === 'string' ? [identity.parameters.dataset_name] : []))].join(', ')
+}
+
+/** Each objective's dataset, attack success, and completion, opening its seed prompts and attacks. */
+export default function ScenarioRunObjectivesSection({
+  summary, plan, results, activeConversations, onOpenObjective,
+}: ScenarioRunObjectivesSectionProps) {
+  const styles = useScenarioRunPageStyles()
+  const planSeeds = useMemo(
+    () => new Map(plan?.seed_groups.map((seed) => [seed.id, seed]) ?? []),
+    [plan],
+  )
+  const datasetsBySeed = useMemo(() => {
+    const identities = new Map<string, ScenarioComponentIdentity[]>()
+    for (const attempt of [...results, ...activeConversations]) {
+      if (!attempt.seed_group_id) continue
+      const seeds = identities.get(attempt.seed_group_id) ?? []
+      seeds.push(...(attempt.seed_identifiers ?? []))
+      identities.set(attempt.seed_group_id, seeds)
+    }
+    return new Map([...identities].map(([id, seeds]) => [id, seedDatasetNames(seeds)]))
+  }, [results, activeConversations])
+
+  return (
+    <section className={styles.section} aria-labelledby="objectives-heading">
+      <Text as="h2" id="objectives-heading" size={500} weight="semibold">Datasets &amp; objectives</Text>
+      <div className={styles.tableScroll}><Table size="small" aria-label="Datasets and objectives">
+        <TableHeader><TableRow>
+          <TableHeaderCell>Dataset</TableHeaderCell><TableHeaderCell>Objective</TableHeaderCell>
+          <TableHeaderCell>Attack success</TableHeaderCell><TableHeaderCell>Completed</TableHeaderCell>
+        </TableRow></TableHeader>
+        <TableBody>{summary.seed_groups.map((seed) => (
+          <TableRow key={seed.id}>
+            <TableCell>{datasetsBySeed.get(seed.id) || 'Not recorded'}</TableCell>
+            <TableCell><Button appearance="transparent" className={styles.objectiveLinkButton} onClick={(event) => {
+              onOpenObjective(
+                planSeeds.get(seed.id) ?? { id: seed.id, objective_sha256: '', objective: seed.objective ?? 'Not recorded', prompts: [] },
+                event.currentTarget,
+              )
+            }}>
+              {objectivePreview(seed.objective ?? null, seed.id)}
+            </Button></TableCell>
+            <TableCell>{formatProgressSuccess(seed)}</TableCell>
+            <TableCell>{seed.completed}{seed.planned === null ? '' : ` / ${seed.planned}`}</TableCell>
+          </TableRow>
+        ))}</TableBody>
+      </Table></div>
+    </section>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunOverview.tsx b/frontend/src/components/Scenarios/ScenarioRunOverview.tsx
new file mode 100644
index 0000000000..945d4eed6d
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunOverview.tsx
@@ -0,0 +1,48 @@
+import { Badge, Text } from '@fluentui/react-components'
+import { Link } from 'react-router'
+
+import { formatProgressSuccess } from '@/components/AttackResults/attackAttemptFormatting'
+import type { ScenarioProgressCounts, ScenarioProgressHeader } from '@/types'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+import ScenarioRunTiming from './ScenarioRunTiming'
+
+interface ScenarioRunOverviewProps {
+  readonly run: ScenarioProgressHeader
+  readonly overall: ScenarioProgressCounts
+}
+
+/** Operation, target, timing, success, errors, and labels for the whole scan. */
+export default function ScenarioRunOverview({ run, overall }: ScenarioRunOverviewProps) {
+  const styles = useScenarioRunPageStyles()
+  const outcomes = overall.outcomes
+  return (
+    <section className={styles.metadata} aria-label="Scan summary">
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Operation</Text>
+        {run.operation_id
+          ? <Link to={`/operations/${encodeURIComponent(run.operation_id)}`}>{run.operation_name ?? 'Operation'}</Link>
+          : <Text>Unassigned</Text>}
+      </div>
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Target</Text>
+        <Text weight="semibold">{run.target?.model_name ?? run.target?.target_type ?? 'Not recorded'}</Text>
+      </div>
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Timing</Text>
+        <ScenarioRunTiming run={run} />
+      </div>
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Attack success</Text>
+        <Text weight="semibold">{formatProgressSuccess(overall)}</Text>
+        <Text size={200} className={styles.sectionHint}>
+          {outcomes ? `${outcomes.successes} / ${outcomes.total_decided} decided` : `${overall.succeeded} / ${overall.completed} complete`}
+        </Text>
+      </div>
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Errors / retries</Text>
+        <Text weight="semibold">{overall.errors} / {overall.retries}</Text>
+      </div>
+      <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Labels</Text>
+        <div className={styles.badgeList}>{Object.entries(run.labels ?? {}).map(([key, value]) => (
+          <Badge key={key} appearance="outline" className={styles.labelBadge}>{key}: {value}</Badge>
+        ))}</div>
+      </div>
+    </section>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioRunPage.tsx b/frontend/src/components/Scenarios/ScenarioRunPage.tsx
index ee0705f3a3..97b676dfab 100644
--- a/frontend/src/components/Scenarios/ScenarioRunPage.tsx
+++ b/frontend/src/components/Scenarios/ScenarioRunPage.tsx
@@ -1,54 +1,30 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
+import { useMemo, useRef, useState } from 'react'
 
-import {
-  Accordion, AccordionHeader, AccordionItem, AccordionPanel, Badge, Button,
-  Dialog, DialogActions, DialogBody, DialogContent, DialogSurface, DialogTitle,
-  MessageBar, MessageBarBody, ProgressBar, Spinner, Table, TableBody, TableCell,
-  TableHeader, TableHeaderCell, TableRow, Text,
-} from '@fluentui/react-components'
-import { ArrowLeftRegular, ArrowClockwiseRegular, ChevronDownRegular, ChevronRightRegular, DismissRegular, PlayRegular, StopRegular } from '@fluentui/react-icons'
-import { Link, useLocation, useNavigate, useParams } from 'react-router'
+import { Button, MessageBar, MessageBarBody, Spinner, Text } from '@fluentui/react-components'
+import { ArrowLeftRegular } from '@fluentui/react-icons'
+import { Link, useLocation, useParams } from 'react-router'
 
-import AttackAttemptDetails from '@/components/AttackResults/AttackAttemptDetails'
-import { formatProgressSuccess, objectivePreview } from '@/components/AttackResults/attackAttemptFormatting'
-import RegistryIdentityRow from '@/components/Registry/RegistryIdentityRow'
-import { suiteExecutionRoutePath } from '@/components/ScenarioSuites/suiteRoutes'
-import { useScenarioRunProgress } from '@/hooks/useScenarioRunProgress'
-import { useScenarioResultHierarchy } from '@/hooks/useScenarioResultHierarchy'
-import { useScenarioRunResume } from '@/hooks/useScenarioRunResume'
 import { useScenarioQueue } from '@/hooks/useScenarioQueue'
-import { scenariosApi } from '@/services/api'
-import { toApiError } from '@/services/errors'
-import type {
-  ScenarioActiveConversation,
-  ScenarioComponentIdentity,
-  ScenarioHierarchyNode,
-  ScenarioProgressResult,
-  ScenarioRunPlanSeedGroup,
-  ScenarioRunState,
-} from '@/types'
-import {
-  attackConversationRoutePath,
-  routerPathParamValue,
-  scenarioConversationRoutePath,
-  scenarioRerunRoutePath,
-  scenarioRunAttackRoutePath,
-  scenarioRunRoutePath,
-} from '@/utils/routeParams'
+import { useScenarioResultHierarchy } from '@/hooks/useScenarioResultHierarchy'
+import { useScenarioRunAttackDetails } from '@/hooks/useScenarioRunAttackDetails'
+import { useScenarioRunControls } from '@/hooks/useScenarioRunControls'
+import { useScenarioRunProgress } from '@/hooks/useScenarioRunProgress'
+import type { ScenarioProgressResult, ScenarioRunPlanSeedGroup } from '@/types'
+import { routerPathParamValue } from '@/utils/routeParams'
 import { isTerminalRunState } from '@/utils/scenarioRunProgress'
 
-import AttackExecutionTable from './AttackExecutionTable'
-import { ObjectiveDetailsDialog } from './ScenarioRunDialogs'
+import AtomicAttackGroupsSection from './AtomicAttackGroupsSection'
+import AttackDetailsDialog from './AttackDetailsDialog'
+import ScenarioRunConfigurationSection from './ScenarioRunConfigurationSection'
+import ScenarioRunConversations from './ScenarioRunConversations'
+import { CancelScanDialog, ObjectiveDetailsDialog } from './ScenarioRunDialogs'
+import ScenarioRunHeader from './ScenarioRunHeader'
+import ScenarioRunNotices from './ScenarioRunNotices'
+import ScenarioRunObjectivesSection from './ScenarioRunObjectivesSection'
+import ScenarioRunOverview from './ScenarioRunOverview'
 import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
-import ScenarioRunTiming from './ScenarioRunTiming'
-import ScenarioResultHierarchy from './ScenarioResultHierarchy'
-import { hierarchyDisplayGroups } from './scenarioHierarchy'
-
-const MAX_VISIBLE_ATTEMPTS_PER_GROUP = 100
-const AUTO_EXPAND_GROUP_LIMIT = 20
-const STATE_COLORS: Record<ScenarioRunState, 'informative' | 'brand' | 'success' | 'danger' | 'warning'> = {
-  CREATED: 'informative', QUEUED: 'informative', IN_PROGRESS: 'brand', COMPLETED: 'success', FAILED: 'danger', CANCELLED: 'warning',
-}
+import ScenarioRunProgress from './ScenarioRunProgress'
+import { scenarioRunBackLink, type ScenarioRunNavigationState } from './scenarioRunNavigation'
 
 export default function ScenarioRunPage() {
   const { scenarioResultId, attackResultId } = useParams<{ scenarioResultId: string; attackResultId?: string }>()
@@ -61,73 +37,31 @@ interface ScenarioRunContentProps {
   readonly attackResultId: string | null
 }
 
-function seedDatasetNames(identities: ScenarioComponentIdentity[]): string {
-  return [...new Set(identities.flatMap((identity: ScenarioComponentIdentity) =>
-    typeof identity.parameters.dataset_name === 'string' ? [identity.parameters.dataset_name] : []))].join(', ')
-}
-
 function ScenarioRunContent({ scenarioResultId, attackResultId }: ScenarioRunContentProps) {
   const styles = useScenarioRunPageStyles()
-  const navigate = useNavigate()
   const location = useLocation()
-  const navigationState = location.state as {
-    fromScenarioHistory?: boolean
-    scenarioHistorySearch?: string
-    scenarioName?: string
-    suiteExecutionId?: string
-    suiteName?: string
-  } | null
-  const backPath = navigationState?.suiteExecutionId
-    ? suiteExecutionRoutePath(navigationState.suiteExecutionId)
-    : navigationState?.fromScenarioHistory || navigationState?.scenarioHistorySearch
-      ? `/scanner/history${navigationState.scenarioHistorySearch ?? ''}`
-      : navigationState?.scenarioName
-        ? `/scanner/launch/${encodeURIComponent(navigationState.scenarioName)}`
-        : '/scanner/launch'
-  const backLabel = navigationState?.suiteExecutionId
-    ? `Back to ${navigationState.suiteName ?? 'suite execution'}`
-    : navigationState?.fromScenarioHistory || navigationState?.scenarioHistorySearch
-      ? 'Back to scans'
-      : navigationState?.scenarioName ? 'Back to scenario' : 'Back to scanners'
+  const backLink = scenarioRunBackLink(location.state as ScenarioRunNavigationState | null)
   const { state, retry, applyRunSummary } = useScenarioRunProgress(scenarioResultId)
   const hierarchy = useScenarioResultHierarchy(scenarioResultId, state.run !== null && state.summary !== null)
   const queue = useScenarioQueue()
-  const [identityExpanded, setIdentityExpanded] = useState(false)
-  const [objective, setObjective] = useState<ScenarioRunPlanSeedGroup | null>(null)
-  const [cancelOpen, setCancelOpen] = useState(false)
-  const [cancelling, setCancelling] = useState(false)
-  const [cancelError, setCancelError] = useState<string | null>(null)
-  const [rerunPending, setRerunPending] = useState(false)
-  const [rerunError, setRerunError] = useState<string | null>(null)
-  const rerunRequest = useRef<AbortController | null>(null)
-  const detailsTrigger = useRef<HTMLElement | null>(null)
+  const controls = useScenarioRunControls({
+    scenarioResultId, applyRunSummary, retry, refreshQueue: queue.retry, runError: state.run?.error,
+  })
+  const overviewRef = useRef<HTMLElement | null>(null)
+  const groupsToggleRef = useRef<HTMLButtonElement | null>(null)
   const objectiveTrigger = useRef<HTMLElement | null>(null)
-  const overviewTarget = useRef<HTMLElement | null>(null)
-  const active = Boolean(state.run && !isTerminalRunState(state.run.status))
-  const resume = useScenarioRunResume({
-    onResumed: applyRunSummary,
-    onRefresh: (succeeded: boolean): void => {
-      queue.retry()
-      if (!succeeded) retry()
-    },
+  const [objective, setObjective] = useState<ScenarioRunPlanSeedGroup | null>(null)
+  const attackDetails = useScenarioRunAttackDetails({
+    scenarioResultId,
+    attackResultId,
+    results: state.results,
+    activeConversations: state.activeConversations,
+    fallbackFocus: () => groupsToggleRef.current ?? overviewRef.current,
   })
-  const [atomicGroupsExpandedChoice, setAtomicGroupsExpandedChoice] = useState<boolean | null>(null)
-  const [expandedGroupChoices, setExpandedGroupChoices] = useState<Map<string, boolean>>(new Map())
-  const detailsTriggerRef = useRef<HTMLElement | null>(null)
-  const atomicGroupsToggleRef = useRef<HTMLButtonElement | null>(null)
-  const [hierarchySelection, setHierarchySelection] = useState<ScenarioHierarchyNode | null>(null)
-  useEffect(() => () => {
-    rerunRequest.current?.abort()
-    rerunRequest.current = null
-  }, [location.pathname])
   const seedObjectives = useMemo(
     () => new Map(state.plan?.seed_groups.map((seed) => [seed.id, seed.objective]) ?? []),
     [state.plan],
   )
-  const planSeeds = useMemo(
-    () => new Map(state.plan?.seed_groups.map((seed) => [seed.id, seed]) ?? []),
-    [state.plan],
-  )
   const attemptsBySeed = useMemo(() => {
     const groups = new Map<string, ScenarioProgressResult[]>()
     for (const attempt of state.results) {
@@ -137,78 +71,6 @@ function ScenarioRunContent({ scenarioResultId, attackResultId }: ScenarioRunCon
     }
     return groups
   }, [state.results])
-  const plannedAtomicGroups = useMemo(
-    () => new Map(state.plan?.atomic_groups.map((group) => [group.id, group]) ?? []),
-    [state.plan],
-  )
-  const progressAtomicGroups = useMemo(
-    () => new Map(state.summary?.atomic_groups.map((group) => [group.id, group]) ?? []),
-    [state.summary],
-  )
-  // A hierarchy node can be opened before the paged progress feed has delivered it.
-  const selectedAttempt = useMemo<ScenarioProgressResult | ScenarioHierarchyNode | ScenarioActiveConversation | null>(
-    () =>
-      state.results.find((attempt) => attempt.attack_result_id === attackResultId) ??
-      state.activeConversations.find((conversation) => conversation.attack_result_id === attackResultId) ??
-      (hierarchySelection?.attack_result_id === attackResultId ? hierarchySelection : null),
-    [attackResultId, state.results, state.activeConversations, hierarchySelection],
-  )
-  const selectedAtomicGroupId = selectedAttempt && 'atomic_group_id' in selectedAttempt
-    ? selectedAttempt.atomic_group_id
-    : null
-  const selectedAttemptGroup = selectedAtomicGroupId
-    ? plannedAtomicGroups.get(selectedAtomicGroupId)
-    : undefined
-  // Attempts are grouped by atomic group id, then truncated per group, so expanding an
-  // older group still shows its own executions rather than an empty table.
-  const attemptsByGroupId = useMemo(() => {
-    const groupedAttempts = new Map<string, ScenarioProgressResult[]>()
-    for (let index = state.results.length - 1; index >= 0; index -= 1) {
-      const attempt = state.results[index]
-      if (!attempt) continue
-      const existing = groupedAttempts.get(attempt.atomic_group_id)
-      if (existing) {
-        existing.push(attempt)
-      } else {
-        groupedAttempts.set(attempt.atomic_group_id, [attempt])
-      }
-    }
-    return groupedAttempts
-  }, [state.results])
-  const datasetsBySeed = useMemo(() => {
-    const identities = new Map<string, ScenarioComponentIdentity[]>()
-    for (const attempt of [...state.results, ...state.activeConversations]) {
-      if (!attempt.seed_group_id) continue
-      const seeds = identities.get(attempt.seed_group_id) ?? []
-      seeds.push(...(attempt.seed_identifiers ?? []))
-      identities.set(attempt.seed_group_id, seeds)
-    }
-    return new Map([...identities].map(([id, seeds]) => [id, seedDatasetNames(seeds)]))
-  }, [state.results, state.activeConversations])
-  const savedConversations = useMemo(() => {
-    const completedConversationIds = new Set(state.results.flatMap((attempt) => [
-      attempt.conversation_id,
-      ...(attempt.related_conversation_ids ?? []),
-    ]))
-    const recorded = new Map<string, ScenarioActiveConversation>()
-    for (const conversation of state.recordedConversations) {
-      if (!completedConversationIds.has(conversation.conversation_id)) {
-        recorded.set(`${conversation.attack_result_id}:${conversation.conversation_id}`, conversation)
-      }
-    }
-    return [...recorded.values()]
-  }, [state.results, state.recordedConversations])
-  const selectedActive = state.activeConversations.find((conversation) => conversation.attack_result_id === attackResultId)
-  const runPath = scenarioRunRoutePath(scenarioResultId)
-
-  const closeAttemptDetails = (): void => {
-    navigate(runPath, { replace: true, state: location.state })
-    requestAnimationFrame(() => {
-      const trigger = detailsTriggerRef.current ?? detailsTrigger.current
-      const focusTarget = trigger?.isConnected ? trigger : atomicGroupsToggleRef.current ?? overviewTarget.current
-      focusTarget?.focus()
-    })
-  }
 
   const closeObjective = (): void => {
     setObjective(null)
@@ -218,69 +80,11 @@ function ScenarioRunContent({ scenarioResultId, attackResultId }: ScenarioRunCon
     })
   }
 
-  const openAttemptDetails = (
-    attempt: ScenarioProgressResult | ScenarioHierarchyNode,
-    trigger: HTMLElement,
-  ): void => {
-    detailsTriggerRef.current = trigger
-    detailsTrigger.current = trigger
-    setHierarchySelection('result_role' in attempt ? attempt : null)
-    navigate(scenarioRunAttackRoutePath(scenarioResultId, attempt.attack_result_id), { state: location.state })
-  }
-
-  const toggleDisplayGroup = (groupId: string, defaultExpanded: boolean): void => {
-    setExpandedGroupChoices((current) => new Map(current).set(
-      groupId,
-      !(current.get(groupId) ?? defaultExpanded),
-    ))
-  }
-
-  function openDetails(attempt: ScenarioProgressResult, trigger: HTMLElement): void {
-    const focusTarget = objective ? objectiveTrigger.current : trigger
-    detailsTriggerRef.current = focusTarget
-    detailsTrigger.current = focusTarget
-    setObjective(null)
-    setHierarchySelection(null)
-    navigate(scenarioRunAttackRoutePath(scenarioResultId, attempt.attack_result_id), { state: location.state })
-  }
-
-  async function rerun(): Promise<void> {
-    rerunRequest.current?.abort()
-    const controller = new AbortController()
-    rerunRequest.current = controller
-    setRerunPending(true)
-    setRerunError(null)
-    try {
-      const request = await scenariosApi.getLaunchConfiguration(scenarioResultId, controller.signal)
-      if (rerunRequest.current !== controller || controller.signal.aborted) return
-      navigate(scenarioRerunRoutePath(request.scenario_name, scenarioResultId))
-    } catch (error: unknown) {
-      if (rerunRequest.current !== controller || controller.signal.aborted) return
-      setRerunError(toApiError(error).detail)
-    } finally {
-      if (rerunRequest.current === controller) {
-        rerunRequest.current = null
-        setRerunPending(false)
-      }
-    }
-  }
-
-  async function cancel(): Promise<void> {
-    setCancelling(true)
-    setCancelError(null)
-    try {
-      applyRunSummary(await scenariosApi.cancelRun(scenarioResultId))
-      setCancelOpen(false)
-    } catch (error: unknown) {
-      setCancelError(toApiError(error).detail)
-    } finally {
-      setCancelling(false)
-    }
-  }
+  const backLinkElement = <Link to={backLink.path} className={styles.backLink}><ArrowLeftRegular /> {backLink.label}</Link>
 
   if (!state.run || !state.summary) return (
     <main className={styles.root} data-testid="scenario-run-page"><div className={styles.content}>
-      <Link to={backPath} className={styles.backLink}><ArrowLeftRegular /> {backLabel}</Link>
+      {backLinkElement}
       {state.loadStatus === 'loading' ? <Spinner label="Loading scan..." /> : (
         <MessageBar intent="error"><MessageBarBody>{state.error ?? 'Scan not found.'} <Button onClick={retry}>Retry</Button></MessageBarBody></MessageBar>
       )}
@@ -289,340 +93,68 @@ function ScenarioRunContent({ scenarioResultId, attackResultId }: ScenarioRunCon
 
   const run = state.run
   const summary = state.summary
-  const overall = summary.overall
-  const outcomes = overall.outcomes
-  const groups = summary.display_groups ?? summary.techniques
-  const firstError = state.results.find((attempt) => attempt.outcome === 'error')
-  const controlError = rerunError ?? resume.error
-    ?? (resume.executionError !== run.error ? resume.executionError : null)
-  const notices: string[] = []
-  if (state.overloadSummaries.length > 0) notices.push('Service overload detected.')
-  const unattributedAttempts = summary.unattributed_attempts ?? 0
-  const unmatched = unattributedAttempts
-  if (unmatched > 0) notices.push(`${unmatched} execution${unmatched === 1 ? '' : 's'} could not be matched to the saved plan.`)
-  if (!state.planComplete) notices.push('The saved execution plan is incomplete; some totals cannot be verified.')
-  const objectiveScorer = summary.objective_scorer
-  const displayGroups = hierarchyDisplayGroups(groups, hierarchy.roots.groups)
-  const producerCounts = overall.producer_counts
-  const executionCount = producerCounts
-    ? producerCounts.target_facing.attempts + producerCounts.orchestration.attempts + producerCounts.unknown.attempts
-    : state.results.length
-  const atomicGroupsExpanded = atomicGroupsExpandedChoice ?? displayGroups.length <= AUTO_EXPAND_GROUP_LIMIT
+  const active = !isTerminalRunState(run.status)
+  const openObjectiveAttempt = (attempt: ScenarioProgressResult): void => {
+    attackDetails.open(attempt, objectiveTrigger.current)
+    setObjective(null)
+  }
+
   return (
     <main className={styles.root} data-testid="scenario-run-page">
       <div className={styles.content}>
-        <Link to={backPath} className={styles.backLink}><ArrowLeftRegular /> {backLabel}</Link>
+        {backLinkElement}
         <Text role="status" aria-label="Run status updates" aria-live="polite" className={styles.liveStatus}>
           {!active ? `${run.scenario_registry_name ?? run.scenario_name}: ${run.status.toLowerCase()}.` : ''}
         </Text>
-        <header className={styles.header} ref={overviewTarget} tabIndex={-1}>
-          <div className={styles.headerIdentity}>
-            <div className={styles.titleRow}>
-              <Text as="h1" size={700} weight="semibold">{run.scenario_registry_name ?? run.scenario_name}</Text>
-              <Badge appearance="tint" color={STATE_COLORS[run.status]} data-testid="run-state-badge">
-                {run.status === 'IN_PROGRESS' ? 'Executing' : run.status.charAt(0) + run.status.slice(1).toLowerCase()}
-              </Badge>
-            </div>
-            {run.description && <Text className={styles.sectionHint}>{run.description}</Text>}
-          </div>
-          <div className={styles.headerActions}>
-            {active && <Link className={styles.backLink} to="/scanner/queue">View queue</Link>}
-            <Button icon={<ArrowClockwiseRegular />} disabled={rerunPending} onClick={() => { void rerun() }}>{rerunPending ? 'Loading...' : 'Rerun'}</Button>
-            {active ? <Button icon={<StopRegular />} className={styles.touchTarget} onClick={() => { setCancelError(null); setCancelOpen(true) }}>Cancel</Button>
-              : (run.status === 'FAILED' || run.status === 'CANCELLED') && <Button appearance="primary" icon={<PlayRegular />}
-                disabled={resume.pendingRunId !== null} onClick={() => { setRerunError(null); resume.requestResume(scenarioResultId) }}>Resume</Button>}
-          </div>
-        </header>
-        {controlError && <MessageBar intent="error"><MessageBarBody>
-          {controlError}
-        </MessageBarBody></MessageBar>}
-        <section className={styles.metadata} aria-label="Scan summary">
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Operation</Text>
-            {run.operation_id ? <Link to={`/operations/${encodeURIComponent(run.operation_id)}`}>{run.operation_name ?? 'Operation'}</Link> : <Text>Unassigned</Text>}
-          </div>
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Target</Text><Text weight="semibold">{run.target?.model_name ?? run.target?.target_type ?? 'Not recorded'}</Text></div>
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Timing</Text><ScenarioRunTiming run={run} /></div>
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Attack success</Text>
-            <Text weight="semibold">{formatProgressSuccess(overall)}</Text>
-            <Text size={200} className={styles.sectionHint}>{outcomes ? `${outcomes.successes} / ${outcomes.total_decided} decided` : `${overall.succeeded} / ${overall.completed} complete`}</Text>
-          </div>
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Errors / retries</Text><Text weight="semibold">{overall.errors} / {overall.retries}</Text></div>
-          <div className={styles.metadataItem}><Text size={200} className={styles.metadataLabel}>Labels</Text>
-            <div className={styles.badgeList}>{Object.entries(run.labels ?? {}).map(([key, value]) => <Badge key={key} appearance="outline" className={styles.labelBadge}>{key}: {value}</Badge>)}</div>
-          </div>
-        </section>
-        {(run.status === 'FAILED' || run.error || overall.errors > 0) && <MessageBar
-          intent={run.status === 'FAILED' ? 'error' : run.status === 'CANCELLED' && overall.errors === 0 ? 'info' : 'warning'}>
-          <MessageBarBody>{run.status === 'FAILED' ? 'Scan failed. Resume to continue remaining attacks.'
-            : run.status === 'CANCELLED' ? 'Scan cancelled.'
-            : `${overall.errors} attack${overall.errors === 1 ? '' : 's'} ended with an error.`}
-            {firstError && <Button appearance="transparent" onClick={(event) => { openDetails(firstError, event.currentTarget) }}>View attack</Button>}
-            {run.error && <Accordion collapsible><AccordionItem value="error">
-              <AccordionHeader>Error details</AccordionHeader>
-              <AccordionPanel><Text className={styles.objective}>{run.error_type ? `${run.error_type}: ` : ''}{run.error}</Text></AccordionPanel>
-            </AccordionItem></Accordion>}
-          </MessageBarBody>
-        </MessageBar>}
-        {state.stale && <MessageBar intent="warning"><MessageBarBody>Live updates paused. {state.error} <Button onClick={retry}>Retry</Button></MessageBarBody></MessageBar>}
-        {notices.length > 0 && <MessageBar aria-label="Scan notices"
-          intent={state.overloadSummaries.length > 0 || unmatched > 0 ? 'warning' : 'info'}>
-          <MessageBarBody>
-            {notices.join(' ')}
-            {state.overloadSummaries.length > 0 && <Accordion collapsible><AccordionItem value="overload">
-              <AccordionHeader>Overload details</AccordionHeader>
-              <AccordionPanel>{state.overloadSummaries.map((overload) => (
-                <Text block key={overload.component_role}>
-                  {overload.component_role.replace(/_/g, ' ')}: {overload.count}
-                  {overload.status_codes.length > 0 ? ` (HTTP ${overload.status_codes.join(', ')})` : ''}
-                </Text>
-              ))}</AccordionPanel>
-            </AccordionItem></Accordion>}
-          </MessageBarBody>
-        </MessageBar>}
-        {active && <section className={styles.progressSurface} aria-label="Scan progress">
-          <div className={styles.progressPrimary}>
-            <Text weight="semibold">{run.status === 'QUEUED' ? `Queued${run.queue_position ? ` · Position ${run.queue_position}` : ''}` : `${overall.completed}${overall.planned === null ? '' : ` of ${overall.planned}`} attacks complete`}</Text>
-            <ProgressBar value={overall.planned ? overall.completed / overall.planned : undefined} aria-label="Scan progress" />
-          </div>
-          <ScenarioRunTiming run={run} overall={overall} />
-        </section>}
-        {state.activeConversations.length > 0 && <section className={styles.section} aria-labelledby="live-conversations-heading">
-          <Text as="h2" id="live-conversations-heading" size={500} weight="semibold">Executing</Text>
-          {state.activeConversations.map((conversation) => (
-            <div key={conversation.conversation_id} className={styles.liveConversation}>
-              <Button appearance="transparent" onClick={(event) => {
-                detailsTrigger.current = event.currentTarget
-                navigate(scenarioRunAttackRoutePath(scenarioResultId, conversation.attack_result_id), { state: location.state })
-              }}>{conversation.atomic_attack_name}</Button>
-              <Text className={styles.preview}>{conversation.objective}</Text>
-              <Link to={scenarioConversationRoutePath(scenarioResultId, conversation.conversation_id)}>Watch live conversation</Link>
-            </div>
-          ))}
-        </section>}
-        {savedConversations.length > 0 && <section className={styles.section} aria-label="Saved conversations">
-          <Text as="h2" size={500} weight="semibold">Saved conversations</Text>
-          {savedConversations.map((conversation) => <div
-            key={`${conversation.attack_result_id}:${conversation.conversation_id}`} className={styles.liveConversation}>
-            <Text>{conversation.atomic_attack_name}</Text>
-            <Text className={styles.preview}>{conversation.objective}</Text>
-            <Link to={scenarioConversationRoutePath(scenarioResultId, conversation.conversation_id)}>Open saved conversation</Link>
-          </div>)}
-        </section>}
-        <section className={styles.section} aria-labelledby="atomic-groups-heading">
-          <div className={styles.sectionHeading}>
-            <div className={styles.objectivesHeading}>
-              <Text as="h2" id="atomic-groups-heading" size={500} weight="semibold">
-                Atomic attack groups
-              </Text>
-              <Button
-                appearance="subtle"
-                className={styles.touchTarget}
-                icon={atomicGroupsExpanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
-                aria-expanded={atomicGroupsExpanded}
-                aria-controls="atomic-groups-panel"
-                aria-label={`${atomicGroupsExpanded ? 'Collapse' : 'Expand'} atomic attack groups`}
-                data-testid="toggle-atomic-groups-btn"
-                ref={atomicGroupsToggleRef}
-                onClick={() => setAtomicGroupsExpandedChoice(!atomicGroupsExpanded)}
-              >
-              </Button>
-            </div>
-            <Text className={styles.sectionHint}>
-              {`${displayGroups.length.toLocaleString()} group${displayGroups.length === 1 ? '' : 's'}, ${executionCount.toLocaleString()} ${producerCounts ? '' : 'loaded '}execution${executionCount === 1 ? '' : 's'}`}
-            </Text>
-          </div>
-          <div id="atomic-groups-panel" hidden={!atomicGroupsExpanded}>
-            {atomicGroupsExpanded && (
-              <ScenarioResultHierarchy hierarchy={hierarchy} runStatus={run.status}>
-                {displayGroups.length === 0 ? (
-                  <EmptyState text="No atomic attack groups have been persisted yet." />
-                ) : (
-                  <div className={styles.displayGroupList}>
-                    {displayGroups.map((group) => {
-                      // Merge member groups newest-first so the row cap keeps the group's latest executions.
-                      const attempts = (group.atomic_group_ids ?? [])
-                        .flatMap((atomicGroupId) => attemptsByGroupId.get(atomicGroupId) ?? [])
-                        .sort((left, right) => Date.parse(right.timestamp) - Date.parse(left.timestamp))
-                      const defaultExpanded = displayGroups.length <= AUTO_EXPAND_GROUP_LIMIT
-                      const expanded = expandedGroupChoices.get(group.id) ?? defaultExpanded
-                      const panelId = `atomic-group-${group.id.replace(/[^a-zA-Z0-9_-]/g, '-')}`
-                      return (
-                        <article key={group.id} className={styles.displayGroup}>
-                          <div className={styles.displayGroupSummary}>
-                            <Button
-                              appearance="subtle"
-                              className={styles.expandButton}
-                              icon={expanded ? <ChevronDownRegular /> : <ChevronRightRegular />}
-                              aria-expanded={expanded}
-                              aria-controls={panelId}
-                              aria-label={`${expanded ? 'Collapse' : 'Expand'} attacks in ${group.display_group}`}
-                              onClick={() => toggleDisplayGroup(group.id, defaultExpanded)}
-                            />
-                            <span className={styles.displayGroupIdentity}>
-                              <Text size={400} weight="semibold">{group.display_group}</Text>
-                              <Text size={200} className={styles.sectionHint}>
-                                {group.atomic_attack_names.join(', ')}
-                              </Text>
-                            </span>
-                            <span className={styles.displayGroupMetrics}>
-                              <DisplayGroupMetric
-                                label="Completed"
-                                value={formatCompletion(group.completed, group.planned)}
-                              />
-                              <DisplayGroupMetric
-                                label="Attack success"
-                                value={formatSuccess(group.succeeded, group.completed, group.success_percentage)}
-                              />
-                              <DisplayGroupMetric label="Errors" value={String(group.errors)} />
-                              <DisplayGroupMetric label="Retries" value={String(group.retries)} />
-                            </span>
-                          </div>
-                          {expanded && (
-                            <div
-                              id={panelId}
-                              className={styles.displayGroupPanel}
-                              aria-label={`${group.display_group} attack executions`}
-                            >
-                              <AttackExecutionTable
-                                scenarioResultId={scenarioResultId}
-                                label={`${group.display_group} attack results`}
-                                attempts={attempts.slice(0, MAX_VISIBLE_ATTEMPTS_PER_GROUP)}
-                                totalAttempts={attempts.length}
-                                roots={hierarchy.roots.groups
-                                  .filter((savedGroup) => group.atomic_group_ids.includes(savedGroup.atomic_group_id))
-                                  .flatMap((savedGroup) => savedGroup.roots)}
-                                hierarchy={hierarchy}
-                                seedObjectives={seedObjectives}
-                                onOpenDetails={openAttemptDetails}
-                                showTimestamp={false}
-                                showConversationLink
-                                booleanOutcome
-                              />
-                            </div>
-                          )}
-                        </article>
-                      )
-                    })}
-                  </div>
-                )}
-              </ScenarioResultHierarchy>
-            )}
-          </div>
-        </section>
-        <section className={styles.section} aria-labelledby="objectives-heading">
-          <Text as="h2" id="objectives-heading" size={500} weight="semibold">Datasets &amp; objectives</Text>
-          <div className={styles.tableScroll}><Table size="small" aria-label="Datasets and objectives">
-            <TableHeader><TableRow><TableHeaderCell>Dataset</TableHeaderCell><TableHeaderCell>Objective</TableHeaderCell><TableHeaderCell>Attack success</TableHeaderCell><TableHeaderCell>Completed</TableHeaderCell></TableRow></TableHeader>
-            <TableBody>{summary.seed_groups.map((seed) => {
-              const planSeed = planSeeds.get(seed.id)
-              return <TableRow key={seed.id}>
-                <TableCell>{datasetsBySeed.get(seed.id) || 'Not recorded'}</TableCell>
-                <TableCell><Button appearance="transparent" className={styles.objectiveLinkButton} onClick={(event) => {
-                  objectiveTrigger.current = event.currentTarget
-                  setObjective(planSeed ?? { id: seed.id, objective_sha256: '', objective: seed.objective ?? 'Not recorded', prompts: [] })
-                }}>
-                  {objectivePreview(seed.objective ?? null, seed.id)}
-                </Button></TableCell>
-                <TableCell>{formatProgressSuccess(seed)}</TableCell>
-                <TableCell>{seed.completed}{seed.planned === null ? '' : ` / ${seed.planned}`}</TableCell>
-              </TableRow>
-            })}</TableBody>
-          </Table></div>
-        </section>
-        <section className={styles.section} aria-labelledby="configuration-heading">
-          <Text as="h2" id="configuration-heading" size={500} weight="semibold">Scenario configuration</Text>
-          {run.scenario_identity ? <Table size="small" aria-label="Scenario configuration"><TableBody>
-            <RegistryIdentityRow name={run.scenario_registry_name ?? run.scenario_name} identity={run.scenario_identity}
-              columns={1} expanded={identityExpanded} onToggle={() => { setIdentityExpanded((value: boolean) => !value) }} />
-          </TableBody></Table> : <Text className={styles.sectionHint}>No saved scenario identity.</Text>}
-        </section>
+        <ScenarioRunHeader run={run} active={active} controls={controls} headerRef={overviewRef} />
+        <ScenarioRunOverview run={run} overall={summary.overall} />
+        <ScenarioRunNotices run={run} summary={summary} state={state} onRetry={retry} onOpenAttempt={attackDetails.open} />
+        {active && <ScenarioRunProgress run={run} overall={summary.overall} />}
+        <ScenarioRunConversations
+          scenarioResultId={scenarioResultId}
+          results={state.results}
+          activeConversations={state.activeConversations}
+          recordedConversations={state.recordedConversations}
+          onOpenAttempt={attackDetails.open}
+        />
+        <AtomicAttackGroupsSection
+          scenarioResultId={scenarioResultId}
+          runStatus={run.status}
+          summary={summary}
+          results={state.results}
+          hierarchy={hierarchy}
+          seedObjectives={seedObjectives}
+          onOpenDetails={attackDetails.open}
+          toggleRef={groupsToggleRef}
+        />
+        <ScenarioRunObjectivesSection
+          summary={summary}
+          plan={state.plan}
+          results={state.results}
+          activeConversations={state.activeConversations}
+          onOpenObjective={(seed: ScenarioRunPlanSeedGroup, trigger: HTMLElement) => {
+            objectiveTrigger.current = trigger
+            setObjective(seed)
+          }}
+        />
+        <ScenarioRunConfigurationSection run={run} />
       </div>
-      <Dialog open={cancelOpen} onOpenChange={(_, data) => { if (!cancelling) setCancelOpen(data.open) }}>
-        <DialogSurface><DialogBody><DialogTitle>Cancel scan?</DialogTitle><DialogContent className={styles.dialogContent}>
-          <Text>Stop remaining attacks. Saved conversations and results stay available.</Text>
-          {cancelError && <MessageBar intent="error"><MessageBarBody>{cancelError}</MessageBarBody></MessageBar>}
-        </DialogContent><DialogActions><Button disabled={cancelling} onClick={() => { setCancelOpen(false) }}>Keep running</Button>
-          <Button appearance="primary" disabled={cancelling} onClick={() => { void cancel() }}>{cancelling ? 'Cancelling...' : 'Cancel scan'}</Button>
-        </DialogActions></DialogBody></DialogSurface>
-      </Dialog>
-      <Dialog
-        open={selectedAttempt !== null}
-        onOpenChange={(_, data) => {
-          if (!data.open) {
-            closeAttemptDetails()
-          }
-        }}
-      >
-        <DialogSurface className={styles.attackDetailDialogSurface}>
-          <DialogBody className={styles.attackDetailDialogBody}>
-            <DialogTitle
-              action={(
-                <Button
-                  appearance="subtle"
-                  icon={<DismissRegular />}
-                  aria-label="Close attack details"
-                  onClick={closeAttemptDetails}
-                />
-              )}
-            >
-              {selectedAttempt?.atomic_attack_name || 'Attack attempt'}
-            </DialogTitle>
-            {selectedAttempt && (
-              <DialogContent className={styles.attackDetailDialogContent}>
-                <AttackAttemptDetails
-                  attempt={selectedAttempt}
-                  objective={
-                    (hierarchySelection?.attack_result_id === selectedAttempt.attack_result_id
-                      ? hierarchySelection.objective
-                      : null) ??
-                    ('objective' in selectedAttempt ? selectedAttempt.objective : null) ??
-                    (selectedAttempt.seed_group_id ? seedObjectives.get(selectedAttempt.seed_group_id) : null) ??
-                    null
-                  }
-                  atomicGroup={selectedAttemptGroup}
-                  techniqueDetails={selectedActive?.technique_details
-                    ?? (selectedAtomicGroupId ? progressAtomicGroups.get(selectedAtomicGroupId)?.technique_details : null)}
-                  objectiveScorer={objectiveScorer}
-                  conversationPath={selectedActive
-                    ? scenarioConversationRoutePath(scenarioResultId, selectedActive.conversation_id)
-                    : selectedAttempt.conversation_id
-                      ? attackConversationRoutePath(selectedAttempt.attack_result_id, selectedAttempt.conversation_id, scenarioResultId)
-                      : null}
-                  conversationState={location.state}
-                />
-              </DialogContent>
-            )}
-            <DialogActions>
-              <Button appearance="primary" onClick={closeAttemptDetails}>Close</Button>
-            </DialogActions>
-          </DialogBody>
-        </DialogSurface>
-      </Dialog>
+      <CancelScanDialog open={controls.cancelOpen} cancelling={controls.cancelling} error={controls.cancelError}
+        onOpenChange={controls.setCancelOpen} onConfirm={controls.cancel} />
+      <AttackDetailsDialog
+        scenarioResultId={scenarioResultId}
+        attempt={attackDetails.selectedAttempt}
+        hierarchySelection={attackDetails.hierarchySelection}
+        plan={state.plan}
+        summary={summary}
+        activeConversations={state.activeConversations}
+        seedObjectives={seedObjectives}
+        conversationState={location.state}
+        onClose={attackDetails.close}
+      />
       <ObjectiveDetailsDialog objective={objective} onClose={closeObjective}
         attempts={objective ? attemptsBySeed.get(objective.id) ?? [] : []}
-        onOpenAttempt={openDetails} scenarioResultId={scenarioResultId} />
+        onOpenAttempt={openObjectiveAttempt} scenarioResultId={scenarioResultId} />
     </main>
   )
 }
-
-function EmptyState({ text }: { readonly text: string }) {
-  return <Text className={useScenarioRunPageStyles().sectionHint}>{text}</Text>
-}
-
-function DisplayGroupMetric({ label, value }: { readonly label: string; readonly value: string }) {
-  return (
-    <div>
-      <Text size={200}>{label}</Text>
-      <Text weight="semibold">{value}</Text>
-    </div>
-  )
-}
-
-function formatCompletion(completed: number, planned: number | null): string {
-  return planned === null ? `${completed}/total unavailable` : `${completed}/${planned}`
-}
-
-function formatSuccess(succeeded: number, completed: number, percentage: number | null): string {
-  if (percentage === null) return completed === 0 ? 'Unavailable' : `${succeeded}/${completed}`
-  return `${percentage}%`
-}
diff --git a/frontend/src/components/Scenarios/ScenarioRunProgress.tsx b/frontend/src/components/Scenarios/ScenarioRunProgress.tsx
new file mode 100644
index 0000000000..9d7712180d
--- /dev/null
+++ b/frontend/src/components/Scenarios/ScenarioRunProgress.tsx
@@ -0,0 +1,28 @@
+import { ProgressBar, Text } from '@fluentui/react-components'
+
+import type { ScenarioProgressCounts, ScenarioProgressHeader } from '@/types'
+
+import { useScenarioRunPageStyles } from './ScenarioRunPage.styles'
+import ScenarioRunTiming from './ScenarioRunTiming'
+
+interface ScenarioRunProgressProps {
+  readonly run: ScenarioProgressHeader
+  readonly overall: ScenarioProgressCounts
+}
+
+/** Queue position or completed attacks, with elapsed time and ETA, while a scan is active. */
+export default function ScenarioRunProgress({ run, overall }: ScenarioRunProgressProps) {
+  const styles = useScenarioRunPageStyles()
+  const status = run.status === 'QUEUED'
+    ? `Queued${run.queue_position ? ` · Position ${run.queue_position}` : ''}`
+    : `${overall.completed}${overall.planned === null ? '' : ` of ${overall.planned}`} attacks complete`
+  return (
+    <section className={styles.progressSurface} aria-label="Scan progress">
+      <div className={styles.progressPrimary}>
+        <Text weight="semibold">{status}</Text>
+        <ProgressBar value={overall.planned ? overall.completed / overall.planned : undefined} aria-label="Scan progress" />
+      </div>
+      <ScenarioRunTiming run={run} overall={overall} />
+    </section>
+  )
+}
diff --git a/frontend/src/components/Scenarios/ScenarioTechniqueSection.tsx b/frontend/src/components/Scenarios/ScenarioTechniqueSection.tsx
index 53aff2aea8..027a86564b 100644
--- a/frontend/src/components/Scenarios/ScenarioTechniqueSection.tsx
+++ b/frontend/src/components/Scenarios/ScenarioTechniqueSection.tsx
@@ -5,7 +5,7 @@ import { ChevronDownRegular, ChevronRightRegular } from '@fluentui/react-icons'
 
 import ContextualHelpLabel from '@/components/ContextualHelpLabel'
 import { HELP_DEFINITIONS } from '@/components/helpDefinitions'
-import { useRegistryIdentityRowStyles } from '@/components/Registry/RegistryIdentityRow.styles'
+import { useIdentityDisclosureStyles } from '@/components/Registry/IdentityDisclosure.styles'
 
 import { useScenarioDetailStyles } from './ScenarioDetail.styles'
 import { exceedsTechniqueLimit, type SelectableTechnique } from './scenarioLaunchForm'
@@ -46,7 +46,7 @@ export default function ScenarioTechniqueSection({
   onRemoveToken,
 }: ScenarioTechniqueSectionProps) {
   const styles = useScenarioDetailStyles()
-  const identityStyles = useRegistryIdentityRowStyles()
+  const identityStyles = useIdentityDisclosureStyles()
   const identityId = useId()
   const [expandedIdentities, setExpandedIdentities] = useState<Set<string>>(new Set())
   const toggleIdentity = (name: string): void => {
diff --git a/frontend/src/components/Scenarios/scenarioRunNavigation.test.ts b/frontend/src/components/Scenarios/scenarioRunNavigation.test.ts
new file mode 100644
index 0000000000..a0a754959c
--- /dev/null
+++ b/frontend/src/components/Scenarios/scenarioRunNavigation.test.ts
@@ -0,0 +1,22 @@
+import { scenarioRunBackLink } from './scenarioRunNavigation'
+
+describe('scenarioRunBackLink', () => {
+  it('returns to the suite execution that opened the run', () => {
+    expect(scenarioRunBackLink({ suiteExecutionId: 'suite-1', suiteName: 'Nightly', fromScenarioHistory: true }))
+      .toEqual({ path: '/scanner/history/suites/executions/suite-1', label: 'Back to Nightly' })
+    expect(scenarioRunBackLink({ suiteExecutionId: 'suite-1' }).label).toBe('Back to suite execution')
+  })
+
+  it('returns to scan history with its filters', () => {
+    expect(scenarioRunBackLink({ scenarioHistorySearch: '?status=FAILED' }))
+      .toEqual({ path: '/scanner/history?status=FAILED', label: 'Back to scans' })
+    expect(scenarioRunBackLink({ fromScenarioHistory: true }))
+      .toEqual({ path: '/scanner/history', label: 'Back to scans' })
+  })
+
+  it('returns to the launched scenario, or the scanner catalog', () => {
+    expect(scenarioRunBackLink({ scenarioName: 'garak/encoding' }))
+      .toEqual({ path: '/scanner/launch/garak%2Fencoding', label: 'Back to scenario' })
+    expect(scenarioRunBackLink(null)).toEqual({ path: '/scanner/launch', label: 'Back to scanners' })
+  })
+})
diff --git a/frontend/src/components/Scenarios/scenarioRunNavigation.ts b/frontend/src/components/Scenarios/scenarioRunNavigation.ts
new file mode 100644
index 0000000000..ece7af2438
--- /dev/null
+++ b/frontend/src/components/Scenarios/scenarioRunNavigation.ts
@@ -0,0 +1,32 @@
+import { suiteExecutionRoutePath } from '@/components/ScenarioSuites/suiteRoutes'
+
+/** Where the run page was opened from, carried in router location state. */
+export interface ScenarioRunNavigationState {
+  fromScenarioHistory?: boolean
+  scenarioHistorySearch?: string
+  scenarioName?: string
+  suiteExecutionId?: string
+  suiteName?: string
+}
+
+interface ScenarioRunBackLink {
+  readonly path: string
+  readonly label: string
+}
+
+/** Return to the suite, history filters, or scanner that opened the run. */
+export function scenarioRunBackLink(state: ScenarioRunNavigationState | null): ScenarioRunBackLink {
+  if (state?.suiteExecutionId) {
+    return {
+      path: suiteExecutionRoutePath(state.suiteExecutionId),
+      label: `Back to ${state.suiteName ?? 'suite execution'}`,
+    }
+  }
+  if (state?.fromScenarioHistory || state?.scenarioHistorySearch) {
+    return { path: `/scanner/history${state.scenarioHistorySearch ?? ''}`, label: 'Back to scans' }
+  }
+  if (state?.scenarioName) {
+    return { path: `/scanner/launch/${encodeURIComponent(state.scenarioName)}`, label: 'Back to scenario' }
+  }
+  return { path: '/scanner/launch', label: 'Back to scanners' }
+}
diff --git a/frontend/src/hooks/useAttackFindings.test.tsx b/frontend/src/hooks/useAttackFindings.test.tsx
new file mode 100644
index 0000000000..7400e7f5be
--- /dev/null
+++ b/frontend/src/hooks/useAttackFindings.test.tsx
@@ -0,0 +1,72 @@
+import { act, renderHook, waitFor } from '@testing-library/react'
+
+import { attacksApi } from '@/services/api'
+import type { AttackFindingItem } from '@/types'
+
+import { useAttackFindings } from './useAttackFindings'
+
+jest.mock('@/services/api', () => ({ attacksApi: { getAttackFindings: jest.fn() } }))
+
+const FINDING = {
+  id: 'finding-1', operation_id: 'operation-1', title: 'Prompt leak', severity: 'high', description: '',
+  created_at: '2026-10-08T12:00:00Z', operation_name: 'Review', evidence_id: 'evidence-1',
+} as AttackFindingItem
+
+describe('useAttackFindings', () => {
+  beforeEach(() => {
+    jest.clearAllMocks()
+  })
+
+  it('should load the findings that link an attack', async () => {
+    jest.mocked(attacksApi.getAttackFindings).mockResolvedValue({ attack_result_id: 'attack-1', items: [FINDING] })
+    const { result } = renderHook(() => useAttackFindings('attack-1'))
+
+    expect(result.current.loading).toBe(true)
+    await waitFor(() => { expect(result.current.loading).toBe(false) })
+    expect(result.current.findings).toEqual([FINDING])
+    expect(result.current.error).toBeNull()
+    expect(attacksApi.getAttackFindings).toHaveBeenCalledWith('attack-1')
+  })
+
+  it('should not request findings without an attack', () => {
+    const { result } = renderHook(() => useAttackFindings(null))
+    expect(result.current).toMatchObject({ findings: [], loading: false, error: null })
+    expect(attacksApi.getAttackFindings).not.toHaveBeenCalled()
+  })
+
+  it('should keep findings visible while a refresh reloads them', async () => {
+    jest.mocked(attacksApi.getAttackFindings).mockResolvedValueOnce({ attack_result_id: 'attack-1', items: [FINDING] })
+    const { result } = renderHook(() => useAttackFindings('attack-1'))
+    await waitFor(() => { expect(result.current.loading).toBe(false) })
+    expect(result.current.findings).toEqual([FINDING])
+
+    let resolve: (value: { attack_result_id: string; items: AttackFindingItem[] }) => void = () => {}
+    jest.mocked(attacksApi.getAttackFindings).mockReturnValueOnce(new Promise((complete) => { resolve = complete }))
+    act(() => { result.current.refresh() })
+    expect(result.current.loading).toBe(true)
+    expect(result.current.findings).toEqual([FINDING])
+
+    await act(async () => { resolve({ attack_result_id: 'attack-1', items: [] }) })
+    expect(result.current.findings).toEqual([])
+    expect(attacksApi.getAttackFindings).toHaveBeenCalledTimes(2)
+  })
+
+  it('should not show another attack\'s findings after switching attacks', async () => {
+    jest.mocked(attacksApi.getAttackFindings).mockResolvedValueOnce({ attack_result_id: 'attack-1', items: [FINDING] })
+    const { result, rerender } = renderHook(({ id }: { id: string }) => useAttackFindings(id), { initialProps: { id: 'attack-1' } })
+    await waitFor(() => { expect(result.current.findings).toEqual([FINDING]) })
+
+    jest.mocked(attacksApi.getAttackFindings).mockReturnValueOnce(new Promise(() => {}))
+    rerender({ id: 'attack-2' })
+    expect(result.current.findings).toEqual([])
+    expect(result.current.loading).toBe(true)
+  })
+
+  it('should report a failed request', async () => {
+    jest.mocked(attacksApi.getAttackFindings).mockRejectedValue(new Error('Findings unavailable'))
+    const { result } = renderHook(() => useAttackFindings('attack-1'))
+    await waitFor(() => { expect(result.current.loading).toBe(false) })
+    expect(result.current.error).toBe('Findings unavailable')
+    expect(result.current.findings).toEqual([])
+  })
+})
diff --git a/frontend/src/hooks/useAttackFindings.ts b/frontend/src/hooks/useAttackFindings.ts
new file mode 100644
index 0000000000..fa022d591d
--- /dev/null
+++ b/frontend/src/hooks/useAttackFindings.ts
@@ -0,0 +1,51 @@
+import { useCallback, useEffect, useState } from 'react'
+
+import { attacksApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import type { AttackFindingItem } from '@/types'
+
+export interface AttackFindingsState {
+  findings: AttackFindingItem[]
+  loading: boolean
+  error: string | null
+  refresh: () => void
+}
+
+interface LoadedFindings {
+  attackResultId: string
+  revision: number
+  findings: AttackFindingItem[]
+  error: string | null
+}
+
+/** Findings in any Operation that link this attack as evidence. Without an attack id, there are none. */
+export function useAttackFindings(attackResultId: string | null | undefined): AttackFindingsState {
+  const [revision, setRevision] = useState(0)
+  const [loaded, setLoaded] = useState<LoadedFindings | null>(null)
+
+  useEffect(() => {
+    if (!attackResultId) return
+    let ignore = false
+    attacksApi.getAttackFindings(attackResultId)
+      .then((response) => {
+        if (!ignore) setLoaded({ attackResultId, revision, findings: response.items, error: null })
+      })
+      .catch((cause: unknown) => {
+        if (!ignore) setLoaded({ attackResultId, revision, findings: [], error: toApiError(cause).detail })
+      })
+    return () => { ignore = true }
+  }, [attackResultId, revision])
+
+  const refresh = useCallback((): void => {
+    setRevision((current: number) => current + 1)
+  }, [])
+
+  // Keep the previous answer for the same attack while a refresh is in flight, so attached findings do not flicker.
+  const current = attackResultId && loaded?.attackResultId === attackResultId ? loaded : null
+  return {
+    findings: current?.findings ?? [],
+    loading: Boolean(attackResultId) && current?.revision !== revision,
+    error: current?.error ?? null,
+    refresh,
+  }
+}
diff --git a/frontend/src/hooks/useScenarioRunAttackDetails.ts b/frontend/src/hooks/useScenarioRunAttackDetails.ts
new file mode 100644
index 0000000000..481f4f50a9
--- /dev/null
+++ b/frontend/src/hooks/useScenarioRunAttackDetails.ts
@@ -0,0 +1,66 @@
+import { useMemo, useRef, useState } from 'react'
+
+import { useLocation, useNavigate } from 'react-router'
+
+import type { ScenarioActiveConversation, ScenarioHierarchyNode, ScenarioProgressResult } from '@/types'
+import { scenarioRunAttackRoutePath, scenarioRunRoutePath } from '@/utils/routeParams'
+
+export type ScenarioRunAttempt = ScenarioProgressResult | ScenarioHierarchyNode | ScenarioActiveConversation
+
+interface UseScenarioRunAttackDetailsOptions {
+  readonly scenarioResultId: string
+  /** The attack named by the route, if any. */
+  readonly attackResultId: string | null
+  readonly results: readonly ScenarioProgressResult[]
+  readonly activeConversations: readonly ScenarioActiveConversation[]
+  /** Receives focus on close when the control that opened the details is gone. */
+  readonly fallbackFocus: () => HTMLElement | null
+}
+
+export interface ScenarioRunAttackDetails {
+  readonly selectedAttempt: ScenarioRunAttempt | null
+  /** The hierarchy node the details were opened from, which may carry the objective. */
+  readonly hierarchySelection: ScenarioHierarchyNode | null
+  readonly open: (attempt: ScenarioRunAttempt, trigger: HTMLElement | null) => void
+  readonly close: () => void
+}
+
+/** The attack shown in the run's details dialog, addressed by route so it survives reloads and back navigation. */
+export function useScenarioRunAttackDetails({
+  scenarioResultId,
+  attackResultId,
+  results,
+  activeConversations,
+  fallbackFocus,
+}: UseScenarioRunAttackDetailsOptions): ScenarioRunAttackDetails {
+  const navigate = useNavigate()
+  const location = useLocation()
+  const trigger = useRef<HTMLElement | null>(null)
+  const [hierarchySelection, setHierarchySelection] = useState<ScenarioHierarchyNode | null>(null)
+
+  // A hierarchy node can be opened before the paged progress feed has delivered it.
+  const selectedAttempt = useMemo<ScenarioRunAttempt | null>(
+    () =>
+      results.find((attempt) => attempt.attack_result_id === attackResultId) ??
+      activeConversations.find((conversation) => conversation.attack_result_id === attackResultId) ??
+      (hierarchySelection?.attack_result_id === attackResultId ? hierarchySelection : null),
+    [attackResultId, results, activeConversations, hierarchySelection],
+  )
+
+  return {
+    selectedAttempt,
+    hierarchySelection,
+    open: (attempt: ScenarioRunAttempt, opener: HTMLElement | null): void => {
+      trigger.current = opener
+      setHierarchySelection('result_role' in attempt ? attempt : null)
+      navigate(scenarioRunAttackRoutePath(scenarioResultId, attempt.attack_result_id), { state: location.state })
+    },
+    close: (): void => {
+      navigate(scenarioRunRoutePath(scenarioResultId), { replace: true, state: location.state })
+      requestAnimationFrame(() => {
+        const focusTarget = trigger.current?.isConnected ? trigger.current : fallbackFocus()
+        focusTarget?.focus()
+      })
+    },
+  }
+}
diff --git a/frontend/src/hooks/useScenarioRunControls.ts b/frontend/src/hooks/useScenarioRunControls.ts
new file mode 100644
index 0000000000..4dc257c21c
--- /dev/null
+++ b/frontend/src/hooks/useScenarioRunControls.ts
@@ -0,0 +1,118 @@
+import { useEffect, useRef, useState } from 'react'
+
+import { useLocation, useNavigate } from 'react-router'
+
+import { useScenarioRunResume } from '@/hooks/useScenarioRunResume'
+import { scenariosApi } from '@/services/api'
+import { toApiError } from '@/services/errors'
+import type { ScenarioRunSummary } from '@/types'
+import { scenarioRerunRoutePath } from '@/utils/routeParams'
+
+interface UseScenarioRunControlsOptions {
+  readonly scenarioResultId: string
+  readonly applyRunSummary: (run: ScenarioRunSummary) => void
+  /** Reload run progress after a resume that did not start. */
+  readonly retry: () => void
+  readonly refreshQueue: () => void
+  /** The run's own error, which the page already shows with the run. */
+  readonly runError?: string | null
+}
+
+export interface ScenarioRunControls {
+  readonly rerunPending: boolean
+  readonly rerun: () => void
+  readonly cancelOpen: boolean
+  readonly setCancelOpen: (open: boolean) => void
+  readonly cancelling: boolean
+  readonly cancelError: string | null
+  readonly cancel: () => void
+  readonly resumePending: boolean
+  readonly resume: () => void
+  /** The rerun or resume failure to show beside the controls. */
+  readonly controlError: string | null
+}
+
+/** Rerun, cancel, and resume one scan, keeping each request's pending state and errors. */
+export function useScenarioRunControls({
+  scenarioResultId,
+  applyRunSummary,
+  retry,
+  refreshQueue,
+  runError,
+}: UseScenarioRunControlsOptions): ScenarioRunControls {
+  const navigate = useNavigate()
+  const location = useLocation()
+  const [cancelOpen, setCancelOpen] = useState(false)
+  const [cancelling, setCancelling] = useState(false)
+  const [cancelError, setCancelError] = useState<string | null>(null)
+  const [rerunPending, setRerunPending] = useState(false)
+  const [rerunError, setRerunError] = useState<string | null>(null)
+  const rerunRequest = useRef<AbortController | null>(null)
+  const resumeRequest = useScenarioRunResume({
+    onResumed: applyRunSummary,
+    onRefresh: (succeeded: boolean): void => {
+      refreshQueue()
+      if (!succeeded) retry()
+    },
+  })
+
+  // Leaving the run, or opening an attempt on it, abandons a rerun still loading its configuration.
+  useEffect(() => () => {
+    rerunRequest.current?.abort()
+    rerunRequest.current = null
+  }, [location.pathname])
+
+  async function requestRerun(): Promise<void> {
+    rerunRequest.current?.abort()
+    const controller = new AbortController()
+    rerunRequest.current = controller
+    setRerunPending(true)
+    setRerunError(null)
+    try {
+      const request = await scenariosApi.getLaunchConfiguration(scenarioResultId, controller.signal)
+      if (rerunRequest.current !== controller || controller.signal.aborted) return
+      navigate(scenarioRerunRoutePath(request.scenario_name, scenarioResultId))
+    } catch (error: unknown) {
+      if (rerunRequest.current !== controller || controller.signal.aborted) return
+      setRerunError(toApiError(error).detail)
+    } finally {
+      if (rerunRequest.current === controller) {
+        rerunRequest.current = null
+        setRerunPending(false)
+      }
+    }
+  }
+
+  async function requestCancel(): Promise<void> {
+    setCancelling(true)
+    setCancelError(null)
+    try {
+      applyRunSummary(await scenariosApi.cancelRun(scenarioResultId))
+      setCancelOpen(false)
+    } catch (error: unknown) {
+      setCancelError(toApiError(error).detail)
+    } finally {
+      setCancelling(false)
+    }
+  }
+
+  return {
+    rerunPending,
+    rerun: (): void => { void requestRerun() },
+    cancelOpen,
+    setCancelOpen: (open: boolean): void => {
+      if (open) setCancelError(null)
+      if (!cancelling) setCancelOpen(open)
+    },
+    cancelling,
+    cancelError,
+    cancel: (): void => { void requestCancel() },
+    resumePending: resumeRequest.pendingRunId !== null,
+    resume: (): void => {
+      setRerunError(null)
+      resumeRequest.requestResume(scenarioResultId)
+    },
+    controlError: rerunError ?? resumeRequest.error
+      ?? (resumeRequest.executionError !== runError ? resumeRequest.executionError : null),
+  }
+}
diff --git a/frontend/src/services/api.test.ts b/frontend/src/services/api.test.ts
index 225fc20e5f..f18e46408f 100644
--- a/frontend/src/services/api.test.ts
+++ b/frontend/src/services/api.test.ts
@@ -42,7 +42,7 @@ import {
 import { compatibility, COMPATIBILITY_HEADER } from "./compatibility";
 import { toApiError } from "./errors";
 import { makeAnalyticsFacets, makeAnalyticsReport, makeAnalyticsResults } from "@/test-utils/analyticsFixtures";
-import type { FindingExportRequest } from "@/types";
+import type { AttackFindingListResponse, FindingExportRequest } from "@/types";
 import { DEFAULT_ANALYTICS_VIEW } from "@/utils/attackAnalytics";
 
 describe("api service", () => {
@@ -823,6 +823,28 @@ describe("api service", () => {
       });
     });
 
+    it("should get the findings linked to an attack", async () => {
+      const data: AttackFindingListResponse = {
+        attack_result_id: "attack/id",
+        items: [{
+          id: "finding", operation_id: "operation", operation_name: "Red team", evidence_id: "evidence",
+          title: "Protected system instructions disclosed", description: "", severity: "important",
+          created_at: "2026-11-06T00:00:00Z",
+        }],
+      };
+      (apiClient.get as jest.Mock).mockResolvedValueOnce({ data });
+
+      expect(await attacksApi.getAttackFindings("attack/id")).toEqual(data);
+      expect(apiClient.get).toHaveBeenCalledTimes(1);
+      expect(apiClient.get).toHaveBeenCalledWith("/attacks/attack%2Fid/findings");
+    });
+
+    it("should propagate attack finding errors", async () => {
+      const error = new Error("Findings unavailable");
+      (apiClient.get as jest.Mock).mockRejectedValueOnce(error);
+      await expect(attacksApi.getAttackFindings("attack")).rejects.toBe(error);
+    });
+
     it("should get attack messages", async () => {
       const mockResponse = {
         data: {
diff --git a/frontend/src/services/api.ts b/frontend/src/services/api.ts
index fe1bb5256c..73c3583fda 100644
--- a/frontend/src/services/api.ts
+++ b/frontend/src/services/api.ts
@@ -7,6 +7,7 @@ import { getGraphScopes } from '../auth/msalConfig'
 import type {
   ApplyChatScorerRequest,
   ApplyChatScorerResponse,
+  AttackFindingListResponse,
   TargetInstance,
   UnregisteredTarget,
   UnregisteredConverter,
@@ -502,6 +503,12 @@ export const attacksApi = {
     return response.data
   },
 
+  /** Findings in any Operation that link this attack as evidence; empty for an unsaved running attack. */
+  getAttackFindings: async (attackResultId: string): Promise<AttackFindingListResponse> => {
+    const response = await apiClient.get(`/attacks/${encodeURIComponent(attackResultId)}/findings`)
+    return response.data
+  },
+
   updateAttack: async (attackResultId: string, request: UpdateAttackRequest): Promise<AttackSummary> => {
     const response = await apiClient.patch(`/attacks/${encodeURIComponent(attackResultId)}`, request)
     return response.data
diff --git a/frontend/src/types/index.ts b/frontend/src/types/index.ts
index d083e05f96..1a4d81f4b1 100644
--- a/frontend/src/types/index.ts
+++ b/frontend/src/types/index.ts
@@ -795,6 +795,9 @@ export type AttackTargetResolutionStatus =
 
 export type AttackOutcome = 'undetermined' | 'success' | 'failure' | 'error'
 
+/** An attack's saved outcome, or where it is before one exists. */
+export type AttackDisplayOutcome = AttackOutcome | 'in_progress' | 'preparing'
+
 // Wire contracts from pyrit.models.analytics. The SDK selects and counts the cohort.
 export type AttackAnalyticsDimensionName =
   | 'operation'
@@ -998,6 +1001,10 @@ export interface AttackSummary {
   chat_scorer?: RegisteredComponentReference | null
   chat_scorer_inherited?: boolean
   execution_read_only?: boolean
+  /** The attack is still running in a scan; its result is not saved yet. */
+  in_progress?: boolean
+  /** The scan run that produced this attack; null outside a scan. */
+  scenario_result_id?: string | null
   manual_continuation?: ManualContinuation | null
   last_score?: BackendScore | null
   last_response?: BackendMessagePiece | null
@@ -1023,7 +1030,7 @@ export interface AttackSummary {
 export interface AttackMetadata extends Pick<AttackSummary,
   | 'attack_result_id' | 'conversation_id' | 'objective' | 'labels' | 'operator'
   | 'target' | 'target_unbound' | 'outcome' | 'automated_score' | 'human_score'
-  | 'chat_scorer' | 'chat_scorer_inherited' | 'manual_continuation'
+  | 'chat_scorer' | 'chat_scorer_inherited' | 'manual_continuation' | 'in_progress' | 'scenario_result_id'
 > {
   readonly execution_read_only: boolean
   readonly last_response_message_piece_id: string | null
@@ -1196,6 +1203,20 @@ export interface DisplayScore extends BackendScore {
   sourceLabel: string
 }
 
+/**
+ * The fields a score popover shows, independent of where the score was recorded,
+ * so scan results do not need to fabricate a message-piece score.
+ */
+export interface ScoreSummary {
+  scorer: string
+  scoreType: string
+  value?: string | null
+  status?: string
+  rationale?: string | null
+  categories?: string[] | null
+  isObjective?: boolean
+}
+
 export interface BackendMessagePiece {
   id: string
   sequence?: number
@@ -2095,13 +2116,14 @@ export interface ScenarioQueueSnapshot {
   queued: ScenarioQueueEntry[]
 }
 
-/** One persisted attack attempt in ascending progress order. */
+/** The objective score of one persisted scan attack attempt. */
 export interface ScenarioProgressScore {
   scorer_name: string
   score_type: 'true_false' | 'float_scale' | 'unknown'
   status: 'complete' | 'undetermined'
   score_value?: string | null
   score_rationale?: string | null
+  score_category?: string[]
 }
 
 export type ScenarioIdentityValue =
@@ -2351,7 +2373,10 @@ export interface ScenarioProgressSummary {
 
 export interface ScenarioActiveConversation {
   attack_result_id: string
+  /** The conversation the attack is working on, or the recorded objective conversation. */
   conversation_id: string
+  /** Every objective conversation the running attack has started so far, in first-use order. */
+  conversation_ids?: string[]
   atomic_attack_name: string
   seed_group_id?: string | null
   objective: string
@@ -2459,6 +2484,20 @@ export interface FindingListItem extends Finding {
   evidence_count: number
 }
 
+/** A finding that links an attack as evidence. */
+export interface AttackFindingItem extends Finding {
+  /** Current name of the finding's Operation. */
+  operation_name: string
+  /** The evidence link; detach it through the Operation evidence route. */
+  evidence_id: string
+}
+
+/** Every finding that links an attack, highest severity first, then newest first. */
+export interface AttackFindingListResponse {
+  attack_result_id: string
+  items: AttackFindingItem[]
+}
+
 export interface FindingEvidenceCreateRequest {
   attack_result_id: string
 }
diff --git a/frontend/src/utils/scoreSummary.test.ts b/frontend/src/utils/scoreSummary.test.ts
new file mode 100644
index 0000000000..fc01d0b0ea
--- /dev/null
+++ b/frontend/src/utils/scoreSummary.test.ts
@@ -0,0 +1,34 @@
+import type { BackendScore, ScenarioProgressScore } from '@/types'
+
+import { scoreSummaryFromBackendScore, scoreSummaryFromProgressScore, scoreSummaryValue } from './scoreSummary'
+
+describe('scoreSummary', () => {
+  it('maps a message-piece score without losing its role', () => {
+    const score: BackendScore = {
+      id: 'score-1', message_piece_id: 'piece-1', scorer_type: 'Judge', score_type: 'true_false',
+      score_value: 'false', status: 'complete', is_objective_score: false, score_category: ['harm'],
+      score_rationale: 'Refused.', timestamp: '2026-01-01T00:00:00Z',
+    }
+    expect(scoreSummaryFromBackendScore(score)).toEqual({
+      scorer: 'Judge', scoreType: 'true_false', value: 'false', status: 'complete',
+      rationale: 'Refused.', categories: ['harm'], isObjective: false,
+    })
+  })
+
+  it('treats a scan result score as the objective score', () => {
+    const score: ScenarioProgressScore = {
+      scorer_name: 'objective', score_type: 'true_false', status: 'complete', score_value: 'true',
+      score_rationale: 'Met.', score_category: ['jailbreak'],
+    }
+    expect(scoreSummaryFromProgressScore(score)).toEqual({
+      scorer: 'objective', scoreType: 'true_false', value: 'true', status: 'complete',
+      rationale: 'Met.', categories: ['jailbreak'], isObjective: true,
+    })
+  })
+
+  it('names the status of a score without a value', () => {
+    expect(scoreSummaryValue({ scorer: 'Judge', scoreType: 'true_false', value: 'true', status: 'complete' })).toBe('true')
+    expect(scoreSummaryValue({ scorer: 'Judge', scoreType: 'true_false', value: null, status: 'undetermined' })).toBe('undetermined')
+    expect(scoreSummaryValue({ scorer: 'Judge', scoreType: 'true_false' })).toBe('')
+  })
+})
diff --git a/frontend/src/utils/scoreSummary.ts b/frontend/src/utils/scoreSummary.ts
new file mode 100644
index 0000000000..342eb674e4
--- /dev/null
+++ b/frontend/src/utils/scoreSummary.ts
@@ -0,0 +1,31 @@
+import type { BackendScore, ScenarioProgressScore, ScoreSummary } from '@/types'
+
+export function scoreSummaryFromBackendScore(score: BackendScore): ScoreSummary {
+  return {
+    scorer: score.scorer_type,
+    scoreType: score.score_type,
+    value: score.score_value,
+    status: score.status,
+    rationale: score.score_rationale,
+    categories: score.score_category,
+    isObjective: score.is_objective_score,
+  }
+}
+
+/** A scan result's score is the attack's objective score. */
+export function scoreSummaryFromProgressScore(score: ScenarioProgressScore): ScoreSummary {
+  return {
+    scorer: score.scorer_name,
+    scoreType: score.score_type,
+    value: score.score_value,
+    status: score.status,
+    rationale: score.score_rationale,
+    categories: score.score_category,
+    isObjective: true,
+  }
+}
+
+/** An undetermined score has no value, so name its status instead. */
+export function scoreSummaryValue(score: ScoreSummary): string {
+  return score.value ?? score.status ?? ''
+}
diff --git a/pyrit/backend/README.md b/pyrit/backend/README.md
index 06afc418b7..62374b6e76 100644
--- a/pyrit/backend/README.md
+++ b/pyrit/backend/README.md
@@ -129,6 +129,42 @@ Both paged and unpaged reads expose only main and pruned conversations.
 Adversarial and preparation contexts are excluded from lists, reference totals,
 and transcript reads, including hierarchy node expansion.
 
+### Running scan attacks
+
+A scan saves each `AttackResult` only when its attack finishes. While an active scan
+is still running an attack, `GET /api/attacks/{attack_result_id}`, `/metadata`,
+`/conversations`, and `/messages` (paged or not) resolve it from the live run instead
+of returning 404. The attack summary and metadata responses set `in_progress: true`,
+report outcome `undetermined`, and set `execution_read_only: true`. Read these
+endpoints for running state; conversation and message responses do not include
+the running-state flags. Write routes still require a saved result. The
+conversation the attack is working on is the main conversation,
+and every other objective conversation started so far is listed as a pruned
+reference. Messages are read from memory as they are saved. A saved result always
+wins, so once the attack finishes the same IDs resolve to its saved result; restart
+reference paging if a cursor becomes stale at that transition. An attack that has
+not started an objective conversation yet still returns 404.
+
+Attack summaries and metadata also include `scenario_result_id`, the scan run that
+produced the attack (`null` for attacks outside a scan). Scan progress
+`active_conversations` entries list every objective conversation so far in
+`conversation_ids`, alongside the current `conversation_id`. Each scan progress
+result and hierarchy node `score` summarizes the objective score: `scorer_name`,
+`score_type`, `status`, `score_value`, `score_rationale`, and `score_category`.
+
+The attack service reads running attacks through a read-only lookup
+(`LiveAttackLookup`) that the scenario run service provides; it does not import
+scenario scheduling.
+
+### Findings linked to an attack
+
+`GET /api/attacks/{attack_result_id}/findings` lists every finding, across all
+Operations, that links the attack as evidence: highest severity first, then
+newest. Each item is the finding plus `operation_name` and the `evidence_id` that
+unlinks it through the Operation evidence route. An attack with no linked
+findings, including one that is not saved yet, returns an empty list; a non-UUID
+ID returns 422.
+
 The saved Scenario Chat viewer consumes these bounded reads with independent
 reference/message continuation controls. It merges stable piece IDs into their
 ordered turns and reconciles page-local partial-sequence markers against the
diff --git a/pyrit/backend/mappers/attack_mappers.py b/pyrit/backend/mappers/attack_mappers.py
index 6558aff2d9..ff5195660a 100644
--- a/pyrit/backend/mappers/attack_mappers.py
+++ b/pyrit/backend/mappers/attack_mappers.py
@@ -232,6 +232,7 @@ async def attack_result_to_summary_async(
     operation_name: str | None = None,
     scoring_inputs: AttackScoringInputs | None = None,
     execution_read_only: bool = False,
+    in_progress: bool = False,
 ) -> AttackSummary:
     """
     Build an AttackSummary view from an AttackResult.
@@ -248,6 +249,7 @@ async def attack_result_to_summary_async(
             Legacy attacks without an Operation ID show their historical name instead.
         scoring_inputs: Effective inputs resolved against the current registry by the service.
         execution_read_only: Whether execution changes require a manual continuation.
+        in_progress: Whether ``ar`` projects an attack still running in a scan.
 
     Returns:
         AttackSummary view ready for the API response.
@@ -264,6 +266,8 @@ async def attack_result_to_summary_async(
         chat_scorer=scoring_inputs.scorer if scoring_inputs else None,
         chat_scorer_inherited=scoring_inputs.inherited if scoring_inputs else False,
         execution_read_only=execution_read_only,
+        in_progress=in_progress,
+        scenario_result_id=ar.attribution_parent_id,
         last_response=await _summary_last_response_async(ar.last_response),
         automated_score=(
             ScoreView.from_domain(ar.automated_score, is_objective_score=True) if ar.automated_score else None
diff --git a/pyrit/backend/models/attacks.py b/pyrit/backend/models/attacks.py
index 4bcca2e36b..cb17c366d2 100644
--- a/pyrit/backend/models/attacks.py
+++ b/pyrit/backend/models/attacks.py
@@ -262,6 +262,10 @@ class AttackSummary(AttackResult[MessagePieceView, ScoreView]):
     )
     chat_scorer_inherited: bool = Field(default=False, description="Uses the scan's registered original scorer")
     execution_read_only: bool = Field(default=False, description="Execution changes require a manual continuation")
+    in_progress: bool = Field(
+        default=False, description="The attack is still running in a scan; its result is not saved yet"
+    )
+    scenario_result_id: str | None = Field(default=None, description="The scan run that produced this attack")
 
     @computed_field
     @property
@@ -360,6 +364,10 @@ class AttackMetadata(BaseModel):
     chat_scorer: RegisteredComponentReference | None = None
     chat_scorer_inherited: bool = False
     execution_read_only: bool = False
+    in_progress: bool = Field(
+        default=False, description="The attack is still running in a scan; its result is not saved yet"
+    )
+    scenario_result_id: str | None = Field(default=None, description="The scan run that produced this attack")
     manual_continuation: ManualContinuation | None = None
     last_response_message_piece_id: str | None = None
     related_conversation_count: int = Field(..., ge=0, description="Number of pruned conversations, excluding main")
diff --git a/pyrit/backend/models/operations.py b/pyrit/backend/models/operations.py
index 723d5b0468..590689f05a 100644
--- a/pyrit/backend/models/operations.py
+++ b/pyrit/backend/models/operations.py
@@ -70,6 +70,22 @@ class FindingListItem(Finding):
     evidence_count: int = Field(ge=0)
 
 
+class AttackFindingItem(Finding):
+    """A finding that links an attack as evidence, with its Operation's current name and the evidence link."""
+
+    operation_name: str
+    evidence_id: UUID = Field(description="The evidence link, which unlinks the attack from the finding")
+
+
+class AttackFindingListResponse(BaseModel):
+    """Every finding that links an attack, highest severity first, then newest first."""
+
+    model_config = ConfigDict(extra="forbid")
+
+    attack_result_id: UUID
+    items: list[AttackFindingItem]
+
+
 class FindingListResponse(BaseModel):
     """One page of an operation's findings."""
 
diff --git a/pyrit/backend/routes/attacks.py b/pyrit/backend/routes/attacks.py
index 103c8706c5..eeedfef4df 100644
--- a/pyrit/backend/routes/attacks.py
+++ b/pyrit/backend/routes/attacks.py
@@ -35,6 +35,7 @@
 )
 from pyrit.backend.models.attacks import AttackMetadata, SaveConversationRequest
 from pyrit.backend.models.common import MAX_IDENTIFIER_LENGTH, MAX_ITEMS, CursorStr, IdentifierStr, LabelFilterStr
+from pyrit.backend.models.operations import AttackFindingListResponse
 from pyrit.backend.models.scores import ApplyChatScorerRequest, ApplyChatScorerResponse
 from pyrit.backend.routes.common import parse_label_query_params
 from pyrit.backend.services import get_attack_service
@@ -43,6 +44,7 @@
 from pyrit.backend.services.history_replay import HistoryReplayError
 from pyrit.backend.services.manual_send_scheduler import ManualSendConflictError, ManualSendQueueFullError
 from pyrit.backend.services.media_persistence import MediaAccessDeniedError
+from pyrit.backend.services.operation_service import OperationService
 from pyrit.common import print_deprecation_message
 from pyrit.memory.memory_interface import AttackStateConflictError
 
@@ -374,6 +376,20 @@ async def get_attack_metadata_async(
     return metadata
 
 
+@router.get("/{attack_result_id}/findings", response_model=AttackFindingListResponse)
+async def get_attack_findings_async(attack_result_id: uuid.UUID) -> AttackFindingListResponse:
+    """
+    List the findings that link this attack as evidence, across all Operations.
+
+    An attack with no linked findings, including a running scan attack that is not saved yet,
+    returns an empty list rather than 404.
+
+    Returns:
+        AttackFindingListResponse: The linked findings with their Operation names and evidence links.
+    """
+    return await OperationService().list_attack_findings_async(attack_result_id)
+
+
 @router.patch(
     "/{attack_result_id}",
     response_model=AttackSummary,
diff --git a/pyrit/backend/services/attack_service.py b/pyrit/backend/services/attack_service.py
index c03af492f7..85d76ac034 100644
--- a/pyrit/backend/services/attack_service.py
+++ b/pyrit/backend/services/attack_service.py
@@ -22,7 +22,7 @@
 from collections.abc import Mapping, Sequence
 from datetime import UTC, datetime
 from functools import lru_cache
-from typing import Any, Literal
+from typing import Any, Literal, NamedTuple
 
 from pyrit.backend.mappers import (
     attack_result_to_summary_async,
@@ -59,6 +59,7 @@
 from pyrit.backend.services.chat_scoring_service import get_chat_scoring_service
 from pyrit.backend.services.component_lifecycle import release_component_async
 from pyrit.backend.services.history_replay import validate_history_replay
+from pyrit.backend.services.live_attack_reader import LiveAttackLookup
 from pyrit.backend.services.media_persistence import persist_message_pieces_async
 from pyrit.backend.services.message_send_service import (
     MessageSendService,
@@ -82,7 +83,7 @@
     data_serializer_factory,
     set_message_piece_sha256_async,
 )
-from pyrit.memory.memory_interface import AttackStateConflictError
+from pyrit.memory.memory_interface import AttackConversationPage, AttackStateConflictError
 from pyrit.models import (
     AtomicAttackIdentifier,
     AttackIdentifier,
@@ -131,19 +132,35 @@ class AttackObjectiveConflictError(Exception):
     """The shared objective changed while it was being edited."""
 
 
+class _ReadableAttack(NamedTuple):
+    """A saved result, or the projection of an attack still running in a scan."""
+
+    result: AttackResult
+    in_progress: bool
+
+
 class AttackService:
     """
     Service for managing attacks.
 
-    Uses PyRIT memory (database) as the source of truth via AttackResult.
+    Uses PyRIT memory (database) as the source of truth via AttackResult. Read APIs also
+    resolve scan attacks that are still running through an optional read-only lookup;
+    a saved result always wins over that live projection.
     """
 
     def __init__(
-        self, *, message_send_service: MessageSendService | None = None, memory: MemoryInterface | None = None
+        self,
+        *,
+        message_send_service: MessageSendService | None = None,
+        memory: MemoryInterface | None = None,
+        live_attack_lookup: LiveAttackLookup | None = None,
     ) -> None:
         """Initialize the attack service."""
         self._memory = memory if memory is not None else CentralMemory.get_memory_instance()
-        self._saved_conversation_reader = SavedConversationReadService(memory=self._memory)
+        self._live_attack_lookup = live_attack_lookup
+        self._saved_conversation_reader = SavedConversationReadService(
+            memory=self._memory, read_references=self._read_conversation_page_async
+        )
         self._message_send_service = (
             message_send_service if message_send_service is not None else get_message_send_service()
         )
@@ -361,16 +378,16 @@ async def get_attack_async(self, *, attack_result_id: str) -> AttackSummary | No
         """
         Get attack details (high-level metadata, no messages).
 
-        Queries the AttackResult from the database by its primary key.
+        Reads the saved AttackResult by its primary key, or projects a scan attack that is still running.
 
         Returns:
             AttackSummary if found, None otherwise.
         """
-        results = await self._memory.get_attack_results_async(attack_result_ids=[attack_result_id])
-        if not results:
+        attack = await self._read_attack_async(attack_result_id=attack_result_id)
+        if attack is None:
             return None
 
-        return await self._summarize_attack_async(ar=results[0])
+        return await self._summarize_attack_async(ar=attack.result, in_progress=attack.in_progress)
 
     async def get_attack_metadata_async(
         self, *, attack_result_id: str, conversation_id: str | None = None
@@ -384,24 +401,25 @@ async def get_attack_metadata_async(
         Returns:
             AttackMetadata | None: Metadata without reference arrays, or None for an absent attack.
         """
-        results = await self._memory.get_attack_results_async(attack_result_ids=[attack_result_id])
-        if not results:
+        attack = await self._read_attack_async(attack_result_id=attack_result_id)
+        if attack is None:
             return None
-        ar = results[0]
-        references = await self._memory.get_attack_conversation_page_async(attack_result_id=attack_result_id, limit=1)
+        ar = attack.result
+        references = await self._read_conversation_page_async(attack_result_id=attack_result_id, limit=1)
         if references is None:
             return None
         selected_id = conversation_id if conversation_id is not None else ar.conversation_id
         selected_valid = bool(selected_id) and selected_id == references.main_conversation_id
         if not selected_valid:
-            selected = await self._memory.get_attack_conversation_page_async(
+            selected = await self._read_conversation_page_async(
                 attack_result_id=attack_result_id, conversation_id=selected_id, limit=1
             )
             if selected is None:
                 return None
             selected_valid = bool(selected.conversations)
         summary = await self._summarize_attack_async(
-            ar=ar.model_copy(update={"related_conversations": set(), "last_response": None})
+            ar=ar.model_copy(update={"related_conversations": set(), "last_response": None}),
+            in_progress=attack.in_progress,
         )
         return AttackMetadata(
             attack_result_id=summary.attack_result_id,
@@ -417,6 +435,8 @@ async def get_attack_metadata_async(
             chat_scorer=summary.chat_scorer,
             chat_scorer_inherited=summary.chat_scorer_inherited,
             execution_read_only=summary.execution_read_only,
+            in_progress=summary.in_progress,
+            scenario_result_id=summary.scenario_result_id,
             manual_continuation=summary.manual_continuation,
             last_response_message_piece_id=str(ar.last_response.id) if ar.last_response is not None else None,
             related_conversation_count=references.total_count - int(bool(references.main_conversation_id)),
@@ -424,7 +444,42 @@ async def get_attack_metadata_async(
             selected_conversation_valid=selected_valid,
         )
 
-    async def _summarize_attack_async(self, *, ar: AttackResult) -> AttackSummary:
+    async def _read_attack_async(self, *, attack_result_id: str) -> _ReadableAttack | None:
+        """
+        Read the saved result, or project the attack while a scan is still running it.
+
+        The live snapshot is taken before the storage read, so an attack that finishes in between
+        resolves to its saved result.
+
+        Returns:
+            _ReadableAttack | None: The readable attack, or None when it is neither saved nor running.
+        """
+        live = self._live_attack_lookup(attack_result_id) if self._live_attack_lookup else None
+        results = await self._memory.get_attack_results_async(attack_result_ids=[attack_result_id])
+        if results:
+            return _ReadableAttack(result=results[0], in_progress=False)
+        if live is None:
+            return None
+        return _ReadableAttack(result=live.to_attack_result(), in_progress=True)
+
+    async def _read_conversation_page_async(
+        self, *, attack_result_id: str, offset: int = 0, limit: int = 50, conversation_id: str | None = None
+    ) -> AttackConversationPage | None:
+        """
+        Page saved conversation references, or a running scan attack's live references.
+
+        Returns:
+            AttackConversationPage | None: The reference page, or None when the attack is neither saved nor running.
+        """
+        live = self._live_attack_lookup(attack_result_id) if self._live_attack_lookup else None
+        page = await self._memory.get_attack_conversation_page_async(
+            attack_result_id=attack_result_id, offset=offset, limit=limit, conversation_id=conversation_id
+        )
+        if page is not None or live is None:
+            return page
+        return live.conversation_page(offset=offset, limit=limit, conversation_id=conversation_id)
+
+    async def _summarize_attack_async(self, *, ar: AttackResult, in_progress: bool = False) -> AttackSummary:
         """
         Map one loaded result with the shared presentation and scoring policy.
 
@@ -439,7 +494,8 @@ async def _summarize_attack_async(self, *, ar: AttackResult) -> AttackSummary:
             stats=stats,
             operation_name=operation_names.get(ar.operation_id) if ar.operation_id else None,
             scoring_inputs=get_chat_scoring_service().inputs(ar),
-            execution_read_only=get_chat_scoring_service().execution_read_only(ar),
+            execution_read_only=in_progress or get_chat_scoring_service().execution_read_only(ar),
+            in_progress=in_progress,
         )
 
     async def _get_operation_names_async(self, *, results: Sequence[AttackResult]) -> dict[uuid.UUID, str]:
@@ -486,12 +542,12 @@ async def get_conversation_messages_async(
             raise ValueError("A message-page cursor requires a limit.")
 
         # Check attack exists
-        results = await self._memory.get_attack_results_async(attack_result_ids=[attack_result_id])
-        if not results:
+        attack = await self._read_attack_async(attack_result_id=attack_result_id)
+        if attack is None:
             return None
 
         # Verify the conversation belongs to this attack
-        ar = results[0]
+        ar = attack.result
         if conversation_id not in ar.get_active_conversation_ids():
             raise ValueError(f"Conversation '{conversation_id}' is not part of attack '{attack_result_id}'")
 
@@ -1275,12 +1331,11 @@ async def get_conversations_async(
             )
         if cursor is not None:
             raise ValueError("A conversation-page cursor requires a limit.")
-        results = await self._memory.get_attack_results_async(attack_result_ids=[attack_result_id])
-        if not results:
+        attack = await self._read_attack_async(attack_result_id=attack_result_id)
+        if attack is None:
             return None
 
-        # attack_result_id is a unique primary key, so at most one result is returned.
-        ar = results[0]
+        ar = attack.result
 
         # Collect all conversation IDs (main + PRUNED related) and fetch stats in one query.
         active_conv_ids = list(ar.get_active_conversation_ids())
@@ -1596,7 +1651,12 @@ def get_attack_service() -> AttackService:
     """
     Get the global attack service instance.
 
+    Wires the scenario run service's read-only lookup for scan attacks that are still running.
+
     Returns:
         The singleton AttackService instance.
     """
-    return AttackService()
+    # Composition root: AttackService depends only on the lookup type, not on scenario scheduling.
+    from pyrit.backend.services.scenario_run_service import find_live_attack
+
+    return AttackService(live_attack_lookup=find_live_attack)
diff --git a/pyrit/backend/services/live_attack_reader.py b/pyrit/backend/services/live_attack_reader.py
new file mode 100644
index 0000000000..739054b58b
--- /dev/null
+++ b/pyrit/backend/services/live_attack_reader.py
@@ -0,0 +1,94 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+Read-only port for scan attacks that are still running.
+
+A scan saves each ``AttackResult`` only when its attack finishes. Until then, the attack read APIs
+project the live execution through this port. The scenario run service provides the lookup; the
+attack service depends only on these types, so it never imports scenario scheduling logic.
+"""
+
+from collections.abc import Callable
+from dataclasses import dataclass
+
+from pyrit.executor.attack.core.attack_executor import ActiveAttackExecution
+from pyrit.memory.memory_interface import AttackConversationPage
+from pyrit.models import AttackOutcome, AttackResult, ConversationReference, ConversationType
+
+
+@dataclass(frozen=True, slots=True)
+class LiveAttack:
+    """An attack still running in a scan, with at least one objective conversation."""
+
+    scenario_result_id: str
+    execution: ActiveAttackExecution
+
+    @classmethod
+    def from_execution(cls, *, scenario_result_id: str, execution: ActiveAttackExecution) -> "LiveAttack | None":
+        """
+        Wrap an execution once it has an objective conversation to read.
+
+        Returns:
+            LiveAttack | None: The live attack, or None before its first objective conversation starts.
+        """
+        if not execution.conversation_ids and execution.current_conversation_id is None:
+            return None
+        return cls(scenario_result_id=scenario_result_id, execution=execution)
+
+    @property
+    def main_conversation_id(self) -> str:
+        """The conversation the attack is working on, otherwise its first objective conversation."""
+        return self.execution.current_conversation_id or self.execution.conversation_ids[0]
+
+    @property
+    def other_conversation_ids(self) -> list[str]:
+        """The other objective conversations started so far, in first-use order."""
+        main = self.main_conversation_id
+        return [conversation_id for conversation_id in self.execution.conversation_ids if conversation_id != main]
+
+    def to_attack_result(self) -> AttackResult:
+        """
+        Project the unsaved result the attack read APIs show while the attack runs.
+
+        Other objective conversations are user-visible references, like the pruned conversations of a saved result.
+
+        Returns:
+            AttackResult: An undetermined, unsaved result owned by the running scan.
+        """
+        execution = self.execution
+        return AttackResult(
+            attack_result_id=execution.attack_result_id,
+            conversation_id=self.main_conversation_id,
+            objective=execution.objective,
+            atomic_attack_identifier=execution.atomic_attack_identifier,
+            outcome=AttackOutcome.UNDETERMINED,
+            timestamp=execution.started_at,
+            related_conversations={
+                ConversationReference(conversation_id=conversation_id, conversation_type=ConversationType.PRUNED)
+                for conversation_id in self.other_conversation_ids
+            },
+            attribution_parent_id=self.scenario_result_id,
+        )
+
+    def conversation_page(
+        self, *, offset: int = 0, limit: int = 50, conversation_id: str | None = None
+    ) -> AttackConversationPage:
+        """
+        Page the live conversation references the same way saved references are paged.
+
+        Returns:
+            AttackConversationPage: The main conversation first, then the others in first-use order.
+        """
+        return AttackConversationPage.from_references(
+            main_conversation_id=self.main_conversation_id,
+            pruned_conversation_ids=self.other_conversation_ids,
+            timestamp=self.execution.started_at,
+            offset=offset,
+            limit=limit,
+            conversation_id=conversation_id,
+        )
+
+
+#: Finds a running scan attack by its ``attack_result_id``; None when no active scan is running it.
+LiveAttackLookup = Callable[[str], LiveAttack | None]
diff --git a/pyrit/backend/services/operation_service.py b/pyrit/backend/services/operation_service.py
index ec80bdd9b0..108b6fd3f6 100644
--- a/pyrit/backend/services/operation_service.py
+++ b/pyrit/backend/services/operation_service.py
@@ -6,6 +6,8 @@
 
 from pyrit.backend.models import ScoreView
 from pyrit.backend.models.operations import (
+    AttackFindingItem,
+    AttackFindingListResponse,
     EvidenceAvailability,
     FindingCreateRequest,
     FindingEvidenceAttachResponse,
@@ -392,6 +394,30 @@ async def detach_finding_evidence_async(self, *, operation_id: UUID, finding_id:
         except LookupError as exc:
             raise FindingEvidenceNotFoundError(str(exc)) from exc
 
+    async def list_attack_findings_async(self, attack_result_id: UUID) -> AttackFindingListResponse:
+        """
+        Read every finding that links an attack as evidence, across all Operations.
+
+        An attack with no linked findings, including one that is not saved yet, has an empty list.
+
+        Returns:
+            AttackFindingListResponse: The linked findings with their Operation names and evidence links.
+        """
+        memory = CentralMemory.get_memory_instance()
+        linked = await memory.get_findings_for_attack_result_async(attack_result_id=attack_result_id)
+        operation_ids = list({finding.operation_id for finding, _ in linked})
+        operations = await memory.get_operations_async(operation_ids=operation_ids) if operation_ids else []
+        names = {operation.id: operation.name for operation in operations}
+        return AttackFindingListResponse(
+            attack_result_id=attack_result_id,
+            items=[
+                AttackFindingItem(
+                    **finding.model_dump(), operation_name=names.get(finding.operation_id, ""), evidence_id=evidence.id
+                )
+                for finding, evidence in linked
+            ],
+        )
+
     async def _require_finding_async(self, *, operation_id: UUID, finding_id: UUID) -> Finding:
         finding = await CentralMemory.get_memory_instance().get_finding_async(
             operation_id=operation_id, finding_id=finding_id
diff --git a/pyrit/backend/services/saved_conversation_read_service.py b/pyrit/backend/services/saved_conversation_read_service.py
index 9f13e2672c..8188958e92 100644
--- a/pyrit/backend/services/saved_conversation_read_service.py
+++ b/pyrit/backend/services/saved_conversation_read_service.py
@@ -4,6 +4,7 @@
 """Bounded, read-only saved conversation views shared by attack and scenario APIs."""
 
 import uuid
+from typing import Protocol
 
 from pyrit.backend.mappers import format_last_message_preview, pyrit_messages_to_dto_async
 from pyrit.backend.models import (
@@ -13,16 +14,34 @@
 )
 from pyrit.common.pagination import decode_keyset_cursor, encode_keyset_cursor, fingerprint_filters
 from pyrit.memory import MemoryInterface
-from pyrit.memory.memory_interface import MessagePieceKeysetCursor
+from pyrit.memory.memory_interface import AttackConversationPage, MessagePieceKeysetCursor
 from pyrit.models import ConversationStats, ConversationSummary
 
 
+class ConversationReferenceReader(Protocol):
+    """Reads one page of an attack's main and pruned conversation references."""
+
+    async def __call__(
+        self, *, attack_result_id: str, offset: int = 0, limit: int = 50, conversation_id: str | None = None
+    ) -> AttackConversationPage | None:
+        """Return the page, or None for an absent attack."""
+        ...
+
+
 class SavedConversationReadService:
     """Read canonical saved references/messages without constructing an executable attack."""
 
-    def __init__(self, *, memory: MemoryInterface) -> None:
-        """Bind all saved reads to the caller's memory instance."""
+    def __init__(self, *, memory: MemoryInterface, read_references: ConversationReferenceReader | None = None) -> None:
+        """
+        Bind all saved reads to the caller's memory instance.
+
+        Args:
+            memory (MemoryInterface): Memory that holds the saved messages.
+            read_references (ConversationReferenceReader | None): Where attack conversation references come from.
+                Defaults to the saved references in memory.
+        """
         self._memory = memory
+        self._read_references = read_references or self._read_saved_references_async
 
     async def list_conversations_async(
         self, *, attack_result_id: str, limit: int = 50, cursor: str | None = None
@@ -36,7 +55,7 @@ async def list_conversations_async(
         Raises:
             ValueError: If the cursor belongs to another attack or an obsolete reference ordering.
         """
-        page = await self._memory.get_attack_conversation_page_async(attack_result_id=attack_result_id, limit=limit)
+        page = await self._read_references(attack_result_id=attack_result_id, limit=limit)
         if page is None:
             return None
         fingerprint = fingerprint_filters(
@@ -59,9 +78,7 @@ async def list_conversations_async(
         offset = anchor.position if anchor is not None and anchor.position is not None else 0
         if offset:
             revision = page.reference_revision
-            page = await self._memory.get_attack_conversation_page_async(
-                attack_result_id=attack_result_id, offset=offset, limit=limit
-            )
+            page = await self._read_references(attack_result_id=attack_result_id, offset=offset, limit=limit)
             if page is None:
                 return None
             if page.reference_revision != revision:
@@ -119,7 +136,7 @@ async def get_messages_async(
         Raises:
             ValueError: If the conversation is unrelated or the continuation cursor is invalid.
         """
-        references = await self._memory.get_attack_conversation_page_async(
+        references = await self._read_references(
             attack_result_id=attack_result_id, conversation_id=conversation_id, limit=1
         )
         if references is None:
@@ -164,3 +181,10 @@ async def get_messages_async(
             pagination=PaginationInfo(limit=limit, has_more=next_cursor is not None, next_cursor=next_cursor),
             partial_message_sequences=list(page.partial_message_sequences),
         )
+
+    async def _read_saved_references_async(
+        self, *, attack_result_id: str, offset: int = 0, limit: int = 50, conversation_id: str | None = None
+    ) -> AttackConversationPage | None:
+        return await self._memory.get_attack_conversation_page_async(
+            attack_result_id=attack_result_id, offset=offset, limit=limit, conversation_id=conversation_id
+        )
diff --git a/pyrit/backend/services/scenario_run_service.py b/pyrit/backend/services/scenario_run_service.py
index 4f1f86f0bd..6c684d8c04 100644
--- a/pyrit/backend/services/scenario_run_service.py
+++ b/pyrit/backend/services/scenario_run_service.py
@@ -39,6 +39,7 @@
     ScenarioRunListResponse,
     filter_sensitive_fields,
 )
+from pyrit.backend.services.live_attack_reader import LiveAttack
 from pyrit.backend.services.pagination import (
     decode_keyset_cursor,
     encode_keyset_cursor,
@@ -2561,6 +2562,21 @@ def snapshot_active_run(self, *, scenario_result_id: str) -> _ActiveRunSnapshot:
             active_scenario_result_id=active_scenario_result_id,
         )
 
+    def find_live_attack(self, *, attack_result_id: str) -> LiveAttack | None:
+        """
+        Find an attack that an active scan is still running.
+
+        Returns:
+            LiveAttack | None: The running attack and its scan, or None when no active scan is running it
+                or it has not started an objective conversation yet.
+        """
+        for scenario_result_id in list(self._active_tasks):
+            snapshot = self.snapshot_active_run(scenario_result_id=scenario_result_id)
+            for execution in snapshot.executions:
+                if execution.attack_result_id == attack_result_id:
+                    return LiveAttack.from_execution(scenario_result_id=scenario_result_id, execution=execution)
+        return None
+
     def _load_run_plan(self, *, scenario_result: ScenarioResult) -> ScenarioRunPlan | None:
         """
         Load a validated plan from scenario metadata.
@@ -2700,6 +2716,7 @@ def _active_conversations(
                 ScenarioActiveConversation(
                     attack_result_id=execution.attack_result_id,
                     conversation_id=conversation_id,
+                    conversation_ids=list(execution.conversation_ids),
                     atomic_attack_name=attribution.parent_collection,
                     seed_group_id=attribution.seed_group_id,
                     objective=execution.objective,
@@ -3257,6 +3274,19 @@ def peek_scenario_run_service() -> ScenarioRunService | None:
     return _service_instance
 
 
+def find_live_attack(attack_result_id: str) -> LiveAttack | None:
+    """
+    Find a running scan attack in the current service, without constructing one.
+
+    Resolves the service on every call, so the lookup stays valid across service resets.
+
+    Returns:
+        LiveAttack | None: The running attack, or None when no active scan is running it.
+    """
+    service = peek_scenario_run_service()
+    return service.find_live_attack(attack_result_id=attack_result_id) if service is not None else None
+
+
 async def reset_scenario_run_service_async() -> None:
     """Close and discard the drained singleton."""
     global _service_instance
diff --git a/pyrit/memory/alembic/versions/b5d7f9a1c3e6_index_finding_evidence_attack_result.py b/pyrit/memory/alembic/versions/b5d7f9a1c3e6_index_finding_evidence_attack_result.py
new file mode 100644
index 0000000000..0d09bafd12
--- /dev/null
+++ b/pyrit/memory/alembic/versions/b5d7f9a1c3e6_index_finding_evidence_attack_result.py
@@ -0,0 +1,31 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+Index finding evidence by attack result so an attack's findings are a direct lookup.
+
+``attack_result_id`` is a bounded UUID column on every backend, so SQL Server accepts it as an index key.
+
+Revision ID: b5d7f9a1c3e6
+Revises: e7c4a2d9f013
+Create Date: 2026-11-06 17:30:00.000000
+"""
+
+from collections.abc import Sequence
+
+from alembic import op
+
+revision: str = "b5d7f9a1c3e6"
+down_revision: str | None = "e7c4a2d9f013"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Add the attack-result lookup index."""
+    op.create_index("ix_FindingEvidenceEntries_attack_result_id", "FindingEvidenceEntries", ["attack_result_id"])
+
+
+def downgrade() -> None:
+    """Remove the attack-result lookup index."""
+    op.drop_index("ix_FindingEvidenceEntries_attack_result_id", table_name="FindingEvidenceEntries")
diff --git a/pyrit/memory/alembic/versions/f8a6c2d4e901_merge_finding_index_and_http_fingerprint.py b/pyrit/memory/alembic/versions/f8a6c2d4e901_merge_finding_index_and_http_fingerprint.py
new file mode 100644
index 0000000000..eb876aeee3
--- /dev/null
+++ b/pyrit/memory/alembic/versions/f8a6c2d4e901_merge_finding_index_and_http_fingerprint.py
@@ -0,0 +1,25 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""
+Merge the finding-evidence index and HTTP request fingerprint heads.
+
+Revision ID: f8a6c2d4e901
+Revises: b5d7f9a1c3e6, d6de1045cca4
+Create Date: 2026-11-07 08:40:00.000000
+"""
+
+from collections.abc import Sequence
+
+revision: str = "f8a6c2d4e901"
+down_revision: str | Sequence[str] | None = ("b5d7f9a1c3e6", "d6de1045cca4")
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """Apply this schema upgrade."""
+
+
+def downgrade() -> None:
+    """Revert this schema upgrade."""
diff --git a/pyrit/memory/memory_interface.py b/pyrit/memory/memory_interface.py
index 53149b427d..7eaac865a1 100644
--- a/pyrit/memory/memory_interface.py
+++ b/pyrit/memory/memory_interface.py
@@ -513,6 +513,58 @@ class AttackConversationPage:
     reference_revision: str
     objective_score_id: str | None = None
 
+    @classmethod
+    def from_references(
+        cls,
+        *,
+        main_conversation_id: str,
+        pruned_conversation_ids: Sequence[str],
+        timestamp: datetime,
+        offset: int = 0,
+        limit: int = 50,
+        conversation_id: str | None = None,
+        objective_score_id: str | None = None,
+    ) -> "AttackConversationPage":
+        """
+        Page main and pruned references in stored order: main first, then pruned in their recorded order.
+
+        The revision fingerprints the full ordering, so continuation cursors detect reference changes.
+
+        Returns:
+            AttackConversationPage: The selected or paged references and their ordering revision.
+        """
+        references: dict[str, AttackConversationRecord] = {}
+        if main_conversation_id:
+            references[main_conversation_id] = AttackConversationRecord(conversation_id=main_conversation_id)
+        for identifier in pruned_conversation_ids:
+            if identifier:
+                references.setdefault(
+                    identifier,
+                    AttackConversationRecord(conversation_id=identifier, conversation_type=ConversationType.PRUNED),
+                )
+        ordered = tuple(references.values())
+        revision = hashlib.sha256(
+            json.dumps(
+                [
+                    (
+                        reference.conversation_id,
+                        reference.conversation_type.value if reference.conversation_type is not None else None,
+                    )
+                    for reference in ordered
+                ]
+            ).encode("utf-8")
+        ).hexdigest()
+        if conversation_id is not None:
+            ordered = tuple(reference for reference in ordered if reference.conversation_id == conversation_id)
+        return cls(
+            main_conversation_id=main_conversation_id,
+            conversations=ordered[offset : offset + limit],
+            total_count=len(ordered),
+            timestamp=timestamp,
+            reference_revision=revision,
+            objective_score_id=objective_score_id,
+        )
+
 
 @dataclass(frozen=True, slots=True, kw_only=True)
 class _AttackResultQuery:
@@ -1237,6 +1289,25 @@ async def get_finding_evidence_by_source_async(
             )
             return entry.get_evidence() if entry else None
 
+    async def get_findings_for_attack_result_async(
+        self, *, attack_result_id: uuid.UUID
+    ) -> list[tuple[Finding, FindingEvidence]]:
+        """
+        Read every finding that links an attack result as evidence, highest severity first, then newest first.
+
+        Returns:
+            list[tuple[Finding, FindingEvidence]]: Each linked finding with the evidence that links it.
+        """
+        statement = (
+            select(FindingEntry, FindingEvidenceEntry)
+            .join(FindingEvidenceEntry, FindingEvidenceEntry.finding_id == FindingEntry.id)
+            .where(FindingEvidenceEntry.attack_result_id == attack_result_id)
+            .order_by(*self._finding_order())
+        )
+        async with await self.get_session_async() as session:
+            rows = (await session.execute(statement)).all()
+            return [(finding.get_finding(), evidence.get_evidence()) for finding, evidence in rows]
+
     async def delete_finding_evidence_async(self, *, finding_id: uuid.UUID, evidence_id: uuid.UUID) -> None:
         """
         Unlink evidence from a finding. The attack result is kept.
@@ -8180,6 +8251,7 @@ def _row_to_scenario_attack_result_delta(row: Mapping[str, Any]) -> ScenarioAtta
                 status=ScoreStatus(row["score_status"]),
                 score_value=row["score_value"],
                 score_rationale=row["score_rationale"],
+                score_category=list(row["score_category"] or []),
             )
         related_cids: list[str] = []
         for col in (
@@ -8238,6 +8310,7 @@ def _scenario_attack_result_delta_statement() -> Select:
             ScoreEntry.score_type,
             ScoreEntry.status.label("score_status"),
             ScoreEntry.score_rationale,
+            ScoreEntry.score_category,
             ScoreEntry.scorer_class_identifier,
         ).outerjoin(
             ScoreEntry,
@@ -8685,38 +8758,16 @@ def _execute_get_attack_conversation_page(
             row = session.execute(statement).mappings().one_or_none()
         if row is None:
             return None
-        references: dict[str, AttackConversationRecord] = {}
-        main_id = row["conversation_id"] or ""
-        if main_id:
-            references[main_id] = AttackConversationRecord(conversation_id=main_id)
         values = row["pruned_conversation_ids"]
-        if isinstance(values, list):
-            for identifier in values:
-                if isinstance(identifier, str) and identifier:
-                    references.setdefault(
-                        identifier,
-                        AttackConversationRecord(conversation_id=identifier, conversation_type=ConversationType.PRUNED),
-                    )
-        ordered = tuple(references.values())
-        revision = hashlib.sha256(
-            json.dumps(
-                [
-                    (
-                        reference.conversation_id,
-                        reference.conversation_type.value if reference.conversation_type is not None else None,
-                    )
-                    for reference in ordered
-                ]
-            ).encode("utf-8")
-        ).hexdigest()
-        if conversation_id is not None:
-            ordered = tuple(reference for reference in ordered if reference.conversation_id == conversation_id)
-        return AttackConversationPage(
-            main_conversation_id=main_id,
-            conversations=ordered[offset : offset + limit],
-            total_count=len(ordered),
+        return AttackConversationPage.from_references(
+            main_conversation_id=row["conversation_id"] or "",
+            pruned_conversation_ids=[value for value in values if isinstance(value, str)]
+            if isinstance(values, list)
+            else [],
             timestamp=row["timestamp"],
-            reference_revision=revision,
+            offset=offset,
+            limit=limit,
+            conversation_id=conversation_id,
             objective_score_id=str(row["objective_score_id"]) if row["objective_score_id"] is not None else None,
         )
 
diff --git a/pyrit/memory/memory_models.py b/pyrit/memory/memory_models.py
index 218ddf72b9..8939fd1d67 100644
--- a/pyrit/memory/memory_models.py
+++ b/pyrit/memory/memory_models.py
@@ -374,6 +374,7 @@ class FindingEvidenceEntry(Base):
     __tablename__ = "FindingEvidenceEntries"
     __table_args__ = (
         Index("ix_FindingEvidenceEntries_finding_id", "finding_id"),
+        Index("ix_FindingEvidenceEntries_attack_result_id", "attack_result_id"),
         UniqueConstraint("finding_id", "attack_result_id", name="uq_finding_evidence_source"),
     )
 
diff --git a/pyrit/models/scenario_progress.py b/pyrit/models/scenario_progress.py
index ed36364e69..57d3006a6e 100644
--- a/pyrit/models/scenario_progress.py
+++ b/pyrit/models/scenario_progress.py
@@ -156,6 +156,7 @@ class ScenarioProgressScore(BaseModel):
     status: ScoreStatus
     score_value: str | None = None
     score_rationale: str | None = None
+    score_category: list[str] = Field(default_factory=list)
 
 
 class ScenarioComponentIdentity(BaseModel):
@@ -365,7 +366,10 @@ class ScenarioActiveConversation(BaseModel):
     """A saved objective conversation and the scan execution that produced it."""
 
     attack_result_id: str
+    #: The conversation the attack is working on, or the recorded objective conversation.
     conversation_id: str
+    #: Every objective conversation the attack has started so far, in first-use order.
+    conversation_ids: list[str] = Field(default_factory=list)
     atomic_attack_name: str
     seed_group_id: str | None = None
     objective: str
diff --git a/tests/unit/backend/test_live_attack_reads.py b/tests/unit/backend/test_live_attack_reads.py
new file mode 100644
index 0000000000..00e7cb51ef
--- /dev/null
+++ b/tests/unit/backend/test_live_attack_reads.py
@@ -0,0 +1,292 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+"""Attack reads for scan attacks that are still running, and findings linked to an attack."""
+
+import uuid
+from datetime import UTC, datetime
+from unittest.mock import AsyncMock, MagicMock, patch
+
+import pytest
+from fastapi.testclient import TestClient
+
+from pyrit.backend.main import app
+from pyrit.backend.models import AttackSummary
+from pyrit.backend.models.operations import AttackFindingItem, AttackFindingListResponse
+from pyrit.backend.services import AttackService, ScenarioRunService
+from pyrit.backend.services import attack_service as attack_service_module
+from pyrit.backend.services import scenario_run_service as scenario_run_service_module
+from pyrit.backend.services.live_attack_reader import LiveAttack
+from pyrit.backend.services.message_send_service import MessageSendService
+from pyrit.backend.services.operation_service import OperationService
+from pyrit.backend.services.scenario_run_service import _ActiveTask, find_live_attack
+from pyrit.executor.attack.core.attack_executor import ActiveAttackExecution
+from pyrit.executor.attack.core.attack_result_attribution import AttackResultAttribution
+from pyrit.memory import SQLiteMemory
+from pyrit.models import (
+    AtomicAttackIdentifier,
+    AttackOutcome,
+    AttackResult,
+    ComponentIdentifier,
+    ConversationType,
+    Finding,
+    FindingEvidence,
+    Operation,
+)
+from pyrit.scenario.core import Scenario
+
+RUN_ID = str(uuid.UUID(int=100))
+ATTACK_ID = str(uuid.UUID(int=200))
+STARTED_AT = datetime(2026, 11, 6, 12, tzinfo=UTC)
+
+
+def _execution(
+    *, conversation_ids: tuple[str, ...] = ("first", "current"), current: str | None = "current"
+) -> ActiveAttackExecution:
+    return ActiveAttackExecution(
+        attack_result_id=ATTACK_ID,
+        objective="Reveal the system prompt",
+        conversation_ids=conversation_ids,
+        current_conversation_id=current,
+        started_at=STARTED_AT,
+        attribution=AttackResultAttribution(parent_id=RUN_ID, parent_collection="live"),
+        atomic_attack_identifier=AtomicAttackIdentifier.build(
+            attack_identifier=ComponentIdentifier(class_name="CrescendoAttack", class_module="pyrit.executor.attack")
+        ),
+    )
+
+
+def _live_attack(**execution: object) -> LiveAttack:
+    live = LiveAttack.from_execution(scenario_result_id=RUN_ID, execution=_execution(**execution))
+    assert live is not None
+    return live
+
+
+def _attack_service(*, memory: SQLiteMemory, live: LiveAttack | None) -> AttackService:
+    return AttackService(
+        message_send_service=MagicMock(spec=MessageSendService),
+        memory=memory,
+        live_attack_lookup=lambda attack_result_id: live if attack_result_id == ATTACK_ID else None,
+    )
+
+
+def test_live_attack_requires_an_objective_conversation() -> None:
+    assert (
+        LiveAttack.from_execution(scenario_result_id=RUN_ID, execution=_execution(conversation_ids=(), current=None))
+        is None
+    )
+
+
+@pytest.mark.parametrize(
+    "conversation_ids, current, expected_main, expected_others",
+    [
+        (("first", "current"), "current", "current", ["first"]),
+        (("first", "second"), None, "first", ["second"]),
+        ((), "current", "current", []),
+    ],
+)
+def test_live_attack_main_is_current_otherwise_first(
+    conversation_ids: tuple[str, ...], current: str | None, expected_main: str, expected_others: list[str]
+) -> None:
+    live = _live_attack(conversation_ids=conversation_ids, current=current)
+    assert live.main_conversation_id == expected_main
+    assert live.other_conversation_ids == expected_others
+
+
+def test_live_attack_projects_an_undetermined_unsaved_result() -> None:
+    result = _live_attack().to_attack_result()
+    assert result.attack_result_id == ATTACK_ID
+    assert result.conversation_id == "current"
+    assert result.objective == "Reveal the system prompt"
+    assert result.outcome == AttackOutcome.UNDETERMINED
+    assert result.timestamp == STARTED_AT
+    assert result.attribution_parent_id == RUN_ID
+    assert result.get_active_conversation_ids() == {"first", "current"}
+    assert {ref.conversation_type for ref in result.related_conversations} == {ConversationType.PRUNED}
+    assert result.get_attack_strategy_identifier().class_name == "CrescendoAttack"
+
+
+def test_live_attack_pages_references_like_saved_references() -> None:
+    live = _live_attack(conversation_ids=("first", "current", "third"))
+    page = live.conversation_page(limit=2)
+    assert [reference.conversation_id for reference in page.conversations] == ["current", "first"]
+    assert page.total_count == 3
+    assert page.timestamp == STARTED_AT
+    assert live.conversation_page(offset=2, limit=2).conversations[0].conversation_id == "third"
+    assert live.conversation_page(conversation_id="first").conversations[0].conversation_type == ConversationType.PRUNED
+    assert live.conversation_page(conversation_id="unrelated").conversations == ()
+    assert live.conversation_page().reference_revision == page.reference_revision
+
+
+@pytest.mark.usefixtures("patch_central_database")
+def test_scenario_run_service_finds_only_attacks_its_active_runs_are_running() -> None:
+    service = ScenarioRunService()
+    scenario = MagicMock(spec=Scenario)
+    scenario.active_executions = (_execution(),)
+    scenario.active_atomic_group_ids = set()
+    assert service.find_live_attack(attack_result_id=ATTACK_ID) is None
+
+    service._active_tasks[RUN_ID] = _ActiveTask(scenario_result_id=RUN_ID, scenario=scenario)
+    live = service.find_live_attack(attack_result_id=ATTACK_ID)
+    assert live is not None
+    assert (live.scenario_result_id, live.main_conversation_id) == (RUN_ID, "current")
+    assert service.find_live_attack(attack_result_id=str(uuid.uuid4())) is None
+
+    scenario.active_executions = (_execution(conversation_ids=(), current=None),)
+    assert service.find_live_attack(attack_result_id=ATTACK_ID) is None
+
+    scenario.active_executions = ()
+    assert service.find_live_attack(attack_result_id=ATTACK_ID) is None
+
+
+def test_module_lookup_does_not_construct_a_scenario_run_service() -> None:
+    with patch.object(scenario_run_service_module, "_service_instance", None):
+        assert find_live_attack(ATTACK_ID) is None
+        assert scenario_run_service_module._service_instance is None
+
+
+def test_module_lookup_reads_the_current_scenario_run_service() -> None:
+    service = MagicMock(spec=ScenarioRunService)
+    service.find_live_attack.return_value = _live_attack()
+    with patch.object(scenario_run_service_module, "_service_instance", service):
+        assert find_live_attack(ATTACK_ID) is service.find_live_attack.return_value
+    assert service.find_live_attack.call_args.kwargs == {"attack_result_id": ATTACK_ID}
+
+
+def test_attack_service_singleton_reads_running_attacks_through_the_scenario_lookup() -> None:
+    attack_service_module.get_attack_service.cache_clear()
+    try:
+        with patch.object(attack_service_module, "AttackService") as constructor:
+            attack_service_module.get_attack_service()
+        assert constructor.call_args.kwargs == {"live_attack_lookup": find_live_attack}
+    finally:
+        attack_service_module.get_attack_service.cache_clear()
+
+
+@pytest.mark.usefixtures("patch_central_database")
+async def test_attack_service_reads_running_attack_when_unsaved_async(sqlite_instance: SQLiteMemory) -> None:
+    service = _attack_service(memory=sqlite_instance, live=_live_attack())
+
+    summary = await service.get_attack_async(attack_result_id=ATTACK_ID)
+    metadata = await service.get_attack_metadata_async(attack_result_id=ATTACK_ID, conversation_id="first")
+    conversations = await service.get_conversations_async(attack_result_id=ATTACK_ID, limit=50)
+
+    assert summary is not None and metadata is not None and conversations is not None
+    data = summary.model_dump(mode="json")
+    assert (data["in_progress"], data["execution_read_only"], data["outcome"]) == (True, True, "undetermined")
+    assert data["scenario_result_id"] == RUN_ID
+    assert data["related_conversation_ids"] == ["first"]
+    assert (metadata.in_progress, metadata.scenario_result_id) == (True, RUN_ID)
+    assert (metadata.related_conversation_count, metadata.selected_conversation_valid) == (1, True)
+    assert conversations.main_conversation_id == "current"
+    assert [item.conversation_id for item in conversations.conversations] == ["current", "first"]
+    with pytest.raises(ValueError, match="not part of attack"):
+        await service.get_conversation_messages_async(attack_result_id=ATTACK_ID, conversation_id="other")
+
+
+@pytest.mark.usefixtures("patch_central_database")
+async def test_attack_service_saved_result_wins_over_running_attack_async(sqlite_instance: SQLiteMemory) -> None:
+    saved = AttackResult(
+        attack_result_id=ATTACK_ID,
+        conversation_id="saved-main",
+        objective="Saved objective",
+        outcome=AttackOutcome.SUCCESS,
+    )
+    await sqlite_instance.add_attack_results_to_memory_async(attack_results=[saved])
+    service = _attack_service(memory=sqlite_instance, live=_live_attack())
+
+    summary = await service.get_attack_async(attack_result_id=ATTACK_ID)
+    metadata = await service.get_attack_metadata_async(attack_result_id=ATTACK_ID)
+    conversations = await service.get_conversations_async(attack_result_id=ATTACK_ID, limit=50)
+
+    assert summary is not None and metadata is not None and conversations is not None
+    assert (summary.in_progress, summary.outcome, summary.conversation_id) == (
+        False,
+        AttackOutcome.SUCCESS,
+        "saved-main",
+    )
+    assert summary.scenario_result_id is None
+    assert (metadata.in_progress, metadata.conversation_id) == (False, "saved-main")
+    assert [item.conversation_id for item in conversations.conversations] == ["saved-main"]
+
+
+@pytest.mark.usefixtures("patch_central_database")
+@pytest.mark.parametrize("with_lookup", [True, False])
+async def test_attack_service_unknown_attack_is_not_found_async(
+    sqlite_instance: SQLiteMemory, with_lookup: bool
+) -> None:
+    service = (
+        _attack_service(memory=sqlite_instance, live=None)
+        if with_lookup
+        else AttackService(message_send_service=MagicMock(spec=MessageSendService), memory=sqlite_instance)
+    )
+    assert await service.get_attack_async(attack_result_id=ATTACK_ID) is None
+    assert await service.get_attack_metadata_async(attack_result_id=ATTACK_ID) is None
+    assert await service.get_conversations_async(attack_result_id=ATTACK_ID) is None
+    assert await service.get_conversations_async(attack_result_id=ATTACK_ID, limit=50) is None
+    assert await service.get_conversation_messages_async(attack_result_id=ATTACK_ID, conversation_id="current") is None
+    assert (
+        await service.get_conversation_messages_async(attack_result_id=ATTACK_ID, conversation_id="current", limit=100)
+        is None
+    )
+
+
+def test_attack_route_serializes_in_progress_attack(compatibility_headers: dict[str, str]) -> None:
+    summary = AttackSummary(
+        attack_result_id=ATTACK_ID,
+        conversation_id="current",
+        objective="Running",
+        in_progress=True,
+        execution_read_only=True,
+        scenario_result_id=RUN_ID,
+    )
+    service = MagicMock(spec=AttackService)
+    service.get_attack_async = AsyncMock(return_value=summary)
+    with patch("pyrit.backend.routes.attacks.get_attack_service", return_value=service):
+        response = TestClient(app, headers=compatibility_headers).get(f"/api/attacks/{ATTACK_ID}")
+    assert response.status_code == 200
+    body = response.json()
+    assert (body["in_progress"], body["scenario_result_id"], body["outcome"]) == (True, RUN_ID, "undetermined")
+
+
+def test_attack_findings_route_returns_linked_findings(compatibility_headers: dict[str, str]) -> None:
+    finding = Finding(operation_id=uuid.uuid4(), title="Leak", severity="important")
+    listed = AttackFindingListResponse(
+        attack_result_id=uuid.UUID(ATTACK_ID),
+        items=[AttackFindingItem(**finding.model_dump(), operation_name="Red team", evidence_id=uuid.uuid4())],
+    )
+    with patch.object(
+        OperationService, "list_attack_findings_async", new_callable=AsyncMock, return_value=listed
+    ) as list_findings:
+        response = TestClient(app, headers=compatibility_headers).get(f"/api/attacks/{ATTACK_ID}/findings")
+    assert response.status_code == 200
+    assert response.json() == listed.model_dump(mode="json")
+    assert list_findings.call_args.args == (uuid.UUID(ATTACK_ID),)
+
+
+def test_attack_findings_route_rejects_non_uuid_ids(compatibility_headers: dict[str, str]) -> None:
+    with patch.object(OperationService, "list_attack_findings_async", new_callable=AsyncMock) as list_findings:
+        response = TestClient(app, headers=compatibility_headers).get("/api/attacks/not-a-uuid/findings")
+    assert response.status_code == 422
+    list_findings.assert_not_awaited()
+
+
+@pytest.mark.usefixtures("patch_central_database")
+async def test_list_attack_findings_names_operations_and_evidence_async(sqlite_instance: SQLiteMemory) -> None:
+    operation = await sqlite_instance.add_operation_async(Operation(name="Red team"))
+    finding = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=operation.id, title="Leak", severity="critical")
+    )
+    attack_result_id = uuid.uuid4()
+    evidence = await sqlite_instance.add_finding_evidence_async(
+        evidence=FindingEvidence(finding_id=finding.id, attack_result_id=attack_result_id)
+    )
+
+    listed = await OperationService().list_attack_findings_async(attack_result_id)
+    empty = await OperationService().list_attack_findings_async(uuid.uuid4())
+
+    assert listed.attack_result_id == attack_result_id
+    assert [item.model_dump(mode="json") for item in listed.items] == [
+        {**finding.model_dump(mode="json"), "operation_name": "Red team", "evidence_id": str(evidence.id)}
+    ]
+    assert empty.items == []
diff --git a/tests/unit/backend/test_scenario_resume.py b/tests/unit/backend/test_scenario_resume.py
index fa21fa8e58..7b4feb3d58 100644
--- a/tests/unit/backend/test_scenario_resume.py
+++ b/tests/unit/backend/test_scenario_resume.py
@@ -15,6 +15,7 @@
 
 from pyrit.backend.models import ConversationMessagesResponse
 from pyrit.backend.services import AttackService, ScenarioRunService
+from pyrit.backend.services.message_send_service import MessageSendService
 from pyrit.backend.services.scenario_run_service import (
     _LAUNCH_REFERENCES_METADATA_KEY,
     _LAUNCH_REQUEST_FIELDS,
@@ -341,6 +342,113 @@ async def build_async(self: Scenario, *, context: ScenarioContext) -> list[Atomi
             release.set()
 
 
+async def test_running_scan_attack_reads_live_until_its_saved_result_wins_async(
+    resume_environment: tuple[ScenarioRunService, MockPromptTarget],
+) -> None:
+    service, target = resume_environment
+    entered, release = asyncio.Event(), asyncio.Event()
+    conversations: list[str] = []
+    original_send = target._send_prompt_to_target_async
+
+    async def send_async(*, normalized_conversation: list[Message]) -> list[Message]:
+        conversations.append(normalized_conversation[-1].get_piece().conversation_id)
+        if len(conversations) == 2:
+            entered.set()
+            await release.wait()
+        return await original_send(normalized_conversation=normalized_conversation)
+
+    async def build_async(self: Scenario, *, context: ScenarioContext) -> list[AtomicAttack]:
+        strategy = PromptSendingAttack(
+            objective_target=context.objective_target,
+            attack_scoring_config=AttackScoringConfig(
+                objective_scorer=SubStringScorer(substring="never matches the response")
+            ),
+            max_attempts_on_failure=1,
+        )
+        return [
+            AtomicAttack(
+                atomic_attack_name="live",
+                attack_technique=AttackTechnique(attack=strategy),
+                seed_groups=[context.seed_groups[0]],
+                memory_labels=context.memory_labels,
+            )
+        ]
+
+    attacks = AttackService(
+        message_send_service=MagicMock(spec=MessageSendService),
+        memory=service._memory,
+        live_attack_lookup=lambda attack_result_id: service.find_live_attack(attack_result_id=attack_result_id),
+    )
+    with (
+        patch.object(_OfflineResumeScenario, "_build_atomic_attacks_async", new=build_async),
+        patch.object(target, "_send_prompt_to_target_async", side_effect=send_async),
+    ):
+        response = await service.start_run_async(
+            request=RunScenarioRequest(
+                scenario_name=_SCENARIO_NAME,
+                target_name=_TARGET_NAME,
+                include_baseline=False,
+                max_concurrency=1,
+                max_retries=0,
+            )
+        )
+        run_id = response.scenario_result_id
+        try:
+            await asyncio.wait_for(entered.wait(), TEST_WATCHDOG_SECONDS)
+            first, current = conversations
+            progress = await service.get_run_progress_async(scenario_result_id=run_id, since=None, limit=500)
+            assert progress is not None
+            active = progress.active_conversations[0]
+            assert active.conversation_id == current
+            assert active.conversation_ids == [first, current]
+            attack_id = active.attack_result_id
+
+            live = await attacks.get_attack_async(attack_result_id=attack_id)
+            assert live is not None
+            assert live.in_progress is True
+            assert live.execution_read_only is True
+            assert live.outcome == AttackOutcome.UNDETERMINED
+            assert live.scenario_result_id == run_id
+            assert live.objective == active.objective
+            assert live.conversation_id == current
+            assert live.related_conversation_ids == [first]
+
+            metadata = await attacks.get_attack_metadata_async(attack_result_id=attack_id, conversation_id=first)
+            assert metadata is not None
+            assert (metadata.in_progress, metadata.scenario_result_id) == (True, run_id)
+            assert metadata.related_conversation_count == 1
+            assert metadata.selected_conversation_valid is True
+
+            unpaged = await attacks.get_conversations_async(attack_result_id=attack_id)
+            assert unpaged is not None and unpaged.main_conversation_id == current
+            assert {conversation.conversation_id for conversation in unpaged.conversations} == {first, current}
+            paged = await attacks.get_conversations_async(attack_result_id=attack_id, limit=50)
+            assert paged is not None
+            assert [conversation.conversation_id for conversation in paged.conversations] == [current, first]
+
+            for limit in (None, 100):
+                messages = await attacks.get_conversation_messages_async(
+                    attack_result_id=attack_id, conversation_id=first, limit=limit
+                )
+                assert messages is not None
+                assert [message.role for message in messages.messages] == ["user", "assistant"]
+            with pytest.raises(ValueError, match="not part of attack"):
+                await attacks.get_conversation_messages_async(
+                    attack_result_id=attack_id, conversation_id="unrelated", limit=100
+                )
+
+            release.set()
+            await _wait_for_run_completion_async(service=service, scenario_result_id=run_id)
+            assert service.find_live_attack(attack_result_id=attack_id) is None
+            saved = await attacks.get_attack_async(attack_result_id=attack_id)
+            assert saved is not None
+            assert saved.in_progress is False
+            assert saved.scenario_result_id == run_id
+            assert saved.outcome == AttackOutcome.FAILURE
+        finally:
+            release.set()
+
+
 async def test_cancelled_provenance_preserves_mixed_outcome_denominators_and_resume_async(
     resume_environment: tuple[ScenarioRunService, MockPromptTarget],
 ) -> None:
diff --git a/tests/unit/memory/memory_interface/test_interface_scenario_progress.py b/tests/unit/memory/memory_interface/test_interface_scenario_progress.py
index 5169e3dcbb..54ffe4c103 100644
--- a/tests/unit/memory/memory_interface/test_interface_scenario_progress.py
+++ b/tests/unit/memory/memory_interface/test_interface_scenario_progress.py
@@ -83,6 +83,7 @@ async def test_scenario_progress_deltas_page_equal_timestamps_by_id(
     score = Score(
         score_value="true",
         score_type="true_false",
+        score_category=["jailbreak"],
         score_rationale="The objective was achieved.",
         scorer_class_identifier=ComponentIdentifier(
             class_name="TestScorer",
@@ -112,6 +113,7 @@ async def test_scenario_progress_deltas_page_equal_timestamps_by_id(
     assert first_page[0].score is not None
     assert first_page[0].score.scorer_name == "TestScorer"
     assert first_page[0].score.score_rationale == "The objective was achieved."
+    assert first_page[0].score.score_category == ["jailbreak"]
     assert has_more is True
     assert [row.attack_result_id for row in second_page] == [str(second_id)]
     assert second_has_more is False
@@ -151,6 +153,7 @@ async def test_scenario_progress_delta_uses_unknown_for_empty_scorer_identifier(
     assert has_more is False
     assert deltas[0].score is not None
     assert deltas[0].score.scorer_name == "Unknown"
+    assert deltas[0].score.score_category == []
 
 
 async def test_scenario_result_header_does_not_hydrate_attack_results(
diff --git a/tests/unit/memory/test_finding_evidence_attack_index_migration.py b/tests/unit/memory/test_finding_evidence_attack_index_migration.py
new file mode 100644
index 0000000000..3bdfad7cf8
--- /dev/null
+++ b/tests/unit/memory/test_finding_evidence_attack_index_migration.py
@@ -0,0 +1,206 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import importlib
+from datetime import UTC, datetime
+from io import StringIO
+from pathlib import Path
+from uuid import uuid4
+
+import pytest
+import sqlalchemy as sa
+from alembic import command
+from alembic.config import Config
+from alembic.migration import MigrationContext
+from alembic.operations import Operations
+from alembic.script import ScriptDirectory
+
+from pyrit.memory.memory_models import FindingEntry, FindingEvidenceEntry, OperationEntry
+from pyrit.memory.migration import check_schema_migrations, run_schema_migrations
+
+PREVIOUS_REVISION = "e7c4a2d9f013"
+REVISION = "b5d7f9a1c3e6"
+HTTP_REVISION = "d6de1045cca4"
+MERGE_REVISION = "f8a6c2d4e901"
+INDEX = "ix_FindingEvidenceEntries_attack_result_id"
+
+
+def _config(connection: sa.Connection | None = None) -> Config:
+    config = Config()
+    config.set_main_option("script_location", str(Path(__file__).resolve().parents[3] / "pyrit" / "memory" / "alembic"))
+    if connection is not None:
+        config.attributes["connection"] = connection
+        config.attributes["version_table"] = "pyrit_memory_alembic_version"
+    return config
+
+
+def _evidence_indexes(connection: sa.Connection) -> dict[str, list[str]]:
+    return {
+        str(index["name"]): [str(column) for column in index["column_names"]]
+        for index in sa.inspect(connection).get_indexes("FindingEvidenceEntries")
+    }
+
+
+def test_migration_branches_have_one_merge_head_without_rewriting_history() -> None:
+    scripts = ScriptDirectory.from_config(_config())
+    assert scripts.get_heads() == [MERGE_REVISION]
+    assert set(scripts.get_revision(MERGE_REVISION).down_revision) == {REVISION, HTTP_REVISION}
+    assert scripts.get_revision(REVISION).down_revision == PREVIOUS_REVISION
+    assert scripts.get_revision(HTTP_REVISION).down_revision == PREVIOUS_REVISION
+
+
+def test_migration_adds_and_drops_attack_result_index() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            assert INDEX not in _evidence_indexes(connection)
+            command.upgrade(config, REVISION)
+            assert _evidence_indexes(connection)[INDEX] == ["attack_result_id"]
+            command.downgrade(config, PREVIOUS_REVISION)
+            assert INDEX not in _evidence_indexes(connection)
+            command.upgrade(config, "head")
+        check_schema_migrations(engine=engine)
+    finally:
+        engine.dispose()
+
+
+def test_migration_compiles_for_sql_server() -> None:
+    migration = importlib.import_module(
+        "pyrit.memory.alembic.versions.b5d7f9a1c3e6_index_finding_evidence_attack_result"
+    )
+    output = StringIO()
+    context = MigrationContext.configure(dialect_name="mssql", opts={"as_sql": True, "output_buffer": output})
+    with Operations.context(context):
+        migration.upgrade()
+    assert f"CREATE INDEX [{INDEX}] ON [FindingEvidenceEntries] (attack_result_id)" in output.getvalue()
+
+
+def test_model_declares_attack_result_index() -> None:
+    indexes = {
+        index.name: [column.name for column in index.columns] for index in FindingEvidenceEntry.__table__.indexes
+    }
+    assert indexes[INDEX] == ["attack_result_id"]
+
+
+def _assert_merged_schema(connection: sa.Connection) -> None:
+    context = MigrationContext.configure(connection, opts={"version_table": "pyrit_memory_alembic_version"})
+    assert context.get_current_heads() == (MERGE_REVISION,)
+    assert _evidence_indexes(connection)[INDEX] == ["attack_result_id"]
+    columns = {column["name"]: column for column in sa.inspect(connection).get_columns("TargetIdentifiers")}
+    assert columns["http_request_fingerprint"]["nullable"] is True
+
+
+def _seed_upgrade_rows(connection: sa.Connection) -> None:
+    operation_id, finding_id = uuid4(), uuid4()
+    timestamp = datetime.now(UTC)
+    connection.execute(
+        sa.insert(OperationEntry).values(
+            id=operation_id, name="Preserved", name_key="preserved", created_at=timestamp, description=""
+        )
+    )
+    connection.execute(
+        sa.insert(FindingEntry).values(
+            id=finding_id,
+            operation_id=operation_id,
+            title="Preserved finding",
+            description="",
+            severity="important",
+            created_at=timestamp,
+        )
+    )
+    connection.execute(
+        sa.insert(FindingEvidenceEntry).values(
+            id=uuid4(), finding_id=finding_id, attack_result_id=uuid4(), attached_at=timestamp
+        )
+    )
+    targets = sa.Table("TargetIdentifiers", sa.MetaData(), autoload_with=connection)
+    connection.execute(
+        targets.insert().values(hash="a" * 64, class_name="HTTPTarget", identifier_json={"marker": "retained"})
+    )
+
+
+@pytest.mark.parametrize(
+    "revisions",
+    [(PREVIOUS_REVISION,), (REVISION,), (HTTP_REVISION,), (REVISION, HTTP_REVISION)],
+    ids=["common-parent", "finding-index", "http-fingerprint", "both-branches"],
+)
+def test_startup_upgrades_either_migration_branch_without_losing_data(revisions: tuple[str, ...]) -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config(connection)
+            command.upgrade(config, PREVIOUS_REVISION)
+            _seed_upgrade_rows(connection)
+            evidence = dict(connection.execute(sa.select(FindingEvidenceEntry)).mappings().one())
+            for revision in revisions:
+                command.upgrade(config, revision)
+            context = MigrationContext.configure(connection, opts={"version_table": "pyrit_memory_alembic_version"})
+            assert set(context.get_current_heads()) == set(revisions)
+            fingerprint = "recorded-fingerprint" if HTTP_REVISION in revisions else None
+            if fingerprint is not None:
+                connection.execute(
+                    sa.text("UPDATE TargetIdentifiers SET http_request_fingerprint = :value"),
+                    {"value": fingerprint},
+                )
+
+        run_schema_migrations(engine=engine, silent=True)
+        run_schema_migrations(engine=engine, silent=True)
+        with engine.connect() as connection:
+            _assert_merged_schema(connection)
+            assert dict(connection.execute(sa.select(FindingEvidenceEntry)).mappings().one()) == evidence
+            assert connection.scalar(sa.select(FindingEntry.title)) == "Preserved finding"
+            assert connection.scalar(sa.select(OperationEntry.name)) == "Preserved"
+            targets = sa.Table("TargetIdentifiers", sa.MetaData(), autoload_with=connection)
+            row = connection.execute(sa.select(targets)).mappings().one()
+            assert row["hash"] == "a" * 64
+            assert row["identifier_json"] == {"marker": "retained"}
+            assert row["http_request_fingerprint"] == fingerprint
+        check_schema_migrations(engine=engine)
+    finally:
+        engine.dispose()
+
+
+def test_startup_creates_merged_schema_from_empty_database() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        run_schema_migrations(engine=engine, silent=True)
+        with engine.connect() as connection:
+            _assert_merged_schema(connection)
+        check_schema_migrations(engine=engine)
+    finally:
+        engine.dispose()
+
+
+def test_merge_downgrades_both_branches_and_upgrades_again() -> None:
+    engine = sa.create_engine("sqlite:///:memory:")
+    try:
+        with engine.begin() as connection:
+            config = _config(connection)
+            command.upgrade(config, "head")
+            _assert_merged_schema(connection)
+            command.downgrade(config, PREVIOUS_REVISION)
+            assert INDEX not in _evidence_indexes(connection)
+            assert "http_request_fingerprint" not in {
+                column["name"] for column in sa.inspect(connection).get_columns("TargetIdentifiers")
+            }
+        run_schema_migrations(engine=engine, silent=True)
+        with engine.connect() as connection:
+            _assert_merged_schema(connection)
+        check_schema_migrations(engine=engine)
+    finally:
+        engine.dispose()
+
+
+@pytest.mark.parametrize("dialect_name", ["sqlite", "mssql"])
+def test_merge_revision_adds_no_dialect_specific_ddl(dialect_name: str) -> None:
+    migration = importlib.import_module(
+        "pyrit.memory.alembic.versions.f8a6c2d4e901_merge_finding_index_and_http_fingerprint"
+    )
+    output = StringIO()
+    context = MigrationContext.configure(dialect_name=dialect_name, opts={"as_sql": True, "output_buffer": output})
+    with Operations.context(context):
+        migration.upgrade()
+        migration.downgrade()
+    assert output.getvalue() == ""
diff --git a/tests/unit/memory/test_findings.py b/tests/unit/memory/test_findings.py
index 38e15344aa..0800a41434 100644
--- a/tests/unit/memory/test_findings.py
+++ b/tests/unit/memory/test_findings.py
@@ -413,6 +413,40 @@ async def test_one_attack_result_can_support_multiple_findings_and_counts(sqlite
     assert await sqlite_instance.get_finding_evidence_counts_async(finding_ids=[]) == {}
 
 
+async def test_get_findings_for_attack_result_spans_operations_in_dashboard_order(
+    sqlite_instance: SQLiteMemory,
+) -> None:
+    first = await sqlite_instance.add_operation_async(Operation(name="First"))
+    second = await sqlite_instance.add_operation_async(Operation(name="Second"))
+    low = await sqlite_instance.add_finding_async(finding=Finding(operation_id=first.id, title="Low", severity="low"))
+    critical = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=second.id, title="Critical", severity="critical")
+    )
+    unlinked = await sqlite_instance.add_finding_async(
+        finding=Finding(operation_id=first.id, title="Unlinked", severity="critical")
+    )
+    attack_result_id, other_attack_id = uuid4(), uuid4()
+    evidence = {
+        finding.id: await sqlite_instance.add_finding_evidence_async(
+            evidence=FindingEvidence(finding_id=finding.id, attack_result_id=attack_result_id)
+        )
+        for finding in (low, critical)
+    }
+    await sqlite_instance.add_finding_evidence_async(
+        evidence=FindingEvidence(finding_id=unlinked.id, attack_result_id=other_attack_id)
+    )
+
+    linked = await sqlite_instance.get_findings_for_attack_result_async(attack_result_id=attack_result_id)
+
+    assert [(finding.id, item.id) for finding, item in linked] == [
+        (critical.id, evidence[critical.id].id),
+        (low.id, evidence[low.id].id),
+    ]
+    assert {finding.operation_id for finding, _ in linked} == {first.id, second.id}
+    assert all(item.attack_result_id == attack_result_id for _, item in linked)
+    assert await sqlite_instance.get_findings_for_attack_result_async(attack_result_id=uuid4()) == []
+
+
 async def test_get_findings_by_ids_follows_dashboard_order_and_scope(sqlite_instance: SQLiteMemory) -> None:
     operation = await sqlite_instance.add_operation_async(Operation(name="Selected"))
     other = await sqlite_instance.add_operation_async(Operation(name="Other"))