Let the reviewer confirm a PDF export refused by a residual the text output has too

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.

[FWao]

The PDF exporter applies redactions by offset but verifies by global text search, so a redacted string sitting at a non-redacted offset killed the export — a kept physician's name matching the patient's, or a redacted phrase recurring where no detector flagged it. The text export already ships in that case (HIGH residual_identifier, status FAIL); only the PDF refused.

Residuals are now classified against the anonymized text output:

• also in the text output → refused with forceable: true, naming the passages → Trotzdem exportieren
• not in the text output, not locatable, or text under a drawn area → refused, always; force_export ignored

Native PDFs black out every occurrence, so this fires on the scanned rebuild.

The confirmation is per finding, not a mode: after an override re-run the export goes out unforced first and the earlier confirmation is re-applied only if it covers everything the new refusal names. The PDF panel keeps an amber notice while a forced export is on screen. Refusal body is now {detail, code, forceable, items, count}, detail unchanged.

Tests: 5 unit, 2 integration, 3 Vitest. Full gate green (ruff, pytest 391, npm run check, vitest, build, e2e 15). Docs: new When the check finds text you kept in docs/user-guide/export.md, plus docs/index.md, RISK_REGISTER.md S4 and AGENTS.md.