@shield-agent/kya 0.33.6 → 0.35.3

package/dist/receipt/render-receipt.js

@@ -6,10 +6,13 @@ import { semanticInstallCommand, semanticRuntimeInstalled } from "./semantic-sta
 import { assertNoSecrets, clip, stripEscapes } from "../dash/render.js";
 import { clipMultiline, DIFF_MAX_TOTAL_CHARS } from "../diff-preview.js";
 import { DOMAIN_LABELS, domainOrder } from "../certify/render.js";
-import { productLabel, eventsSince, readTrail } from "../trail.js";
+import { productLabel, eventsSince, readTrail, countOutcomes, outcomeOf, wouldHoldInStrict } from "../trail.js";
+import { eventIdOf, isNearMiss } from "../card.js";
+import { readCredentials } from "../login/credentials.js";
 import { mcpServerLabel, parseMcpToolId } from "../mcp-servers.js";
 import { loadInvestigateLastRun, } from "../investigate/last-run.js";
 import { readNotifyLog, summarizeNotifyLog, } from "../notify/log.js";
+import { readAlertsState } from "../alerts/state.js";
 import { readOtelStats } from "../otel/stats.js";
 import { loadCertifyCard, loadDiscoveryCard, loadIdentity, loadOrrCard, loadSandboxes, loadShowbackCard, loadWiredHosts, } from "./enrich.js";
 import { SHOWBACK_DISCLAIMER, } from "../showback/cost-per-task.js";
@@ -18,6 +21,7 @@ import { computeDashboard } from "./dashboard.js";
 import { buildChangesModel } from "./changes.js";
 import { GATE_NOT_SETUP_QUICKSTART, loadGatePage, toolNameFromToolId, toolServerPrefix, } from "./gate-page.js";
 import { receiptCss } from "./receipt-css.js";
+import { DEMO_CALLS, PROMISE } from "../guard-demo.js";
 import { applyChipFilters, rankEvents } from "./search.js";
 import { emptyOpenshellCard, loadOpenshellCard } from "./openshell-card.js";
 import { readIocResult } from "../ioc/result.js";
@@ -62,6 +66,11 @@ function mdFence(content) {
 function mdInline(s) {
     return stripEscapes(s).replace(/`/g, "'");
 }
+/**
+ * Counts for the report headline. A row with an outcome is counted by what happened to the call (`outcomes`); only a
+ * row without one (written before outcomes existed) is counted by its stored verdict (allow, deny, require).
+ * `never` is a policy overlay and counts every row.
+ */
 function countVerdicts(events) {
     let allow = 0;
     let deny = 0;
@@ -71,6 +80,8 @@ function countVerdicts(events) {
         const v = e.verdict.toUpperCase();
         if (e.neverEvent || e.reasonCode === "NEVER_EVENT")
             never++;
+        if (outcomeOf(e))
+            continue;
         if (v === "ALLOW")
             allow++;
         else if (v === "DENY")
@@ -78,7 +89,55 @@ function countVerdicts(events) {
         else if (v === "REQUIRE_APPROVE")
             require++;
     }
-    return { allow, deny, require, never };
+    return { allow, deny, require, never, outcomes: countOutcomes(events) };
+}
+const STRICT_NOTE = "would hold in strict mode";
+/** One line under the headline: how to turn strict mode on. Shown only when a call ran that strict mode would hold (STRICT_NOTE is the row note). */
+function strictHowTo(wouldHold, code) {
+    return `${wouldHold} ${wouldHold === 1 ? "call that ran" : "calls that ran"} would hold in strict mode. To turn strict mode on, add ${code("--strict")} to the ${code("kya hook")} command in your tool's hook settings.`;
+}
+/** Headline text for the Markdown report: "Ran 11, Blocked 5, Held 0". Error is listed only when it is not 0. */
+function outcomeHeadline(o) {
+    return `Ran ${o.ran}, Blocked ${o.blocked}, Held ${o.held}${o.error > 0 ? `, Error ${o.error}` : ""}`;
+}
+const OUTCOME_WORD = { ran: "RAN", blocked: "BLOCKED", held: "HELD", error: "ERROR" };
+/** A short note for a call that ran although policy said otherwise (REQUIRE_APPROVE, or DENY in shadow mode). */
+function ranNote(e) {
+    if (wouldHoldInStrict(e))
+        return STRICT_NOTE;
+    if (outcomeOf(e) === "ran" && e.verdict.toUpperCase() === "DENY")
+        return "would block (shadow mode)";
+    return undefined;
+}
+/** Feed order: blocked rows (newest first) above everything else (newest first). Rows without an outcome sort as before. */
+function compareFeed(a, b) {
+    const rank = (e) => (outcomeOf(e) === "blocked" ? 0 : 1);
+    return rank(a) - rank(b) || b.ts.localeCompare(a.ts);
+}
+/** Key for rows that may collapse. Only rows with an outcome collapse; a blocked row, or one with a change preview, never does. */
+function collapseKey(e) {
+    const o = outcomeOf(e);
+    if (!o || o === "blocked" || e.diffPreview?.trim())
+        return undefined;
+    return JSON.stringify([e.toolId, o, e.verdict, e.reasonCode, e.summary ?? "", e.targetPath ?? "", e.argsHash ?? "", e.sessionId, e.product ?? "", e.project ?? "", e.mode]);
+}
+/** Merge identical consecutive rows ("shell echo, 10 times"). Input order is kept. */
+export function collapseFeedRows(ordered) {
+    const out = [];
+    for (const e of ordered) {
+        const key = collapseKey(e);
+        const last = out[out.length - 1];
+        if (last && key !== undefined && last.key === key)
+            last.count++;
+        else
+            out.push({ event: e, count: 1, key });
+    }
+    return out.map(({ event, count }) => ({ event, count }));
+}
+/** "shell echo (+1 args), 3 times" or just "3 times" when the row has no summary. */
+function repeatText(e, count) {
+    const base = e.summary?.trim();
+    return `${base ? `${base}, ` : ""}${count} times`;
 }
 function relativeTime(ts, nowMs) {
     const t = Date.parse(ts);
@@ -141,6 +200,21 @@ function verdictWord(verdict) {
         return "REVIEW";
     return v;
 }
+/** Row tone: by outcome when the row has one (a call that ran is ok, even if policy said review), else by verdict. */
+function rowTone(e) {
+    switch (outcomeOf(e)) {
+        case "ran": return "ok";
+        case "blocked": return "bad";
+        case "held": return "warn";
+        case "error": return "mute";
+        default: return tone(e.verdict);
+    }
+}
+/** Row label: RAN, BLOCKED, HELD or ERROR when the row has an outcome, else the verdict word as before. */
+function rowWord(e) {
+    const o = outcomeOf(e);
+    return o ? OUTCOME_WORD[o] : verdictWord(e.verdict);
+}
 /** Pure rollup of trail events for the report's stat chips and sections. */
 export function aggregateEvents(events) {
     const modes = { observe: 0, hold: 0, offline: 0 };
@@ -181,8 +255,15 @@ export function aggregateEvents(events) {
         s.events++;
         if (e.neverEvent || e.reasonCode === "NEVER_EVENT")
             s.never++;
+        const o = outcomeOf(e);
         const v = e.verdict.toUpperCase();
-        if (v === "DENY")
+        if (o) {
+            if (o === "blocked")
+                s.deny++;
+            else if (o === "held")
+                s.hold++;
+        }
+        else if (v === "DENY")
             s.deny++;
         else if (v === "REQUIRE_APPROVE")
             s.hold++;
@@ -274,6 +355,7 @@ export function buildReceiptModel(sessionId, events, extras) {
         liveToken: extras?.liveToken,
         searchQuery: extras?.searchQuery,
         identity: extras?.identity,
+        planeConfigured: extras?.planeConfigured,
         sandboxes: extras?.sandboxes,
         openshell: extras?.openshell,
         wiredHosts: extras?.wiredHosts,
@@ -285,6 +367,7 @@ export function buildReceiptModel(sessionId, events, extras) {
         discovery: extras?.discovery,
         investigate: extras?.investigate,
         alerts: extras?.alerts,
+        incidentAlerts: extras?.incidentAlerts,
         otel: extras?.otel,
         ioc: extras?.ioc,
         posture: extras?.posture,
@@ -304,6 +387,7 @@ export function buildWindowReceiptModel(events, days, extras) {
         liveToken: extras?.liveToken,
         searchQuery: extras?.searchQuery,
         identity: extras?.identity,
+        planeConfigured: extras?.planeConfigured,
         sandboxes: extras?.sandboxes,
         openshell: extras?.openshell,
         wiredHosts: extras?.wiredHosts,
@@ -315,6 +399,7 @@ export function buildWindowReceiptModel(events, days, extras) {
         discovery: extras?.discovery,
         investigate: extras?.investigate,
         alerts: extras?.alerts,
+        incidentAlerts: extras?.incidentAlerts,
         otel: extras?.otel,
         ioc: extras?.ioc,
         posture: extras?.posture,
@@ -339,6 +424,7 @@ export function loadReceiptModel(input) {
         liveToken: input.liveToken,
         searchQuery: input.searchQuery,
         identity: loadIdentity(input.cwd),
+        planeConfigured: isPlaneConfigured(loadIdentity(input.cwd), env),
         sandboxes: loadSandboxes(input.cwd),
         openshell: loadOpenshellCard({ cwd: input.cwd, events: importEvents, env, certify }),
         wiredHosts: loadWiredHosts(input.cwd),
@@ -350,6 +436,7 @@ export function loadReceiptModel(input) {
         discovery: loadDiscoveryCard(env),
         investigate: loadInvestigateLastRun(env),
         alerts: summarizeNotifyLog(readNotifyLog(env)),
+        incidentAlerts: readAlertsState(env),
         otel: readOtelStats(env),
         ioc: readIocResult(env),
         posture: postureCard(env),
@@ -375,6 +462,7 @@ function filterDataAttrs(e, sessionId) {
     const project = e.project?.trim();
     const server = parseMcpToolId(e.toolId);
     return (`data-verdict="${esc(e.verdict.toUpperCase())}"` +
+        (outcomeOf(e) ? ` data-outcome="${outcomeOf(e)}"` : "") +
         (never ? ` data-never="1"` : "") +
         ` data-mode="${esc(e.mode)}"` +
         ` data-plane="${esc(e.host?.trim() || "unknown")}"` +
@@ -410,6 +498,18 @@ function noMatchHint(query, env = process.env) {
     return (`${base} Plain-language search is off, so only exact words match. ` +
         `Turn it on once with <code>${esc(semanticInstallCommand(env))}</code>, then search again.`);
 }
+/**
+ * "Make card" next to a stopped row (G5). Only a denied call gets it. The live report gets a button that calls the local
+ * /action/card; a static file has no server, so it shows the CLI command. Never in the deny text the agent reads.
+ */
+function cardControl(e, live) {
+    if (!isNearMiss(e))
+        return "";
+    const id = esc(eventIdOf(e));
+    return live
+        ? `<span class="card-ctl"><button type="button" class="stat" data-card-id="${id}">Make card</button><span class="mute small card-result" role="status" aria-live="polite"></span></span>`
+        : `<span class="card-ctl mute small">Make card: <code>kya receipt --card --id ${id}</code></span>`;
+}
 function renderFeed(events, nowMs, live, preserveOrder, noMatch) {
     if (events.length === 0) {
         if (noMatch)
@@ -419,19 +519,34 @@ function renderFeed(events, nowMs, live, preserveOrder, noMatch) {
             : "No events yet - evaluate a tool call with <code>kya wrap</code>, then regenerate this receipt.";
         return `<p class="empty">${hint}</p>`;
     }
-    const ordered = preserveOrder ? [...events] : [...events].sort((a, b) => b.ts.localeCompare(a.ts));
+    const ordered = preserveOrder ? [...events] : [...events].sort(compareFeed);
+    // Search ranking keeps its order and never collapses; the plain feed merges identical consecutive rows.
+    const rows = preserveOrder ? ordered.map((event) => ({ event, count: 1 })) : collapseFeedRows(ordered);
     const parts = [];
     let lastDay = "";
-    for (const e of ordered) {
-        const key = localDayKey(e.ts);
-        if (key !== lastDay) {
-            lastDay = key;
-            parts.push(`<div class="day" role="presentation">${esc(dayLabel(key, nowMs))}</div>`);
+    let pinnedHeading = false;
+    for (const { event: e, count } of rows) {
+        // Blocked rows sit above everything else, under one heading, so they never hide below repeated rows.
+        const pinned = !preserveOrder && outcomeOf(e) === "blocked";
+        if (pinned) {
+            if (!pinnedHeading) {
+                pinnedHeading = true;
+                parts.push(`<div class="day" role="presentation">Blocked</div>`);
+            }
         }
-        const t = tone(e.verdict);
+        else {
+            const key = localDayKey(e.ts);
+            if (key !== lastDay) {
+                lastDay = key;
+                parts.push(`<div class="day" role="presentation">${esc(dayLabel(key, nowMs))}</div>`);
+            }
+        }
+        const t = rowTone(e);
         const never = e.neverEvent || e.reasonCode === "NEVER_EVENT";
-        const summary = e.summary?.trim()
-            ? `<div class="summary">${esc(e.summary.trim())}</div>`
+        const note = ranNote(e);
+        const summaryText = count > 1 ? repeatText(e, count) : e.summary?.trim();
+        const summary = summaryText
+            ? `<div class="summary">${esc(summaryText)}</div>`
             : "";
         const preview = e.diffPreview?.trim()
             ? `<details class="diff"><summary>Change preview</summary><pre>${esc(e.diffPreview.trim())}</pre></details>`
@@ -446,9 +561,10 @@ function renderFeed(events, nowMs, live, preserveOrder, noMatch) {
   <div class="rail" aria-hidden="true"><span class="tick"></span></div>
   <div class="main">
     <div class="top">
-      <span class="verdict">${esc(verdictWord(e.verdict))}</span>${modeBadge(e.mode)}
+      <span class="verdict">${esc(rowWord(e))}</span>${note ? `<span class="strict-note">${esc(note)}</span>` : ""}${modeBadge(e.mode)}
       <code class="tool">${esc(e.toolId)}</code>
       <time class="when" datetime="${esc(e.ts)}" title="${esc(e.ts)}">${esc(clock(e.ts))} <span class="rel">${esc(relativeTime(e.ts, nowMs))}</span></time>
+      ${cardControl(e, live)}
     </div>
     ${summary}
     ${preview}
@@ -484,11 +600,11 @@ function changesPanel(changes, nowMs) {
             .map((f) => {
             const entries = f.entries
                 .map((e) => {
-                const t = tone(e.verdict);
+                const t = rowTone(e);
                 const dataAttrs = filterDataAttrs(e, s.sessionId);
                 return `      <div class="chg-entry ${t}${e.never ? " never" : ""}" ${dataAttrs}>
         <div class="top">
-          <span class="verdict">${esc(verdictWord(e.verdict))}</span>${modeBadge(e.mode)}
+          <span class="verdict">${esc(rowWord(e))}</span>${modeBadge(e.mode)}
           <code class="tool">${esc(e.toolId)}</code>
           <time class="when" datetime="${esc(e.ts)}" title="${esc(e.ts)}">${esc(clock(e.ts))} <span class="rel">${esc(relativeTime(e.ts, nowMs))}</span></time>
         </div>
@@ -517,13 +633,41 @@ ${files}
     })
         .join("\n");
 }
-function identityLine(identity) {
+/** Default base URL `kya init` writes. It is a placeholder, not a plane that runs. */
+const DEFAULT_PLANE_URL = "http://127.0.0.1:8090";
+/** A control plane counts as configured with an API key, saved hosted login, or a base URL other than the init default. */
+export function isPlaneConfigured(identity, env = process.env) {
+    if (env.KYA_API_KEY?.trim() || env.SHIELD_API_KEY?.trim() || env.KYA_BASE_URL?.trim())
+        return true;
+    if (readCredentials(env))
+        return true;
+    const base = identity?.baseUrl?.trim().replace(/\/+$/, "");
+    return Boolean(base && base !== DEFAULT_PLANE_URL);
+}
+/** Who the report is for. Host and plane address show only when a plane is configured. */
+function identityBits(identity, planeConfigured) {
     if (!identity)
-        return "";
+        return [];
+    // Hidden fields are still checked: a credential in the saved base URL must stop the render, shown or not.
+    assertNoSecrets([identity.agentName, identity.agentId, identity.host, identity.baseUrl].filter(Boolean).join(" · "));
     const nameId = identity.agentName && identity.agentId
         ? `${identity.agentName}/${identity.agentId}`
         : (identity.agentName ?? identity.agentId);
-    const bits = [nameId, identity.host, identity.baseUrl].filter((b) => typeof b === "string" && b.trim().length > 0);
+    return [nameId, ...(planeConfigured ? [identity.host, identity.baseUrl] : [])].filter((b) => typeof b === "string" && b.trim().length > 0);
+}
+/**
+ * Header block of the live report (F4): the "Share this report" button and the place for its result. The button
+ * calls POST /action/share (the same redacted payload as `kya receipt --share`). Static files do not get it:
+ * there is no server to answer.
+ */
+function shareHeaderBlock() {
+    return `<div class="share-row" id="share-report" style="margin-top:0.75rem">
+      <button type="button" class="stat" id="share-report-btn">Share this report</button>
+      <div id="share-report-result" role="status" aria-live="polite"></div>
+    </div>`;
+}
+function identityLine(identity, planeConfigured) {
+    const bits = identityBits(identity, planeConfigured);
     if (bits.length === 0)
         return "";
     // baseUrl is inert text here - never an anchor.
@@ -641,7 +785,20 @@ function dashboardPanel(db) {
     </button>`;
     // Zero-count rows are hidden, consistent with the header chips.
     const mixRow = (label, group, value, count, fill) => count > 0 ? barRow(label, group, value, pct(count), `${pct(count)}%`, fill) : "";
-    const mixCard = `<div class="db-card">
+    const om = db.outcomeMix;
+    const mixCard = om.recorded > 0
+        ? `<div class="db-card">
+    <h3>Outcome mix</h3>
+    ${mixRow("Ran", "outcome", "ran", om.ran, "ok")}
+    ${mixRow("Blocked", "outcome", "blocked", om.blocked, "bad")}
+    ${mixRow("Held", "outcome", "held", om.held, "warn")}
+    ${mixRow("Error", "outcome", "error", om.error, "warn")}
+    ${mixRow("Earlier: Allow", "verdict", "ALLOW", om.legacyMix.allow, "ok")}
+    ${mixRow("Earlier: Review", "verdict", "REQUIRE_APPROVE", om.legacyMix.review, "warn")}
+    ${mixRow("Earlier: Deny", "verdict", "DENY", om.legacyMix.deny, "bad")}
+    ${mixRow("Never", "never", "1", db.verdictMix.never, "bad")}
+  </div>`
+        : `<div class="db-card">
     <h3>Verdict mix</h3>
     ${mixRow("Allow", "verdict", "ALLOW", db.verdictMix.allow, "ok")}
     ${mixRow("Review", "verdict", "REQUIRE_APPROVE", db.verdictMix.review, "warn")}
@@ -1374,6 +1531,46 @@ function kpiTile(label, value, cls = "") {
     const toned = typeof value === "number" && value > 0 && cls ? ` ${cls}` : "";
     return `<div class="kpi"><span class="kpi-num${toned}">${v}</span><span class="kpi-lab">${label}</span></div>`;
 }
+/** Rows the hook stopped (outcome "blocked", F3), newest first. Rows with no outcome are not counted. */
+export function blockedCalls(events) {
+    return events.filter((e) => outcomeOf(e) === "blocked").sort((a, b) => b.ts.localeCompare(a.ts));
+}
+const BLOCKED_ROWS_SHOWN = 5;
+/**
+ * First panel of the report (guard first): how many calls the guard stopped and the last five.
+ * With none blocked it shows the three built-in demo calls, labelled as a demo, never as activity.
+ */
+function heroBlockedPanel(events, nowMs, windowLabel, live) {
+    const blocked = blockedCalls(events);
+    if (blocked.length === 0) {
+        const demo = DEMO_CALLS.map((c) => `    <li><code>${esc(c.label)}</code><span class="blk-what">${esc(c.what)}</span><span class="pill">demo</span></li>`).join("\n");
+        return `<section class="panel hero-blocked demo" id="frag-hero-blocked" aria-label="Blocked">
+  <h2>Blocked <span class="pill">demo</span></h2>
+  <p class="blk-lead"><span class="blk-num">0</span> calls blocked ${esc(windowLabel)}. Demo: three calls your agent could make, and the guard stops all three.</p>
+  <ul class="blk-rows">
+${demo}
+  </ul>
+  <p class="mute small">These rows are samples, not your activity. Real blocked calls replace them here.</p>
+</section>`;
+    }
+    const rows = blocked
+        .slice(0, BLOCKED_ROWS_SHOWN)
+        .map((e) => {
+        const what = e.summary?.trim() ? esc(clip(e.summary.trim(), 140)) : "";
+        const rule = e.neverRule ? `<span class="mute small">rule <code>${esc(e.neverRule)}</code></span>` : "";
+        return `    <li><code>${esc(e.toolId)}</code><span class="blk-what">${what}</span>${rule}<span class="mute small">${esc(relativeTime(e.ts, nowMs))}</span>${cardControl(e, live)}</li>`;
+    })
+        .join("\n");
+    const more = blocked.length > BLOCKED_ROWS_SHOWN ? `<p class="mute small">Showing the last ${BLOCKED_ROWS_SHOWN} of ${blocked.length}. The Activity tab lists every call.</p>` : "";
+    return `<section class="panel hero-blocked" id="frag-hero-blocked" aria-label="Blocked">
+  <h2>Blocked</h2>
+  <p class="blk-lead"><span class="blk-num bad">${blocked.length}</span> ${blocked.length === 1 ? "call" : "calls"} blocked ${esc(windowLabel)}.</p>
+  <ul class="blk-rows">
+${rows}
+  </ul>
+  ${more}
+</section>`;
+}
 /**
  * Hero Certify panel: purpose-built rich card for the live Agent Trust
  * Baseline. The section carries the result state (`hero-certify pass|gap|
@@ -1536,6 +1733,23 @@ function verdictsHeroCard(c, total) {
     // raw event count keeps every bar inside the base the Overview card uses.
     const pct = (n) => (total > 0 ? Math.round((n / total) * 100) : 0);
     const mixRow = (label, n, fill) => `<div class="mix-row"><span class="mix-lab">${label}</span><span class="mix-bar"><span class="mix-fill ${fill}" style="width:${pct(n)}%"></span></span><span class="mix-num">${n}</span></div>`;
+    const o = c.outcomes;
+    if (o.recorded > 0) {
+        const row = (label, n, fill) => (n > 0 ? mixRow(label, n, fill) : "");
+        return `<section class="panel" aria-label="Verdicts">
+  <h2>Decisions</h2>
+  <div class="mix">
+    ${mixRow("Ran", o.ran, "ok")}
+    ${mixRow("Blocked", o.blocked, "bad")}
+    ${mixRow("Held", o.held, "warn")}
+    ${row("Error", o.error, "warn")}
+    ${row("Earlier: Allow", c.allow, "ok")}
+    ${row("Earlier: Deny", c.deny, "bad")}
+    ${row("Earlier: Review", c.require, "warn")}
+    ${mixRow("Never", c.never, "bad")}
+  </div>
+</section>`;
+    }
     return `<section class="panel" aria-label="Verdicts">
   <h2>Decisions</h2>
   <div class="mix">
@@ -1769,6 +1983,29 @@ ${card.findings
   <p class="mute small">ran ${esc(relativeTime(card.ranAt, nowMs))} · window ${card.windowDays}d · <code>kya investigate</code> for the full report</p>
 </section>`;
 }
+/** Overview list of incidents that alerted, newest first. Renders nothing until one has alerted. */
+function incidentAlertsPanel(entries, nowMs) {
+    if (!entries || entries.length === 0)
+        return "";
+    const rows = [...entries]
+        .reverse()
+        .slice(0, 5)
+        .map((e) => {
+        const where = e.status === "sent" && e.delivered > 0 ? `sent to ${e.delivered}` : e.status === "sent" ? "report only" : "not delivered";
+        const tri = e.triage
+            ? `<br><span class="mute small">triage (local model, advisory): ${esc(e.triage.category.id)} ${Math.round(e.triage.category.p * 100)}% · ${esc(e.triage.urgency.id)} · ${esc(e.triage.action.id)} · harmless ${Math.round(e.triage.benign * 100)}%</span>`
+            : "";
+        return `    <li>${severityPill(e.severity)} ${esc(e.title)} <span class="mute">${esc(where)} · <time datetime="${esc(e.ts)}" title="${esc(e.ts)}">${esc(relativeTime(e.ts, nowMs))}</time></span>${tri}</li>`;
+    })
+        .join("\n");
+    return `<section class="panel" aria-label="Incident alerts">
+  <h2>Incident alerts</h2>
+  <ul class="rows">
+${rows}
+  </ul>
+  <p class="mute small">incidents that raised an alert · <code>kya alerts status</code> · local KYA is advisory</p>
+</section>`;
+}
 /**
  * System-tab Alerts panel: per-target delivery rollup from the notify ledger.
  * With no deliveries yet the panel still renders as an empty state (config
@@ -1877,7 +2114,7 @@ export function renderFeedPage(events, filters, page, nowMs, live, query, embedd
         total = ranked.length;
     }
     else {
-        const sorted = [...events].sort((a, b) => b.ts.localeCompare(a.ts));
+        const sorted = [...events].sort(compareFeed);
         ordered = applyChipFilters(sorted, filters);
         total = ordered.length;
     }
@@ -1921,6 +2158,21 @@ const zoneBody = (parts, empty) => parts.some((p) => p.length > 0)
     : `<p class="mute small zone-empty">${empty}</p>`;
 /** Inner markup of the Activity counts bar (verdict buttons + mode/plane chips). */
 function statCountsInner(c, chips) {
+    const o = c.outcomes;
+    if (o.recorded > 0) {
+        const btn = (label, n, group, value, cls, title) => `<button type="button" class="stat${cls ? ` ${cls}` : ""}" data-fgroup="${group}" data-fvalue="${value}" aria-pressed="false" title="Filter: ${title}">${label}<b>${n}</b></button>`;
+        // Rows from before outcomes existed keep their verdict counts, labelled as earlier rows.
+        const earlier = (label, n, value, cls) => n > 0 ? btn(`Earlier: ${label}`, n, "verdict", value, cls, `${label} (rows with no outcome recorded)`) : "";
+        const howTo = o.wouldHold > 0 ? `\n        <span class="strict-howto">${strictHowTo(o.wouldHold, (t) => `<code>${t}</code>`)}</span>` : "";
+        return `${btn("Ran", o.ran, "outcome", "ran", "ok", "Ran")}
+        ${btn("Blocked", o.blocked, "outcome", "blocked", "bad", "Blocked")}
+        ${btn("Held", o.held, "outcome", "held", "warn", "Held")}
+        ${o.error > 0 ? btn("Error", o.error, "outcome", "error", "", "Error") : ""}
+        ${earlier("Allow", c.allow, "ALLOW", "ok")}${earlier("Deny", c.deny, "DENY", "bad")}${earlier("Review", c.require, "REQUIRE_APPROVE", "warn")}
+        <button type="button" class="stat" data-fgroup="never" data-fvalue="1" aria-pressed="false" title="Filter: Never">Never<b>${c.never}</b></button>
+        ${chips.modes}${chips.planes}${howTo}
+        <button type="button" class="stat clear-filters" id="clear-filters" hidden>Clear filters ×</button>`;
+    }
     return `<button type="button" class="stat ok" data-fgroup="verdict" data-fvalue="ALLOW" aria-pressed="false" title="Filter: Allow">Allow<b>${c.allow}</b></button>
         <button type="button" class="stat bad" data-fgroup="verdict" data-fvalue="DENY" aria-pressed="false" title="Filter: Deny">Deny<b>${c.deny}</b></button>
         <button type="button" class="stat warn" data-fgroup="verdict" data-fvalue="REQUIRE_APPROVE" aria-pressed="false" title="Filter: Review">Review<b>${c.require}</b></button>
@@ -1948,7 +2200,7 @@ export function buildLiveFragments(model, livePaged) {
             chipProducts: chips.products,
             chipProjects: chips.projects,
             chipServers: chips.servers,
-            heroCertify: heroCertifyPanel(model.certify),
+            heroBlocked: heroBlockedPanel(events, nowMs, `in the ${model.rangeLabel}`, model.live),
             heroTiles: [
                 verdictsHeroCard(c, events.length),
                 activityHeroCard(agg, dashboard, events.length),
@@ -1956,18 +2208,24 @@ export function buildLiveFragments(model, livePaged) {
                 importHeroCard(model.imports, nowMs, livePaged),
                 discoveryHeroCard(model.discovery, nowMs, livePaged),
                 investigateHeroCard(model.investigate, nowMs, livePaged),
-                showbackHeroCard(model.showback, events),
             ].join("\n        "),
-            overviewPanels: zoneBody([dashboardPanel(dashboard), sessionsPanel(agg, nowMs, changes), reasonsPanel(agg)], "No activity in this window yet - analytics appear once events land."),
-            certifyBody: zoneBody([model.certify ? certifyDetailPanel(model.certify.requirements) : ""], "No check yet - use your coding tools with kya connected, then run kya certify."),
+            showbackPanel: showbackHeroCard(model.showback, events),
+            connectedBody: zoneBody([wiredHostsPanel(model.wiredHosts)], "No coding agent is connected yet. Run kya connect &lt;host&gt; to add one."),
+            overviewPanels: zoneBody([incidentAlertsPanel(model.incidentAlerts, nowMs), dashboardPanel(dashboard), sessionsPanel(agg, nowMs, changes), reasonsPanel(agg)], "No activity in this window yet - analytics appear once events land."),
+            certifyBody: zoneBody([
+                heroCertifyPanel(model.certify),
+                model.certify
+                    ? certifyDetailPanel(model.certify.requirements)
+                    : `<p class="mute small zone-empty">The full rule table appears here after the first check.</p>`,
+            ], "No check yet - use your coding tools with kya connected, then run kya certify."),
             orrPanel: orrPanel(model.orr, nowMs, livePaged),
             changesList: changesPanel(changes, nowMs),
         },
         nav: {
-            overview: events.length,
+            overview: blockedCalls(events).length,
             activity: events.length,
             changes: changes.fileCount,
-            certify: model.certify?.gap ?? null,
+            certify: null,
             orr: model.orr ? model.orr.scorecards.fail : null,
         },
     };
@@ -2371,8 +2629,10 @@ export function renderReceiptHtml(model) {
       chipProducts: 'chip-products',
       chipProjects: 'chip-projects',
       chipServers: 'chip-servers',
-      heroCertify: 'frag-hero-certify',
+      heroBlocked: 'frag-hero-blocked',
       heroTiles: 'frag-hero-tiles',
+      showbackPanel: 'frag-showback',
+      connectedBody: 'frag-connected',
       overviewPanels: 'frag-overview-panels',
       certifyBody: 'frag-certify',
       orrPanel: 'frag-orr',
@@ -2589,6 +2849,25 @@ export function renderReceiptHtml(model) {
     try { localStorage.setItem('kya-theme', root.getAttribute('data-theme')); } catch(e){}
   });
 })();
+</script>`;
+    // The "More" menu: closed by default, remembered per browser, and open when the page was reached through
+    // a link to a tab inside it (a hash such as #certify). Without JS or localStorage the page still works.
+    const moreScript = `<script>
+(function(){
+  var more = document.getElementById('nav-more');
+  if (!more) return;
+  var inside = false;
+  try { inside = !!(location.hash && more.querySelector('a[href="' + location.hash + '"]')); } catch(e){}
+  var stored = null;
+  try { stored = localStorage.getItem('kya-nav-more'); } catch(e){}
+  if (inside || stored === 'open') more.open = true;
+  more.addEventListener('toggle', function(){
+    try { localStorage.setItem('kya-nav-more', more.open ? 'open' : 'closed'); } catch(e){}
+  });
+  window.addEventListener('hashchange', function(){
+    try { if (location.hash && more.querySelector('a[href="' + location.hash + '"]')) more.open = true; } catch(e){}
+  });
+})();
 </script>`;
     // Gateway interactive controls: playground evaluator, quick actions, and the
     // sidebar stop-report link. Only wired when the page is served by the live
@@ -2748,6 +3027,68 @@ export function renderReceiptHtml(model) {
     });
   });
 
+  // The card control next to a stopped row. Delegated: the Blocked panel is replaced on every live refresh.
+  document.addEventListener('click', function(ev){
+    var b = ev.target && ev.target.closest ? ev.target.closest('[data-card-id]') : null;
+    if (!b) return;
+    var out = b.parentNode.querySelector('.card-result');
+    b.disabled = true;
+    out.textContent = 'Making the card...';
+    post('/action/card', { id: b.getAttribute('data-card-id') }).then(parseJson).then(function(d){
+      out.textContent = d && d.ok ? 'Saved ' + (d.png || d.svg) + '. Caption: ' + d.caption.replace(/\\n/g, ' ') : 'No card: ' + (d && d.error ? d.error : 'unknown error');
+      b.disabled = false;
+    }).catch(function(err){ out.textContent = 'No card: ' + err.message; b.disabled = false; });
+  });
+
+  var shareBtn = document.getElementById('share-report-btn');
+  if (shareBtn) {
+    var shareOut = document.getElementById('share-report-result');
+    var shareFail = function(msg){
+      setResult(shareOut, '<p>Could not share the report: ' + esc(msg) + '. The report still works. Try again when you are online.</p>', true);
+      shareBtn.disabled = false;
+    };
+    var copyText = function(text, field, btn){
+      var done = function(){ btn.textContent = 'Copied'; };
+      if (navigator.clipboard && navigator.clipboard.writeText) {
+        navigator.clipboard.writeText(text).then(done, function(){ field.select(); btn.textContent = 'Press Ctrl+C to copy'; });
+      } else { field.select(); btn.textContent = 'Press Ctrl+C to copy'; }
+    };
+    shareBtn.addEventListener('click', function(){
+      shareBtn.disabled = true;
+      shareOut.textContent = 'Sharing...';
+      post('/action/share', {}).then(parseJson).then(function(d){
+        if (!d || !d.ok) { shareFail(d && d.error ? d.error : 'unknown error'); return; }
+        // Show and open only an http(s) link. share.ts already checked it is on the server that was asked.
+        if (!/^https?:/.test(String(d.url))) { shareFail('the server sent a link that is not a web address'); return; }
+        shareOut.textContent = '';
+        var label = document.createElement('p');
+        label.textContent = 'Public link. Send it to a colleague:';
+        var field = document.createElement('input');
+        field.type = 'text'; field.readOnly = true; field.id = 'share-url'; field.value = d.url; field.size = 44;
+        var copy = document.createElement('button');
+        copy.type = 'button'; copy.className = 'stat'; copy.id = 'share-copy'; copy.textContent = 'Copy link';
+        copy.addEventListener('click', function(){ copyText(d.url, field, copy); });
+        shareOut.appendChild(label); shareOut.appendChild(field); shareOut.appendChild(copy);
+        var claim = document.createElement('p');
+        var a = document.createElement('a');
+        a.id = 'share-claim'; a.href = d.url; a.target = '_blank'; a.rel = 'noopener';
+        a.textContent = 'Open the page to claim it, keep it and get a weekly summary';
+        claim.appendChild(a);
+        shareOut.appendChild(claim);
+        var connect = document.createElement('p');
+        connect.id = 'share-connect';
+        connect.textContent = 'To connect this computer to your account, run kya login.';
+        shareOut.appendChild(connect);
+        if (d.expiresAt) {
+          var exp = document.createElement('p');
+          exp.textContent = 'If nobody claims the report, it is deleted on ' + String(d.expiresAt).slice(0, 10) + '.';
+          shareOut.appendChild(exp);
+        }
+        shareBtn.disabled = false;
+      }).catch(function(err){ shareFail(err.message); });
+    });
+  }
+
   var importForm = document.getElementById('import-form');
   if (importForm) {
     importForm.addEventListener('submit', function(e){
@@ -2813,7 +3154,6 @@ export function renderReceiptHtml(model) {
         postureSectionHtml(model.posture, !!model.liveToken),
         capabilitiesPanel(model),
         gatePanel(model.gate, nowMs),
-        wiredHostsPanel(model.wiredHosts),
         sandboxesPanel(model.sandboxes, nowMs),
         openshellPanel(model.openshell, nowMs),
         alertsPanel(model.alerts, nowMs, livePaged),
@@ -2825,7 +3165,7 @@ export function renderReceiptHtml(model) {
 <head>
 <meta charset="utf-8"/>
 <meta name="viewport" content="width=device-width, initial-scale=1"/>
-<title>${esc(model.title)} - ${esc(model.rangeLabel)}</title>
+<title>${esc(PROMISE)} - ${esc(model.rangeLabel)}</title>
 <style>${receiptCss()}${model.liveToken ? MAP_CSS + MAP_LIVE_ZONE_CSS : ""}</style>
 </head>
 <body>
@@ -2837,20 +3177,25 @@ export function renderReceiptHtml(model) {
     </div>
   </header>
   <nav class="sidebar-nav" aria-label="Report sections">
-    ${navItem("#overview", "Overview", events.length)}
+    ${navItem("#overview", "Blocked", blockedCalls(events).length)}
     ${navItem("#activity", "Activity", events.length)}
-    ${navItem("#changes", "Changes", changes.fileCount)}
-    ${navItem("#certify", "Certify", model.certify?.gap ?? 0)}
-    ${navItem("#orr", "ORR", model.orr ? model.orr.scorecards.fail : undefined)}
-    ${model.liveToken ? navItem("#map", "Map", undefined) : ""}
-    ${navGroup("Gateway", model.gate?.state === "running")}
-    ${navSubItem("#gateway-home", "Home", model.gate?.servers.length ?? 0)}
-    ${navSubItem("#gateway-listeners", "Listeners", model.gate?.listeners?.length ?? 0)}
-    ${navSubItem("#gateway-routes", "Routes", model.gate?.routes?.length ?? 0)}
-    ${navSubItem("#gateway-backends", "Backends", model.gate?.servers.length ?? 0)}
-    ${navSubItem("#gateway-policies", "Policies", model.gate?.policySummary?.totalPolicies ?? 0)}
-    ${navSubItem("#gateway-playground", "Playground", model.gate?.playgroundSamples?.length ?? 0)}
-    ${navItem("#system", "System", undefined)}
+    ${navItem("#connected", "Connected tools", undefined)}
+    <details class="nav-more" id="nav-more">
+      <summary class="nav-more-summary">More</summary>
+      ${navItem("#changes", "Changes", changes.fileCount)}
+      ${navItem("#certify", "Certify", undefined)}
+      ${navItem("#orr", "ORR", model.orr ? model.orr.scorecards.fail : undefined)}
+      ${model.liveToken ? navItem("#map", "Map", undefined) : ""}
+      ${model.showback ? navItem("#showback", "Showback", undefined) : ""}
+      ${navGroup("Gateway", model.gate?.state === "running")}
+      ${navSubItem("#gateway-home", "Home", model.gate?.servers.length ?? 0)}
+      ${navSubItem("#gateway-listeners", "Listeners", model.gate?.listeners?.length ?? 0)}
+      ${navSubItem("#gateway-routes", "Routes", model.gate?.routes?.length ?? 0)}
+      ${navSubItem("#gateway-backends", "Backends", model.gate?.servers.length ?? 0)}
+      ${navSubItem("#gateway-policies", "Policies", model.gate?.policySummary?.totalPolicies ?? 0)}
+      ${navSubItem("#gateway-playground", "Playground", model.gate?.playgroundSamples?.length ?? 0)}
+      ${navItem("#system", "System", undefined)}
+    </details>
   </nav>
   <footer class="sidebar-footer">
     <button type="button" class="theme-toggle" id="theme-toggle" aria-label="Toggle theme">Theme</button>
@@ -2862,16 +3207,17 @@ export function renderReceiptHtml(model) {
 ${model.liveToken ? '<main data-live-token="1">' : '<main>'}
   <header class="page-header">
     <div class="title-row">
-      <h1>${esc(model.title)}</h1>
+      <h1>${esc(PROMISE)}</h1>
       <div class="range">${esc(model.rangeLabel)}${livePill}</div>
     </div>
-    ${identityLine(model.identity)}
+    ${identityLine(model.identity, model.planeConfigured)}
+    ${model.liveToken ? shareHeaderBlock() : ""}
   </header>
   ${blockedBanner}
   ${iocBanner}
   <section class="zone" id="overview" aria-labelledby="tab-overview">
     <div class="hero">
-      ${fr.fragments.heroCertify}
+      ${fr.fragments.heroBlocked}
       <div class="hero-tiles" id="frag-hero-tiles">
         ${fr.fragments.heroTiles}
       </div>
@@ -2897,6 +3243,9 @@ ${initialFeed.feedHtml}
 ${initialFeed.paginationHtml}
     </div>
   </section>
+  <section class="zone" id="connected" aria-labelledby="tab-connected">
+    <div id="frag-connected">${fr.fragments.connectedBody}</div>
+  </section>
   <section class="zone" id="changes" aria-labelledby="tab-changes">
     <section class="feed chg" id="changes-list" aria-label="Changes by session and file">
 ${fr.fragments.changesList}
@@ -2909,6 +3258,7 @@ ${fr.fragments.changesList}
     <div id="frag-orr">${fr.fragments.orrPanel}</div>
   </section>
   ${model.liveToken ? '<section class="zone" id="map" aria-labelledby="tab-map"><div id="frag-map"><p class="mute">Loading the map.</p></div></section>' : ""}
+  ${model.showback ? `<section class="zone" id="showback" aria-labelledby="tab-showback"><div id="frag-showback">${fr.fragments.showbackPanel}</div></section>` : ""}
   ${gatePagePanel(model.gate, nowMs)}
   <section class="zone" id="system" aria-labelledby="tab-system">
     ${systemBody}
@@ -2918,6 +3268,7 @@ ${filterScript}
 ${model.liveToken ? liveMapScripts() : ""}
 ${staticSearchScript}
 ${themeScript}
+${moreScript}
 ${gateScript}
 </body>
 </html>`;
@@ -2925,28 +3276,83 @@ ${gateScript}
     assertNoSecrets(html);
     return html;
 }
+/** "## Blocked" section: the count and the last five blocked calls, or the demo when none was blocked. */
+function blockedMarkdown(events, nowMs) {
+    const blocked = blockedCalls(events);
+    if (blocked.length === 0) {
+        return [
+            "## Blocked (demo)",
+            "",
+            "0 calls blocked in this window. Demo: three calls your agent could make, and the guard stops all three. These rows are samples, not your activity.",
+            "",
+            ...DEMO_CALLS.map((c) => `- \`${mdInline(c.label)}\` - ${mdText(c.what)} (demo)`),
+            "",
+        ];
+    }
+    return [
+        "## Blocked",
+        "",
+        `${blocked.length} ${blocked.length === 1 ? "call" : "calls"} blocked in this window. Last ${Math.min(5, blocked.length)}:`,
+        "",
+        ...blocked.slice(0, 5).map((e) => {
+            const sum = e.summary?.trim() ? ` - ${mdText(clip(e.summary.trim(), 140))}` : "";
+            return `- \`${mdInline(e.toolId)}\`${sum} - ${mdText(relativeTime(e.ts, nowMs))}`;
+        }),
+        "",
+    ];
+}
 export function renderReceiptMarkdown(model) {
     const c = countVerdicts(model.events);
     const agg = aggregateEvents(model.events);
     const nowMs = Date.now();
+    const o = c.outcomes;
     const lines = [
-        `# ${mdText(model.title)}`,
+        `# ${mdText(PROMISE)}`,
         "",
         mdText(model.rangeLabel),
         "",
-        `Allow ${c.allow} | Deny ${c.deny} | Review ${c.require} | Never ${c.never}`,
+        ...blockedMarkdown(model.events, nowMs),
+    ];
+    if (o.recorded > 0) {
+        // Counted by what happened to each call. Rows from before outcomes existed keep their verdict counts, on a second line.
+        lines.push(`${outcomeHeadline(o)} | Never ${c.never}`, "");
+        if (o.wouldHold > 0)
+            lines.push(strictHowTo(o.wouldHold, (t) => `\`${t}\``), "");
+        if (o.legacy > 0) {
+            lines.push(`Earlier calls (no outcome recorded): Allow ${c.allow} | Deny ${c.deny} | Review ${c.require}`, "");
+        }
+    }
+    else {
+        lines.push(`Allow ${c.allow} | Deny ${c.deny} | Review ${c.require} | Never ${c.never}`, "");
+    }
+    // Feed rows. With outcomes recorded the feed leads (blocked rows first); without, it stays where it was.
+    const feedLines = [
+        "## Feed",
+        ...collapseFeedRows(o.recorded > 0 ? [...model.events].sort(compareFeed) : [...model.events].sort((a, b) => b.ts.localeCompare(a.ts)))
+            .flatMap(({ event: e, count }) => {
+            const text = count > 1 ? repeatText(e, count) : e.summary?.trim();
+            const sum = text ? ` - ${mdText(text)}` : "";
+            const note = ranNote(e);
+            const head = `- **${mdText(rowWord(e))}**${note ? ` (${note})` : ""} \`${mdInline(e.toolId)}\`${sum} - ${productLabel(e.product)} - ${mdText(e.reasonCode)}`;
+            if (!e.diffPreview?.trim())
+                return [head];
+            // Fenced content is verbatim (stripEscapes only - backslash escapes
+            // are literal in code fences); the dynamically sized tilde fence
+            // prevents breakout and backticks cannot close a tilde fence.
+            const diff = stripEscapes(e.diffPreview.trim());
+            const fence = mdFence(diff);
+            return [head, "", fence, diff, fence, ""];
+        }),
         "",
     ];
+    if (o.recorded > 0)
+        lines.push(...feedLines);
     if (model.ioc) {
         const k = model.ioc.findings.length;
         lines.push(mdText(`IoC check (advisory): ${k === 0 ? "no findings" : `${k} finding${k === 1 ? "" : "s"}`}, list ${model.ioc.listVersion}, checked ${model.ioc.checkedAt}.`), "");
     }
     if (model.identity) {
-        const id = model.identity;
-        const nameId = id.agentName && id.agentId
-            ? `${id.agentName}/${id.agentId}`
-            : (id.agentName ?? id.agentId);
-        const bits = [nameId, id.host, id.baseUrl].filter((b) => typeof b === "string" && b.trim().length > 0);
+        const bits = identityBits(model.identity, model.planeConfigured);
         if (bits.length > 0) {
             lines.push(mdText(bits.join(" · ")), "");
         }
@@ -2961,7 +3367,7 @@ export function renderReceiptMarkdown(model) {
         agg.planes.runtime > 0 ? `Runtime ${agg.planes.runtime}` : "",
     ].filter(Boolean);
     if (modeBits.length > 0 || planeBits.length > 0) {
-        lines.push(`Modes: ${modeBits.join(" | ") || "-"} · Planes: ${planeBits.join(" | ") || "-"}`, "");
+        lines.push(`Modes: ${modeBits.join(" | ") || "-"} · Source: ${planeBits.join(" | ") || "-"}`, "");
     }
     if (agg.products.length >= 2) {
         lines.push("## Products", ...agg.products.map((p) => `- ${mdText(p.label)} × ${p.count}`), "");
@@ -2969,23 +3375,16 @@ export function renderReceiptMarkdown(model) {
     if (agg.projects.length >= 2) {
         lines.push("## Projects", ...agg.projects.map((p) => `- ${mdText(p.label)} × ${p.count}`), "");
     }
-    if (model.certify) {
-        const c = model.certify;
-        lines.push("## Certify", `result: ${c.result} · counts: ${c.pass} pass · ${c.gap} gap · ${c.insufficientEvidence} insufficient · ${c.attested} attested`);
-        if (c.topGaps.length > 0) {
-            lines.push("Top gaps:");
-            for (const g of c.topGaps) {
-                lines.push(`- \`${mdInline(g.id)}\` - ${mdText(g.title)} (${mdText(g.severity)})`);
-            }
-        }
-        lines.push(`checked live - last ${c.windowDays} days, ${c.trailEvents} recorded events · the Certify tab lists every rule · kya certify writes the gap report and signed proof file`, "");
-    }
     const db = computeDashboard(model.events);
     if (db.verdictMix.total > 0) {
         const pct = (n) => Math.round((n / db.verdictMix.total) * 100);
         // never is a reason overlay: the Never share is computed from neverEvent
         // rows on top of the same 100% = total events base as the verdict buckets.
-        lines.push("## Analytics", "", `Verdict mix: Allow ${pct(db.verdictMix.allow)}% · Review ${pct(db.verdictMix.review)}% · Deny ${pct(db.verdictMix.deny)}% · Never ${pct(db.verdictMix.never)}%`, "");
+        const om = db.outcomeMix;
+        const mixLine = om.recorded > 0
+            ? `Outcome mix: Ran ${pct(om.ran)}% · Blocked ${pct(om.blocked)}% · Held ${pct(om.held)}%${om.error > 0 ? ` · Error ${pct(om.error)}%` : ""}${om.legacy > 0 ? ` · Earlier (no outcome): Allow ${pct(om.legacyMix.allow)}% · Review ${pct(om.legacyMix.review)}% · Deny ${pct(om.legacyMix.deny)}%` : ""} · Never ${pct(db.verdictMix.never)}%`
+            : `Verdict mix: Allow ${pct(db.verdictMix.allow)}% · Review ${pct(db.verdictMix.review)}% · Deny ${pct(db.verdictMix.deny)}% · Never ${pct(db.verdictMix.never)}%`;
+        lines.push("## Analytics", "", mixLine, "");
         if (db.activity.buckets.length > 0) {
             const max = Math.max(1, ...db.activity.buckets.map((b) => b.count));
             lines.push(`Activity (${db.activity.granularity === "hour" ? "hourly" : "daily"}):`);
@@ -3013,20 +3412,8 @@ export function renderReceiptMarkdown(model) {
             lines.push("");
         }
     }
-    lines.push("## Feed", ...[...model.events]
-        .sort((a, b) => b.ts.localeCompare(a.ts))
-        .flatMap((e) => {
-        const sum = e.summary?.trim() ? ` - ${mdText(e.summary.trim())}` : "";
-        const head = `- **${mdText(verdictWord(e.verdict))}** \`${mdInline(e.toolId)}\`${sum} - ${productLabel(e.product)} - ${mdText(e.reasonCode)}`;
-        if (!e.diffPreview?.trim())
-            return [head];
-        // Fenced content is verbatim (stripEscapes only - backslash escapes
-        // are literal in code fences); the dynamically sized tilde fence
-        // prevents breakout and backticks cannot close a tilde fence.
-        const diff = stripEscapes(e.diffPreview.trim());
-        const fence = mdFence(diff);
-        return [head, "", fence, diff, fence, ""];
-    }), "");
+    if (o.recorded === 0)
+        lines.push(...feedLines);
     // Same normalization as the HTML path: targetPath flows into single-line
     // `#### ` code-span headers, so embedded newlines must be flattened first.
     const changes = buildChangesModel(normalizeTrailEvents(model.events));
@@ -3041,7 +3428,7 @@ export function renderReceiptMarkdown(model) {
                     // fence one longer than the longest run inside.
                     const diff = stripEscapes(e.preview);
                     const fence = mdFence(diff);
-                    lines.push(`- **${mdText(verdictWord(e.verdict))}** \`${mdInline(e.toolId)}\` - ${mdText(e.ts)}`, "", fence, diff, fence, "");
+                    lines.push(`- **${mdText(rowWord(e))}** \`${mdInline(e.toolId)}\` - ${mdText(e.ts)}`, "", fence, diff, fence, "");
                 }
             }
         }
@@ -3147,6 +3534,18 @@ export function renderReceiptMarkdown(model) {
         const ot = model.otel;
         lines.push("## Export to your monitoring (OTel)", `${ot.endpoint ? `\`${mdInline(ot.endpoint)}\` · ` : ""}${ot.spansSent} sent · ${ot.spansFailed} failed${ot.lastExportAt ? ` · last export ${relativeTime(ot.lastExportAt, nowMs)}` : ""}`, "");
     }
+    // Certify last: no gap count reaches the top of the report.
+    if (model.certify) {
+        const c = model.certify;
+        lines.push("## Certify", `result: ${c.result} · counts: ${c.pass} pass · ${c.gap} gap · ${c.insufficientEvidence} insufficient · ${c.attested} attested`);
+        if (c.topGaps.length > 0) {
+            lines.push("Top gaps:");
+            for (const g of c.topGaps) {
+                lines.push(`- \`${mdInline(g.id)}\` - ${mdText(g.title)} (${mdText(g.severity)})`);
+            }
+        }
+        lines.push(`checked live - last ${c.windowDays} days, ${c.trailEvents} recorded events · the Certify tab lists every rule · kya certify writes the gap report and signed proof file`, "");
+    }
     const md = `${lines.join("\n")}\n`;
     assertNoSecrets(md);
     return md;