failproofai 1.0.4-beta.8 → 1.0.4

package/.next/standalone/app/audit/_components/share-templates.ts

@@ -7,31 +7,20 @@
  * appends a clipboard paste hint. Pure — no React, no DOM — so it's
  * unit-testable and shared by the client poster component.
  *
- * ## The score is switched off (2026-09-07)
- *
- * Every template but one used to interpolate `${score}/100`. The score is
- * commented out across the audit — see the header of `src/audit/scoring.ts` for
- * why — so the copy is archetype-only. Eighteen templates lost a subordinate
- * clause; two whose entire premise WAS the number ("my agent scored X/100,
- * think yours can beat it?") are commented out in place rather than reworded,
- * because there is nothing left of them once the number goes.
- *
- * `ShareCtx.score` is kept and still populated so restoring is re-adding the
- * clause, not re-plumbing the type. The originals are preserved verbatim in the
- * block at the bottom of this file.
+ * Each template references the score and/or archetype and ends on the
+ * install-free CTA + handle. We intentionally never include a URL: a bare link
+ * would make X/LinkedIn render a link-preview card and swallow the copied
+ * image. The npx command is the call to action instead.
  */
 import type { Grade } from "@/src/audit/scoring";
 
 export interface ShareCtx {
+  score: number;
   /** Lowercased archetype name, e.g. "the cowboy". */
   arch: string;
+  grade: Grade;
   /** Count of unenabled prescribed policies. */
   missing: number;
-  /** Optional ONLY because the score is switched off and nothing upstream
-   *  computes them any more. Restoring the score means making these required
-   *  again — which the compiler will then walk you through. */
-  score?: number;
-  grade?: Grade;
 }
 
 /** Call-to-action + handle per channel. No URL by design (see file header). */
@@ -44,107 +33,52 @@ const PASTE_LINE = "[ audit card copied to your clipboard — paste it into the
 
 /** Short, curiosity-forward — for X / Twitter. Ends on the npx CTA + @failproofai. */
 export const X_TEMPLATES: ((c: ShareCtx) => string)[] = [
-  ({ arch }) =>
-    `my agent has a personality and it's ${arch}. did not see that coming.\n\nran a failproof audit, all local. find out what yours is → ${X_CTA}`,
-  ({ arch }) =>
-    `spent 30 seconds auditing my agent. learned more about it than i did all month.\n\nit's ${arch}. → ${X_CTA}`,
-  // Score-spined — nothing survives removing the number:
-  // ({ score }) =>
-  //   `my agent scored ${score}/100. think yours can beat it?\n\n30 sec audit, runs locally, gives you a personality too → ${X_CTA}`,
+  ({ score, arch }) =>
+    `my agent has a personality and it's ${arch}. did not see that coming.\n\nran a failproof audit, scored ${score}/100, all local. find out what yours is → ${X_CTA}`,
+  ({ score, arch }) =>
+    `spent 30 seconds auditing my agent. learned more about it than i did all month.\n\nit's ${arch}. scored ${score}/100. → ${X_CTA}`,
+  ({ score }) =>
+    `my agent scored ${score}/100. think yours can beat it?\n\n30 sec audit, runs locally, gives you a personality too → ${X_CTA}`,
   ({ arch }) =>
     `turns out my agent is ${arch} and honestly it explains everything.\n\n→ ${X_CTA}`,
-  ({ arch }) =>
-    `ran a failproof audit on my agent. it reads how it actually behaves when things break, not just the happy path.\n\npersonality: ${arch}. all local → ${X_CTA}`,
-  ({ arch }) =>
-    `got to know my agent today. it's ${arch}. wow.\n\naudit yours in 30s, nothing leaves your machine → ${X_CTA}`,
-  ({ arch }) =>
-    `your agent has a personality. you just haven't met it.\n\ni met mine today: ${arch}. → ${X_CTA}`,
-  ({ arch }) =>
-    `everyone talks about what their agent can build. nobody talks about how it acts when it breaks.\n\nmine's ${arch}, all local → ${X_CTA}`,
-  ({ arch }) =>
-    `every agent builder should run this once.\n\n30 sec, local, gives your agent a personality. mine: ${arch}.\n\n${X_CTA}`,
-  ({ arch }) =>
-    `i'll go first: ${arch}.\n\nwhat's your agent? 30 sec audit, no signup → ${X_CTA}`,
+  ({ score, arch }) =>
+    `ran a failproof audit on my agent. it reads how it actually behaves when things break, not just the happy path.\n\npersonality: ${arch}. score: ${score}/100. all local → ${X_CTA}`,
+  ({ score, arch }) =>
+    `got to know my agent today. it's ${arch} and scored ${score}/100. wow.\n\naudit yours in 30s, nothing leaves your machine → ${X_CTA}`,
+  ({ score, arch }) =>
+    `your agent has a personality. you just haven't met it.\n\ni met mine today: ${arch}, ${score}/100. → ${X_CTA}`,
+  ({ score, arch }) =>
+    `everyone talks about what their agent can build. nobody talks about how it acts when it breaks.\n\nmine's ${arch}, scored ${score}/100, all local → ${X_CTA}`,
+  ({ score, arch }) =>
+    `every agent builder should run this once.\n\n30 sec, local, gives your agent a personality and a quality score. mine: ${arch}, ${score}/100.\n\n${X_CTA}`,
+  ({ score, arch }) =>
+    `i'll go first: ${arch}, ${score}/100.\n\nwhat's your agent? 30 sec audit, no signup → ${X_CTA}`,
 ];
 
 /** Longer, reflective — for LinkedIn. Ends on the npx CTA + @Failproof AI. */
 export const LI_TEMPLATES: ((c: ShareCtx) => string)[] = [
-  ({ arch }) =>
-    `I've spent more hours with my agent this month than with most people I know. Today I realized I couldn't tell you a single thing about how it actually behaves.\n\nSo I audited it. Turns out it's ${arch}.\n\nThe audit reads its real history, including how it handles failures, not just the clean runs. 30 seconds, runs entirely locally.\n\nMeet yours: ${LI_CTA}`,
-  ({ arch }) =>
-    `Took a personality test today. It wasn't for me — it was for my AI agent.\n\nThe result: ${arch}.\n\nIt works by reading the agent's actual run history, so the personality comes from how it really behaves, not a vibe. Took 30 seconds and stayed local.\n\nTry it on yours: ${LI_CTA}`,
-  ({ arch }) =>
-    `Everyone asks what their AI agent can build. I just found out mine has a temper.\n\nAfter watching how it reacts to a failed command, the audit called it ${arch}.\n\nOddly useful to see it written down. 30 seconds, all local: ${LI_CTA}`,
-  ({ arch }) =>
-    `My agent does this very specific thing every time a command fails. Today I learned there's basically a name for it.\n\nRan a quick audit and it came back ${arch}. The whole read is based on how the agent handles things going wrong, which is where its real character shows.\n\n30 seconds, nothing leaves your machine: ${LI_CTA}`,
-  // Score-spined — the opening line is the number:
-  // ({ score, arch }) =>
-  //   `My AI agent scored ${score}/100 today. I didn't know you could even measure that.\n\nThe same audit also handed it a personality: ${arch}.\n\nIt reads the agent's real history and tells you where it's solid and where it slips. Took 30 seconds and ran fully locally: ${LI_CTA}`,
-  ({ arch }) =>
-    `I'm usually the first to scroll past "audit your X" tools. This one took 30 seconds and actually told me something.\n\nMy agent is ${arch}.\n\nIt reads the agent's real run history rather than asking me anything, and none of it leaves the machine: ${LI_CTA}`,
-  ({ arch }) =>
-    `What is your agent's personality? I realized today that I had no answer.\n\nSo I checked. Mine is ${arch}, with a clear read on where it shines and where it slips.\n\nIf you work with agents, run it and drop yours in the comments. 30 seconds, fully local: ${LI_CTA}`,
-  ({ arch }) =>
-    `I trusted my agent a little less after this morning, and quite a bit more by the afternoon.\n\nI ran an audit on it. It showed me exactly where it's reliable and where it isn't, and gave it a personality: ${arch}.\n\nKnowing the gaps is what made me trust it more. 30 seconds, all local: ${LI_CTA}`,
-  ({ arch }) =>
-    `I almost skipped this because I assumed it would quietly ship my code off somewhere. It doesn't. Everything runs locally.\n\n30 seconds later I had my agent's personality: ${arch}.\n\nIf privacy is usually what stops you from trying these, this one is different: ${LI_CTA}`,
-  ({ arch }) =>
-    `Found out my AI agent has a personality type. Found out it's ${arch}. Found out that explains a lot.\n\nThe audit reads how the agent handles failures, not just the runs where everything goes fine.\n\n30 seconds, runs locally: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `I've spent more hours with my agent this month than with most people I know. Today I realized I couldn't tell you a single thing about how it actually behaves.\n\nSo I audited it. Turns out it's ${arch}, and it scored ${score}/100.\n\nThe audit reads its real history, including how it handles failures, not just the clean runs. 30 seconds, runs entirely locally.\n\nMeet yours: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `Took a personality test today. It wasn't for me — it was for my AI agent.\n\nThe result: ${arch}, with a quality score of ${score}/100.\n\nIt works by reading the agent's actual run history, so the personality comes from how it really behaves, not a vibe. Took 30 seconds and stayed local.\n\nTry it on yours: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `Everyone asks what their AI agent can build. I just found out mine has a temper.\n\nAfter watching how it reacts to a failed command, the audit called it ${arch}. It also scored its quality at ${score}/100.\n\nOddly useful to see it written down. 30 seconds, all local: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `My agent does this very specific thing every time a command fails. Today I learned there's basically a name for it.\n\nRan a quick audit and it came back ${arch}, scored ${score}/100. The whole read is based on how the agent handles things going wrong, which is where its real character shows.\n\n30 seconds, nothing leaves your machine: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `My AI agent scored ${score}/100 today. I didn't know you could even measure that.\n\nThe same audit also handed it a personality: ${arch}.\n\nIt reads the agent's real history and tells you where it's solid and where it slips. Took 30 seconds and ran fully locally: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `I'm usually the first to scroll past "audit your X" tools. This one took 30 seconds and actually told me something.\n\nMy agent is ${arch}, and it scored ${score}/100.\n\nIt reads the agent's real run history rather than asking me anything, and none of it leaves the machine: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `What is your agent's personality? I realized today that I had no answer.\n\nSo I checked. Mine is ${arch}, scored ${score}/100, with a clear read on where it shines and where it slips.\n\nIf you work with agents, run it and drop yours in the comments. 30 seconds, fully local: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `I trusted my agent a little less after this morning, and quite a bit more by the afternoon.\n\nI ran an audit on it. It showed me exactly where it's reliable and where it isn't, gave it a personality (${arch}), and scored it ${score}/100.\n\nKnowing the gaps is what made me trust it more. 30 seconds, all local: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `I almost skipped this because I assumed it would quietly ship my code off somewhere. It doesn't. Everything runs locally.\n\n30 seconds later I had my agent's personality (${arch}) and a quality score (${score}/100).\n\nIf privacy is usually what stops you from trying these, this one is different: ${LI_CTA}`,
+  ({ score, arch }) =>
+    `Found out my AI agent has a personality type. Found out it's ${arch}. Found out that explains a lot.\n\nIt scored ${score}/100 too. The audit reads how the agent handles failures, not just the runs where everything goes fine.\n\n30 seconds, runs locally: ${LI_CTA}`,
 ];
 
-/* ---------------------------------------------------------------------------
- * THE ORIGINAL SCORE-BEARING COPY, verbatim. To restore: put these two arrays
- * back in place of the two above, and re-enable the score at its source (see
- * `src/audit/scoring.ts`). Nothing else has to change — `ShareCtx` is unchanged
- * and `score` is still populated by `audit-poster.tsx`.
- *
- * export const X_TEMPLATES: ((c: ShareCtx) => string)[] = [
- *   ({ score, arch }) =>
- *     `my agent has a personality and it's ${arch}. did not see that coming.\n\nran a failproof audit, scored ${score}/100, all local. find out what yours is → ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `spent 30 seconds auditing my agent. learned more about it than i did all month.\n\nit's ${arch}. scored ${score}/100. → ${X_CTA}`,
- *   ({ score }) =>
- *     `my agent scored ${score}/100. think yours can beat it?\n\n30 sec audit, runs locally, gives you a personality too → ${X_CTA}`,
- *   ({ arch }) =>
- *     `turns out my agent is ${arch} and honestly it explains everything.\n\n→ ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `ran a failproof audit on my agent. it reads how it actually behaves when things break, not just the happy path.\n\npersonality: ${arch}. score: ${score}/100. all local → ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `got to know my agent today. it's ${arch} and scored ${score}/100. wow.\n\naudit yours in 30s, nothing leaves your machine → ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `your agent has a personality. you just haven't met it.\n\ni met mine today: ${arch}, ${score}/100. → ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `everyone talks about what their agent can build. nobody talks about how it acts when it breaks.\n\nmine's ${arch}, scored ${score}/100, all local → ${X_CTA}`,
- *   ({ score, arch }) =>
- *     `every agent builder should run this once.\n\n30 sec, local, gives your agent a personality and a quality score. mine: ${arch}, ${score}/100.\n\n${X_CTA}`,
- *   ({ score, arch }) =>
- *     `i'll go first: ${arch}, ${score}/100.\n\nwhat's your agent? 30 sec audit, no signup → ${X_CTA}`,
- * ];
- *
- * export const LI_TEMPLATES: ((c: ShareCtx) => string)[] = [
- *   ({ score, arch }) =>
- *     `I've spent more hours with my agent this month than with most people I know. Today I realized I couldn't tell you a single thing about how it actually behaves.\n\nSo I audited it. Turns out it's ${arch}, and it scored ${score}/100.\n\nThe audit reads its real history, including how it handles failures, not just the clean runs. 30 seconds, runs entirely locally.\n\nMeet yours: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `Took a personality test today. It wasn't for me — it was for my AI agent.\n\nThe result: ${arch}, with a quality score of ${score}/100.\n\nIt works by reading the agent's actual run history, so the personality comes from how it really behaves, not a vibe. Took 30 seconds and stayed local.\n\nTry it on yours: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `Everyone asks what their AI agent can build. I just found out mine has a temper.\n\nAfter watching how it reacts to a failed command, the audit called it ${arch}. It also scored its quality at ${score}/100.\n\nOddly useful to see it written down. 30 seconds, all local: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `My agent does this very specific thing every time a command fails. Today I learned there's basically a name for it.\n\nRan a quick audit and it came back ${arch}, scored ${score}/100. The whole read is based on how the agent handles things going wrong, which is where its real character shows.\n\n30 seconds, nothing leaves your machine: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `My AI agent scored ${score}/100 today. I didn't know you could even measure that.\n\nThe same audit also handed it a personality: ${arch}.\n\nIt reads the agent's real history and tells you where it's solid and where it slips. Took 30 seconds and ran fully locally: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `I'm usually the first to scroll past "audit your X" tools. This one took 30 seconds and actually told me something.\n\nMy agent is ${arch}, and it scored ${score}/100.\n\nIt reads the agent's real run history rather than asking me anything, and none of it leaves the machine: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `What is your agent's personality? I realized today that I had no answer.\n\nSo I checked. Mine is ${arch}, scored ${score}/100, with a clear read on where it shines and where it slips.\n\nIf you work with agents, run it and drop yours in the comments. 30 seconds, fully local: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `I trusted my agent a little less after this morning, and quite a bit more by the afternoon.\n\nI ran an audit on it. It showed me exactly where it's reliable and where it isn't, gave it a personality (${arch}), and scored it ${score}/100.\n\nKnowing the gaps is what made me trust it more. 30 seconds, all local: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `I almost skipped this because I assumed it would quietly ship my code off somewhere. It doesn't. Everything runs locally.\n\n30 seconds later I had my agent's personality (${arch}) and a quality score (${score}/100).\n\nIf privacy is usually what stops you from trying these, this one is different: ${LI_CTA}`,
- *   ({ score, arch }) =>
- *     `Found out my AI agent has a personality type. Found out it's ${arch}. Found out that explains a lot.\n\nIt scored ${score}/100 too. The audit reads how the agent handles failures, not just the runs where everything goes fine.\n\n30 seconds, runs locally: ${LI_CTA}`,
- * ];
- * ------------------------------------------------------------------------- */
-
 /** djb2 hash — stable per seed so the template choice is deterministic. */
 function hashStr(s: string): number {
   let h = 5381;

package/.next/standalone/app/audit/audit-styles.css

@@ -496,13 +496,7 @@
 .poster-meta .of { color: var(--dim); }
 .poster-meta .poster-sep { color: var(--dim); }
 
-/* body — vertical centered stack: sigil → persona → score ───
-   The score block is switched off (see `src/audit/scoring.ts`), so this stack
-   currently renders two children, not three. It is a centered flex column with
-   a gap and no fixed track count, so it re-centers on its own. The
-   `.poster-score` rules below are kept, dormant, against the score coming
-   back — do not tidy them away, or restoring it means rewriting the styles
-   too. */
+/* body — vertical centered stack: sigil → persona → score ─── */
 .poster-body {
   display: flex;
   flex-direction: column;
@@ -561,7 +555,6 @@
 .poster-persona .persona-rarity .pct { color: var(--accent-pink); font-weight: 600; }
 
 /* score — score-n + /100, baseline-aligned and centered in the card. */
-/* Dormant while the score is switched off — see `src/audit/scoring.ts`. */
 .poster-score {
   display: flex;
   align-items: baseline;
@@ -1164,127 +1157,3 @@
 .share-card {
   max-width: 420px;
 }
-
-/* ── Leak report ─────────────────────────────────────────────────────────────
-   One block per distinct credential. Deliberately NOT a table: a table implies
-   columns worth scanning down, and the interesting comparison between two
-   leaked keys is never "which is longer" — it is what each one is and where it
-   went, which reads as a sentence.                                            */
-
-.leak-notify { margin-left: auto; }
-
-.leak-list {
-  list-style: none;
-  margin: 20px 0 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 10px;
-}
-
-.leak-row {
-  border: 1px solid var(--line-2);
-  /* Hard-offset pixel shadow, never a blur — the house rule. Pink is the
-     accent that means "this one is yours to act on". */
-  box-shadow: 4px 4px 0 0 var(--line-2);
-  padding: 14px 16px;
-  display: flex;
-  flex-direction: column;
-  gap: 8px;
-  background: var(--bg);
-}
-/* A recognised prefix means a console exists and this is revocable in a
-   minute. That is a real difference in what the reader has to do, so it is the
-   one thing the row's own frame encodes. */
-.leak-row[data-attributed="true"] { box-shadow: 4px 4px 0 0 var(--accent-pink); }
-
-.leak-row-top {
-  display: flex;
-  align-items: baseline;
-  gap: 10px;
-  flex-wrap: wrap;
-}
-
-.leak-key {
-  font-family: var(--font-mono);
-  font-size: 14px;
-  color: var(--ink);
-  letter-spacing: 0.02em;
-  /* The masked value can be long; it must wrap rather than push the row wide. */
-  word-break: break-all;
-}
-
-.leak-label {
-  font-family: var(--font-mono);
-  font-size: 11px;
-  color: var(--accent-pink);
-  text-transform: lowercase;
-}
-
-.leak-name {
-  font-family: var(--font-mono);
-  font-size: 11px;
-  color: var(--ink-2);
-  border: 1px solid var(--line-2);
-  padding: 1px 5px;
-}
-
-.leak-dismiss {
-  margin-left: auto;
-  font-family: var(--font-mono);
-  font-size: 10px;
-  color: var(--dim);
-  background: none;
-  border: 1px solid var(--line-2);
-  padding: 3px 8px;
-  cursor: pointer;
-  text-transform: lowercase;
-}
-.leak-dismiss:hover:not(:disabled) { color: var(--ink); border-color: var(--ink-2); }
-.leak-dismiss:disabled { opacity: 0.4; cursor: not-allowed; }
-.leak-dismiss:focus-visible { outline: 2px solid var(--accent-pink); outline-offset: 2px; }
-
-.leak-how {
-  font-family: var(--font-mono);
-  font-size: 12px;
-  color: var(--ink-2);
-  line-height: 1.6;
-}
-.leak-verb { color: var(--ink); }
-.leak-where { color: var(--accent-green); }
-.leak-who { color: var(--ink); }
-.leak-when { color: var(--dim); }
-
-.leak-foot {
-  display: flex;
-  gap: 14px;
-  flex-wrap: wrap;
-  font-family: var(--font-mono);
-  font-size: 10px;
-  color: var(--dim);
-}
-.leak-fix { color: var(--accent-green); }
-.leak-dir { color: var(--ink-2); }
-
-@media (max-width: 640px) {
-  .leak-dismiss { margin-left: 0; }
-  .leak-foot { gap: 6px; flex-direction: column; }
-}
-
-/* The re-scan control in the scan header. Sits at the end of the eyebrow row so
-   it reads as an action on that section rather than a page-level nav item. */
-.scan-rerun {
-  margin-left: auto;
-  font-family: var(--font-mono);
-  font-size: 10.5px;
-  letter-spacing: 0.1em;
-  text-transform: lowercase;
-  color: var(--ink-2);
-  background: none;
-  border: 1px solid var(--line-2);
-  padding: 4px 10px;
-  cursor: pointer;
-}
-.scan-rerun:hover:not(:disabled) { color: var(--ink); border-color: var(--accent-pink); }
-.scan-rerun:disabled { opacity: 0.5; cursor: not-allowed; }
-.scan-rerun:focus-visible { outline: 2px solid var(--accent-pink); outline-offset: 2px; }

package/.next/standalone/app/settings/page.tsx

@@ -30,7 +30,7 @@ export const dynamic = "force-dynamic";
 export default async function SettingsPage() {
   // Same gate the audit, policies and projects pages carry. It was dropped in
   // the rewrite, and this is the page that least deserves to lose it: it shows
-  // the address credential alerts go to and can sign the machine out, on a dashboard an
+  // the address digests go to and can sign the machine out, on a dashboard an
   // operator may deliberately be exposing beyond localhost.
   const disabled = (process.env.FAILPROOFAI_DISABLE_PAGES ?? "")
     .split(",").map((s) => s.trim()).filter(Boolean);

package/.next/standalone/app/settings/settings-client.tsx

@@ -29,8 +29,12 @@
  * acts and for anything wrong, mint for the thing that is alive. No third hue,
  * no new webfont, one hard pixel shadow on the console. That is the budget.
  *
- * Scheduling and system notifications are separate machine settings. Turning
- * notifications off must not silently stop the seven-day scan or email alerts.
+ * ## One switch, not two
+ *
+ * Scheduling and mailing are the same decision — the reason to put a scan on a
+ * timer is to be told what it found. So there is one toggle, it requires a
+ * sign-in, and "signed out with the timer on" is a real state the page names
+ * rather than a contradiction it prevents.
  */
 
 import { useCallback, useEffect, useRef, useState, type ReactNode } from "react";
@@ -40,7 +44,6 @@ import {
 } from "@/app/actions/get-scheduled-audit";
 import {
   setAutoAuditAction,
-  setAuditNotifyAction,
   setAuditIntervalAction,
 } from "@/app/actions/update-scheduled-audit";
 import { triggerRun, RerunError } from "@/app/audit/_components/rerun-button";
@@ -184,9 +187,12 @@ function Toggle({
  * What the scan does, as three labelled lines. This is the old footer paragraph
  * restructured — same claims, scannable instead of a wall.
  *
- * "sends" names the exact remote payload. The scheduled scan itself stays
- * local, and no report is attempted unless a credential leak exists and the
- * machine has a verified email identity.
+ * "sends" ENUMERATES rather than saying "only counts and redacted examples".
+ * That was very nearly true, and very nearly true is the worse kind: the report
+ * carries the machine's name too — its hostname, which routinely carries its
+ * owner's. A list a person can check beats a stronger claim they cannot, and
+ * this panel is the one place they would come to check. The digest email states
+ * the same three, in the same order.
  */
 const HOW_IT_WORKS: ReadonlyArray<{ label: string; body: string }> = [
   {
@@ -196,7 +202,7 @@ const HOW_IT_WORKS: ReadonlyArray<{ label: string; body: string }> = [
   { label: "runs", body: "entirely on this machine. the transcripts never leave it." },
   {
     label: "sends",
-    body: "only the newest masked credential exposure, its CLI, time, location, and this machine's name — only when email is configured.",
+    body: "counts, redacted examples, and this machine's name — and only when a scan finds something harmful.",
   },
 ];
 
@@ -205,7 +211,6 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
   // about whether scheduled audits are on. See the note in `page.tsx`.
   const [view, setView] = useState<ScheduledAuditView | null>(initial);
   const [auto, setAuto] = useState(initial?.auto ?? false);
-  const [notify, setNotify] = useState(initial?.notify ?? true);
   const [intervalDays, setIntervalDays] = useState(initial?.intervalDays ?? 7);
   const [busy, setBusy] = useState(false);
   const [running, setRunning] = useState(false);
@@ -249,7 +254,6 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
       setView(next);
       hasView.current = true;
       setAuto(next.auto);
-      setNotify(next.notify);
       setIntervalDays(next.intervalDays);
       setNowMs(Date.now());
       setLoadError(false);
@@ -308,6 +312,26 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
     setBusy(true);
     try {
       const res = await setAutoAuditAction(true);
+      if (!res.ok) {
+        setAuto(false);
+        if (res.reason === "unreachable") {
+          // The session is fine and the network is not. Offering a code prompt
+          // here would name a failure the user does not have and hand them a
+          // flow that cannot succeed either — and abandoning it mid-way is how
+          // a working session gets replaced with none at all.
+          toast("could not reach the server. check your connection and try again.");
+          return;
+        }
+        // The server rejected the session this page had been showing an address
+        // for — expired, or minted against a different api-server. The local
+        // file is the only thing that said "signed in", and `whoAmI` has since
+        // cleared it, so re-read before opening the dialog: otherwise the page
+        // asks for an email while still displaying one.
+        await reload();
+        setAuthOpen(true);
+        toast("that sign-in expired. one more code and it's on.");
+        return;
+      }
       setAuto(res.auto);
       toast("scheduled audits on.");
       await reload();
@@ -336,23 +360,13 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
       }
       return;
     }
-    await enable();
-  }, [auto, enable, reload]);
-
-  const onNotifyToggle = useCallback(async () => {
-    const requested = !notify;
-    setBusy(true);
-    try {
-      const res = await setAuditNotifyAction(requested);
-      setNotify(res.notify);
-      setView((v) => (v ? { ...v, notify: res.notify } : v));
-      toast(res.notify ? "system notifications on." : "system notifications off.");
-    } catch {
-      toast(`could not turn system notifications ${requested ? "on" : "off"}.`);
-    } finally {
-      setBusy(false);
+    // Turning it on needs somewhere to send the digest.
+    if (!signedIn) {
+      setAuthOpen(true);
+      return;
     }
-  }, [notify]);
+    await enable();
+  }, [auto, enable, reload, signedIn]);
 
   const commitInterval = useCallback(
     async (raw: number) => {
@@ -389,7 +403,7 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
     setBusy(true);
     try {
       await fetch("/api/auth/logout", { method: "POST" });
-      toast("signed out. scans and desktop notifications continue; email alerts pause.");
+      toast("signed out. scans continue; digests pause.");
       await reload();
     } catch {
       toast("could not sign out.");
@@ -520,9 +534,7 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                     </span>
                     <span className="set-dim">
                       {auto
-                        ? signedIn
-                          ? "scheduled scans are active; the latest masked leak is emailed."
-                          : "scheduled scans are active. add an email below for masked alerts."
+                        ? "you'll get an email only when a scan finds something."
                         : "off. nothing runs and nothing is sent."}
                     </span>
                   </div>
@@ -554,23 +566,6 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                   </span>
                 </div>
 
-                <div className="set-row set-row-main">
-                  <Toggle
-                    enabled={notify}
-                    disabled={busy || view === null}
-                    onChange={() => void onNotifyToggle()}
-                    label={notify ? "turn off system notifications" : "turn on system notifications"}
-                  />
-                  <div className="set-row-copy">
-                    <span className="set-strong">system notifications.</span>
-                    <span className="set-dim">
-                      {notify
-                        ? "on when a scheduled scan finds credentials."
-                        : "off. scheduled scans and email alerts continue."}
-                    </span>
-                  </div>
-                </div>
-
                 <div className="set-rule" />
 
                 <div className="set-row set-row-identity">
@@ -598,7 +593,7 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                     // from it at all.
                     <>
                       <span className="set-warn">
-                        signed out — scheduled scans continue; email alerts are paused.
+                        signed out — scans continue, digests are paused.
                       </span>
                       <button
                         type="button"
@@ -606,13 +601,13 @@ export default function SettingsClient({ initial }: { initial: ScheduledAuditVie
                         disabled={busy}
                         onClick={() => setAuthOpen(true)}
                       >
-                        add email alerts
+                        sign in to resume
                       </button>
                     </>
                   ) : (
                     <span className="set-dim">
-                      scans and system notifications work without an account.
-                      add email later if you want alerts in your inbox.
+                      turning this on asks for an email, so there is somewhere to
+                      send the report.
                     </span>
                   )}
                 </div>

package/.next/standalone/lib/auth/api-server-client.ts

@@ -253,49 +253,21 @@ export interface AuditReportBody {
     last_seen?: string;
     examples: string[];
   }[];
-  /**
-   * Credentials this machine found in its own transcripts.
-   *
-   * Optional on the wire, so a CLI newer than the api-server sends a field the
-   * server ignores rather than failing the whole report — the harmful counts
-   * are the older half of the contract and must keep arriving either way.
-   *
-   * Every field here is a mask, a label, a length or a location. There is no
-   * shape of this object that carries a secret, because the record it is built
-   * from never stores one: `recordLeaks` fingerprints at detection time and
-   * keeps only the masked rendering.
-   */
-  leaks?: {
-    id: string;
-    display: string;
-    label: string;
-    length: number;
-    attributed: boolean;
-    name: string | null;
-    confidence: string;
-    first_seen: string;
-    last_seen: string;
-    occurrences: number;
-    cli: string;
-    project: string;
-    mechanism: string;
-    direction: "input" | "result";
-  }[];
 }
 
 export interface AuditReportResult {
   report_id: string;
   /** Whether this report produced an email. */
   emailed: boolean;
-  /** `no_leak`, `cooldown`, `send_failed`, or null when mail went out. */
+  /** `below_threshold`, `cooldown`, `send_failed`, or null when mail went out. */
   reason: string | null;
   /**
    * Where the next window starts, per the SERVER.
    *
    * Persisted verbatim rather than computed locally. The server anchors it on
-   * the last DELIVERED alert, so a report held by the cooldown — or one whose
+   * the last DELIVERED digest, so a report held by the cooldown — or one whose
    * send failed — correctly leaves the watermark where it was, and its findings
-   * turn up in the next alert instead of falling into a gap. A machine that
+   * turn up in the next digest instead of falling into a gap. A machine that
    * lost `machine.json` also resyncs here rather than re-reporting from the
    * beginning of time.
    */
@@ -303,11 +275,11 @@ export interface AuditReportResult {
 }
 
 /**
- * Submit one scheduled scan's harmful findings and newest masked credential.
+ * Submit one scheduled scan's harmful findings.
  *
  * Called only by the audit child, and only on `--scheduled`. The destination
  * address is never sent: the api-server takes it from the access-token claims,
- * so a report cannot name where its email alert goes.
+ * so a report cannot name where its digest goes.
  */
 export async function submitAuditReport(
   accessToken: string,