@redsift/products 12.5.12-alpha.2 → 12.5.12-alpha.4

package/_internal/SignalCardSpfDomain.js

@@ -539,7 +539,31 @@ var EXTRACTOR_STRINGS = {
     "investigate:card.dmarc.full-rejection-subdomain-weak_md": "**100%** of unauthorized emails with the [](FROM#:glossary) `{domain}` will be **rejected**, but subdomains use a weaker policy (sp={sp}), leaving them vulnerable to spoofing.",
     "investigate:card.dmarc.misplaced-bad-policy_md": "**The [FULL](DMARC_POLICY#:glossary) is misplaced and has a syntax error:**",
     "investigate:card.dmarc.misplaced-policy_md": "**The [FULL](DMARC_POLICY#:glossary) is misplaced.**",
-    "investigate:card.dmarc.multiple-policies_md": "**More than one [FULL](DMARC_POLICY#:glossary) is published on `{policyDomain}`.** Receivers stop policy discovery and apply no DMARC policy at all, so the domain is unprotected. Publish exactly one DMARC record.",
+    // WEB-1243: standards-neutral. The previous wording said receivers "stop policy
+    // discovery and apply no DMARC policy at all", which is RFC 7489 §6.6.3 step 5 only.
+    // RFC 9989 §4.10 receivers discard the duplicates and CONTINUE the tree walk, so an
+    // ancestor policy may still apply — and DNS-DMARC-0044, the live signal on current
+    // production, is emitted by exactly those receivers. Stating the RFC 7489 behaviour
+    // as universal was therefore false for the code that now triggers this message.
+    // Rewritten to assert only what is true on both: the outcome is receiver-dependent
+    // and therefore unreliable, and the fix is the same either way.
+    "investigate:card.dmarc.multiple-policies_md": "**More than one [FULL](DMARC_POLICY#:glossary) is published on `{policyDomain}`.** Handling depends on the receiver: some stop policy discovery and apply no DMARC policy at all, others discard the duplicate records and continue. Your policy cannot be relied on for any recipient while more than one record is published. Publish exactly one DMARC record.",
+    // WEB-1243: the UNCONFIRMED counterpart. `indeterminate` means the check could not
+    // finish, NOT that duplicates were found. It resolves to a danger status on purpose —
+    // an unproven absence must not read as a proven one on a security signal — but the copy
+    // must not then assert the conflict as fact. `multiple-policies_md` says duplicates ARE
+    // published and to publish exactly one record, which on this path would tell a user
+    // with a healthy single record to change it.
+    //
+    // DELIBERATELY CAUSE-NEUTRAL. `indeterminate` has more than one cause: the scan budget
+    // running out, AND a candidate entry the check could not read (a rendered display group
+    // reaching a semantic position). An earlier draft said "the domain published more
+    // records than this check inspects", which is a FALSE statement of fact on the second
+    // cause — a one-name payload got told it had published too many records. Naming any
+    // single cause here is wrong unless the reason is carried alongside the verdict, so the
+    // copy states only what is true of every path: not everything was inspected, and the
+    // reader should go and look.
+    "investigate:card.dmarc.multiple-policies-unconfirmed_md": "**We could not fully check how many [FULL](DMARC_POLICY#:glossary) records are published on `{policyDomain}`.** This check did not inspect every record, so we cannot confirm whether more than one is live. If more than one is published, your policy cannot be relied on for any recipient. Review the DNS zone for `{policyDomain}` and confirm it publishes exactly one DMARC record.",
     "investigate:card.dmarc.no-policy_md": "**No [FULL](DMARC_POLICY#:glossary) published on domain**\n\n**`{policyDomain}`**",
     "investigate:card.dmarc.no-txt-published-policy-on-domain_md": "No [](TXT_RECORDS#:glossary) published on `{policyDomain}`",
     "investigate:card.dmarc.permerror-no-rua_md": "No valid reporting URI ([](RUA#:glossary)) is present, so receivers will skip DMARC processing entirely.",
@@ -1026,7 +1050,8 @@ var EXTRACTOR_STRINGS = {
     "investigate:card.dmarc.full-rejection-subdomain-weak_md": "**100%** des courriels non autoris\xE9s avec le [](FROM#:glossary) `{domain}` seront **rejet\xE9s**, mais les sous-domaines utilisent une politique plus faible (sp={sp}), les laissant vuln\xE9rables \xE0 l'usurpation.",
     "investigate:card.dmarc.misplaced-bad-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal plac\xE9 et a une erreur de syntaxe:**",
     "investigate:card.dmarc.misplaced-policy_md": "**Le [FULL](DMARC_POLICY#:glossary) est mal plac\xE9.",
-    "investigate:card.dmarc.multiple-policies_md": "**Plusieurs [FULL](DMARC_POLICY#:glossary) sont publi\xE9es sur `{policyDomain}`.** Les destinataires interrompent la d\xE9couverte de la politique et n'appliquent aucune politique DMARC, le domaine n'est donc pas prot\xE9g\xE9. Publiez un seul enregistrement DMARC.",
+    "investigate:card.dmarc.multiple-policies_md": "**Plusieurs [FULL](DMARC_POLICY#:glossary) sont publi\xE9es sur `{policyDomain}`.** Le traitement d\xE9pend du destinataire : certains interrompent la d\xE9couverte de la politique et n'appliquent aucune politique DMARC, d'autres ignorent les enregistrements en double et continuent. Votre politique ne peut \xEAtre consid\xE9r\xE9e comme fiable pour aucun destinataire tant que plusieurs enregistrements sont publi\xE9s. Publiez un seul enregistrement DMARC.",
+    "investigate:card.dmarc.multiple-policies-unconfirmed_md": "**Nous n'avons pas pu v\xE9rifier enti\xE8rement combien d'enregistrements [FULL](DMARC_POLICY#:glossary) sont publi\xE9s sur `{policyDomain}`.** Cette v\xE9rification n'a pas inspect\xE9 tous les enregistrements, nous ne pouvons donc pas confirmer si plusieurs sont actifs. Si plusieurs sont publi\xE9s, votre politique ne peut \xEAtre consid\xE9r\xE9e comme fiable pour aucun destinataire. Examinez la zone DNS de `{policyDomain}` et confirmez qu'elle publie un seul enregistrement DMARC.",
     "investigate:card.dmarc.no-policy_md": "**Aucune [FULL](DMARC_POLICY#:glossary) publi\xE9e sur le domaine**\n\n**`{policyDomain}`**",
     "investigate:card.dmarc.no-txt-published-policy-on-domain_md": "Aucun [](TXT_RECORD#:glossary) publi\xE9 sur `{policyDomain}`",
     "investigate:card.dmarc.permerror-no-rua_md": "Aucun URI de rapport valide ([](RUA#:glossary)) n'est pr\xE9sent, les destinataires ignoreront enti\xE8rement le traitement DMARC.",
@@ -1291,6 +1316,7 @@ var enUS = {
 	"investigate.extracted-email-short": "Extracted from your email",
 	"investigate.dkim-evaluation": "DKIM Evaluation",
 	"investigate.fcrdns-evaluation": "FCrDNS Evaluation",
+	"investigate.card.bimi.glossary-link": "What does this mean?",
 	"investigate.card.spf-passed_md": "**[](SPF#:glossary) authentication passed.**",
 	"investigate.card.spf-failed_md": "**[](SPF#:glossary) authentication failed.**",
 	"investigate.card.dmarc.error-raw_md": [
@@ -1315,6 +1341,7 @@ var enUS = {
 	"investigate.card.dmarc.policy-remaining-emails-pct-reject_md": "The remaining **{remainingPercent}%** of unauthorized emails will be subject to the **quarantine** policy.",
 	"investigate.card.dmarc.policy-remaining-emails-pct-quarantine_md": "The remaining **{remainingPercent}%** of unauthorized emails will be **delivered normally**.",
 	"investigate.card.dmarc.no-policy_md": "**No [FULL](DMARC_POLICY#:glossary) published on domain**\n\n**`{policyDomain}`**",
+	"investigate.card.dmarc.multiple-policies_md": "**More than one [FULL](DMARC_POLICY#:glossary) is published on `{policyDomain}`.** Handling depends on the receiver: some stop policy discovery and apply no DMARC policy at all, others discard the duplicate records and continue. Your policy cannot be relied on for any recipient while more than one record is published. Publish exactly one DMARC record.",
 	"investigate.card.dmarc.dmarc-passed_md": "[](DMARC#:glossary) **passed**",
 	"investigate.card.dmarc.dmarc-passed-no-rua_md": "[](DMARC#:glossary) is BIMI compliant **BUT** it does not have an **aggregate report address** (rua) entry.",
 	"investigate.card.dmarc.dmarc-no-rua_md": "[](DMARC#:glossary) does not have an **aggregate report address** (rua) entry.",
@@ -1934,7 +1961,14 @@ var enUS = {
 	"investigate.card.dmarc.domain-aligned": "The domain is aligned with the From Domain. It can contribute to passing DMARC.",
 	"investigate.card.dmarc.domain-aligned-not-verified": "The domain is aligned with the From Domain, but its signature did not verify, so it cannot contribute to passing DMARC.",
 	"investigate.card.dmarc.spf-domain-aligned-not-verified": "The domain is aligned with the From Domain, but SPF did not pass, so it cannot contribute to passing DMARC.",
-	"investigate.card.dmarc.domain-not-aligned": "The domain is not aligned with the From Domain. It cannot contribute to passing DMARC."
+	"investigate.card.dmarc.domain-not-aligned": "The domain is not aligned with the From Domain. It cannot contribute to passing DMARC.",
+	"investigate.card.dmarc.multiple-policies-unconfirmed_md": "**We could not fully check how many [FULL](DMARC_POLICY#:glossary) records are published on `{policyDomain}`.** This check did not inspect every record, so we cannot confirm whether more than one is live. If more than one is published, your policy cannot be relied on for any recipient. Review the DNS zone for `{policyDomain}` and confirm it publishes exactly one DMARC record.",
+	"investigate.card.extracted.truncated-records": "[… {count} more records not shown]",
+	"investigate.card.extracted.truncated-records_one": "[… 1 more record not shown]",
+	"investigate.card.extracted.truncated-records-atleast": "[… at least {count} more records not shown]",
+	"investigate.card.extracted.truncated-records-uninspected": "[… further records not inspected]",
+	"investigate.card.extracted.truncated-record-length": "[… long records shortened for display]",
+	"investigate.card.extracted.truncated-records-atleast_one": "[… at least 1 more record not shown]"
 };
 
 var frFR = {
@@ -2008,6 +2042,7 @@ var frFR = {
 	"investigate.summary.dnssec": "DNSSEC",
 	"investigate.summary.dns-lookups": "{count} Recherches DNS",
 	"investigate.summary.void-lookups": "{count} Recherches vides",
+	"investigate.card.bimi.glossary-link": "Qu’est-ce que cela signifie ?",
 	"investigate.card.spf-passed_md": "**[](SPF#:glossary) authentification réussie.**",
 	"investigate.card.spf-failed_md": "**[](SPF#:glossary) authentification échouée.**",
 	"investigate.card.dmarc.error-raw_md": [
@@ -2032,6 +2067,7 @@ var frFR = {
 	"investigate.card.dmarc.policy-remaining-emails-pct-reject_md": "Les **{remainingPercent}%** restants de courriels non autorisés seront soumis à la politique de **mise en quarantaine**.",
 	"investigate.card.dmarc.policy-remaining-emails-pct-quarantine_md": "Les **{remainingPercent}%** restants de courriels non autorisés seront **livrés normalement**.",
 	"investigate.card.dmarc.no-policy_md": "**Aucune [FULL](DMARC_POLICY#:glossary) publiée sur le domaine**\n\n**`{policyDomain}`**",
+	"investigate.card.dmarc.multiple-policies_md": "**Plusieurs [FULL](DMARC_POLICY#:glossary) sont publiées sur `{policyDomain}`.** Le traitement dépend du destinataire : certains interrompent la découverte de la politique et n'appliquent aucune politique DMARC, d'autres ignorent les enregistrements en double et continuent. Votre politique ne peut être considérée comme fiable pour aucun destinataire tant que plusieurs enregistrements sont publiés. Publiez un seul enregistrement DMARC.",
 	"investigate.card.dmarc.dmarc-passed_md": "[](DMARC#:glossary) **réussi**",
 	"investigate.card.dmarc.dmarc-passed-no-rua_md": "[](DMARC#:glossary) est conforme à BIMI **MAIS** n'a pas d'**adresse de rapport agrégé** (rua).",
 	"investigate.card.dmarc.dmarc-no-rua_md": "[](DMARC#:glossary) n'a pas d'**adresse de rapport agrégé** (rua).",
@@ -2653,7 +2689,14 @@ var frFR = {
 	"investigate.card.dmarc.domain-aligned": "Le domaine est aligné avec le domaine expéditeur. Il peut contribuer à la réussite de DMARC.",
 	"investigate.card.dmarc.domain-aligned-not-verified": "Le domaine est aligné avec le domaine expéditeur, mais sa signature n'a pas été vérifiée, il ne peut donc pas contribuer à la réussite de DMARC.",
 	"investigate.card.dmarc.spf-domain-aligned-not-verified": "Le domaine est aligné avec le domaine expéditeur, mais SPF n'a pas réussi, il ne peut donc pas contribuer à la réussite de DMARC.",
-	"investigate.card.dmarc.domain-not-aligned": "Le domaine n'est pas aligné avec le domaine expéditeur. Il ne peut pas contribuer à la réussite de DMARC."
+	"investigate.card.dmarc.domain-not-aligned": "Le domaine n'est pas aligné avec le domaine expéditeur. Il ne peut pas contribuer à la réussite de DMARC.",
+	"investigate.card.dmarc.multiple-policies-unconfirmed_md": "**Nous n'avons pas pu vérifier entièrement combien d'enregistrements [FULL](DMARC_POLICY#:glossary) sont publiés sur `{policyDomain}`.** Cette vérification n'a pas inspecté tous les enregistrements, nous ne pouvons donc pas confirmer si plusieurs sont actifs. Si plusieurs sont publiés, votre politique ne peut être considérée comme fiable pour aucun destinataire. Examinez la zone DNS de `{policyDomain}` et confirmez qu'elle publie un seul enregistrement DMARC.",
+	"investigate.card.extracted.truncated-records": "[… {count} enregistrements supplémentaires non affichés]",
+	"investigate.card.extracted.truncated-records_one": "[… 1 enregistrement supplémentaire non affiché]",
+	"investigate.card.extracted.truncated-records-atleast": "[… au moins {count} enregistrements supplémentaires non affichés]",
+	"investigate.card.extracted.truncated-records-uninspected": "[… enregistrements supplémentaires non examinés]",
+	"investigate.card.extracted.truncated-record-length": "[… enregistrements longs raccourcis pour l’affichage]",
+	"investigate.card.extracted.truncated-records-atleast_one": "[… au moins 1 enregistrement supplémentaire non affiché]"
 };
 
 /**
@@ -4826,8 +4869,49 @@ const CodeBlock = styled.div`
     display: none !important;
   }
 `;
+
+/**
+ * One logical line inside a `CodeBlock` — typically a single published DNS record.
+ *
+ * DS-115: a domain can publish more than one competing `_dmarc` TXT record, and the card
+ * must show them as distinct records. `CodeBlock` forces `p { display: inline }`, which
+ * flowed them into one unbroken line, so multi-line values use this block-level wrapper
+ * instead of a `<p>`.
+ */
+const CodeBlockLine = styled.div`
+  display: block;
+  white-space: pre-wrap;
+  word-break: break-all;
+
+  & + & {
+    margin-top: 4px;
+  }
+`;
+
+/**
+ * Renderer commentary about a truncated literal value — NOT zone content.
+ *
+ * DS-115. Deliberately its own component rather than a reused `ExtractionCaption`: that one
+ * is `position: absolute`, anchored to an `ExtractionBox`, so on the paths that have no
+ * positioned ancestor it would escape its container, and inside a box it would land on the
+ * same coordinates as the ordinary caption. This stays in normal flow directly beneath the
+ * code block.
+ *
+ * Visually distinct from `CodeBlockLine` on purpose — italic, not monospace — because a zone
+ * can publish a record whose text imitates this notice, and the two must not be confusable.
+ */
+const LiteralTruncationNotice = styled.div`
+  display: block;
+  margin-top: 6px;
+  font-style: italic;
+  font-size: 12px;
+  opacity: 0.75;
+  word-break: break-word;
+`;
 ExtractionBox.displayName = 'ExtractionBox';
 ExtractionCaption.displayName = 'ExtractionCaption';
+CodeBlockLine.displayName = 'CodeBlockLine';
+LiteralTruncationNotice.displayName = 'LiteralTruncationNotice';
 InfoItemsHighlight.displayName = 'InfoItemsHighlight';
 
 // All theming uses CSS variables with Design System fallbacks (Poppins).
@@ -6640,19 +6724,244 @@ function getIcon(_ref) {
     size: "small"
   }) : null;
 }
-const renderExtractedValue = (value, keyPrefix) => {
+
+/**
+ * Lines a literal (code-block) render may emit, shared across ONE CATEGORY.
+ *
+ * Scope is per category, not per card: `ExtractedCategoryContent` creates one budget and
+ * threads it through every item and leaf it renders, so a card with N literal categories can
+ * emit up to N x this figure. That is deliberate — a category is the unit a reader looks at,
+ * and letting one category's pathological payload blank out a sibling section would trade a
+ * bounded render for a misleading one.
+ *
+ * Two earlier attempts were not bounds at all. A per-leaf cap failed because
+ * `renderExtractedValue` recurses into arrays (5,000 one-line entries → 5,004 nodes). A
+ * per-value cap failed because upstream emits one item PER CANDIDATE GROUP, so 20 groups each
+ * got a fresh 50 (→ 1,000 lines, 20 notices).
+ *
+ * Generous for real data: a real `_dmarc` name publishes one record and the pathological
+ * production case is two.
+ */
+const MAX_LITERAL_LINES = 50;
+
+/**
+ * Characters rendered per literal line.
+ *
+ * Count alone does not bound size — 50 lines of 200KB each rendered 10,001,001 characters
+ * (measured). 4096 rather than upstream's 512 context bound: this is the UI, and legitimate
+ * evidence exceeds 512 — a DNS TXT RR concatenates multiple 255-octet strings, and a
+ * 4096-bit DKIM `p=` value alone is ~740 characters. 512 would have silently truncated real
+ * keys, which on a card whose job is showing published records is a correctness bug, not a
+ * safety measure.
+ */
+const MAX_LITERAL_LINE_CHARS = 4096;
+
+/**
+ * Total literal characters per CATEGORY, independent of the per-line cap.
+ *
+ * The per-line cap alone still allows `MAX_LITERAL_LINES × MAX_LITERAL_LINE_CHARS`. This is
+ * the ceiling that actually bounds payload size. Same per-category scope as
+ * `MAX_LITERAL_LINES` — see that note.
+ */
+const MAX_LITERAL_TOTAL_CHARS = 64000;
+
+/**
+ * Array entries VISITED per category, whatever they turn out to contain.
+ *
+ * Distinct from the line budget, which bounds output: entries that contribute nothing —
+ * empty strings, whitespace, nulls — do not consume output quota, so a scan that stopped
+ * only on the output budget could still walk a million entries. Nothing past this is read.
+ */
+const MAX_LITERAL_ENTRIES_SCANNED = 2000;
+
+/**
+ * Shared, mutable literal render budget for one CATEGORY.
+ *
+ * `hiddenLines` is a LOWER BOUND, not an exact count: producing an exact figure would mean
+ * scanning every withheld character of an attacker-controlled value, which is unbounded work
+ * for a number nobody acts on. Copy says "at least N" / "not inspected" accordingly.
+ */
+
+const createLiteralBudget = () => ({
+  lines: MAX_LITERAL_LINES,
+  chars: MAX_LITERAL_TOTAL_CHARS,
+  entries: MAX_LITERAL_ENTRIES_SCANNED,
+  hiddenLines: 0,
+  hiddenUncounted: false,
+  shortenedLines: false
+});
+const budgetExhausted = b => b.lines <= 0 || b.chars <= 0;
+
+/**
+ * Truncate without splitting a surrogate pair.
+ *
+ * A bare `slice` cuts UTF-16 code units, so a boundary landing between a high and low
+ * surrogate emits a replacement glyph — a rendering artifact in what is supposed to be a
+ * verbatim record.
+ */
+const sliceWholeCodePoints = (value, max) => {
+  if (value.length <= max) {
+    return value;
+  }
+  const code = value.charCodeAt(max - 1);
+  // High surrogate at the boundary: its pair would be cut, so drop it too.
+  const end = code >= 0xd800 && code <= 0xdbff ? max - 1 : max;
+  return value.slice(0, end);
+};
+
+/**
+ * Render an extracted value.
+ *
+ * `literal` is set for code-block values (DNS TXT records and similar). Those come from
+ * the inspected domain's own zone, NOT from our translations, so they are attacker-
+ * controlled and must never go through `parseGlossaryMarkdown` — its documented trust
+ * model assumes source-controlled input, and it turns `[text](https://...)` into a real
+ * anchor. See the adversarial tests in `SignalCardExtractedItems.test.tsx`.
+ */
+const renderExtractedValue = function (value, keyPrefix) {
+  let literal = arguments.length > 2 && arguments[2] !== undefined ? arguments[2] : false;
+  let budget = arguments.length > 3 ? arguments[3] : undefined;
   const nodes = [];
+  // A local budget when none is shared, so non-card callers still get a bound.
+  const b = budget !== null && budget !== void 0 ? budget : createLiteralBudget();
   const process = (input, prefix) => {
     if (input === null || input === undefined) {
       return;
     }
     if (Array.isArray(input)) {
-      input.forEach((entry, idx) => process(entry, `${prefix}-${idx}`));
+      for (const entry of input) {
+        // Stop traversing once nothing more can be emitted: continuing would walk the whole
+        // attacker-controlled array to render nothing.
+        if (literal && (budgetExhausted(b) || b.entries <= 0)) {
+          b.hiddenUncounted = true;
+          return;
+        }
+        if (literal) {
+          b.entries -= 1;
+        }
+        process(entry, `${prefix}-${nodes.length}`);
+      }
       return;
     }
     if (typeof input === 'string') {
-      const trimmed = input.trim();
-      if (!trimmed) {
+      const trimmed = literal ? undefined : input.trim();
+      if (!literal && !trimmed) {
+        return;
+      }
+
+      // DS-115: in literal (code-block) mode a single string leaf may itself carry multiple
+      // records separated by newlines — and so may a string nested inside an array, e.g.
+      // `['record A\nrecord B']`. Split every string leaf, not just a top-level one, so each
+      // record gets its own <p> (and so its own CodeBlockLine) rather than flowing together.
+      if (literal) {
+        // Every line becomes a React element and a styled `CodeBlockLine`, and the values are
+        // attacker-controlled: DNS TXT records read from the domain under inspection.
+        // Upstream deliberately does NOT bound the card path (only the context/LLM path is
+        // capped) because a display cap that dropped a whole name could make the
+        // multiple-records predicate deny a real conflict. That is right upstream, and it
+        // makes the RENDER side the place to bound node count and byte size.
+        //
+        // Scanned with an index-bounded loop rather than `split().map().filter().slice()`:
+        // the chained form materializes every line of an adversarial value before discarding
+        // almost all of it, so the work is unbounded even though the output is not. The
+        // string is never `trim()`ed as a whole either — that copies the entire input.
+        let cursor = 0;
+        while (cursor < input.length && !budgetExhausted(b)) {
+          // Bound the scan for one line's end by what could still be rendered, so a single
+          // 10-million-character line is never fully walked or normalized.
+          const scanLimit = Math.min(input.length, cursor + MAX_LITERAL_LINE_CHARS + 1);
+          let next = cursor;
+          while (next < scanLimit && input[next] !== '\n' && input[next] !== '\r') {
+            next += 1;
+          }
+          const overlong = next === scanLimit && next < input.length && input[next] !== '\n' && input[next] !== '\r';
+          const raw = input.slice(cursor, next);
+          const line = raw.replace(/\s+/g, ' ').trim();
+          if (overlong) {
+            // Skip this line’s untruncated remainder WITHOUT materializing it — and BOUND the skip.
+            // Walking to the next newline is still O(input): a 40-million-character line with no
+            // newline took ~164ms against ~97ms for 20M, so the work was linear in attacker input
+            // even though the OUTPUT was bounded. Give up after a bounded probe and report the
+            // rest as uninspected rather than scanning it.
+            const skipLimit = cursor + MAX_LITERAL_LINE_CHARS;
+            while (cursor < input.length && cursor < skipLimit && input[cursor] !== '\n' && input[cursor] !== '\r') {
+              cursor += 1;
+            }
+            if (cursor < input.length && input[cursor] !== '\n' && input[cursor] !== '\r') {
+              // The skip budget ran out before this line ended. Record that the withheld
+              // figure is a floor, then stop consuming budget so the reporting block below
+              // still runs from this cursor — an early `break` here escaped the loop and
+              // skipped reporting entirely, leaving NO notice at all (caught by test).
+              b.hiddenUncounted = true;
+              b.lines = 0;
+            }
+          } else {
+            cursor = next;
+          }
+
+          // Advance past the whole run of newline characters, matching the previous
+          // `/[\r\n]+/` split so a CRLF pair does not emit a blank line between records.
+          while (cursor < input.length && (input[cursor] === '\n' || input[cursor] === '\r')) {
+            cursor += 1;
+          }
+          if (!line) {
+            continue;
+          }
+          const allowed = Math.min(MAX_LITERAL_LINE_CHARS, b.chars);
+          const shown = sliceWholeCodePoints(line, allowed);
+          if (shown.length < line.length || overlong) {
+            b.shortenedLines = true;
+          }
+          nodes.push( /*#__PURE__*/React__default.createElement("p", {
+            key: `${prefix}-text-${nodes.length}`
+          }, shown));
+          b.lines -= 1;
+          b.chars -= shown.length;
+        }
+
+        // Report — never silently drop. This card exists to tell someone which records to
+        // remove, and a hidden remainder invites them to believe they are finished.
+        //
+        // The count is deliberately a LOWER BOUND: an exact figure would mean scanning every
+        // withheld character of an attacker-controlled value. `hiddenUncounted` is what makes
+        // the copy honest about that ("at least N"), so it MUST be set whenever the scan
+        // stopped early. The previous version counted SEPARATORS rather than segments and
+        // could stop on its own budget while still reporting an exact-sounding figure, so 55
+        // records reported 4 withheld when 5 were (verified).
+        if (cursor < input.length) {
+          let hidden = 0;
+          let scan = cursor;
+          // Count SEGMENTS: a segment is a run of non-newline characters.
+          //
+          // BOTH loops are bounded. The segment count is capped by the line budget, and each
+          // segment's own walk is capped by `MAX_LITERAL_LINE_CHARS` — without that inner cap a
+          // remainder holding one very long newline-free line walked the whole string (20M
+          // chars ≈ 42ms, linear in attacker input), which silently undid the "bound WORK, not
+          // only output" guarantee the skip loop above exists to provide.
+          while (scan < input.length && hidden < MAX_LITERAL_LINES) {
+            while (scan < input.length && (input[scan] === '\n' || input[scan] === '\r')) {
+              scan += 1;
+            }
+            if (scan >= input.length) {
+              break;
+            }
+            hidden += 1;
+            const segmentLimit = scan + MAX_LITERAL_LINE_CHARS;
+            while (scan < input.length && scan < segmentLimit && input[scan] !== '\n' && input[scan] !== '\r') {
+              scan += 1;
+            }
+            if (scan < input.length && input[scan] !== '\n' && input[scan] !== '\r') {
+              // Gave up mid-segment, so anything past here is uncounted.
+              b.hiddenUncounted = true;
+              break;
+            }
+          }
+          // Anything left unscanned means the figure is a floor, not a total.
+          if (scan < input.length) {
+            b.hiddenUncounted = true;
+          }
+          b.hiddenLines += hidden;
+        }
         return;
       }
       nodes.push( /*#__PURE__*/React__default.createElement("p", {
@@ -6662,11 +6971,37 @@ const renderExtractedValue = (value, keyPrefix) => {
     }
     if ( /*#__PURE__*/React__default.isValidElement(input)) {
       var _input$key;
+      // Charged against the budget too: element leaves are nodes like any other, and an
+      // uncharged leaf type is an escape hatch — 5,000 object leaves previously rendered
+      // 5,000 lines with no notice.
+      if (literal) {
+        if (budgetExhausted(b)) {
+          b.hiddenLines += 1;
+          return;
+        }
+        b.lines -= 1;
+      }
       nodes.push( /*#__PURE__*/React__default.cloneElement(input, {
         key: (_input$key = input.key) !== null && _input$key !== void 0 ? _input$key : `${prefix}-element`
       }));
       return;
     }
+
+    // Numbers, booleans, objects. Stringified, so they are bounded and charged exactly like
+    // string leaves rather than bypassing the budget.
+    if (literal) {
+      if (budgetExhausted(b)) {
+        b.hiddenLines += 1;
+        return;
+      }
+      const text = sliceWholeCodePoints(String(input), Math.min(MAX_LITERAL_LINE_CHARS, b.chars));
+      b.lines -= 1;
+      b.chars -= text.length;
+      nodes.push( /*#__PURE__*/React__default.createElement("p", {
+        key: `${prefix}-fallback`
+      }, text));
+      return;
+    }
     nodes.push( /*#__PURE__*/React__default.createElement("p", {
       key: `${prefix}-fallback`
     }, String(input)));
@@ -6674,6 +7009,65 @@ const renderExtractedValue = (value, keyPrefix) => {
   process(value, keyPrefix);
   return nodes;
 };
+
+/**
+ * Wrap already-literal, newline-split nodes in a `CodeBlock`, one `CodeBlockLine` per record.
+ *
+ * Shared by every code-block path so they cannot drift apart: `CodeBlock` sets
+ * `white-space: normal`, so without one element per line multiple records flow together.
+ */
+const renderCodeBlock = nodes => /*#__PURE__*/React__default.createElement(CodeBlock, null, nodes.map((node, idx) => {
+  if ( /*#__PURE__*/React__default.isValidElement(node) && node.type === 'p') {
+    var _node$key;
+    return /*#__PURE__*/React__default.createElement(CodeBlockLine, {
+      key: (_node$key = node.key) !== null && _node$key !== void 0 ? _node$key : `code-line-${idx}`
+    }, node.props.children);
+  }
+  return node;
+}));
+
+/**
+ * Notice that the renderer withheld part of a literal value.
+ *
+ * The caps above are initial-render SAFETY limits, not a completeness guarantee: DNS defines
+ * no record-count limit for a name, a TXT RR may concatenate several 255-octet strings, and
+ * under RFC 9989 §4.10 every competing record is discarded — so dozens of short records are
+ * protocol-plausible and each withheld value is one the operator still has to delete.
+ *
+ * Reporting is therefore the minimum: truncating silently would tell someone the list is
+ * complete when it is not. A "copy all published records" action was built and REVERTED (see
+ * CHANGELOG) — it could not honour its own promise, so full-evidence access is tracked
+ * separately rather than half-delivered here.
+ *
+ * Rendered OUTSIDE the `CodeBlock` and as its own `LiteralTruncationNotice`, for a security
+ * reason rather than a stylistic one: inside the block it was structurally and visually
+ * identical to a record, so a zone publishing the literal text `[… 3 more records not shown]`
+ * produced an indistinguishable line (verified). Zone content and renderer commentary must
+ * not share a presentation. `data-testid` is stable so tests can assert the notice
+ * specifically, rather than matching prose an attacker could also publish.
+ */
+const renderTruncationNotice = (budget, t) => {
+  const parts = [];
+  if (budget.hiddenLines > 0) {
+    parts.push(t(budget.hiddenUncounted ? 'card.extracted.truncated-records-atleast' : 'card.extracted.truncated-records', {
+      count: budget.hiddenLines
+    }));
+  } else if (budget.hiddenUncounted) {
+    parts.push(t('card.extracted.truncated-records-uninspected'));
+  }
+
+  // Reported ALONGSIDE the hidden count, not instead of it: a payload that both shortened
+  // every visible record and hid further ones must not announce only one of the two.
+  if (budget.shortenedLines) {
+    parts.push(t('card.extracted.truncated-record-length'));
+  }
+  if (!parts.length) {
+    return null;
+  }
+  return /*#__PURE__*/React__default.createElement(LiteralTruncationNotice, {
+    "data-testid": "extracted-truncation-notice"
+  }, parts.join(' '));
+};
 const ExtractedItem = _ref2 => {
   let {
     type,
@@ -6682,7 +7076,8 @@ const ExtractedItem = _ref2 => {
     text,
     inline = true,
     useCodeBlock = false,
-    extractionBox
+    extractionBox,
+    literalBudget
   } = _ref2;
   // Get translated caption for extraction box
   const {
@@ -6693,29 +7088,25 @@ const ExtractedItem = _ref2 => {
   // Parse label if it's a string with glossary markdown
   const parsedLabel = typeof label === 'string' ? parseGlossaryMarkdown(label) : label;
 
-  // Strip newlines from text if it's a string and we're using code block
-  const cleanedText = useCodeBlock && typeof text === 'string' ? text.replace(/[\r\n]+/g, ' ').replace(/\s+/g, ' ').trim() : text;
-  const renderedText = renderExtractedValue(cleanedText, 'extracted-item-text');
+  // DS-115: a code-block value may legitimately be MULTIPLE records (e.g. a domain that
+  // publishes two competing `_dmarc` TXT records). Collapsing newlines into spaces ran them
+  // together into one flowed line with no visible boundary, which is precisely the condition
+  // the card exists to report. `renderExtractedValue`'s literal mode splits every string leaf
+  // on newlines (including strings nested in arrays) so each record renders on its own line.
+  const budget = literalBudget !== null && literalBudget !== void 0 ? literalBudget : createLiteralBudget();
+  const renderedText = renderExtractedValue(text, 'extracted-item-text', useCodeBlock, budget);
   const icon = getIcon({
     type,
     theme
   });
 
-  // Wrap in CodeBlock if needed
-  const displayText = useCodeBlock ? /*#__PURE__*/React__default.createElement(CodeBlock, null, typeof renderedText === 'string' ? renderedText : /*#__PURE__*/React__default.createElement(React__default.Fragment, null, renderedText.map(node => {
-    // Extract text content from p tags and flatten
-    if ( /*#__PURE__*/React__default.isValidElement(node) && node.type === 'p') {
-      const children = node.props.children;
-
-      // If children is a string, strip ALL newlines aggressively
-      const cleanedChildren = typeof children === 'string' ? children.replace(/[\r\n\t]+/g, ' ').replace(/\s+/g, ' ').trim() : children;
-      return cleanedChildren;
-    }
-    return node;
-  }))) : renderedText;
+  // Wrap in CodeBlock if needed. The truncation notice sits OUTSIDE the block — see
+  // `renderTruncationNotice` on why it must never be a `CodeBlockLine`.
+  const displayText = useCodeBlock ? /*#__PURE__*/React__default.createElement(React__default.Fragment, null, renderCodeBlock(renderedText), renderTruncationNotice(budget, t)) : renderedText;
+  const hasContent = renderedText.length > 0;
   const content = /*#__PURE__*/React__default.createElement(SignalCardInfoBox$1, null, /*#__PURE__*/React__default.createElement(InfoItemRow, null, icon ? /*#__PURE__*/React__default.createElement(InfoItemIcon, null, icon) : null, /*#__PURE__*/React__default.createElement(InfoItemContent, null, /*#__PURE__*/React__default.createElement(InfoItemLabel, {
     $inline: true
-  }, parsedLabel), inline && renderedText.length ? displayText : null)), !inline && renderedText.length ? /*#__PURE__*/React__default.createElement(InfoItemSubtexts, null, displayText) : null);
+  }, parsedLabel), inline && hasContent ? displayText : null)), !inline && hasContent ? /*#__PURE__*/React__default.createElement(InfoItemSubtexts, null, displayText) : null);
 
   // Wrap in extraction box if specified
   if (extractionBox) {
@@ -6725,9 +7116,12 @@ const ExtractedItem = _ref2 => {
   }
   return content;
 };
-function renderGridItem(item, idx, t) {
+function renderGridItem(item, idx, t, budget) {
   const parsedLabel = typeof item.label === 'string' ? parseGlossaryMarkdown(item.label) : item.label;
-  const renderedText = renderExtractedValue(item.text, `grid-item-${idx}`);
+  // DS-115: code-block values are attacker-controlled DNS data, so render them literally —
+  // same trust model as `ExtractedItem`. Without this the grid path fed raw TXT records
+  // through `parseGlossaryMarkdown`, which turns `[text](https://...)` into a real anchor.
+  const renderedText = renderExtractedValue(item.text, `grid-item-${idx}`, !!item.useCodeBlock, budget);
   const icon = getIcon({
     type: item.type,
     theme: item.theme
@@ -6747,7 +7141,7 @@ function renderGridItem(item, idx, t) {
       display: 'inline-flex'
     }
   }, icon))) : null;
-  const displayValue = item.useCodeBlock ? /*#__PURE__*/React__default.createElement(CodeBlock, null, renderedText) : /*#__PURE__*/React__default.createElement(GridValue, null, renderedText, alignmentIcon);
+  const displayValue = item.useCodeBlock ? /*#__PURE__*/React__default.createElement(React__default.Fragment, null, renderCodeBlock(renderedText), renderTruncationNotice(budget, t)) : /*#__PURE__*/React__default.createElement(GridValue, null, renderedText, alignmentIcon);
   return /*#__PURE__*/React__default.createElement(React__default.Fragment, {
     key: idx
   }, /*#__PURE__*/React__default.createElement(GridLabel, null, icon && !item.tooltipKey ? /*#__PURE__*/React__default.createElement("span", {
@@ -6766,6 +7160,15 @@ const ExtractedCategoryContent = _ref3 => {
   const {
     t
   } = useSignalCardTranslation('investigate');
+  // ONE budget per category render: upstream emits one item per candidate group, so a
+  // per-item budget let 20 groups render 20 x 50 lines with 20 separate notices.
+  //
+  // The notice is emitted per ITEM rather than once per category. Hoisting it was attempted
+  // and reverted: the budget is mutated while the ITEMS render, and a parent cannot observe
+  // that — `<Body/>` is only an element when the parent returns, so the notice read a pristine
+  // budget and never appeared. Doing it properly means precomputing each category's preview
+  // and truncation state before rendering, which is tracked separately (see CHANGELOG).
+  const literalBudget = createLiteralBudget();
   const useGridLayout = category.categoryType === 'dmarc-domain' || category.categoryType === 'dmarc-policy' || category.categoryType === 'dkim-details';
   if (useGridLayout) {
     var _category$items, _category$items2;
@@ -6797,12 +7200,13 @@ const ExtractedCategoryContent = _ref3 => {
           text: text,
           inline: inline,
           useCodeBlock: useCodeBlock,
-          extractionBox: undefined
+          extractionBox: undefined,
+          literalBudget: literalBudget
         });
       }), /*#__PURE__*/React__default.createElement(InfoItemsGrid, {
         $hasNonInlineItems: hasNonInlineItems,
         $insideCollapsible: true
-      }, (_category$items5 = category.items) === null || _category$items5 === void 0 ? void 0 : _category$items5.filter(item => item.inline !== false).map((item, idx) => renderGridItem(item, idx, t))));
+      }, (_category$items5 = category.items) === null || _category$items5 === void 0 ? void 0 : _category$items5.filter(item => item.inline !== false).map((item, idx) => renderGridItem(item, idx, t, literalBudget))));
     } else if (hasNonInlineItems) {
       var _category$items6, _category$items6$find, _category$items6$find2, _category$items7;
       // Only TXT records present
@@ -6828,7 +7232,8 @@ const ExtractedCategoryContent = _ref3 => {
           text: text,
           inline: inline,
           useCodeBlock: useCodeBlock,
-          extractionBox: undefined
+          extractionBox: undefined,
+          literalBudget: literalBudget
         });
       }));
     } else {
@@ -6839,7 +7244,7 @@ const ExtractedCategoryContent = _ref3 => {
       }, /*#__PURE__*/React__default.createElement(InfoItemsGrid, {
         $hasNonInlineItems: false,
         $insideCollapsible: true
-      }, (_category$items8 = category.items) === null || _category$items8 === void 0 ? void 0 : _category$items8.filter(item => item.inline !== false).map((item, idx) => renderGridItem(item, idx, t))));
+      }, (_category$items8 = category.items) === null || _category$items8 === void 0 ? void 0 : _category$items8.filter(item => item.inline !== false).map((item, idx) => renderGridItem(item, idx, t, literalBudget))));
     }
   }
 
@@ -6865,7 +7270,8 @@ const ExtractedCategoryContent = _ref3 => {
       text: text,
       inline: inline,
       useCodeBlock: useCodeBlock,
-      extractionBox: undefined
+      extractionBox: undefined,
+      literalBudget: literalBudget
     });
   })));
 };
@@ -7472,9 +7878,273 @@ function renderDisplayValue(value) {
   return value;
 }
 
+/**
+ * BIMI code → glossary page map.
+ *
+ * Each BIMI finding carries a `checker_codes` schema id from `redsift/event-schemas`
+ * (e.g. `DNS-BIMI-0020`). The glossary publishes one explainer page per code. This
+ * module turns a code into the URL of its page so a card row can offer a
+ * "What does this mean?" link.
+ *
+ * ## Why the map lives here
+ *
+ * Decision D4a of the glossary design: the website deliberately publishes no
+ * code → slug manifest and performs no code → URL resolution. Its side of the
+ * contract is that these slugs are permanent; if one ever has to change, the
+ * website owes a redirect and an updated map here.
+ *
+ * ## Keyed on the code, never the slug or the message text
+ *
+ * The code is the only stable identifier. Titles, severities and statuses drift
+ * (0033 changed under WEB-1155; 0021's grammar changed) and slugs are human text,
+ * so they are the most likely thing to be re-worded later. Row message text is
+ * worse still — it is backend prose that `formatMessageWithUrls()` rewrites before
+ * it reaches the card, and it is not in any translation catalogue.
+ *
+ * ## Unmapped codes resolve to nothing, by design
+ *
+ * `resolveBimiGlossaryHref` returns `undefined` rather than guessing a URL. This is
+ * an everyday path, not an edge case:
+ *   - `DNS-BIMI-0003` has no glossary page — the authored set jumps 0002 → 0004.
+ *   - `msgCode` is a free-form string upstream; real payloads carry non-schema
+ *     values such as `multiple-records`, `config-error` and `DNS-BIMI-0000-MISMATCH`.
+ *   - IPForensics currently mis-assigns some codes (`bimi-error-invalid-record` is
+ *     tagged 0021, which is the "both l and a tags missed" page). A permissive
+ *     resolver would send a reader to a page describing a *different* error, which
+ *     is worse than offering no link at all.
+ *
+ * @see https://redsift.atlassian.net/browse/DS-113
+ */
+
+/** Production origin for glossary pages, used when the card renders outside the website. */
+const GLOSSARY_ORIGIN = 'https://redsift.com';
+
+/** Site-relative path prefix for glossary pages. */
+const GLOSSARY_PATH = '/glossary';
+
+/**
+ * Code → glossary slug. Read from the published Prismic API on 2026-08-18.
+ *
+ * 36 entries. Regenerate from the content API rather than editing by hand, and
+ * note the two known coverage gaps:
+ *   - 0003 is absent (no authored page).
+ *   - 0023–0032 are authored and live but the BIMI Checker does not emit them yet,
+ *     so they only appear on cards fed directly from the schema feed.
+ */
+const BIMI_CODE_TO_GLOSSARY_SLUG = Object.freeze(Object.assign(Object.create(null), {
+  'DNS-BIMI-0001': 'logo-url-scheme-is-not-https-missing-vmc-in-record',
+  'DNS-BIMI-0002': 'no-vmc-in-record',
+  // 0003 intentionally absent — no glossary page authored.
+  'DNS-BIMI-0004': 'missing-l-tag',
+  'DNS-BIMI-0005': 'failed-to-fetch-logo',
+  'DNS-BIMI-0006': 'no-version-in-record',
+  'DNS-BIMI-0007': 'failed-to-fetch-authority-certificate',
+  'DNS-BIMI-0008': 'no-record',
+  'DNS-BIMI-0009': 'invalid-record',
+  'DNS-BIMI-0010': 'valid-record-but-dmarc-isn-t-ready',
+  'DNS-BIMI-0011': 'vmc-validation-errors',
+  'DNS-BIMI-0012': 'certificate-can-t-be-accessed-automatically',
+  'DNS-BIMI-0013': 'declination-to-publish',
+  'DNS-BIMI-0014': 'certificate-not-valid-for-the-domain',
+  'DNS-BIMI-0015': 'bimi-record-validation-errors',
+  'DNS-BIMI-0016': 'authority-url-scheme-is-not-https',
+  'DNS-BIMI-0017': 'logo-validation-errors',
+  'DNS-BIMI-0018': 'bimi-record-found-on-organizational-domain',
+  'DNS-BIMI-0019': 'multiple-bimi-records-found-on-target-domain',
+  'DNS-BIMI-0020': 'duplicate-tag-detected-in-bimi-record',
+  'DNS-BIMI-0021': 'both-l-and-a-tags-missed',
+  'DNS-BIMI-0022': 'no-bimi-record-found-and-dmarc-policy-is-insufficient',
+  'DNS-BIMI-0023': 'svg-logo-dimensions-use-non-pixel-values',
+  'DNS-BIMI-0024': 'svg-logo-dimensions-below-96x96-pixel-minimum',
+  'DNS-BIMI-0025': 'svg-logo-missing-width-or-height-attributes',
+  'DNS-BIMI-0026': 'vmc-pem-starts-with-utf-8-bom',
+  'DNS-BIMI-0027': 'vmc-pem-bundle-contains-only-the-leaf-certificate',
+  'DNS-BIMI-0028': 'vmc-certificate-chain-signature-verification-failed',
+  'DNS-BIMI-0029': 'vmc-certificate-chain-does-not-terminate-at-a-trusted-bimi-root-ca',
+  'DNS-BIMI-0030': 'vmc-certificate-chain-ordering-does-not-match-expected-issuance-order',
+  'DNS-BIMI-0031': 'vmc-pem-bundle-omits-the-root-ca-certificate',
+  'DNS-BIMI-0032': 'non-https-url-encountered-while-fetching-the-vmc-certificate',
+  'DNS-BIMI-0033': 'vmc-leaf-certificate-selection-is-ambiguous',
+  'DNS-BIMI-0034': 'timed-out-fetching-the-bimi-asset',
+  'DNS-BIMI-0035': 'bimi-asset-host-could-not-be-resolved',
+  'DNS-BIMI-0036': 'connection-to-the-bimi-asset-host-failed',
+  'DNS-BIMI-0037': 'tls-handshake-failed-fetching-the-bimi-asset'
+}));
+
+/** Options for {@link resolveBimiGlossaryHref}. */
+
+/**
+ * Resolve a BIMI schema code to its glossary page URL.
+ *
+ * @param code - A `checker_codes` schema id, e.g. `'DNS-BIMI-0020'`. Anything not
+ *               in {@link BIMI_CODE_TO_GLOSSARY_SLUG} resolves to `undefined`.
+ * @returns The page URL, or `undefined` when the code has no glossary page.
+ *
+ * @example
+ * resolveBimiGlossaryHref('DNS-BIMI-0008');
+ * // 'https://redsift.com/glossary/no-record'
+ * resolveBimiGlossaryHref('DNS-BIMI-0008', { relative: true });
+ * // '/glossary/no-record'
+ * resolveBimiGlossaryHref('DNS-BIMI-0003');   // undefined — no page authored
+ * resolveBimiGlossaryHref('config-error');    // undefined — not a schema code
+ */
+function resolveBimiGlossaryHref(code) {
+  let options = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : {};
+  if (!code) return undefined;
+
+  // Own-property check, not just a truthiness test. `code` originates from `msgCode`,
+  // which is free-form backend data, so a key like `__proto__` or `constructor` would
+  // otherwise resolve to an inherited value — truthy, and stringified into a URL such
+  // as `/glossary/[object Object]`. Both maps are null-prototyped as well; this is the
+  // second layer, so reverting either one alone cannot reintroduce the hole.
+  // Raised in review on PR #1172.
+  if (!Object.prototype.hasOwnProperty.call(BIMI_CODE_TO_GLOSSARY_SLUG, code)) return undefined;
+  const slug = BIMI_CODE_TO_GLOSSARY_SLUG[code];
+  if (typeof slug !== 'string' || !slug) return undefined;
+  const path = `${GLOSSARY_PATH}/${slug}`;
+  return options.relative ? path : `${GLOSSARY_ORIGIN}${path}`;
+}
+
+/**
+ * signal-logic translation key → BIMI schema code, for rows that carry no `code`.
+ *
+ * The `bimiRecordStatus` switch in signal-logic builds its rows from a fixed
+ * translation key and never attaches a code, so those rows cannot be linked from
+ * `InfoItem.code` alone (see WEB-1239). The key, however, *is* deterministic: it is
+ * a literal in signal-logic's source, not backend prose, so mapping key → code is
+ * stable in a way that matching the rendered message text is not.
+ *
+ * Covers two families of key:
+ *
+ * 1. The `bimiRecordStatus` switch rows (`record-missing_md` and friends).
+ * 2. The per-error `recordValidationErrors` rows, keyed `card.bimi.errors.<errorCode>`.
+ *    These are the individual "Record l value needs to be a valid URL" lines listed
+ *    under an invalid record. They matter because they are the rows that actually tell
+ *    a reader *what* to fix, and the schema code that IPForensics assigned them is
+ *    destroyed before the card sees it: the website's `RecordMessageCodes` rewrites
+ *    `DNS-BIMI-00XX` into these `bimi-error-*` names, collapsing 0009/0015/0020/0021
+ *    all onto `bimi-error-invalid-record`. Mapping the name back is therefore the only
+ *    way to link these rows, and it is safe only where the relation is 1:1.
+ *
+ * Deliberately absent:
+ *   - `record-failed_md` — `NOT_VMC`, `WITH_ERRORS` and `CERT_INVALID` all collapse
+ *     to this one row, so it is many-to-one and cannot name a single page.
+ *   - `record-passed_md` / `record-declination_md` are pass/info states; 0013
+ *     (declination) is emitted separately as a coded report row.
+ *   - `record-unknown-error_md` has no page.
+ *   - `errors.bimi-error-unsupported-values` has no authored glossary page.
+ *   - `errors.bimi-error-invalid-record` — the website collapses 0009, 0015, 0020 and
+ *     0021 onto this one name, and those pages describe different errors: 0009 is a
+ *     record that cannot be parsed at all, while 0020 (duplicate tag) and 0021 (both
+ *     l= and a= missing) are parseable records. Mapping it to 0009 sent a reader
+ *     whose actual error was 0020 or 0021 to a page describing a parse failure that
+ *     did not happen. Raised in review on PR #1172.
+ *   - Most `logoErrors.invalid-svg-*` rows. These describe *which* SVG rule the logo
+ *     broke (bad root element, disallowed `script` element, wrong profile, …) and the
+ *     glossary has no page per rule — only the umbrella 0017 `logo-validation-errors`.
+ *     Pointing 16 distinct failures at one generic page would tell a reader nothing
+ *     they cannot already see on the row. `invalid-svg-missing-title` is the exception:
+ *     it appears on cards whose only other SVG row is the 0017 summary, so without it
+ *     an all-SVG failure card can have no link at all.
+ *   - `logoErrors.logo-extract-error` — the website collapses 0034/0035/0036/0037
+ *     (timeout, host unresolved, connection failed, TLS handshake failed) all onto it,
+ *     and each of those has its own distinct page, so it cannot name one.
+ *   - `pemErrors.cert-not-found` — lossy: the website maps 0002+0007 onto it, and
+ *     0034–0037 land there too.
+ */
+const BIMI_TRANSLATION_KEY_TO_CODE = Object.freeze(Object.assign(Object.create(null), {
+  // bimiRecordStatus switch rows
+  'card.bimi.record-missing_md': 'DNS-BIMI-0008',
+  // no-record
+  'card.bimi.record-invalid_md': 'DNS-BIMI-0009',
+  // invalid-record
+  'card.bimi.record-no-cert_md': 'DNS-BIMI-0007',
+  // failed-to-fetch-authority-certificate
+  // The row's own "[here]" help link is stripped by the adapter, so the glossary page
+  // is the single destination rather than competing with it.
+  'card.bimi.cert-forbidden_md': 'DNS-BIMI-0012',
+  // certificate-can-t-be-accessed-automatically
+  'card.bimi.could-not-fetch_md': 'DNS-BIMI-0005',
+  // failed-to-fetch-logo
+  // Per-error recordValidationErrors rows
+  'card.bimi.errors.bimi-error-missing-l': 'DNS-BIMI-0004',
+  // missing-l-tag
+  'card.bimi.errors.bimi-error-missing-a': 'DNS-BIMI-0002',
+  // no-vmc-in-record
+  'card.bimi.errors.bimi-error-missing-v': 'DNS-BIMI-0006',
+  // no-version-in-record
+  'card.bimi.errors.bimi-error-invalid-l': 'DNS-BIMI-0001',
+  // logo-url-scheme-is-not-https…
+  'card.bimi.errors.bimi-error-invalid-a': 'DNS-BIMI-0016',
+  // authority-url-scheme-is-not-https
+  'card.bimi.errors.bimi-error-cert-not-valid': 'DNS-BIMI-0014',
+  // certificate-not-valid-for-the-domain
+  'card.bimi.errors.bimi-error-incorrect-v': 'DNS-BIMI-0006',
+  // no-version-in-record — v= present but wrong
+  // No page describes an unspecified error, but the row only ever appears under record
+  // validation, and 0015 is that section's umbrella page — better than nothing for a
+  // reader who cannot otherwise tell what to do next.
+  'card.bimi.errors.bimi-error-unknown': 'DNS-BIMI-0015',
+  // bimi-record-validation-errors
+  // Safe SVG section
+  'card.bimi.svg-missing-title_md': 'DNS-BIMI-0004',
+  // missing-l-tag — no logo published on the record
+  'card.bimi.record-svg-added-from-itag-invalid_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // VMC/CMC certificate rows
+  'card.bimi.vmc-invalid-title_md': 'DNS-BIMI-0011',
+  // vmc-validation-errors
+  'card.bimi.vmc-not-vmc-title_md': 'DNS-BIMI-0011',
+  // vmc-validation-errors — not a VMC/CMC at all
+  'card.bimi.vmc.cert-ambiguous-leaf_md': 'DNS-BIMI-0033',
+  // vmc-leaf-certificate-selection-is-ambiguous
+  'card.bimi.logoErrors.invalid-svg-missing-title_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // signal-logic's catch-all for an svgErrors string it has no translation for. Those
+  // strings are raw fetch/parse failures ("can't fetch SVG from ...: http status not
+  // OK"), which IPForensics tags extractError = DNS-BIMI-0005, so failed-to-fetch-logo
+  // is the page. Without this the row renders with no link at all, since the fallback
+  // branch attaches neither a code nor a per-error key.
+  'card.bimi.svg-error-fallback_md': 'DNS-BIMI-0005',
+  // failed-to-fetch-logo
+  // IPForensics tags the l=/certificate logo mismatch 'DNS-BIMI-0000-MISMATCH', which is
+  // not a schema code and matches no page, so the code on the item cannot resolve.
+  // The umbrella 0017 page covers this class, and the sibling "image with errors" row
+  // on the same card already points there.
+  'card.bimi.logoErrors.logo-and-evidence-mismatch_md': 'DNS-BIMI-0017',
+  // logo-validation-errors
+  // VMC/PEM error rows that map 1:1
+  'card.bimi.pemErrors.cert-not-https_md': 'DNS-BIMI-0016',
+  // authority-url-scheme-is-not-https
+  'card.bimi.pemErrors.cert-forbidden_md': 'DNS-BIMI-0012',
+  // certificate-can-t-be-accessed-automatically
+  // Matches the `bimi-error-cert-not-valid` row, which resolves to the same page.
+  // Leaving this unlinked made identical "Certificate is not valid" text linked under
+  // BIMI record status but not under VMC/CMC Certificate on the same card.
+  'card.bimi.pemErrors.cert-not-valid_md': 'DNS-BIMI-0014',
+  // certificate-not-valid-for-the-domain
+  'card.bimi.pemErrors.cert-bad-signature_md': 'DNS-BIMI-0028' // vmc-certificate-chain-signature-verification-failed
+}));
+
+/**
+ * Resolve the BIMI schema code for a signal-logic translation key, for rows that
+ * signal-logic derives from status alone and therefore emits without a `code`.
+ *
+ * @returns The schema code, or `undefined` when the key maps to no single code.
+ */
+function resolveBimiCodeForTranslationKey(key) {
+  if (!key) return undefined;
+  // Same own-property guard as resolveBimiGlossaryHref: translation keys are literals
+  // today, but this must not become the weak link if that ever changes.
+  if (!Object.prototype.hasOwnProperty.call(BIMI_TRANSLATION_KEY_TO_CODE, key)) return undefined;
+  const code = BIMI_TRANSLATION_KEY_TO_CODE[key];
+  return typeof code === 'string' && code ? code : undefined;
+}
+
 // =============================================================================
 // BIMI TRANSLATION KEY → data-testid MAPPING
 // =============================================================================
+
 /**
  * Maps signal-logic BIMI translation keys to the data-testid values
  * that the old DS helpers used to set on checklist items.
@@ -7558,17 +8228,106 @@ function adaptExtractedItemCategory(cat) {
   };
 }
 
+/**
+ * Build the markdown for a row's "What does this mean?" glossary link (DS-113).
+ *
+ * Returns `undefined` when the row carries no code, or a code with no glossary page.
+ * The link is emitted as markdown so the existing `parseGlossaryMarkdown` path in
+ * Checklist renders it — that path already validates the protocol and applies
+ * `target="_blank" rel="noopener noreferrer"`, so this adds no new render surface.
+ *
+ * The reader never sees the raw code: `DNS-BIMI-0024` means nothing to them.
+ */
+function buildGlossaryLinkMarkdown(code, t) {
+  const href = resolveBimiGlossaryHref(code);
+  if (!href) return undefined;
+  return `[${t('card.bimi.glossary-link')}](${href})`;
+}
+
+/**
+ * Markdown links whose target is a "how to fix it" help article, in either of the two
+ * hosts signal-logic links to.
+ *
+ * Matches the whole markdown link plus any leading space, so removing it leaves no gap.
+ * The label is matched loosely (any text) but each href is pinned:
+ *   - a bare `community.redsift.com/s/article/<n>` — no `#fragment` branch, so a
+ *     glossary *term* link like `[BIMI Record](…/article/000001019#bimi-record)`, which
+ *     defines a term mid-sentence rather than offering a fix, is left intact.
+ *   - a `knowledge.ondmarc.redsift.com/en/articles/<slug>` — the "[here]" link on the
+ *     anti-bot row.
+ */
+const HELP_ARTICLE_LINK = /\s*\[[^\]]*\]\((?:https:\/\/community\.redsift\.com\/s\/article\/\d+|https:\/\/knowledge\.ondmarc\.redsift\.com\/en\/articles\/[^)]+)\)/g;
+
+/**
+ * A trailing clause left behind once a help-article link is removed.
+ *
+ * Deliberately **locale-agnostic**: it cuts everything after the last sentence-ending
+ * punctuation rather than matching known lead-in wording. Listing English phrases
+ * would leave every other locale broken — `fr-FR` renders the anti-bot row as
+ * "…anti-bot. En savoir plus et comment résoudre le problème [ici](…)", so an
+ * English-only pattern strips the link and leaves the French clause dangling in front
+ * of the glossary link.
+ *
+ * Requires a preceding sentence to keep: a row that is *only* a lead-in has nothing
+ * to fall back to, so the guard in `stripHelpArticleLink` leaves it alone.
+ */
+const TRAILING_CLAUSE = /([.!?](?:\*{1,2}|_{1,2}|`)?)[^.!?]*$/;
+
+/**
+ * Drop a row's help-article link when a glossary link replaces it.
+ *
+ * Both answer the same question, and the glossary page is the canonical explainer —
+ * it covers what the error means *and* how to fix it — so showing both leaves the
+ * reader choosing between two competing links on one line.
+ *
+ * A clause left stranded by the removal goes with it, in any locale. When the row has
+ * no earlier sentence to fall back on, the text is left as-is minus the link rather
+ * than risk emptying the row.
+ */
+function stripHelpArticleLink(text) {
+  const withoutLink = text.replace(HELP_ARTICLE_LINK, '');
+  if (withoutLink === text) return text;
+  const trimmedEnd = withoutLink.trimEnd();
+  // Nothing after the final sentence break means nothing dangled — keep as-is.
+  if (/[.!?]\s*$/.test(trimmedEnd)) return trimmedEnd;
+  const cut = trimmedEnd.replace(TRAILING_CLAUSE, '$1');
+  return cut === trimmedEnd ? trimmedEnd : cut;
+}
+
 /**
  * Convert an InfoItem (DisplayValue text) → ChecklistItem-compatible shape.
+ *
+ * When the item carries a `code` (a `checker_codes` schema id forwarded by
+ * signal-logic under WEB-1239) and that code has a glossary page, a
+ * "What does this mean?" link is appended to the end of the row's own text, so it
+ * reads inline rather than as a stacked second line — a card listing several
+ * validation errors would otherwise double in height.
+ *
+ * The link can only be appended inline when the row text is a plain string. A
+ * StructuredData row (charts, status lists, code blocks) has no meaningful "end of
+ * the line" to append to, so those fall back to a subtext beneath the row.
+ *
+ * Where the row already carried a help-article link ("Learn how to fix it", or the
+ * anti-bot row's "[here]"), that link is removed: the glossary page supersedes it, and
+ * two links answering the same question on one line makes the reader choose between
+ * them.
  */
-function adaptInfoItem(item, testId) {
+function adaptInfoItem(item, testId, t, fallbackCode) {
+  var _item$code;
+  const existing = item.subtexts ? item.subtexts.map(s => ({
+    text: renderDisplayValue(s.text)
+  })) : undefined;
+  // A code carried on the item always wins; the fallback only fills in for rows
+  // signal-logic derives from status alone (DS-113).
+  const link = t ? buildGlossaryLinkMarkdown((_item$code = item.code) !== null && _item$code !== void 0 ? _item$code : fallbackCode, t) : undefined;
+  const inlineable = link !== undefined && typeof item.text === 'string';
   return _objectSpread2({
     type: item.type,
     theme: item.theme,
-    text: renderDisplayValue(item.text),
-    subtexts: item.subtexts ? item.subtexts.map(s => ({
-      text: renderDisplayValue(s.text)
-    })) : undefined
+    text: renderDisplayValue(inlineable ? `${stripHelpArticleLink(item.text)} ${link}` : item.text),
+    subtexts: link !== undefined && !inlineable ? [...(existing !== null && existing !== void 0 ? existing : []), {
+      text: renderDisplayValue(link)
+    }] : existing
   }, testId ? {
     'data-testid': testId
   } : undefined);
@@ -7738,12 +8497,14 @@ function adaptBimiExtractor() {
   const [props, t, context] = args;
 
   // Wrap t to track which translation keys map to which returned strings.
-  // This lets us stamp data-testid on items by matching the translated text back to its key.
+  // This lets us stamp data-testid on items by matching the translated text back to its key,
+  // and (DS-113) recover the BIMI schema code for status-derived rows that signal-logic
+  // emits without an `InfoItem.code`.
   const translatedValueToKey = new Map();
   const trackingT = (key, params) => {
     const value = t(key, params);
-    // Only track keys that have a known testId mapping
-    if (BIMI_KEY_TO_TESTID[key]) {
+    // Track keys that carry a testId mapping or a glossary code
+    if (BIMI_KEY_TO_TESTID[key] || resolveBimiCodeForTranslationKey(key)) {
       translatedValueToKey.set(value, key);
     }
     return value;
@@ -7784,11 +8545,49 @@ function adaptBimiExtractor() {
     }
     return undefined;
   };
+
+  // Recover the schema code for a status-derived row (DS-113). signal-logic attaches
+  // `code` only to rows built from a coded error; the `bimiRecordStatus`, validation
+  // error, Safe SVG and VMC-title rows carry none, so fall back to the translation key
+  // that produced the text.
+  //
+  // Mirrors resolveTestId's reverse CMC→VMC pass: signal-logic post-processes several
+  // of these strings with localizeAssertionMarkdown() after t() returns, so the text on
+  // the item no longer matches what the tracking wrapper recorded.
+  const resolveFallbackCode = text => {
+    const direct = resolveBimiCodeForTranslationKey(translatedValueToKey.get(text));
+    if (direct) return direct;
+    const vmcText = text.replace(/CMC/g, 'VMC');
+    if (vmcText !== text) {
+      const viaVmc = resolveBimiCodeForTranslationKey(translatedValueToKey.get(vmcText));
+      if (viaVmc) return viaVmc;
+    }
+    return undefined;
+  };
+
+  // A row whose message contains a URL is not a string: signal-logic runs it through
+  // formatMessageWithUrls(), which returns FormattedText StructuredData with the text
+  // split into segments. Flatten those segments back to a plain string so the key
+  // lookups above can see rows like the svgErrors fallback ("can't fetch SVG from
+  // <url>: http status not OK"), which would otherwise never resolve a code.
+  const plainText = value => {
+    if (typeof value === 'string') return value;
+    if (!value || typeof value !== 'object') return undefined;
+    const segments = value.segments;
+    if (!Array.isArray(segments)) return undefined;
+    const joined = segments.map(s => {
+      var _s$text;
+      return (_s$text = s === null || s === void 0 ? void 0 : s.text) !== null && _s$text !== void 0 ? _s$text : '';
+    }).join('');
+    return joined || undefined;
+  };
   const adaptWithTestIds = categories => categories === null || categories === void 0 ? void 0 : categories.map(cat => ({
     title: cat.title,
     items: cat.items.map(item => {
-      const testId = typeof item.text === 'string' ? resolveTestId(item.text) : undefined;
-      return adaptInfoItem(item, testId);
+      const text = plainText(item.text);
+      const testId = text !== undefined ? resolveTestId(text) : undefined;
+      const fallbackCode = text !== undefined ? resolveFallbackCode(text) : undefined;
+      return adaptInfoItem(item, testId, t, fallbackCode);
     })
   }));
   return {
@@ -8672,20 +9471,43 @@ const buildPublishedCertificateSections = (cert, pem, t, now, assertionMarkType)
 
   // --- Verification issues ---
   // Sourced from PEM evidence errors plus an ambiguous leaf-selection signal.
-  const errorMessages = ((_pem$errors = pem === null || pem === void 0 ? void 0 : pem.errors) !== null && _pem$errors !== void 0 ? _pem$errors : []).map(e => typeof e === 'string' ? e : e === null || e === void 0 ? void 0 : e.message).filter(m => !!m);
+  //
+  // These rows are built here rather than in the extractor adapter, so the adapter's
+  // glossary-link pass (DS-113) does not reach them. Append the link locally, keyed on
+  // the same code the adapter uses, so a verification issue is explained exactly as the
+  // equivalent row in the legacy VMC section is.
+  const withGlossaryLink = (text, code) => {
+    const href = resolveBimiGlossaryHref(code);
+    return href ? `${text} [${t('card.bimi.glossary-link')}](${href})` : text;
+  };
+
+  // pem.errors entries carry a code alongside the message (IPForensics BimiError);
+  // keep it so the row can resolve its page rather than dropping to message-only.
+  const errorEntries = ((_pem$errors = pem === null || pem === void 0 ? void 0 : pem.errors) !== null && _pem$errors !== void 0 ? _pem$errors : []).map(e => typeof e === 'string' ? {
+    message: e,
+    code: undefined
+  } : {
+    message: e === null || e === void 0 ? void 0 : e.message,
+    code: e === null || e === void 0 ? void 0 : e.code
+  }).filter(e => !!e.message);
   const isAmbiguous = (pem === null || pem === void 0 ? void 0 : pem.leafSelectionMethod) === 'AMBIGUOUS';
   const issueItems = [];
   if (isAmbiguous) {
+    const key = 'card.bimi.vmc.cert-ambiguous-leaf_md';
     issueItems.push({
       type: 'warning',
-      text: t('card.bimi.vmc.cert-ambiguous-leaf_md'),
+      text: withGlossaryLink(t(key), resolveBimiCodeForTranslationKey(key)),
       'data-testid': 'bimi-cert-issue-ambiguous'
     });
   }
-  errorMessages.forEach((message, idx) => {
+  errorEntries.forEach((_ref2, idx) => {
+    let {
+      message,
+      code
+    } = _ref2;
     issueItems.push({
       type: 'warning',
-      text: message,
+      text: withGlossaryLink(message, code),
       'data-testid': `bimi-cert-issue-${idx}`
     });
   });