From 4d493af61f21def9a61b1ab031a7600b4d519ae0 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Sun, 11 Oct 2026 21:58:43 +0000
Subject: [PATCH 1/3] feat(report): collapse advisory corpus provenance in the
 HTML footer

vg report --format html left #advisory-corpus empty, so vulnerability
database provenance never appeared. The footer now records
extended.vulnerabilities source, advisory and package counts, and
severity counts after the finding tables, collapsed so those tables
stay first. An unreachable source does not print zero counts, and the
same artifact still produces the same HTML.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
---
 DOCS.md                               |   5 +-
 README.md                             |   2 +-
 src/reporting/formatters/html.test.ts | 119 +++++++++++++++++++++++++-
 src/reporting/formatters/html.ts      |  57 +++++++++---
 4 files changed, 167 insertions(+), 16 deletions(-)

diff --git a/DOCS.md b/DOCS.md
index def4288b..4a04432f 100644
--- a/DOCS.md
+++ b/DOCS.md
@@ -501,6 +501,7 @@ external files. The page opens with a summary:
 - Counts by severity for vulnerability findings and for security findings. A check that did not run stays "Not scanned" rather than a row of zeros. A check that finished with nothing to report shows zeros.
 - When a finding carries `details.fixedVersions`, how many of those findings name a fix.
 - Links to the full tables under the summary: vulnerabilities, security findings, and the other findings.
+- Advisory-database provenance is a collapsed footer after those tables (`#advisory-corpus`), not a banner above the findings. It reads `extended.vulnerabilities`: `source` (`osv`, `manifest`, `unreachable`, or `none`), `totalAdvisories`, how many `packages` are listed, and `severityCounts` (critical, high, moderate, low, unknown). The scan artifact does not store a separate corpus version; `source` is the recorded database (online OSV, or an offline package-version manifest). A missing vulnerability block says "Not scanned". `source: "unreachable"` does not print zero counts.
 
 The same artifact always produces the same page. Save it with a shell redirect:
 
@@ -596,7 +597,7 @@ When set:
 
 ##### HTML (`formatHtmlReport`)
 
-`vg report --format html` writes one self-contained page from the same artifact. It does not call the network and does not load external files. The page opens with the summary listed above (DriftScore, severity counts, a fix-available count when a finding carries `details.fixedVersions`, and links to the tables), then the full vulnerability, security, and other-finding tables. A check that did not run stays "Not scanned". A missing score is `n/a`. The same artifact always produces the same page.
+`vg report --format html` writes one self-contained page from the same artifact. It does not call the network and does not load external files. The page opens with the summary listed above (DriftScore, severity counts, a fix-available count when a finding carries `details.fixedVersions`, and links to the tables), then the full vulnerability, security, and other-finding tables. Advisory-database provenance is the collapsed `#advisory-corpus` footer after those tables: `extended.vulnerabilities.source`, the advisory count, the affected-package count, and severity counts. A check that did not run stays "Not scanned". A missing score is `n/a`. The same artifact always produces the same page.
 
 ##### Differences
 
@@ -609,7 +610,7 @@ When set:
 - DriftScore: Markdown puts the lower-is-better gloss in the opening cell. Text puts the score in **DriftScore Summary** without that gloss.
 - VCS: Markdown uses separate VCS, Branch, and Commit rows, and Commit requires `vcs.sha`. Text uses one line and can show `shortSha` without requiring `sha`.
 - Runtime wording: Markdown always says `major(s)`. Text says `major` or `majors`.
-- HTML is the browser page: the summary above, then the vulnerability, security, and other-finding tables. It does not print Markdown's recommended-standards section or the text inventory.
+- HTML is the browser page: the summary above, then the vulnerability, security, and other-finding tables, then the collapsed `#advisory-corpus` footer for advisory-database provenance. It does not print Markdown's recommended-standards section or the text inventory.
 
 ##### JSON
 
diff --git a/README.md b/README.md
index d4893a3b..811d6366 100644
--- a/README.md
+++ b/README.md
@@ -829,7 +829,7 @@ All HCS computation runs in an optional, separately-licensed engine module that
 | `vg evidence` | Signed, reproducible regulatory evidence — jurisdiction-neutral regimes (EU CRA first, DORA incident reporting too): `init`, `product`, `release`, `exposure`, `readiness`, `drill`, `watch`, `pack`, `verify`, `push`, `export` |
 | `vg fix` | Ranked, risk-tiered upgrade plans from the hosted planner — then apply the one you choose |
 | `vg init [path]` | Initialise config and `.vibgrate/` |
-| `vg report` | Render a saved scan artifact as text (default), Markdown, or JSON. There is no HTML report. Field coverage is in [DOCS.md](./DOCS.md#report-format-coverage) |
+| `vg report` | Render a saved scan artifact as text (default), Markdown, JSON, or HTML. HTML leads with the summary and finding tables; advisory-database provenance is the collapsed `#advisory-corpus` footer. Field coverage is in [DOCS.md](./DOCS.md#report-format-coverage) |
 | `vg review` | **Vibgrate Review** — architecture + security-control review of the current change, locally (`--in-place`, `--local`, `--loop`). Deterministic blast-radius findings from the code graph via `vg review findings-from-diff`; `vg review propose <id>` attaches a PatchIR dry-run (same `--base` / `--in-place` / `--diff`, `--findings`, or `.vibgrate/review-propose-handoff.json`). One decision (`pass` / `needs_review` / `fail` / `undetermined`) in a signed receipt (Ed25519 over the receipt digest; `vg review verify <receipt.json>` checks it offline); protected findings cannot be blessed into a pass. Reports change integrity, not a proof of security. Builds or refreshes the code map itself when it is missing or stale (`--no-auto-build` opts out) |
 | `vg sbom export` / `delta` / `vex` | Export CycloneDX/SPDX SBOM, diff two artifacts, or emit an OpenVEX document |
 | `vg scan [path]` | Scan for upgrade drift |
diff --git a/src/reporting/formatters/html.test.ts b/src/reporting/formatters/html.test.ts
index 96ab9deb..5ea86c92 100644
--- a/src/reporting/formatters/html.test.ts
+++ b/src/reporting/formatters/html.test.ts
@@ -48,6 +48,14 @@ function section(html: string, id: string): string {
   return html.slice(start, end);
 }
 
+function footer(html: string): string {
+  const start = html.indexOf(`<details id="${ADVISORY_CORPUS_FOOTER_ID}">`);
+  if (start < 0) throw new Error('missing advisory corpus footer');
+  const end = html.indexOf('</details>', start);
+  if (end < 0) throw new Error('unclosed advisory corpus footer');
+  return html.slice(start, end + '</details>'.length);
+}
+
 function sample(): ScanArtifact {
   return artifact({
     drift: {
@@ -174,10 +182,12 @@ describe('formatHtmlReport', () => {
     expect(html).toContain('href="#vulnerabilities"');
     expect(html).toContain('href="#security"');
     expect(html).toContain('href="#findings"');
+    expect(html).toContain(`href="#${ADVISORY_CORPUS_FOOTER_ID}"`);
     expect(html).toContain('id="summary"');
     expect(html).toContain('id="vulnerabilities"');
     expect(html).toContain('id="security"');
     expect(html).toContain('id="findings"');
+    expect(html).toContain(`id="${ADVISORY_CORPUS_FOOTER_ID}"`);
   });
 
   it('keeps the full finding tables, in stable order, under the summary', () => {
@@ -209,6 +219,11 @@ describe('formatHtmlReport', () => {
     expect(html).not.toContain('engine/1');
     expect(findings).not.toContain('GHSA-crit');
     expect(html.indexOf('id="summary"')).toBeLessThan(html.indexOf('id="vulnerabilities"'));
+    expect(html.indexOf('id="vulnerabilities"')).toBeLessThan(html.indexOf('id="security"'));
+    expect(html.indexOf('id="security"')).toBeLessThan(html.indexOf('id="findings"'));
+    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
+    expect(footer(html)).toContain('Not scanned');
+    expect(footer(html)).not.toContain('GHSA-crit');
   });
 
   it('escapes markup and redacts credential-shaped text', () => {
@@ -230,6 +245,9 @@ describe('formatHtmlReport', () => {
     expect(section(html, 'vulnerabilities')).toContain('Not scanned');
     expect(section(html, 'security')).toContain('Not scanned');
     expect(section(html, 'findings')).toContain('None');
+    expect(footer(html)).toContain('<p class="absent">Not scanned</p>');
+    expect(footer(html)).not.toContain('<dt>Advisories</dt>');
+    expect(footer(html)).not.toContain('critical');
   });
 
   it('renders real zeros when a vulnerability check finished with nothing to report', () => {
@@ -246,6 +264,12 @@ describe('formatHtmlReport', () => {
     expect(block(html, 'vuln-counts')).toContain('data-evaluated="yes"');
     expect(block(html, 'vuln-counts')).toContain('critical 0');
     expect(section(html, 'vulnerabilities')).toContain('None');
+    const foot = footer(html);
+    expect(foot).toContain('<dt>Source</dt><dd>none</dd>');
+    expect(foot).toContain('<dt>Advisories</dt><dd>0</dd>');
+    expect(foot).toContain('<dt>Packages</dt><dd>0</dd>');
+    expect(foot).toContain('<dt>Severity</dt><dd>critical 0, high 0, moderate 0, low 0, unknown 0</dd>');
+    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
   });
 
   it('leaves an unfinished vulnerability check blank instead of zero', () => {
@@ -261,6 +285,12 @@ describe('formatHtmlReport', () => {
     }));
     expect(block(html, 'vuln-counts')).toContain('Not scanned');
     expect(html).not.toContain('critical 0');
+    const foot = footer(html);
+    expect(foot).toContain('<dt>Source</dt><dd>unreachable</dd>');
+    expect(foot).not.toContain('<dt>Advisories</dt>');
+    expect(foot).not.toContain('<dt>Packages</dt>');
+    expect(foot).not.toContain('<dt>Severity</dt>');
+    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
   });
 
   it('shows a zero fix rollup when the field is present and no version is listed', () => {
@@ -292,9 +322,94 @@ describe('formatHtmlReport', () => {
     expect(again).not.toMatch(/<script/i);
     expect(again).not.toMatch(/<link[\s>]/i);
     expect(again).not.toMatch(/\ssrc\s*=/i);
-    expect(again).not.toMatch(/<details/i);
+    expect(again).not.toMatch(/<details[^>]*\sopen\b/i);
     expect(again).not.toMatch(/fix available only/i);
-    expect(again).toContain(`<div id="${ADVISORY_CORPUS_FOOTER_ID}" hidden></div>`);
+    expect(again).not.toMatch(/class="banner"/);
+    expect(footer(again)).toBe(
+      `<details id="${ADVISORY_CORPUS_FOOTER_ID}">\n<summary>Advisory data</summary>\n<p class="absent">Not scanned</p>\n</details>`,
+    );
     expect(again.startsWith('<!doctype html>')).toBe(true);
   });
+
+  it('records advisory source and counts in a collapsed footer after the tables', () => {
+    const html = formatHtmlReport(artifact({
+      extended: {
+        vulnerabilities: {
+          source: 'manifest',
+          packages: [
+            { ecosystem: 'pypi', package: 'aaa', version: '1.0.0', advisories: [] },
+            { ecosystem: 'npm', package: 'zzz', version: '2.0.0', advisories: [] },
+          ],
+          totalAdvisories: 3,
+          severityCounts: { unknown: 0, low: 1, moderate: 0, high: 2, critical: 0 },
+        },
+      },
+    }));
+    const foot = footer(html);
+    expect(html.indexOf('id="summary"')).toBeLessThan(html.indexOf('id="vulnerabilities"'));
+    expect(html.indexOf('id="vulnerabilities"')).toBeLessThan(html.indexOf('id="security"'));
+    expect(html.indexOf('id="security"')).toBeLessThan(html.indexOf('id="findings"'));
+    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
+    expect(foot.startsWith(`<details id="${ADVISORY_CORPUS_FOOTER_ID}">`)).toBe(true);
+    expect(foot).not.toMatch(/\sopen\b/);
+    expect(foot).toContain('<dt>Source</dt><dd>manifest</dd>');
+    expect(foot).toContain('<dt>Advisories</dt><dd>3</dd>');
+    expect(foot).toContain('<dt>Packages</dt><dd>2</dd>');
+    expect(foot).toContain('<dt>Severity</dt><dd>critical 0, high 2, moderate 0, low 1, unknown 0</dd>');
+    expect(foot.indexOf('<dt>Source</dt>')).toBeLessThan(foot.indexOf('<dt>Advisories</dt>'));
+    expect(foot.indexOf('<dt>Advisories</dt>')).toBeLessThan(foot.indexOf('<dt>Packages</dt>'));
+    expect(foot.indexOf('<dt>Packages</dt>')).toBeLessThan(foot.indexOf('<dt>Severity</dt>'));
+    expect(foot).not.toContain('aaa');
+    expect(foot).not.toContain('zzz');
+    expect(foot).not.toContain('<h2');
+    expect(foot).not.toContain('class="banner"');
+  });
+
+  it('keeps the advisory footer byte-stable when package and severity key order change', () => {
+    const scanned = artifact({
+      extended: {
+        vulnerabilities: {
+          source: 'osv',
+          packages: [
+            { ecosystem: 'npm', package: 'left-pad', version: '1.0.0', advisories: [] },
+            { ecosystem: 'npm', package: 'lodash', version: '4.17.21', advisories: [] },
+          ],
+          totalAdvisories: 0,
+          severityCounts: { low: 0, moderate: 0, high: 0, critical: 0, unknown: 0 },
+        },
+      },
+    });
+    const flipped = structuredClone(scanned);
+    flipped.extended!.vulnerabilities!.packages.reverse();
+    flipped.extended!.vulnerabilities!.severityCounts = {
+      unknown: 0,
+      critical: 0,
+      low: 0,
+      high: 0,
+      moderate: 0,
+    };
+    const html = formatHtmlReport(scanned);
+    expect(formatHtmlReport(flipped)).toBe(html);
+    expect(footer(html)).toContain('<dt>Source</dt><dd>osv</dd>');
+    expect(footer(html)).toContain('<dt>Advisories</dt><dd>0</dd>');
+    expect(footer(html)).toContain('<dt>Packages</dt><dd>2</dd>');
+    expect(footer(html)).toContain('critical 0, high 0, moderate 0, low 0, unknown 0');
+  });
+
+  it('escapes and redacts advisory source text in the footer', () => {
+    const html = formatHtmlReport(artifact({
+      extended: {
+        vulnerabilities: {
+          source: `manifest <b>${TOKEN}</b>` as 'manifest',
+          packages: [],
+          totalAdvisories: 1,
+          severityCounts: { low: 0, moderate: 0, high: 0, critical: 0, unknown: 0 },
+        },
+      },
+    }));
+    const foot = footer(html);
+    expect(foot).toContain('manifest &lt;b&gt;[REDACTED]&lt;/b&gt;');
+    expect(foot).not.toContain(TOKEN);
+    expect(foot).not.toContain('<b>');
+  });
 });
diff --git a/src/reporting/formatters/html.ts b/src/reporting/formatters/html.ts
index e1c98703..f1112407 100644
--- a/src/reporting/formatters/html.ts
+++ b/src/reporting/formatters/html.ts
@@ -9,19 +9,22 @@ import type { Finding, ScanArtifact } from '../types.js';
  * Pure function of the artifact: stable sorts, no clock, no randomness, no
  * network, no external assets. Artifact strings are redacted, then escaped.
  *
- * Stable ids: `#summary`, `#vulnerabilities`, `#security`, `#findings`.
+ * Stable ids: `#summary`, `#vulnerabilities`, `#security`, `#findings`,
+ * `#advisory-corpus`.
  *
- * Two extension points, unused today:
- * - Rows carry {@link FIX_AVAILABLE_ATTR} so a client-side "fix available
- *   only" filter can be added without changing the row model.
- * - {@link advisoryCorpusFooter} emits an empty `#advisory-corpus` mount for
- *   a later collapsible advisory-corpus metadata footer.
+ * Rows carry {@link FIX_AVAILABLE_ATTR} so a client-side "fix available
+ * only" filter can be added without changing the row model.
+ * {@link advisoryCorpusFooter} is a collapsed footer after the finding
+ * tables. It records advisory-database provenance already stored on
+ * `extended.vulnerabilities`: `source` (online OSV, offline manifest,
+ * unreachable, or none), advisory count, affected-package count, and
+ * severity counts. The artifact has no separate corpus-version field.
  */
 
 /** Row attribute a later "fix available only" filter can select on. */
 export const FIX_AVAILABLE_ATTR = 'data-fix-available';
 
-/** Element id reserved for a later advisory-corpus metadata footer. */
+/** Collapsed footer id for advisory-database provenance. */
 export const ADVISORY_CORPUS_FOOTER_ID = 'advisory-corpus';
 
 const VULN_RULE_ID = 'vibgrate/vulnerability';
@@ -75,6 +78,8 @@ export function formatHtmlReport(artifact: ScanArtifact): string {
   nav a { margin-right: 1rem; }
   a { color: inherit; }
   .absent { font-style: italic; }
+  #${ADVISORY_CORPUS_FOOTER_ID} { margin-top: 2.5rem; }
+  #${ADVISORY_CORPUS_FOOTER_ID} summary { font-weight: 600; }
 </style>
 </head>
 <body>
@@ -98,6 +103,7 @@ ${fix === null ? '' : `<p id="fix-available">Fix available: ${fix}</p>\n`}
 <a href="#vulnerabilities">Vulnerabilities</a>
 <a href="#security">Security</a>
 <a href="#findings">Findings</a>
+<a href="#${ADVISORY_CORPUS_FOOTER_ID}">Advisory data</a>
 </nav>
 </section>
 <section id="vulnerabilities">
@@ -112,15 +118,44 @@ ${securityEvaluated ? renderSecurityTable(securityRows) : '<p class="absent">Not
 <h2>Findings</h2>
 ${renderFindingTable(otherRows)}
 </section>
-${advisoryCorpusFooter()}
+${advisoryCorpusFooter(artifact)}
 </body>
 </html>
 `;
 }
 
-/** Empty mount. A later change can fill this with a collapsible footer. */
-function advisoryCorpusFooter(): string {
-  return `<div id="${ADVISORY_CORPUS_FOOTER_ID}" hidden></div>`;
+/**
+ * Collapsed provenance for the vulnerability database. Counts are a result
+ * only when `source` is not `unreachable` — a zero there would read as clean.
+ * Severity order is fixed, so object key order cannot change the bytes.
+ */
+function advisoryCorpusFooter(artifact: ScanArtifact): string {
+  const vulns = artifact.extended?.vulnerabilities;
+  const open = `<details id="${ADVISORY_CORPUS_FOOTER_ID}">\n<summary>Advisory data</summary>\n`;
+  if (!vulns) {
+    return `${open}<p class="absent">Not scanned</p>\n</details>`;
+  }
+  const rows = [`<dt>Source</dt><dd>${sourceText(vulns.source)}</dd>`];
+  if (vulns.source !== 'unreachable') {
+    rows.push(`<dt>Advisories</dt><dd>${scoreText(vulns.totalAdvisories)}</dd>`);
+    const packageCount = Array.isArray(vulns.packages) ? vulns.packages.length : undefined;
+    rows.push(`<dt>Packages</dt><dd>${scoreText(packageCount)}</dd>`);
+    rows.push(`<dt>Severity</dt><dd>${severityLine(vulns.severityCounts)}</dd>`);
+  }
+  return `${open}<dl>\n${rows.join('\n')}\n</dl>\n</details>`;
+}
+
+function sourceText(value: unknown): string {
+  if (typeof value !== 'string' || value.trim() === '') return 'n/a';
+  return text(value.trim());
+}
+
+/** Fixed severity order. A missing count is `n/a`, never a fabricated zero. */
+function severityLine(counts: unknown): string {
+  const record = counts && typeof counts === 'object' && !Array.isArray(counts)
+    ? counts as Record<string, unknown>
+    : {};
+  return VULN_SEVERITIES.map((name) => `${name} ${scoreText(record[name])}`).join(', ');
 }
 
 function vulnerabilityEvaluated(artifact: ScanArtifact, vulnFindings: Finding[]): boolean {

From e11ffeb918c7fe4e437c7bdbddfe8420b7820573 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 12 Oct 2026 07:05:09 +0000
Subject: [PATCH 2/3] feat(report): collapse advisory corpus provenance in the
 HTML footer

The HTML report names the recorded advisory source and count in a
collapsed footer after the finding tables. A missing source stays
Not scanned, Not checked, or Not recorded, and a missing count is
omitted.

Closes #245

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
---
 DOCS.md                               |   6 +-
 README.md                             |   2 +-
 src/reporting/formatters/html.test.ts | 192 +++++++++++---------------
 src/reporting/formatters/html.ts      | 115 ++++++++++-----
 4 files changed, 163 insertions(+), 152 deletions(-)

diff --git a/DOCS.md b/DOCS.md
index 4a04432f..8da277ae 100644
--- a/DOCS.md
+++ b/DOCS.md
@@ -500,8 +500,8 @@ external files. The page opens with a summary:
 - DriftScore and the four component scores. A missing score is `n/a`. A measured `0` stays `0`.
 - Counts by severity for vulnerability findings and for security findings. A check that did not run stays "Not scanned" rather than a row of zeros. A check that finished with nothing to report shows zeros.
 - When a finding carries `details.fixedVersions`, how many of those findings name a fix.
+- A collapsed footer after the tables names the advisory source when the artifact records one: OSV, an offline package-version manifest, or no packages to check. The advisory count is included when it is present, and a finished check with nothing to report shows 0. A check that did not run says "Not scanned". A check that could not reach its source says "Not checked" and omits the count. Findings with no recorded source say "Not recorded".
 - Links to the full tables under the summary: vulnerabilities, security findings, and the other findings.
-- Advisory-database provenance is a collapsed footer after those tables (`#advisory-corpus`), not a banner above the findings. It reads `extended.vulnerabilities`: `source` (`osv`, `manifest`, `unreachable`, or `none`), `totalAdvisories`, how many `packages` are listed, and `severityCounts` (critical, high, moderate, low, unknown). The scan artifact does not store a separate corpus version; `source` is the recorded database (online OSV, or an offline package-version manifest). A missing vulnerability block says "Not scanned". `source: "unreachable"` does not print zero counts.
 
 The same artifact always produces the same page. Save it with a shell redirect:
 
@@ -597,7 +597,7 @@ When set:
 
 ##### HTML (`formatHtmlReport`)
 
-`vg report --format html` writes one self-contained page from the same artifact. It does not call the network and does not load external files. The page opens with the summary listed above (DriftScore, severity counts, a fix-available count when a finding carries `details.fixedVersions`, and links to the tables), then the full vulnerability, security, and other-finding tables. Advisory-database provenance is the collapsed `#advisory-corpus` footer after those tables: `extended.vulnerabilities.source`, the advisory count, the affected-package count, and severity counts. A check that did not run stays "Not scanned". A missing score is `n/a`. The same artifact always produces the same page.
+`vg report --format html` writes one self-contained page from the same artifact. It does not call the network and does not load external files. The page opens with the summary listed above (DriftScore, severity counts, a fix-available count when a finding carries `details.fixedVersions`, and links to the tables), then the full vulnerability, security, and other-finding tables. A check that did not run stays "Not scanned". A missing score is `n/a`. A collapsed footer after the tables names the advisory source (OSV, an offline package-version manifest, or no packages to check) and the advisory count when that count is present. A missing source stays "Not scanned", "Not checked", or "Not recorded", and a missing count is left out rather than shown as 0. The same artifact always produces the same page.
 
 ##### Differences
 
@@ -610,7 +610,7 @@ When set:
 - DriftScore: Markdown puts the lower-is-better gloss in the opening cell. Text puts the score in **DriftScore Summary** without that gloss.
 - VCS: Markdown uses separate VCS, Branch, and Commit rows, and Commit requires `vcs.sha`. Text uses one line and can show `shortSha` without requiring `sha`.
 - Runtime wording: Markdown always says `major(s)`. Text says `major` or `majors`.
-- HTML is the browser page: the summary above, then the vulnerability, security, and other-finding tables, then the collapsed `#advisory-corpus` footer for advisory-database provenance. It does not print Markdown's recommended-standards section or the text inventory.
+- HTML is the browser page: the summary above, then the vulnerability, security, and other-finding tables, then a collapsed advisory-data footer. It does not print Markdown's recommended-standards section or the text inventory. Text's closing line is the scan time and file counts. Markdown has no advisory-source line.
 
 ##### JSON
 
diff --git a/README.md b/README.md
index 811d6366..d4893a3b 100644
--- a/README.md
+++ b/README.md
@@ -829,7 +829,7 @@ All HCS computation runs in an optional, separately-licensed engine module that
 | `vg evidence` | Signed, reproducible regulatory evidence — jurisdiction-neutral regimes (EU CRA first, DORA incident reporting too): `init`, `product`, `release`, `exposure`, `readiness`, `drill`, `watch`, `pack`, `verify`, `push`, `export` |
 | `vg fix` | Ranked, risk-tiered upgrade plans from the hosted planner — then apply the one you choose |
 | `vg init [path]` | Initialise config and `.vibgrate/` |
-| `vg report` | Render a saved scan artifact as text (default), Markdown, JSON, or HTML. HTML leads with the summary and finding tables; advisory-database provenance is the collapsed `#advisory-corpus` footer. Field coverage is in [DOCS.md](./DOCS.md#report-format-coverage) |
+| `vg report` | Render a saved scan artifact as text (default), Markdown, or JSON. There is no HTML report. Field coverage is in [DOCS.md](./DOCS.md#report-format-coverage) |
 | `vg review` | **Vibgrate Review** — architecture + security-control review of the current change, locally (`--in-place`, `--local`, `--loop`). Deterministic blast-radius findings from the code graph via `vg review findings-from-diff`; `vg review propose <id>` attaches a PatchIR dry-run (same `--base` / `--in-place` / `--diff`, `--findings`, or `.vibgrate/review-propose-handoff.json`). One decision (`pass` / `needs_review` / `fail` / `undetermined`) in a signed receipt (Ed25519 over the receipt digest; `vg review verify <receipt.json>` checks it offline); protected findings cannot be blessed into a pass. Reports change integrity, not a proof of security. Builds or refreshes the code map itself when it is missing or stale (`--no-auto-build` opts out) |
 | `vg sbom export` / `delta` / `vex` | Export CycloneDX/SPDX SBOM, diff two artifacts, or emit an OpenVEX document |
 | `vg scan [path]` | Scan for upgrade drift |
diff --git a/src/reporting/formatters/html.test.ts b/src/reporting/formatters/html.test.ts
index 5ea86c92..a6ce573c 100644
--- a/src/reporting/formatters/html.test.ts
+++ b/src/reporting/formatters/html.test.ts
@@ -49,11 +49,22 @@ function section(html: string, id: string): string {
 }
 
 function footer(html: string): string {
-  const start = html.indexOf(`<details id="${ADVISORY_CORPUS_FOOTER_ID}">`);
-  if (start < 0) throw new Error('missing advisory corpus footer');
-  const end = html.indexOf('</details>', start);
-  if (end < 0) throw new Error('unclosed advisory corpus footer');
-  return html.slice(start, end + '</details>'.length);
+  const start = html.indexOf(`<footer id="${ADVISORY_CORPUS_FOOTER_ID}">`);
+  const end = html.indexOf('</footer>', start);
+  if (start < 0 || end < 0) throw new Error('missing advisory footer');
+  return html.slice(start, end + '</footer>'.length);
+}
+
+function vulnResult(
+  source: 'osv' | 'manifest' | 'unreachable' | 'none',
+  totalAdvisories: number,
+): NonNullable<ScanArtifact['extended']>['vulnerabilities'] {
+  return {
+    source,
+    packages: [],
+    totalAdvisories,
+    severityCounts: { low: 0, moderate: 0, high: 0, critical: 0, unknown: 0 },
+  };
 }
 
 function sample(): ScanArtifact {
@@ -182,12 +193,10 @@ describe('formatHtmlReport', () => {
     expect(html).toContain('href="#vulnerabilities"');
     expect(html).toContain('href="#security"');
     expect(html).toContain('href="#findings"');
-    expect(html).toContain(`href="#${ADVISORY_CORPUS_FOOTER_ID}"`);
     expect(html).toContain('id="summary"');
     expect(html).toContain('id="vulnerabilities"');
     expect(html).toContain('id="security"');
     expect(html).toContain('id="findings"');
-    expect(html).toContain(`id="${ADVISORY_CORPUS_FOOTER_ID}"`);
   });
 
   it('keeps the full finding tables, in stable order, under the summary', () => {
@@ -219,11 +228,6 @@ describe('formatHtmlReport', () => {
     expect(html).not.toContain('engine/1');
     expect(findings).not.toContain('GHSA-crit');
     expect(html.indexOf('id="summary"')).toBeLessThan(html.indexOf('id="vulnerabilities"'));
-    expect(html.indexOf('id="vulnerabilities"')).toBeLessThan(html.indexOf('id="security"'));
-    expect(html.indexOf('id="security"')).toBeLessThan(html.indexOf('id="findings"'));
-    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
-    expect(footer(html)).toContain('Not scanned');
-    expect(footer(html)).not.toContain('GHSA-crit');
   });
 
   it('escapes markup and redacts credential-shaped text', () => {
@@ -245,9 +249,9 @@ describe('formatHtmlReport', () => {
     expect(section(html, 'vulnerabilities')).toContain('Not scanned');
     expect(section(html, 'security')).toContain('Not scanned');
     expect(section(html, 'findings')).toContain('None');
-    expect(footer(html)).toContain('<p class="absent">Not scanned</p>');
-    expect(footer(html)).not.toContain('<dt>Advisories</dt>');
-    expect(footer(html)).not.toContain('critical');
+    expect(block(html, 'advisory-source')).toBe('<p id="advisory-source" class="absent">Not scanned</p>');
+    expect(footer(html)).toContain('<summary>Advisory data: Not scanned</summary>');
+    expect(footer(html)).not.toContain('id="advisory-count"');
   });
 
   it('renders real zeros when a vulnerability check finished with nothing to report', () => {
@@ -264,12 +268,9 @@ describe('formatHtmlReport', () => {
     expect(block(html, 'vuln-counts')).toContain('data-evaluated="yes"');
     expect(block(html, 'vuln-counts')).toContain('critical 0');
     expect(section(html, 'vulnerabilities')).toContain('None');
-    const foot = footer(html);
-    expect(foot).toContain('<dt>Source</dt><dd>none</dd>');
-    expect(foot).toContain('<dt>Advisories</dt><dd>0</dd>');
-    expect(foot).toContain('<dt>Packages</dt><dd>0</dd>');
-    expect(foot).toContain('<dt>Severity</dt><dd>critical 0, high 0, moderate 0, low 0, unknown 0</dd>');
-    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
+    expect(block(html, 'advisory-source')).toBe('<dd id="advisory-source">No packages to check</dd>');
+    expect(block(html, 'advisory-count')).toBe('<dd id="advisory-count">0</dd>');
+    expect(footer(html)).toContain('<summary>Advisory data: No packages to check, 0 advisories</summary>');
   });
 
   it('leaves an unfinished vulnerability check blank instead of zero', () => {
@@ -285,12 +286,10 @@ describe('formatHtmlReport', () => {
     }));
     expect(block(html, 'vuln-counts')).toContain('Not scanned');
     expect(html).not.toContain('critical 0');
-    const foot = footer(html);
-    expect(foot).toContain('<dt>Source</dt><dd>unreachable</dd>');
-    expect(foot).not.toContain('<dt>Advisories</dt>');
-    expect(foot).not.toContain('<dt>Packages</dt>');
-    expect(foot).not.toContain('<dt>Severity</dt>');
-    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
+    expect(block(html, 'advisory-source')).toBe('<p id="advisory-source" class="absent">Not checked</p>');
+    expect(footer(html)).toContain('<summary>Advisory data: Not checked</summary>');
+    expect(footer(html)).not.toContain('id="advisory-count"');
+    expect(footer(html)).not.toContain('0 advisories');
   });
 
   it('shows a zero fix rollup when the field is present and no version is listed', () => {
@@ -308,6 +307,54 @@ describe('formatHtmlReport', () => {
     expect(block(html, 'fix-available')).toBe('<p id="fix-available">Fix available: 0</p>');
   });
 
+  it('names a finished advisory source and keeps a missing total absent', () => {
+    const osv = formatHtmlReport(artifact({
+      findings: [{
+        ruleId: 'vibgrate/vulnerability',
+        level: 'error',
+        message: 'critical row',
+        location: 'left-pad',
+        details: { severity: 'critical', package: 'left-pad', advisoryId: 'GHSA-crit' },
+      }],
+      extended: { vulnerabilities: vulnResult('osv', 1) },
+    }));
+    expect(footer(osv)).toContain('<summary>Advisory data: OSV, 1 advisory</summary>');
+    expect(block(osv, 'advisory-source')).toBe('<dd id="advisory-source">OSV</dd>');
+    expect(block(osv, 'advisory-count')).toBe('<dd id="advisory-count">1</dd>');
+
+    const manifest = formatHtmlReport(artifact({
+      extended: { vulnerabilities: vulnResult('manifest', 2) },
+    }));
+    expect(block(manifest, 'advisory-source')).toBe('<dd id="advisory-source">Offline package-version manifest</dd>');
+    expect(block(manifest, 'advisory-count')).toBe('<dd id="advisory-count">2</dd>');
+
+    const missingTotal = vulnResult('osv', 0);
+    delete (missingTotal as { totalAdvisories?: number }).totalAdvisories;
+    const omitted = formatHtmlReport(artifact({ extended: { vulnerabilities: missingTotal } }));
+    expect(footer(omitted)).toContain('<summary>Advisory data: OSV</summary>');
+    expect(footer(omitted)).not.toContain('id="advisory-count"');
+    expect(footer(omitted)).not.toContain('0 advisories');
+  });
+
+  it('does not echo an unknown advisory source', () => {
+    const hostile = `<img src=x onerror=alert(1)> ${TOKEN}`;
+    const recorded = vulnResult('osv', 4);
+    (recorded as { source: string }).source = hostile;
+    const html = formatHtmlReport(artifact({ extended: { vulnerabilities: recorded } }));
+    expect(block(html, 'advisory-source')).toBe('<p id="advisory-source" class="absent">Not scanned</p>');
+    expect(html).not.toContain(TOKEN);
+    expect(html).not.toContain('<img');
+    expect(html).not.toContain('onerror');
+    expect(footer(html)).not.toContain('4');
+  });
+
+  it('says the advisory source was not recorded when findings have no source', () => {
+    const html = formatHtmlReport(sample());
+    expect(block(html, 'advisory-source')).toBe('<p id="advisory-source" class="absent">Not recorded</p>');
+    expect(footer(html)).not.toContain('id="advisory-count"');
+    expect(html.indexOf('id="findings"')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
+  });
+
   it('is deterministic and does not embed a timestamp, a script, or external assets', () => {
     const first = sample();
     const again = formatHtmlReport(first);
@@ -322,94 +369,11 @@ describe('formatHtmlReport', () => {
     expect(again).not.toMatch(/<script/i);
     expect(again).not.toMatch(/<link[\s>]/i);
     expect(again).not.toMatch(/\ssrc\s*=/i);
-    expect(again).not.toMatch(/<details[^>]*\sopen\b/i);
+    expect(again.match(/<details/gi)).toEqual(['<details']);
+    expect(again).not.toMatch(/<details[^>]*\bopen\b/i);
     expect(again).not.toMatch(/fix available only/i);
-    expect(again).not.toMatch(/class="banner"/);
-    expect(footer(again)).toBe(
-      `<details id="${ADVISORY_CORPUS_FOOTER_ID}">\n<summary>Advisory data</summary>\n<p class="absent">Not scanned</p>\n</details>`,
-    );
+    expect(footer(again)).toContain(`<footer id="${ADVISORY_CORPUS_FOOTER_ID}">`);
+    expect(footer(again)).toContain('<summary>Advisory data: Not recorded</summary>');
     expect(again.startsWith('<!doctype html>')).toBe(true);
   });
-
-  it('records advisory source and counts in a collapsed footer after the tables', () => {
-    const html = formatHtmlReport(artifact({
-      extended: {
-        vulnerabilities: {
-          source: 'manifest',
-          packages: [
-            { ecosystem: 'pypi', package: 'aaa', version: '1.0.0', advisories: [] },
-            { ecosystem: 'npm', package: 'zzz', version: '2.0.0', advisories: [] },
-          ],
-          totalAdvisories: 3,
-          severityCounts: { unknown: 0, low: 1, moderate: 0, high: 2, critical: 0 },
-        },
-      },
-    }));
-    const foot = footer(html);
-    expect(html.indexOf('id="summary"')).toBeLessThan(html.indexOf('id="vulnerabilities"'));
-    expect(html.indexOf('id="vulnerabilities"')).toBeLessThan(html.indexOf('id="security"'));
-    expect(html.indexOf('id="security"')).toBeLessThan(html.indexOf('id="findings"'));
-    expect(html.lastIndexOf('</section>')).toBeLessThan(html.indexOf(`id="${ADVISORY_CORPUS_FOOTER_ID}"`));
-    expect(foot.startsWith(`<details id="${ADVISORY_CORPUS_FOOTER_ID}">`)).toBe(true);
-    expect(foot).not.toMatch(/\sopen\b/);
-    expect(foot).toContain('<dt>Source</dt><dd>manifest</dd>');
-    expect(foot).toContain('<dt>Advisories</dt><dd>3</dd>');
-    expect(foot).toContain('<dt>Packages</dt><dd>2</dd>');
-    expect(foot).toContain('<dt>Severity</dt><dd>critical 0, high 2, moderate 0, low 1, unknown 0</dd>');
-    expect(foot.indexOf('<dt>Source</dt>')).toBeLessThan(foot.indexOf('<dt>Advisories</dt>'));
-    expect(foot.indexOf('<dt>Advisories</dt>')).toBeLessThan(foot.indexOf('<dt>Packages</dt>'));
-    expect(foot.indexOf('<dt>Packages</dt>')).toBeLessThan(foot.indexOf('<dt>Severity</dt>'));
-    expect(foot).not.toContain('aaa');
-    expect(foot).not.toContain('zzz');
-    expect(foot).not.toContain('<h2');
-    expect(foot).not.toContain('class="banner"');
-  });
-
-  it('keeps the advisory footer byte-stable when package and severity key order change', () => {
-    const scanned = artifact({
-      extended: {
-        vulnerabilities: {
-          source: 'osv',
-          packages: [
-            { ecosystem: 'npm', package: 'left-pad', version: '1.0.0', advisories: [] },
-            { ecosystem: 'npm', package: 'lodash', version: '4.17.21', advisories: [] },
-          ],
-          totalAdvisories: 0,
-          severityCounts: { low: 0, moderate: 0, high: 0, critical: 0, unknown: 0 },
-        },
-      },
-    });
-    const flipped = structuredClone(scanned);
-    flipped.extended!.vulnerabilities!.packages.reverse();
-    flipped.extended!.vulnerabilities!.severityCounts = {
-      unknown: 0,
-      critical: 0,
-      low: 0,
-      high: 0,
-      moderate: 0,
-    };
-    const html = formatHtmlReport(scanned);
-    expect(formatHtmlReport(flipped)).toBe(html);
-    expect(footer(html)).toContain('<dt>Source</dt><dd>osv</dd>');
-    expect(footer(html)).toContain('<dt>Advisories</dt><dd>0</dd>');
-    expect(footer(html)).toContain('<dt>Packages</dt><dd>2</dd>');
-    expect(footer(html)).toContain('critical 0, high 0, moderate 0, low 0, unknown 0');
-  });
-
-  it('escapes and redacts advisory source text in the footer', () => {
-    const html = formatHtmlReport(artifact({
-      extended: {
-        vulnerabilities: {
-          source: `manifest <b>${TOKEN}</b>` as 'manifest',
-          packages: [],
-          totalAdvisories: 1,
-          severityCounts: { low: 0, moderate: 0, high: 0, critical: 0, unknown: 0 },
-        },
-      },
-    }));
-    const foot = footer(html);
-    expect(foot).toContain('manifest &lt;b&gt;[REDACTED]&lt;/b&gt;');
-    expect(foot).not.toContain(TOKEN);
-    expect(foot).not.toContain('<b>');
-  });
 });
diff --git a/src/reporting/formatters/html.ts b/src/reporting/formatters/html.ts
index f1112407..ab2ec997 100644
--- a/src/reporting/formatters/html.ts
+++ b/src/reporting/formatters/html.ts
@@ -12,19 +12,19 @@ import type { Finding, ScanArtifact } from '../types.js';
  * Stable ids: `#summary`, `#vulnerabilities`, `#security`, `#findings`,
  * `#advisory-corpus`.
  *
- * Rows carry {@link FIX_AVAILABLE_ATTR} so a client-side "fix available
- * only" filter can be added without changing the row model.
- * {@link advisoryCorpusFooter} is a collapsed footer after the finding
- * tables. It records advisory-database provenance already stored on
- * `extended.vulnerabilities`: `source` (online OSV, offline manifest,
- * unreachable, or none), advisory count, affected-package count, and
- * severity counts. The artifact has no separate corpus-version field.
+ * Rows carry {@link FIX_AVAILABLE_ATTR} so a client-side "fix available only"
+ * filter can be added without changing the row model. That filter is unused.
+ *
+ * {@link advisoryCorpusFooter} fills `#advisory-corpus` with a collapsed
+ * footer. It names the advisory source recorded on the artifact, and it says
+ * "Not scanned", "Not checked", or "Not recorded" when that fact is absent.
+ * A missing advisory total is omitted rather than printed as zero.
  */
 
 /** Row attribute a later "fix available only" filter can select on. */
 export const FIX_AVAILABLE_ATTR = 'data-fix-available';
 
-/** Collapsed footer id for advisory-database provenance. */
+/** Element id of the collapsed advisory-data footer. */
 export const ADVISORY_CORPUS_FOOTER_ID = 'advisory-corpus';
 
 const VULN_RULE_ID = 'vibgrate/vulnerability';
@@ -78,8 +78,8 @@ export function formatHtmlReport(artifact: ScanArtifact): string {
   nav a { margin-right: 1rem; }
   a { color: inherit; }
   .absent { font-style: italic; }
-  #${ADVISORY_CORPUS_FOOTER_ID} { margin-top: 2.5rem; }
-  #${ADVISORY_CORPUS_FOOTER_ID} summary { font-weight: 600; }
+  #${ADVISORY_CORPUS_FOOTER_ID} { margin-top: 2.5rem; font-size: 0.85rem; }
+  #${ADVISORY_CORPUS_FOOTER_ID} summary { cursor: pointer; }
 </style>
 </head>
 <body>
@@ -103,7 +103,6 @@ ${fix === null ? '' : `<p id="fix-available">Fix available: ${fix}</p>\n`}
 <a href="#vulnerabilities">Vulnerabilities</a>
 <a href="#security">Security</a>
 <a href="#findings">Findings</a>
-<a href="#${ADVISORY_CORPUS_FOOTER_ID}">Advisory data</a>
 </nav>
 </section>
 <section id="vulnerabilities">
@@ -124,38 +123,86 @@ ${advisoryCorpusFooter(artifact)}
 `;
 }
 
+const ADVISORY_SOURCES = ['osv', 'manifest', 'unreachable', 'none'] as const;
+type AdvisorySourceName = (typeof ADVISORY_SOURCES)[number];
+
+const ADVISORY_SOURCE_LABEL: Record<AdvisorySourceName, string> = {
+  osv: 'OSV',
+  manifest: 'Offline package-version manifest',
+  unreachable: 'Not checked',
+  none: 'No packages to check',
+};
+
 /**
- * Collapsed provenance for the vulnerability database. Counts are a result
- * only when `source` is not `unreachable` — a zero there would read as clean.
- * Severity order is fixed, so object key order cannot change the bytes.
+ * Collapsed footer. Closed by default so the finding tables stay first.
+ * Known sources are the only strings copied from the artifact. An unknown
+ * source value is not echoed.
  */
 function advisoryCorpusFooter(artifact: ScanArtifact): string {
-  const vulns = artifact.extended?.vulnerabilities;
-  const open = `<details id="${ADVISORY_CORPUS_FOOTER_ID}">\n<summary>Advisory data</summary>\n`;
-  if (!vulns) {
-    return `${open}<p class="absent">Not scanned</p>\n</details>`;
+  const view = advisoryCorpusView(artifact);
+  const summary = view.count === null
+    ? `Advisory data: ${view.label}`
+    : `Advisory data: ${view.label}, ${advisoryCountPhrase(view.count)}`;
+  const body = view.absent
+    ? `<p id="advisory-source" class="absent">${text(view.label)}</p>`
+    : advisoryCorpusList(view.label, view.count);
+  return `<footer id="${ADVISORY_CORPUS_FOOTER_ID}">
+<details>
+<summary>${text(summary)}</summary>
+${body}
+</details>
+</footer>`;
+}
+
+function advisoryCorpusList(label: string, count: number | null): string {
+  const countRow = count === null
+    ? ''
+    : `<dt>Advisories</dt><dd id="advisory-count">${count}</dd>\n`;
+  return `<dl>
+<dt>Source</dt><dd id="advisory-source">${text(label)}</dd>
+${countRow}</dl>`;
+}
+
+interface AdvisoryCorpusView {
+  label: string;
+  /** Null when the artifact does not record a finished total. Never a stand-in zero. */
+  count: number | null;
+  absent: boolean;
+}
+
+function advisoryCorpusView(artifact: ScanArtifact): AdvisoryCorpusView {
+  const recorded = artifact.extended?.vulnerabilities;
+  const source = advisorySourceName(recorded?.source);
+  if (source === 'unreachable') {
+    return { label: ADVISORY_SOURCE_LABEL.unreachable, count: null, absent: true };
+  }
+  if (source === 'osv' || source === 'manifest' || source === 'none') {
+    return {
+      label: ADVISORY_SOURCE_LABEL[source],
+      count: advisoryTotal(recorded?.totalAdvisories),
+      absent: false,
+    };
   }
-  const rows = [`<dt>Source</dt><dd>${sourceText(vulns.source)}</dd>`];
-  if (vulns.source !== 'unreachable') {
-    rows.push(`<dt>Advisories</dt><dd>${scoreText(vulns.totalAdvisories)}</dd>`);
-    const packageCount = Array.isArray(vulns.packages) ? vulns.packages.length : undefined;
-    rows.push(`<dt>Packages</dt><dd>${scoreText(packageCount)}</dd>`);
-    rows.push(`<dt>Severity</dt><dd>${severityLine(vulns.severityCounts)}</dd>`);
+  const findings = Array.isArray(artifact.findings) ? artifact.findings : [];
+  if (findings.some((finding) => finding.ruleId === VULN_RULE_ID)) {
+    return { label: 'Not recorded', count: null, absent: true };
   }
-  return `${open}<dl>\n${rows.join('\n')}\n</dl>\n</details>`;
+  return { label: 'Not scanned', count: null, absent: true };
 }
 
-function sourceText(value: unknown): string {
-  if (typeof value !== 'string' || value.trim() === '') return 'n/a';
-  return text(value.trim());
+function advisorySourceName(value: unknown): AdvisorySourceName | null {
+  if (typeof value !== 'string') return null;
+  return (ADVISORY_SOURCES as readonly string[]).includes(value) ? (value as AdvisorySourceName) : null;
+}
+
+/** A non-negative integer is a real total, including 0. Anything else is absent. */
+function advisoryTotal(value: unknown): number | null {
+  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) return null;
+  return value;
 }
 
-/** Fixed severity order. A missing count is `n/a`, never a fabricated zero. */
-function severityLine(counts: unknown): string {
-  const record = counts && typeof counts === 'object' && !Array.isArray(counts)
-    ? counts as Record<string, unknown>
-    : {};
-  return VULN_SEVERITIES.map((name) => `${name} ${scoreText(record[name])}`).join(', ');
+function advisoryCountPhrase(count: number): string {
+  return count === 1 ? '1 advisory' : `${count} advisories`;
 }
 
 function vulnerabilityEvaluated(artifact: ScanArtifact, vulnFindings: Finding[]): boolean {

From 1884e9e266d498f589c09b954f3338e727d86230 Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Mon, 12 Oct 2026 11:29:35 +0000
Subject: [PATCH 3/3] docs(report): place the advisory footer after the fix
 checkbox

Keep the collapsed advisory-source footer and the Fix available only
checkbox on the same page.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
---
 DOCS.md                               |  2 +-
 src/reporting/formatters/html.test.ts |  4 ++--
 src/reporting/formatters/html.ts      | 11 ++++++-----
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/DOCS.md b/DOCS.md
index 3bd9f4f9..55bd1896 100644
--- a/DOCS.md
+++ b/DOCS.md
@@ -502,9 +502,9 @@ external files. The page opens with a summary:
 - DriftScore and the four component scores. A missing score is `n/a`. A measured `0` stays `0`.
 - Counts by severity for vulnerability findings and for security findings. A check that did not run stays "Not scanned" rather than a row of zeros. A check that finished with nothing to report shows zeros.
 - When a finding carries `details.fixedVersions`, how many of those findings name a fix.
-- A collapsed footer after the tables names the advisory source when the artifact records one: OSV, an offline package-version manifest, or no packages to check. The advisory count is included when it is present, and a finished check with nothing to report shows 0. A check that did not run says "Not scanned". A check that could not reach its source says "Not checked" and omits the count. Findings with no recorded source say "Not recorded".
 - A **Fix available only** checkbox. It starts unchecked, so the tables show every finding. Checking it hides findings that do not name a fix version. The page file still contains every finding, and the checkbox does not call the network.
 - Links to the full tables under the summary: vulnerabilities, security findings, and the other findings.
+- A collapsed footer after the tables names the advisory source when the artifact records one: OSV, an offline package-version manifest, or no packages to check. The advisory count is included when it is present, and a finished check with nothing to report shows 0. A check that did not run says "Not scanned". A check that could not reach its source says "Not checked" and omits the count. Findings with no recorded source say "Not recorded".
 
 The same artifact always produces the same page. Save it with a shell redirect:
 
diff --git a/src/reporting/formatters/html.test.ts b/src/reporting/formatters/html.test.ts
index 465d6b9c..98bd66a1 100644
--- a/src/reporting/formatters/html.test.ts
+++ b/src/reporting/formatters/html.test.ts
@@ -396,10 +396,10 @@ describe('formatHtmlReport', () => {
     expect(again).not.toMatch(/\ssrc\s*=/i);
     expect(again.match(/<details/gi)).toEqual(['<details']);
     expect(again).not.toMatch(/<details[^>]*\bopen\b/i);
-    expect(again).toContain('Fix available only');
-    expect(again).toContain(`<input id="${FIX_AVAILABLE_ONLY_ID}" type="checkbox">`);
     expect(footer(again)).toContain(`<footer id="${ADVISORY_CORPUS_FOOTER_ID}">`);
     expect(footer(again)).toContain('<summary>Advisory data: Not recorded</summary>');
+    expect(again).toContain('Fix available only');
+    expect(again).toContain(`<input id="${FIX_AVAILABLE_ONLY_ID}" type="checkbox">`);
     expect(again.startsWith('<!doctype html>')).toBe(true);
   });
 });
diff --git a/src/reporting/formatters/html.ts b/src/reporting/formatters/html.ts
index 536eec04..0bef26fd 100644
--- a/src/reporting/formatters/html.ts
+++ b/src/reporting/formatters/html.ts
@@ -12,10 +12,11 @@ import type { Finding, ScanArtifact } from '../types.js';
  * Stable ids: `#summary`, `#vulnerabilities`, `#security`, `#findings`,
  * `#advisory-corpus`.
  *
- * {@link FIX_AVAILABLE_ONLY_ID} is an unchecked checkbox. Checking it hides
- * rows whose {@link FIX_AVAILABLE_ATTR} is `no`. The page file always contains
- * every row, so the default (unfiltered) document stays a pure function of the
- * artifact. The checkbox is presentation only: no network, no external file.
+ * Rows carry {@link FIX_AVAILABLE_ATTR}. {@link FIX_AVAILABLE_ONLY_ID} is an
+ * unchecked checkbox. Checking it hides rows whose attribute is `no`. The
+ * page file always contains every row, so the default document stays a pure
+ * function of the artifact. The checkbox is presentation only: no network,
+ * no external file.
  *
  * {@link advisoryCorpusFooter} fills `#advisory-corpus` with a collapsed
  * footer. It names the advisory source recorded on the artifact, and it says
@@ -86,9 +87,9 @@ export function formatHtmlReport(artifact: ScanArtifact): string {
   nav a { margin-right: 1rem; }
   a { color: inherit; }
   .absent { font-style: italic; }
+  body:has(#${FIX_AVAILABLE_ONLY_ID}:checked) tr[${FIX_AVAILABLE_ATTR}="no"] { display: none; }
   #${ADVISORY_CORPUS_FOOTER_ID} { margin-top: 2.5rem; font-size: 0.85rem; }
   #${ADVISORY_CORPUS_FOOTER_ID} summary { cursor: pointer; }
-  body:has(#${FIX_AVAILABLE_ONLY_ID}:checked) tr[${FIX_AVAILABLE_ATTR}="no"] { display: none; }
 </style>
 </head>
 <body>