Pre-fill the assessment from discovery notes

I've attached discovery notes for [CLIENT NAME]. Using the ControlMap common assessment questions for this client:
1. Draft an answer (Yes, No, Partially, Not applicable) for every question the notes clearly answer, with the line from my notes that supports it
2. Leave anything uncertain unanswered and add it to a "questions to ask" list, grouped by topic so I can run through it in one meeting
3. Show how many questions this covers and how the assessment score would change

Before you create, update or delete anything, show me exactly what you plan to change in a table and wait for my approval. After approval, save each answer with PUT .../assessments/common/questions/{code}/answer. Keep the supporting notes in your reply, because written responses on questions can't currently be saved through the API.

How to work with the ControlMap API (ScalePad MCP):
- Find the client with GET /controlmap/v1/clients/health and use its tenant ID (for example "dundmif") in every request. Some clients have no UUID.
- Send the header Content-Type: application/json on every POST, PUT and PATCH, including searches.
- Use page_size of 50 or less and follow next_cursor. The "fields" parameter is ignored, so responses are large.
- Judge controls by "status", not the "compliant" flag. Objective lists include sub-objectives, so take totals from objective_summary.
- Use framework-level scores and labels. The overall score_label on client health can be wrong.
- Older policy sections may be URL-encoded twice: decode them and use the highest version of each section.
- If a call returns 502 or fails to connect, wait a few seconds and retry once. If it still fails, tell me exactly which data is missing.

When writing to ControlMap:
- Update policies one field per request. review_date must include milliseconds (2027-01-01T00:00:00.000Z) and policy status must be draft, in_progress, in_review or approved.
- Risk scores and treatment can't be changed through the API. A new risk takes one impact and likelihood, which sets inherent, current and target together. List any score or treatment changes for me to make in ControlMap.
- Write evidence request notes to the "notes" field and assignees to "assigned_to".
- Files can't be uploaded through the MCP. Attach a link to where the file lives (SharePoint, Google Drive) and list any files I need to upload in ControlMap.
- Department and risk category must match existing values (GET /risks/departments and /risks/categories).
- Action item effort is capped at 8 hours, so put larger estimates in the description.
- A 500 error can still save part of a change. Read the record back before retrying.