@certrev/cert-block 2.0.0 → 2.0.2

package/dist/builder/cert-review-card.js

@@ -24,10 +24,10 @@ import { memoToggleFor, toggleMemo } from '../components/memo-toggle.js';
 import { renderCertBlock } from '../components/render-cert-block.js';
 import { CERT_STRINGS_VERSION } from '../components/render-def.js';
 import { renderVerdict } from '../contract/kernel.js';
-import { getVerifiedDelivery, parseDesignPin, readVerifiedDelivery, } from '../verify/get-verified-delivery.js';
+import { deliveryLoading, getVerifiedDelivery, parseDesignPin, readVerifiedDelivery, rememberDeliveryUnreachable, unreachableDelivery, } from '../verify/get-verified-delivery.js';
 import { acceptedCardBinding, cardDigestFor, cardDigestMatches, cardMatchesPlacement, cardPartsFor, parseCardDocument, } from './card-contract.js';
 import { CARD_READER_CSS } from './card-reader-css.js';
-import { reportCardFallbackInBrowser, reportCardFallbackOnServer, } from './card-report.js';
+import { CARD_FALLBACK_REASONS, reportCardFallbackInBrowser, reportCardFallbackOnServer, } from './card-report.js';
 import { BUILDER_CERT_CHROME_KEYS } from './cert-chrome-data.js';
 import { ContractCardFace } from './contract-card.js';
 import { deliveredFaceDigest, deliveredFaceHtml, deliveredFaceMatches, faceHashesFor, showsWholeCard, } from './delivered-face.js';
@@ -53,27 +53,6 @@ export const CERT_COMPONENT_NAME = 'CertREV Cert';
 function text(value) {
     return typeof value === 'string' ? value : '';
 }
-/** The same rule where ABSENT and EMPTY are different renders (`authorTitle`, `bio`). */
-function optionalText(value) {
-    return text(value) || undefined;
-}
-/**
- * The fused credential pair — accepted ONLY when both halves are present AND both are strings.
- *
- * The R1 gate ("a credential never displays without its dated verification") is THIS FUNCTION,
- * not the type: the pair arrives as untyped CMS JSON, and the old truthiness check keyed the
- * whole pair off the OBJECT, so `{credential:'MD'}` forwarded `verifiedAt: undefined` into the
- * renderer and crashed. Anything malformed — a half pair, a bare string, an array, a number
- * where a date belongs — degrades to the name-only face, which is the honest render of a
- * delivery whose verification cannot be read.
- */
-function fusedCredential(pair) {
-    if (!pair || typeof pair !== 'object')
-        return null;
-    const credential = text(pair.credential);
-    const verifiedAt = text(pair.verifiedAt);
-    return credential && verifiedAt ? { credential, verifiedAt } : null;
-}
 /**
  * The delivery marker, accepted only as `{ v: 1, baseUrl }` with `baseUrl` an `https:` ORIGIN on
  * `certrev.com` or one of its subdomains (no path, query, credentials or port). Anything else is
@@ -107,16 +86,72 @@ export function acceptedDeliveryMarker(value) {
  * flight; React 18 (no `use`) gets the promise thrown, the Suspense protocol it supports. Either
  * way the retry finds the settled read in the cache through `readVerifiedDelivery`, so it never
  * suspends on a second promise.
+ *
+ * 2.0.2, on a server (`suspendOnServer`): the render waits at most the runtime's `serverWaitMs` (300 ms). Past it, the
+ * placement's failure is remembered in the cache (so every render in the failure window answers at once, even where the
+ * runtime abandons the read when the response ends), the render prints nothing (`delivery_unreachable`), and the read
+ * runs on: when it lands, the next render paints it. A render that finds a read of the placement already running that it
+ * did not start (another request's, a background refresh, or a second card of the placement on the same page: React
+ * gives a component no way to tell these apart) never waits on it: it is `'skipped'` and prints a marker only
+ * (`SkippedRead`), which the same card instance re-renders while hydrating and replaces with the page's verified seed
+ * right after.
  */
-const inflightReads = new Map();
-function suspendOn(key, start) {
-    let pending = inflightReads.get(key);
+/** The reads a render is suspended on, per runtime cache (a fresh runtime, a fresh page in a test, starts with none). */
+const inflightReadsByCache = new WeakMap();
+function suspendOn(cache, key, start) {
+    let reads = inflightReadsByCache.get(cache);
+    if (!reads) {
+        reads = new Map();
+        inflightReadsByCache.set(cache, reads);
+    }
+    let pending = reads.get(key);
     if (!pending) {
-        pending = start().finally(() => inflightReads.delete(key));
-        inflightReads.set(key, pending);
+        const own = reads;
+        pending = start().finally(() => own.delete(key));
+        reads.set(key, pending);
     }
     return suspendUntil(pending);
 }
+function suspendOnServer(key, read, waitMs) {
+    if (deliveryLoading(read))
+        return 'skipped';
+    return suspendOn(read.cache ?? inflightReadsByCache, key, () => {
+        const loaded = getVerifiedDelivery(read);
+        if (waitMs === undefined || !Number.isFinite(waitMs) || waitMs <= 0)
+            return loaded;
+        return new Promise((resolve) => {
+            const timer = setTimeout(() => {
+                rememberDeliveryUnreachable(read);
+                resolve(unreachableDelivery());
+            }, waitMs);
+            loaded.then((settled) => {
+                clearTimeout(timer);
+                resolve(settled);
+            }, () => {
+                clearTimeout(timer);
+                resolve(unreachableDelivery());
+            });
+        });
+    });
+}
+/** 2.0.2: the attribute a skipped server render's marker carries: the card instance's `useId`. */
+export const SKIPPED_ATTRIBUTE = 'data-certrev-skipped';
+/**
+ * 2.0.2: what a server render prints when it did not wait for a read it did not start: a hidden marker naming the card
+ * instance, and no record (it knows nothing about the placement, so it must never stand in for another card's record).
+ * Not a failure: nothing is reported or remembered.
+ */
+function SkippedRead({ instance }) {
+    return _jsx("div", { hidden: true, [SKIPPED_ATTRIBUTE]: instance });
+}
+/** 2.0.2: whether the live document holds this card instance's skipped marker (it is hydrating one). */
+function skippedInDocument(instance) {
+    for (const el of Array.from(document.querySelectorAll(`[${SKIPPED_ATTRIBUTE}]`))) {
+        if (el.getAttribute(SKIPPED_ATTRIBUTE) === instance)
+            return true;
+    }
+    return false;
+}
 /** `use` where React has it (19), else the thrown promise (18). */
 function suspendUntil(pending) {
     const use = React.use;
@@ -300,55 +335,34 @@ function paintEnvelope(payload, renderDef, props, seed) {
         return null;
     return _jsx(EnvelopeFace, { html: renderCertBlock(input), defVersion: defVersion, seed: seed });
 }
-const FALLBACK_LAYOUTS = ['banner', 'sidebar', 'floating'];
-/**
- * The options face a block with the delivery marker paints in place of the envelope (1.2.0), or null. Its placement is
- * the block's own `mode`, else its def's layout, as the envelope face's is, else the banner bridge. A pinned card (the
- * canary replica) paints it too, so the replica shows what a brand's page shows when CertREV is not reached; its
- * record names the pin and says `'options'`, so a capture can never take it for the pinned design.
- */
-function fallbackFace(props) {
-    const { block } = props;
-    const layout = block.renderDef?.layout;
-    const mode = typeof block.mode === 'string' && FALLBACK_LAYOUTS.includes(block.mode)
-        ? block.mode
-        : typeof layout === 'string' && FALLBACK_LAYOUTS.includes(layout)
-            ? layout
-            : undefined;
-    return optionsFaceHtml(block, mode);
-}
-/** The block's options face, stamped with a fallback record when the server wrote one (`ssr-seed.ts`). */
-function OptionsFace(props) {
-    return (_jsx("div", { "data-certrev-cert-chrome": "", "data-certrev-strings-version": optionalText(props.block.stringsVersion), "data-certrev-def-version": typeof props.block.renderDef?.v === 'number' ? props.block.renderDef.v : undefined, ...(props.record === undefined ? {} : { [SEED_ATTRIBUTE]: props.record }), 
-        // biome-ignore lint/security/noDangerouslySetInnerHtml: renderCertBlock is the escaping-safe SSR string renderer
-        dangerouslySetInnerHTML: { __html: props.html } }));
-}
 /** Where the server painted no face, an empty hidden element carries the record that says so. */
 function NoFace(props) {
     return _jsx("div", { hidden: true, [SEED_ATTRIBUTE]: props.record });
 }
 /**
  * 2.0.0: reports one fallback (`card-report.ts`) and renders nothing (no element, no marker: it changes no byte of the
- * page). On a server it reports as it renders; in a browser, once it has mounted.
+ * page). On a server it reports as it renders; in a browser, once it has mounted. 2.0.1: the report is also a beacon to
+ * `origin`, the delivery origin the block reads (none: CertREV's production origin).
  */
 function FallbackReport(props) {
-    const { detail, server } = props;
+    const { detail, server, origin } = props;
     if (server)
-        reportCardFallbackOnServer(detail);
+        reportCardFallbackOnServer(detail, origin);
     React.useEffect(() => {
-        reportCardFallbackInBrowser(detail);
-    }, [detail]);
+        reportCardFallbackInBrowser(detail, origin);
+    }, [detail, origin]);
     return null;
 }
 /** A face with its fallback report beside it. */
-function withReport(face, reason, props, server, certId) {
+function withReport(face, reason, props, server, certId, status) {
     const detail = {
         reason,
         platform: 'builder',
         externalId: props.externalId,
         ...(certId === undefined ? {} : { certId }),
+        ...(status === undefined ? {} : { status }),
     };
-    return (_jsxs(_Fragment, { children: [face, _jsx(FallbackReport, { detail: detail, server: server })] }));
+    return (_jsxs(_Fragment, { children: [face, _jsx(FallbackReport, { detail: detail, server: server, origin: props.baseUrl })] }));
 }
 function contractOutcome(binding, rawCard, payload, props, 
 /** The digest the read computed (`VerifiedDelivery.cardDigest`): then nothing suspends here. */
@@ -393,31 +407,43 @@ function contractNone(props, reason, server, certId) {
     return reason ? withReport(face, reason, props, server, certId) : face;
 }
 /**
- * What a card with no verified envelope paints: the options face when CertREV was not reached, else nothing. 2.0.0:
- * the same faces and records as 1.3.1, and two of them are now reported: the options face painted because CertREV
- * was not reached (`delivery_unreachable`), and nothing painted because the envelope's kid is unknown (`unknown_key`).
+ * What a card with no verified envelope paints: nothing, and a `'none'` record. 2.0.1: CertREV not reached prints
+ * nothing too (it painted the block's export-time options through 2.0.0), and the record names `delivery_unreachable`
+ * so the browser reports it as well (with CertREV's HTTP status when it answered with one); an unknown kid is reported as
+ * `unknown_key`, and (2.0.1) an envelope that does not verify as `envelope_verify_failed`. A definitive no (revoked,
+ * expired, for another entry, not found) prints nothing, by design, unreported.
  */
 function settleWithoutEnvelope(props, verdict, server) {
-    const html = verdict.unreachable ? fallbackFace(props) : null;
-    const face = html === null ? 'none' : 'options';
+    const reason = verdict.unreachable
+        ? 'delivery_unreachable'
+        : verdict.reason === 'unknown_key'
+            ? 'unknown_key'
+            : verdict.reason !== undefined && ENVELOPE_VERIFY_FAILURES.has(verdict.reason)
+                ? 'envelope_verify_failed'
+                : undefined;
     const record = serializeFallback({
         baseUrl: props.baseUrl,
         externalId: props.externalId,
         ...(props.design ? { design: props.design } : {}),
-        face,
+        face: 'none',
+        ...(reason ? { reason } : {}),
     });
-    if (html !== null) {
-        return withReport(_jsx(OptionsFace, { block: props.block, html: html, record: record }), 'delivery_unreachable', props, server);
-    }
     const none = _jsx(NoFace, { record: record });
-    // A block with no options to paint when CertREV was not reached is reported too (break-it B5).
-    if (verdict.unreachable)
-        return withReport(none, 'delivery_unreachable', props, server);
-    return verdict.reason === 'unknown_key' ? withReport(none, 'unknown_key', props, server) : none;
-}
+    return reason
+        ? withReport(none, reason, props, server, undefined, verdict.unreachable ? verdict.status : undefined)
+        : none;
+}
+/** 2.0.1: the kernel's suppress reasons that mean the envelope itself did not verify (reported, never silent). */
+const ENVELOPE_VERIFY_FAILURES = new Set([
+    'invalid_signature',
+    'unsupported_alg',
+    'platform_mismatch',
+    'content_drift',
+    'unsupported_contract_version',
+]);
 /**
  * Paint what the page's record for this placement says: a seed its envelope (judged at the browser's clock first when
- * `judge`), an `'options'` record the options face, a `'none'` record nothing.
+ * `judge`), a `'none'` record nothing, and (2.0.1) a 2.0.0 server's `'options'` record nothing too.
  */
 function paintRecord(record, props, context, judge) {
     if ('seed' in record) {
@@ -437,7 +463,7 @@ function paintRecord(record, props, context, judge) {
         if (binding !== null) {
             const outcome = contractOutcome(binding, seed.card, seed.payload, props);
             if (outcome.kind === 'card')
-                return _jsx(ContractCardFace, { card: outcome.card, names: outcome.names, seed: record.raw });
+                return _jsx(ContractCardFace, { card: outcome.card, names: outcome.names, seed: record.raw, origin: props.baseUrl });
             // Hydrating over the card the server printed, which the browser could not confirm (no WebCrypto): adopt the
             // server's element; the render right after hydration prints nothing in its place.
             if (!judge && outcome.reason === 'card_verify_failed' && seed.card !== undefined)
@@ -458,30 +484,20 @@ function paintRecord(record, props, context, judge) {
             return _jsx(ServerFaceUntilHydrated, {});
         return paintEnvelope(seed.payload, seed.renderDef, props, record.raw);
     }
-    const html = record.fallback.face === 'options' ? fallbackFace(props) : null;
-    if (html !== null) {
-        return withReport(_jsx(OptionsFace, { block: props.block, html: html, record: record.raw }), 'delivery_unreachable', props, false);
-    }
     const none = _jsx(NoFace, { record: record.raw });
+    // 2.0.1: an `'options'` record (a page a 2.0.0 server rendered while CertREV was not reached) prints nothing too.
+    if (record.fallback.face === 'options')
+        return withReport(none, 'delivery_unreachable', props, false);
     // 2.0.0: a contract-1 placement's record names why it printed nothing; the browser reports it too.
     const reason = record.fallback.reason;
     return isFallbackReason(reason) ? withReport(none, reason, props, false) : none;
 }
-const FALLBACK_REASONS = [
-    'card_missing',
-    'card_verify_failed',
-    'card_unsupported_contract',
-    'card_pin_mismatch',
-    'unknown_key',
-    'delivery_unreachable',
-];
 function isFallbackReason(value) {
-    return typeof value === 'string' && FALLBACK_REASONS.includes(value);
+    return typeof value === 'string' && CARD_FALLBACK_REASONS.includes(value);
 }
-/** What a card the client mounts with no record and no `clientRead` paints: the options face, or nothing. */
+/** 2.0.1: a card the client mounts with no record and `clientRead` off prints nothing (2.0.0: the options face). */
 function clientMountFace(props) {
-    const html = fallbackFace(props);
-    return html === null ? null : _jsx(OptionsFace, { block: props.block, html: html });
+    return withReport(null, 'client_read_off', props, false);
 }
 const pendingRecord = () => 'pending';
 /**
@@ -503,6 +519,24 @@ function StreamedRecordCard(props) {
         return props.clientRead ? readAndPaint(props, context, true) : clientMountFace(props);
     return paintRecord(record, props, context, true);
 }
+/**
+ * 2.0.2 (final review R2-1): a card whose server render skipped its read. While hydrating, its marker as the server
+ * printed it. After, the record the page holds for its placement (the seed the card that did the read printed), also
+ * when that record streams in after this card hydrated; nothing while it has not arrived, and nothing if the page loads
+ * without one. It reads nothing.
+ */
+function SkippedThenRecord(props) {
+    const rt = cardDeliveryRuntime();
+    // In render, not in an effect, as `StreamedRecordCard` does.
+    watchStreamedRecords();
+    const record = React.useSyncExternalStore(subscribeStreamedRecords, () => streamedRecordFor(props.baseUrl, props.externalId, props.design), pendingRecord);
+    if (props.hydrating)
+        return _jsx(SkippedRead, { instance: props.instance });
+    if (record === 'pending' || record === 'done')
+        return null;
+    const context = { platform: 'builder', externalId: props.externalId, now: new Date(rt.now()) };
+    return paintRecord(record, props, context, true);
+}
 const subscribeNever = () => () => { };
 /**
  * True on a server and while a browser hydrates server HTML; false once the client has committed, and from the first
@@ -520,27 +554,28 @@ function useHydrating() {
  * storefront whose CSP `connect-src` does not name CertREV (e.l.f.'s live policy) never sees a request or a violation
  * from it, and a page never loses its card for want of one.
  *
- *  - Server: read (up to `CARD_DELIVERY_TIMEOUT_MS`, a fresh or stale-while-revalidating cache first), verify and paint
+ *  - Server: read (2.0.2: waiting at most `CARD_SERVER_WAIT_MS`, never behind another request's read; a fresh or stale-while-revalidating cache, or a remembered failure, first), verify and paint
  *    as through 1.1.1, and write a record of what it painted (`ssr-seed.ts`):
  *     - a verified envelope: its face and the envelope seed (less the fields the def hides, and with no signature if
  *       it hid any);
- *     - CertREV not reached (a timeout, a network error, a 5xx, a body that is not JSON): the block's own options face,
- *       as 0.5.x painted it, and an `'options'` record (a pinned card too: the record names its pin);
+ *     - CertREV not reached (a timeout, a network error, a 5xx, a body that is not JSON) with no verified answer inside
+ *       the stale window: nothing, and a `'none'` record naming `delivery_unreachable` (2.0.1; through 2.0.0 the
+ *       block's own options face and an `'options'` record);
  *     - a definitive no (revoked, expired, unverifiable, for another entry, not found): nothing, and a `'none'` record
  *       on an empty hidden element.
  *  - Browser, the page carries this placement's record: paint what it says. A seed paints its envelope; while
  *    hydrating the server's verdict stands (the tree is the server's, byte for byte), and once hydrated the lifecycle
- *    and subject are judged at the browser's clock, so a card that expired since the server render is taken down. An
- *    `'options'` record paints the options face, a `'none'` record nothing. This holds when React renders the card
+ *    and subject are judged at the browser's clock, so a card that expired since the server render is taken down. A
+ *    `'none'` record, and (2.0.1) a 2.0.0 server's `'options'` record, print nothing. This holds when React renders the card
  *    again on the client after a hydration error elsewhere on the page: the record is still in the document (or in
  *    the page's memory of it), so the browser repaints the server's answer and reads nothing.
  *  - Browser, hydrating with no record: server HTML from before 1.2.0 painted nothing here, so nothing.
  *  - Browser, a card mounted on the client with no record (a client-side navigation to an article this page never
- *    server-rendered, Builder's editor): the block's options face, pinned or not. With `clientRead`, instead, the
- *    one read, settled exactly as on the server.
+ *    server-rendered, Builder's editor): with `clientRead` (the default), the one read, settled exactly as on the
+ *    server; with `clientRead={false}`, nothing (`client_read_off`; 2.0.0: the block's options face).
  *  - Browser, the same while the document is still loading (1.2.1; React rendered the card on the client before the
- *    server's streamed record arrived, `ssr-seed.ts`): nothing until the record arrives, then what it says; the
- *    options face, or nothing, if the page loads without one (`StreamedRecordCard`). `clientRead` reads as above.
+ *    server's streamed record arrived, `ssr-seed.ts`): nothing until the record arrives, then what it says; if the page
+ *    loads without one, what a client mount does (`StreamedRecordCard`). `clientRead` reads as above.
  *
  * WHICH OF THE TWO FIRST CASES THIS RENDER IS (server or browser) is decided from what the render can observe, with
  * no switch a test could set. A server render and a hydration are both "hydrating" to React and both see a `document`
@@ -560,6 +595,8 @@ function useHydrating() {
 function EnvelopeCertReviewCard(props) {
     const rt = cardDeliveryRuntime();
     const hydrating = useHydrating();
+    // 2.0.2: this card instance's id, the same on the server and while hydrating (`SkippedRead`).
+    const instance = React.useId();
     // Latched at mount: this instance hydrated server HTML (as opposed to a client mount).
     const [hydratedMount] = React.useState(hydrating);
     // The clock is read per render, so the lifecycle is judged NOW, not when the envelope was fetched.
@@ -575,6 +612,10 @@ function EnvelopeCertReviewCard(props) {
     // record lands).
     // 2.0.0: whatever `clientRead` says: a card that read instead of waiting would miss the record the server streams.
     const [awaitsStream] = React.useState(() => inBrowser && !hydrating && fromPage === undefined && document.readyState === 'loading');
+    // 2.0.2, latched at mount: this instance is hydrating a server render that skipped its read (`SkippedRead`).
+    const [skippedMount] = React.useState(() => inBrowser && hydrating && skippedInDocument(instance));
+    if (skippedMount)
+        return _jsx(SkippedThenRecord, { ...props, instance: instance, hydrating: hydrating });
     if (awaitsStream)
         return _jsx(StreamedRecordCard, { ...props });
     if (inBrowser) {
@@ -585,13 +626,13 @@ function EnvelopeCertReviewCard(props) {
         if (!props.clientRead)
             return clientMountFace(props);
     }
-    return readAndPaint(props, context, inBrowser);
+    return readAndPaint(props, context, inBrowser, instance);
 }
 /**
  * The Delivery read and its paint: a server render's, or a browser's (`clientRead`). Suspends on the read, and (1.3.0)
  * on a delivered face's hashes or (2.0.0) on a card document's digest.
  */
-function readAndPaint(props, context, inBrowser) {
+function readAndPaint(props, context, inBrowser, instance = '') {
     const rt = cardDeliveryRuntime();
     const { design } = props;
     const read = {
@@ -608,9 +649,18 @@ function readAndPaint(props, context, inBrowser) {
     const key = design
         ? `${props.baseUrl}|${props.externalId}|design=${design.version}|${design.brand ?? ''}`
         : `${props.baseUrl}|${props.externalId}`;
-    const settled = readVerifiedDelivery(read) ?? suspendOn(key, () => getVerifiedDelivery(read));
+    const settled = readVerifiedDelivery(read) ??
+        (inBrowser
+            ? suspendOn(rt.cache, key, () => getVerifiedDelivery(read))
+            : suspendOnServer(key, read, rt.serverWaitMs));
+    if (settled === 'skipped')
+        return _jsx(SkippedRead, { instance: instance });
     if (settled.verdict.decision !== 'render') {
-        return settleWithoutEnvelope(props, { unreachable: settled.unreachable === true, reason: settled.verdict.reason }, !inBrowser);
+        return settleWithoutEnvelope(props, {
+            unreachable: settled.unreachable === true,
+            reason: settled.verdict.reason,
+            ...(settled.status === undefined ? {} : { status: settled.status }),
+        }, !inBrowser);
     }
     // The face is painted from the seed's payload (what the def hides is already out of it), so the server's HTML and
     // the browser's, which paints from the seed, are the same bytes and neither holds a hidden field.
@@ -627,7 +677,7 @@ function readAndPaint(props, context, inBrowser) {
     if (binding !== null) {
         const outcome = contractOutcome(binding, settled.card, seed.payload, props, settled.cardDigest);
         if (outcome.kind === 'card') {
-            return (_jsx(ContractCardFace, { card: outcome.card, names: outcome.names, seed: serializeSeed({ ...seed, card: outcome.card }) }));
+            return (_jsx(ContractCardFace, { card: outcome.card, names: outcome.names, seed: serializeSeed({ ...seed, card: outcome.card }), origin: props.baseUrl }));
         }
         // Nothing of this design for this block, by design: nothing at all, and NO record. A record here would sit under the
         // same placement as the block that printed the card (a split header and memo pair) and, read last on hydration,
@@ -645,104 +695,27 @@ function readAndPaint(props, context, inBrowser) {
     return paintEnvelope(seed.payload, seed.renderDef, props, serializeSeed(seed));
 }
 export function CertReviewCard(props) {
-    // 1.1.0: a block that carries the delivery marker paints from the signed envelope and the
-    // brand's def, never from the options beside it. No marker (every entry exported before 1.1.0)
-    // takes the options path below, unchanged from 1.0.3.
-    // 1.2.0-canary.5: a design pin (CertREV's canary replica only) fails closed. One that cannot be read renders
-    // nothing, and so does one on a block without the delivery marker: the options face is never the pinned design.
-    // 1.2.0: where the envelope cannot be had (CertREV not reached, or no server render and no `clientRead`), a block
-    // with the marker paints this options face too, pinned or not: see `EnvelopeCertReviewCard`.
+    // 1.1.0: a block that carries the delivery marker paints from the signed envelope and the brand's def, never from
+    // the options beside it. 2.0.1: a block WITHOUT the marker (an entry exported before 1.1.0, a block dropped in by
+    // hand) prints nothing at all and reports `no_marker`; through 2.0.0 it painted its export-time options (a reviewer
+    // name, a credential, a memo, a verify link nobody had signed). A marker this client does not accept, or a block
+    // with no Builder entry to read for, prints nothing and reports `marker_invalid`.
+    // 1.2.0-canary.5: a design pin (CertREV's canary replica only) that cannot be read renders nothing.
     const design = parseDesignPin(props.builderContext?.context?.certrevDesignPin);
     if (design === 'invalid')
         return null;
-    if (props.delivery != null) {
-        const marker = acceptedDeliveryMarker(props.delivery);
-        const entryId = text(props.builderContext?.content?.id);
-        if (!marker || !entryId)
-            return null;
-        return (_jsx(Suspense, { fallback: null, children: _jsx(EnvelopeCertReviewCard, { baseUrl: marker.baseUrl, externalId: entryId, mode: props.mode, part: props.part, design: design, block: props, clientRead: props.clientRead !== false }) }));
-    }
-    if (design)
-        return null;
-    const html = optionsFaceHtml(props, 'banner');
-    if (html === null)
-        return null; // no chrome pre-cert (or an unreadable delivery)
-    return _jsx(OptionsFace, { block: props, html: html });
-}
-/**
- * The options face's HTML (1.0.3's, unchanged), or null when the block lacks a reviewer or a certificate link. `bridge`
- * is the placement a block with no `mode` gets: `'banner'` for a block without the delivery marker (the bridge below);
- * the def's layout for a marked block's fallback (`fallbackFace`).
- */
-function optionsFaceHtml(props, bridge) {
-    const reviewerName = text(props.reviewerName);
-    const verifyUrl = text(props.verifyUrl);
-    if (!reviewerName || !verifyUrl)
-        return null;
-    // Name-only face when the pair is unreadable, or when the brand set showCredentials:false.
-    const showCred = props.display?.showCredentials !== false;
-    const withCred = showCred ? fusedCredential(props.credentialVerification) : null;
-    const tokens = props.renderDef?.tokens;
-    const theme = tokens
-        ? {
-            accentColor: optionalText(tokens.accentColor),
-            surface: optionalText(tokens.surface),
-            cornerRadius: optionalText(tokens.cornerRadius),
-            fontSlot: optionalText(tokens.fontSlot),
-            // v2 brand-ink (post-demo): the bar + free-content ink follow the def.
-            barInk: optionalText(tokens.barInk),
-            inkColor: optionalText(tokens.inkColor),
-        }
-        : undefined;
-    return renderCertBlock({
-        // COMPATIBILITY BRIDGE, NOT THE DESIGN. Delete this fallback once the exporter emits an
-        // explicit `mode` and existing entries have been backfilled; until then it must stay.
-        //
-        // `renderCertBlock` owns the ONE placement default (absent or unrecognised ⇒ sidebar) and
-        // that decision STANDS: it is what a direct caller gets, and `sidebar` is the registered
-        // input's `defaultValue`, so every block created in the editor from now on carries an
-        // explicit `mode` and never reaches this line.
-        //
-        // The problem is the entries that already exist. `mode` is a PLACEMENT input, not one of
-        // the 20 wire keys (`BUILDER_CERT_CHROME_KEYS`), and the exporter emits only the wire
-        // projection (`options: { ...certData }`), so every entry exported to date has NO `mode`
-        // key at all. Through 0.5.5 this line read `?? 'banner'` and those entries rendered the
-        // banner face. Removing it in 1.0.0 did not give them the renderer's default in the
-        // abstract; it silently repainted live pages from banner to sidebar, with no entry edit
-        // and no version pin to protect them, because their install line is unpinned.
-        //
-        // So this is a bridge for pre-existing entries, NOT a reversal of the sidebar default.
-        // The three-copies-of-a-default problem that motivated removing it is still real and is
-        // still fixed: the helper text and the wire type's doc comment no longer name a default,
-        // and this line names one only for input the renderer can no longer distinguish from a
-        // deliberate choice. The exporter writing `mode` is what retires it.
-        mode: props.mode ?? bridge ?? 'banner',
-        theme,
-        // First-class banner memo split — renderCertBlock composes the requested
-        // part directly; no string-splitting. Ignored outside banner mode, and an unrecognised
-        // value is normalised to 'full' there, same as `mode` — not here.
-        ...(props.part ? { part: props.part } : {}),
-        facts: {
-            authorName: optionalText(props.authorName) ?? 'Editorial',
-            authorTitle: optionalText(props.authorTitle),
-            reviewerName,
-            credential: withCred?.credential ?? '',
-            credentialVerifiedAt: withCred?.verifiedAt ?? '',
-            certifiedAt: text(props.certifiedAt),
-            memo: text(props.memo),
-            bio: optionalText(props.bio),
-            profileUrl: text(props.reviewerProfileUrl),
-            certificateUrl: verifyUrl,
-            // The compliance disclosures are CONSTANTS the renderer owns — a delivered cue is
-            // IGNORED (an editor cannot retype the FTC copy into something friendlier), and the
-            // scope line is not forwarded at all. The ONE thing honored is an explicit `null`:
-            // the pro-bono reviewer has no compensation to disclose, so the cue is omitted
-            // rather than replaced by the compensated constant (the modal already gets this
-            // right — a card claiming "Compensated expert" over a volunteer is an FTC-facing
-            // falsehood, not a cosmetic default).
-            compensationCue: props.compensationCue === null ? null : undefined,
-        },
-    });
+    const entryId = text(props.builderContext?.content?.id);
+    if (props.delivery == null)
+        return _jsx(BlockReport, { reason: "no_marker", externalId: entryId });
+    const marker = acceptedDeliveryMarker(props.delivery);
+    if (!marker || !entryId)
+        return _jsx(BlockReport, { reason: "marker_invalid", externalId: entryId });
+    return (_jsx(Suspense, { fallback: null, children: _jsx(EnvelopeCertReviewCard, { baseUrl: marker.baseUrl, externalId: entryId, mode: props.mode, part: props.part, design: design, block: props, clientRead: props.clientRead !== false }) }));
+}
+/** 2.0.1: a block with nothing to read reports why, to CertREV's production origin (it has no delivery origin). */
+function BlockReport(props) {
+    const detail = React.useMemo(() => ({ reason: props.reason, platform: 'builder', externalId: props.externalId }), [props.reason, props.externalId]);
+    return _jsx(FallbackReport, { detail: detail, server: typeof document === 'undefined' });
 }
 /** Builder input TYPE per wire-type key — the exporter serializes these option values. */
 const WIRE_INPUT_TYPE = {