From db982cb13ec2dfd8fbf197240061b55731b5fe04 Mon Sep 17 00:00:00 2001
From: Frank Steiler <frank@steiler.dev>
Date: Thu, 6 Aug 2026 01:12:21 +0200
Subject: [PATCH 1/3] feat(reports): add splitKind to distinguish
 deposit-driven splits from line splits

Adds SourceReportInvoice.splitKind ('lines' | 'deposits' | 'both' | null),
derived alongside isSplit in the existing step-f UNION at zero extra query
cost, so the report legend can distinguish a genuine line split from an
invoice whose lines all sit in one source but carries a deposit tagged to
another. Previously both cases were byte-identical in the response and
collapsed to the generic split label instead of the deposit-reduced one.

Also removes the unsound budgetLines.length > 0 gate on isDepositReduced,
and fixes a second, previously unreported defect: isDepositReduced was
over-inclusive, firing on line-split invoices carrying an untagged deposit
even though untagged deposits are apportioned pro-rata rather than claimed
separately.

Fixes #1911

Co-Authored-By: Claude dev-team-lead <noreply@anthropic.com>
Co-Authored-By: Claude backend-developer <noreply@anthropic.com>
Co-Authored-By: Claude frontend-developer <noreply@anthropic.com>
Co-Authored-By: Claude qa-integration-tester <noreply@anthropic.com>
Co-Authored-By: Claude e2e-test-engineer <noreply@anthropic.com>
Co-Authored-By: Claude product-owner <noreply@anthropic.com>
---
 .../agent-memory/e2e-test-engineer/MEMORY.md  |   1 +
 .../issue-1911-splitkind-e2e.md               |  84 ++++
 .claude/agent-memory/product-owner/MEMORY.md  |  78 ++--
 .../product-owner/bank-report-wizard.md       | 137 ++++++
 .../qa-integration-tester/MEMORY.md           |   1 +
 .../story-1911-splitkind.md                   | 116 +++++
 .../reports/ReportInvoiceList.test.tsx        |   1 +
 .../reportContent/buildReportContent.test.ts  | 160 +++++--
 .../lib/reportContent/buildReportContent.ts   |  26 +-
 client/src/lib/reportExclusions.test.ts       |   1 +
 client/src/lib/reportPdf/merge.test.ts        |   1 +
 client/src/lib/reportPdf/realRender.test.ts   | 278 +++++++++++-
 .../ReportWizardPage.aiGeneration.test.tsx    |   4 +-
 .../ReportWizardPage.test.tsx                 |  10 +
 .../ReportWizardPage/wizardReducer.test.ts    |   1 +
 e2e/pages/ReportWizardPage.ts                 |  47 +-
 .../reportWizardEditableContent.spec.ts       | 212 +++++++--
 server/src/routes/sourceReports.test.ts       |   3 +
 .../src/services/sourceReportService.test.ts  | 410 ++++++++++++++++++
 server/src/services/sourceReportService.ts    |  31 +-
 shared/src/lib/reportMath.test.ts             |   1 +
 shared/src/types/sourceReport.ts              |   8 +
 wiki                                          |   2 +-
 23 files changed, 1462 insertions(+), 151 deletions(-)
 create mode 100644 .claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
 create mode 100644 .claude/agent-memory/qa-integration-tester/story-1911-splitkind.md

diff --git a/.claude/agent-memory/e2e-test-engineer/MEMORY.md b/.claude/agent-memory/e2e-test-engineer/MEMORY.md
index ddaab131a..d8696067a 100644
--- a/.claude/agent-memory/e2e-test-engineer/MEMORY.md
+++ b/.claude/agent-memory/e2e-test-engineer/MEMORY.md
@@ -32,6 +32,7 @@
 - [issue-1959-inline-meta-and-labels.md](issue-1959-inline-meta-and-labels.md) — #1959 reversed #1923's †/‡ footnotes → inline `(partial)`/`(less deposit)` and merged area+attachments into one `.usageMetaText` line; POM renames, rewritten scenarios 2/17/18/20 + AI 8, attachment-tier facts, untested column toggles.
 - [claim-deposit-scope-1922.md](claim-deposit-scope-1922.md) — PR #1922 invoice/deposit claim-scope split: `handleMarkClaimed`'s two-array submit, server-truth success-banner counts, the three "deposit surfaces the invoice" shapes, `claimNothingClaimable` guard.
 - [issue-1973-column-visibility-pdf.md](issue-1973-column-visibility-pdf.md) — column-visibility toggles wired to the PDF (supersedes #1966): reducer reset facts (use-case change resets `hiddenColumns`, `SET_ATTACH_DOCUMENTS` doesn't), Scenarios 28-33, size-diff PDF-consequence proof pattern, `goBack()` viewport-independent multi-step walk, new `columnToggleGroup`/`usageHiddenAttachmentsWarning` POM locators.
+- [issue-1911-splitkind-e2e.md](issue-1911-splitkind-e2e.md) — #1911 `splitKind` field: incoming spec said "no E2E changes needed", was wrong — fixed Scenario 18's mis-seeded fixture AND found Scenario 17 independently affected (zero-contribution-line case) by cross-referencing unit-test ACs; new AC-3.2 regression-guard sibling test; POM docblock corrections.
 
 ## Open follow-ups to flag to orchestrator
 
diff --git a/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md b/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
new file mode 100644
index 000000000..14287609f
--- /dev/null
+++ b/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
@@ -0,0 +1,84 @@
+---
+name: issue-1911-splitkind-e2e
+description: Issue #1911 (SourceReportInvoice.splitKind) E2E fallout in reportWizardEditableContent.spec.ts — dev-team-lead's "no E2E changes needed" spec conclusion was wrong; two scenarios (17 AND 18) were affected, found by cross-referencing server/client unit-test ACs, not by running the browser suite.
+metadata:
+  type: project
+---
+
+## What #1911 actually changed (semantics, not just a field addition)
+
+`server/src/services/sourceReportService.ts` step f: `isSplit`/`isDepositReduced` used to be
+derived client-side from `invoice.isSplit(raw) && budgetLines.length>0` /
+`invoice.isSplit(raw) && deposits.length>0 && !ownTagged`. Both gates were unsound (claim reports
+drop zero-contribution budget lines; a foreign-tagged deposit never appears in `deposits[]` at
+all). #1911 replaced them with a purely server-derived `splitKind: 'lines'|'deposits'|'both'|null`
+(SQL computes `has_foreign_line_source`/`has_foreign_deposit_source` — "this arm contains a source
+≠ the reported one", untagged deposits excluded from the deposit arm entirely since the query
+filters `budget_source_id IS NOT NULL`). `buildReportContent.ts`: `row.isSplit ⟺ splitKind ∈
+{'lines','both'}`, `row.isDepositReduced ⟺ splitKind ∈ {'deposits','both'}`. `row.isDeposit`
+(constituted-deposit badge) trigger is UNCHANGED and now independent of the other two — all three
+can co-occur on one row (old code's implicit either/or is gone).
+
+## Two E2E scenarios were affected, not one — the incoming spec only caught the second
+
+`e2e/tests/budget/reportWizardEditableContent.spec.ts`:
+
+- **Scenario 18** ("split + deposit-reduced labels"): `invoice3`'s deposit was seeded
+  `budgetSourceId: null` (untagged) with a comment claiming that produces `isDepositReduced: true`
+  — true under the OLD buggy code, false under the fix (this was the literal bug #1911 exists to
+  fix). Retagged to `otherSourceId` (a source ≠ the reported one) to get the genuine
+  `splitKind: 'both'` shape.
+- **Scenario 17** ("constituted-deposit row … carries NO marker/label"): NOT flagged by the
+  incoming spec at all, found by grepping every `createDepositViaApi(...budgetSourceId...)` call
+  site per the task's own hint ("tagged to the reported source" is one of the two shapes to
+  check). Its invoice has budget lines ENTIRELY on a different source (A) and a deposit tagged to
+  the reported source (B) itself. Under the OLD code: `isSplit(row)` was gated by
+  `budgetLines.length>0` for B, which is 0 → false → no `(partial)`. Under NEW code:
+  `has_foreign_line_source` is true (A's line is foreign to B) regardless of whether B itself has
+  ANY line contribution → `splitKind: 'lines'` → `isSplit(row)` **true**. This is the "AC 3.1
+  zero-contribution-line regression case" explicitly called out in
+  `client/src/lib/reportContent/buildReportContent.test.ts` (search that phrase) — a unit test
+  already asserted this new behavior; the E2E suite just hadn't been told. Net: the row now shows
+  BOTH the "Deposit" badge AND `(partial)`, plus one footnote entry (previously zero).
+
+**How I found it without a live browser**: cross-referenced `server/src/services/
+sourceReportService.test.ts` (search `Story #1891 regression: invoice with lines only for source B
++ a deposit tagged to source A → isSplit true in both A and B reports`, line ~346) against the
+E2E fixture shape — that unit test's `resultB.invoices[0].isSplit` assertion is `true`, which is
+the DB-level raw `isSplit` (unchanged by #1911) that Scenario 17's OLD stale comment claimed was
+`false`. Then confirmed via `buildReportContent.test.ts`'s "AC 3.1 (regression, #1898/claim
+zero-contribution-line drop)" test that the row-level flag inherits this. Static/unit-test
+cross-referencing caught a bug the incoming E2E spec missed — worth doing whenever a spec claims
+"no E2E changes needed" for a semantic (not just additive) server change.
+
+## Regression-guard test added
+
+A new sibling `test()` inside Scenario 18's `describe` block (not folded into the existing test,
+so `footnoteItems` can assert count 1 cleanly — the existing test's count is 2 for unrelated
+reasons): a split invoice (lines on two sources) + an UNTAGGED deposit must show `(partial)` but
+never `(less deposit)`, with exactly one footnote entry. This is literally the fixture shape
+Scenario 18's `invoice3` used to have (before being retagged) — without a standalone guard, the
+AC 3.2 over-inclusive bug could regress silently since every other test in the file now uses
+either no deposit, an own-tagged deposit, or a genuinely-foreign-tagged one.
+
+## POM docblock corrections
+
+`e2e/pages/ReportWizardPage.ts` had TWO now-false invariants baked into JSDoc comments (found by
+reading the file, not just the test): `depositBadge()`'s doc claimed a constituted-deposit row
+"carries no inline note of its own" and `inlineNote()`'s doc claimed such a row "gets NEITHER —
+it gets the inline depositBadge instead". Both corrected with an "Issue #1911" note; also added a
+dedicated "Issue #1911" paragraph to the class docstring (same location/style as the existing
+"Issue #1965" paragraph) so a future reader hits the corrected model before writing a new fixture
+against stale assumptions.
+
+## Reusable lesson
+
+When a dev-team-lead spec says a server change is "purely additive, no E2E changes needed" for a
+field that DRIVES existing conditional rendering, don't take it on faith — grep every fixture that
+feeds the changed derivation (here: every `createDepositViaApi` call with `budgetSourceId` null or
+equal to the reported/requested source) and check its assertions against the NEW derivation logic,
+not just the ONE scenario the spec happened to mention. The unit test suite (already written and
+green) is a fast, authoritative way to derive "what SHOULD this fixture shape now assert" without
+needing a live browser.
+
+See [[story-1879-report-wizard]], [[issue-1959-inline-meta-and-labels]].
diff --git a/.claude/agent-memory/product-owner/MEMORY.md b/.claude/agent-memory/product-owner/MEMORY.md
index c90014d75..64eae132d 100644
--- a/.claude/agent-memory/product-owner/MEMORY.md
+++ b/.claude/agent-memory/product-owner/MEMORY.md
@@ -21,9 +21,9 @@
 
 ## Active / Planned Epics
 
-- EPIC-04 (#4) Household Items [Must] — IN PROGRESS, 11 stories (#387-#394, #413, #415, #467). Full detail + per-story review notes in [epic-04-planning.md](epic-04-planning.md)
+- EPIC-04 (#4) Household Items [Must] — IN PROGRESS, 11 stories (#387-#394, #413, #415, #467). See [epic-04-planning.md](epic-04-planning.md)
 - EPIC-16 (#752) Floor Plans & Utility Tracking (2.5D) [Should, Future] — 22 stories (#753-#775), all Backlog, 6 phases. See [epic-16-planning.md](epic-16-planning.md)
-- Backlog-only (not started): EPIC-07 Reporting [#7], EPIC-09 Dashboard [#9], EPIC-10 UX Polish [#10]. Deps: 07←05,08; 09←02,03,05; 10←all.
+- Backlog-only (not started): EPIC-07 Reporting [#7], EPIC-09 Dashboard [#9], EPIC-10 UX Polish [#10]. Deps: 07←05,08; 09←02,03,05; 10←all. See [epic-09-planning.md](epic-09-planning.md), [epic-17-planning.md](epic-17-planning.md), [epic-18-planning.md](epic-18-planning.md)
 
 ## Completed Sprint Story References
 
@@ -31,22 +31,25 @@
 
 ## Standalone bugs & stories (no active parent epic)
 
-Full detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md) (budget/invoice) and [standalone-diary-bugs.md](standalone-diary-bugs.md) / [standalone-photo-stories.md](standalone-photo-stories.md). Growing budget/invoice cluster (20+) → propose new "Budget/Invoice UX Polish" epic next planning cycle. Auto-itemize is standalone (no parent epic): stories #1545-#1547 + bug fixes.
-
-- Budget/invoice batches: #1369-#1373 (2026-04-28), #1389-#1390 (2026-04-29), #1401 (2026-05-10), #1421-#1425 (2026-05-15), #1439-#1441 (2026-05-17), #1553 (2026-05-22)
-- Auto-itemize: #1545/#1546/#1547 mini-epic (2026-05-21), #1600 (2026-05-26), **#1833 duplicate budget lines on commit retry (2026-07-07)**
-- **Auth rate limits: #1970** — PR #1989 APPROVED round 3 (2026-08-04), M1 resolved (`5446b29a`), all 7 ACs met → **Done on merge**. Follow-ups #1990/#1991/#1992 stay open. Detail in [auth-rate-limits-1970.md](auth-rate-limits-1970.md) — incl. verifying "proves X reached the route" assertions **by local mutation + revert**, and checking a numeric-header probe is deterministic (which request in the window it observes).
-- Diary: #1426 critical photo data loss (2026-05-15)
-- Photo: #1723 lightbox picker UX (2026-06-16)
-- **DataTable: #1955** two-column toggle race silently hides 2nd column, all 6 DataTable pages (Should Have, S, Backlog, 2026-08-02). See [datatable-column-preference-race.md](datatable-column-preference-race.md) — records that **fast clicking is the SAFE case** (I judged this backwards; debounce `clearTimeout` coalesces rapid input, the >500ms reading-pace gap is the reachable one) and that #1920's E2E-only fix (`InvoicesPage.enableColumn()` awaits the PATCH) makes CI green **without** fixing production — don't close #1955 on a green shard.
-- **#1957** latent cross-file E2E test-isolation hazard (shared-admin `user_preferences` writes under `fullyParallel`, `LocaleContext.syncWithServer` actively flips a victim test's locale) — Should Have, bug, Backlog, 2026-08-02/03, filed from `/fix-e2e` work on PR #1956. Scoped as an audit + per-spec sweep, not a single-file fix — found a second live instance (`diary-uat-fixes.spec.ts` vs `dashboard.spec.ts`, key `dashboard.hiddenCards`) while researching it. Distinct from #1955 (production race) and #1920 (E2E workaround for #1955). Detail in [e2e-shared-admin-preference-hazard.md](e2e-shared-admin-preference-hazard.md).
-- **PR #2008 (#2003 ADR-034 overflow enforcement + #1980 legend assertions)** — **REJECTED round 1** (`664bf048`, 2026-08-05), verdict in a comment (human-authored PR). Three criticals: **C1** the new `max(horizontalRatio) <= 1` assertions are the constant `0` — pdfmake records the write cursor's _left_ edge (`DocumentContext.js:515-529`), so a left-margin-anchored full-width table can never exceed 0; proven by 3 mutations (`WORST_CASE_CHAR_ADVANCE_EM 1.04→0.1` and `VENDOR_WIDTH 45→600` both stayed green; inverting the bound to `-1` printed `Received: 0` at all 8 sites in all states). **C2** the ADR pointer claims the assertion is "non-vacuous", refuted by the PR's own helper comment. **C3** the new E2E test is red twice (NBSP: `locator.textContent()` doesn't normalize, `toContainText()` does). New reusable patterns: **invert an inequality's bound to read the measured value**, **a synthetic revert-test proves the helper not the assertion**, **a comment conceding non-coverage IS the finding**, **a documented ADR bar can be unmeasurable — escalate as a rule correction**. → **APPROVED round 2** (`4f4b93e3`): metric replaced by per-cell `_minWidth <= widths[i]._calcWidth` (8 assertions, claim/budget-overview × en/de), ADR-034 rule #1 corrected (3rd correction + Deviation Log), **#2003's body amended with a supersession block** so the dead `<= 1` bullet isn't read as live spec. Round-2 patterns: **verify a vacuity fix by re-running the exact mutations that stayed green last round** (both went green→all-8-fail); **"moves with the input" is the positive signal** (`212.93`/`7.10`/~`33`; legend `_minWidth` 36.80 en vs 54.86 de); **when a fix removes a vacuous assertion, check it was REPLACED not just deleted** (#1980 AC1 went vacuous→**absent**, carried as Medium — re-grading my own round-1 Medium upward would move goalposts); **probe that a measurement exists before demanding it**; **prove an E2E failure is a flake via a byte-identical-subtree green run** (`git diff <green> <red> -- e2e/` empty + all-16-green 16 min earlier + shard 3/16 green last round rules out a shard-boundary shift). #2003 Done on merge; **#1980 Done only if M1 lands**. Detail in [bank-report-wizard.md](bank-report-wizard.md) §"PR #2008".
-- **PR #2007 (#2001 remove `TFunction` from `reportPdf/*`)** — **APPROVED round 1** (`df7d2c73`, 2026-08-05), all 9 ACs met, **Done on merge** (every AC machine-checkable, no UAT). One Medium non-blocking: the fix re-opened the same hazard class in a new form (`labels.skipReasonLabels[reason as 'a'|'b'] ?? reason` — unchecked cast + silent fallback echoes a raw identifier if a third `SkippedDocument['reason']` is added). **Pattern: when a story's purpose is "close the class", check whether the fix introduces a fresh instance of it.** Verification: grep ACs get run directory-wide _and_ one step past the AC text (also checked `i18n`/`useTranslation`/`toLocale`/`Intl.`); AC7 discrimination proven by 3 mutations in a throwaway `/tmp` worktree (symlink root `node_modules`) — **mutate the i18n _key_, not just the value**; call-time→build-time refactors need a `useMemo` dep-array staleness check. Detail in [bank-report-wizard.md](bank-report-wizard.md) §"#2001 reviewed".
-- **#2005** now **CLOSED** — all 16 E2E shards green on `df7d2c73`; the promotion blocker below is cleared. E2E shard 8/16 red across four beta PRs — dashboard "New Invoice" (Scenario 13, #1735) opens no modal in either Paperless branch, fails on retry too (bug, Must Have, Todo, 2026-08-05, filed from PR #2004 round-5 sign-off). **Blocks the next `beta`→`main` promotion** (`E2E Gates` is main-only). Proved PR-independent by checking the head commits of #1999/#2000/#2002 — not `beta`, which never runs full E2E. AC1 is a _classification_ AC so the dev-team-lead keeps the Test Failure Debugging Protocol call. Detail in [bank-report-wizard.md](bank-report-wizard.md) §"round 5".
-- **PR #2004 (#1888 + #1910)** — **APPROVED, M1 closed round 5** (`6a3eb7ec`, 2026-08-05): `lang={lang}` on the `<label>` at `ReportContentEditor.tsx:245`, verified by local mutation + revert (`"de"`→`null`). Also mutation-checked the unrequested `uiLang` wiring test — **a test guarding an _optional_ prop needs its own mutation check, since its failure mode stays type-legal and green everywhere else**. Exhaustiveness re-check found nothing further; stating the round-4 enumeration as exhaustive is what turned round 5 into a one-item confirmation. Earlier: **APPROVED round 4** (`03a30990`): mechanism (b) taken verbatim (wrapper tags restored + `EditableField.uiLang` on reset button/sr-only hint). All 5 canonical #1910 ACs met; one Medium MUST FIX left non-blocking (**column-toggle labels** render `content.labels.*` untagged — `.columnToggleGroup` is a _sibling_ of `.tableWrapper`; fix on the `<label>`, not `.columnToggles`). Capped at Medium because **I missed it in my own round-2 and round-3 enumerations** — a finding's severity is capped by my own enumeration failure. Ended the mirror-image cycle by **stating the enumeration as exhaustive**. Told them explicitly NOT to remove the now-redundant `<thead lang>` (E2E 25/26/27 target it). Round-2 H2 mirror: stale _comment_ over fresh `expect` = flag, not block. #1888 re-verified by diffing its file against the accepted commit (empty). Coordinator AC numbering wrong a **5th** time. Prior rounds: #1910 REJECTED **three times**: round 1 on AC3 (`lang` blanket-tagged on `.container`, only `<h3>`s counter-tagged → `EditableField` chrome announced in report language, correct before the PR); round 2 on the "Option A surgical tagging" fix (`64c07b8a`) — **H2 AC5 red** (E2E Scenario 25 still asserts `container` lang, only the _comment_ was updated; Shard 2/16 test #168 confirms), **H3 AC1 regression** (`coverLetter.dateLine`/`closing` report-language spans lost coverage when the blanket tag narrowed), **H4 AC3 residue** (`.tableWrapper`/`.mobileCardList` still enclose the reset button + sr-only edited hint). Patterns: **AC enumerating element classes → tick each one off**; **override-by-inheritance fix → "what else inherits from the node you tagged?"**; **behaviour-inverting fix → grep for the OLD assertion, not the old comment**; **blanket→surgical refactor → audit what the blanket was silently covering**; **price intrinsic tensions differently from oversights** (offered a documented deviation for the one-element-one-lang `aria-label` conflict). Round 3 (`04e4ae0c`): H2/H3/H4/M1/L1 all verified fixed (**shard-diff across the PR's own commits** is the cheap proof — Shard 2/16 red→green), rejected again on **H5**: emptying `.tableWrapper`/`.mobileCardList` and reconciling only `<thead>` leaves the desktop `<tbody>` and the **entire** `.mobileCardList` untagged, and CSS hides `.table` at ≤767px → **zero `lang` on the mobile viewport**, AC1 unmet for a whole viewport + net regression vs the prior commit. Lessons: **when demanding a tag be removed, name the replacement coverage in the same breath**; **retract your own misread takeaway** (round 2's `uiLang` deletion was not a ruling against targeted counter-tagging); `npm run lint` has **no Prettier** and CI has no `format:check`, so formatting drift merges silently; `gh pr review` can't request changes on a human-authored PR → verdict goes in a comment. Detail in [bank-report-wizard.md](bank-report-wizard.md) §§"PR #2004 review" + "round 2" + "round 3".
-- **Bank Report Wizard mini-epic** (no parent epic) — all rulings, contract facts, per-PR review outcomes and filed follow-ups in [bank-report-wizard.md](bank-report-wizard.md). Shipped: #1876→#1877→#1878→#1879, Round 2 #1898–#1901, Round 3 #1929–#1933 (all merged; #1929 took 4 rounds, #1925 closed as duplicate). **Open**: #1888 indicator, #1891 (2 wiki MUST FIX), #1895→#1896/#1897 claim close-out, #1910 `lang` attr, #1917 consolidated follow-ups (incl. `KI` glossary entry + `computeIncludedTotal` extraction), #1937/#1938 PDF header bugs, #1939 geometry hygiene, #1940/#1941/#1950, #1946 in-flight AI generation (Must Have), #1947 `useReducer`, #1952/#1953, #1965–#1972 (PR #1959 sweep), **#1973** column visibility (Should Have, Todo, blocked-by #1965). #1931 merged but **not Done** — ACs 3.2/3.3 need live-LLM UAT.
-- **Reusable rulings from this cluster** (detail in [bank-report-wizard.md](bank-report-wizard.md), patterns in [pr-review-patterns.md](pr-review-patterns.md)): **merge is a code gate, Done is an acceptance gate** (unverifiable AC _with_ a substitute assertion = documented deviation; _without_ one → UAT, reopen on failure); **a finding that defeats the PR's own AC belongs in that PR, not a follow-up**; **closed/released ACs get a dated supersession comment, never a rewrite**; **ACs that misdescribe reality fail correct implementations at UAT** (seen 3×: #1943 AC4, #1933 AC2.1/2.7, my own #1925/#1932 transcription); **comment keeps the rationale, issue owns the guard**; bounded-and-quantified earns a tracked owner, unbounded-and-estimated gets documentation only.
-- **#1973 column visibility wired through to the PDF** (user-story, Should Have, Todo, 2026-08-03, **blocked-by #1965**) — user reversed #1959's preview-only hint. **My proposed "at least one of Vendor/Invoice #" floor was rejected as an invented compliance rule**; only Allocated Amount is mandatory (survived because its justification is _structural_ — summary amounts + #1959 inline labels live in that cell — not purposive). 96 legal subsets (overview 2^6=64, claim 2^5=32), floor 1 column. Rulings: legend stays **unconditional** (AC 6.1 forbids `if invoiceAmount hidden`) because `(less deposit)` was insufficient regardless of adjacency; base set **IS** the ceiling for a **data** reason (`status: isOverview ? status : null`) — corrected the coordinator's "arbitrary means no ceiling" reading; per-session state, not `useColumnPreferences`; narrower-than-page table when neither Usage nor Vendor visible. **#1966 CLOSED as superseded** (board Wont-Do) — its AC1 would pass while the PDF still contained every column. Recommended **after** the #1958 promotion. **Rev 3 (spec reconciliation)**: adopted the dev-team-lead's **three-tier summary-label fallback** over my "same cell" ruling (92 subsets last-leading-column → Invoice Amount → separate block beneath table for 4; tier 3 _increases_ preview parity, `ReportContentEditor.tsx:442-445`); added **AC 3.7 one-sided chunk-budget clamp** (650 scales _down_ never _up_ — the hazard is a future _added_ column narrowing Usage, not this change); 72 subsets = `printableWidth()`, 24 narrower (84.00–315.00pt). **Process failure: I rewrote the body but reported only the rulings, so two agents spec'd from a stale rev 1 and re-filed an already-fixed contradiction — always say "body rewritten, numbering reassigned".** **PR #2010 APPROVED round 1** (`b5b03bec`, 2026-08-05, verdict in a comment — self-authored PR): 28/33 ACs met, 5 Medium partials (all the same shape — an AC's *second clause* dropped while the first was met: 4.1 header text, 4.2 continuation rows, 4.5 all-96 label, 3.3 vendor-absorber, 7.4 PR-body reporting), 0 functional gaps, all 16 E2E shards green. **Two AC errors were mine, corrected on the issue: AC 4.6's "92" → Tier 1 is 88 (Tier 2 = 4, folded in by 96−4); AC 5.3's "leaving and re-entering the step" over-reached R5 and would have mandated a third #1943/#1946 silent-state-loss.** **#1973 → UAT, stays In Progress** (R7 narrow table + R2 tier-3 block are visual judgments). **Follow-ups filed 2026-08-05, all Backlog + blocked-by #1973: #2011** (bug, tier-3 block not width-constrained — R7's "stretched numeric table" failure relocated below the table; **live UAT-rejection candidate, so width-rejection→#2011 vs design-rejection→reopen #1973 is stated up front**), **#2012** (tech-debt, the 3 "correct by construction, therefore untested" ACs + stale `92` in a test title), **#2013** (bug, German mixed quotes, both instances), **#2014** (tech-debt, `ContentTier` DISCARD_EDITS rule in the reducer). Standing ruling: **a green PR is not reopened to absorb non-blocking findings — file, don't expand.** Detail in [bank-report-wizard.md](bank-report-wizard.md) §"#1973 column visibility" + §"rev 3" + §"PR #2010" + §"#2010 follow-ups".
+Detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md) (budget/invoice), [standalone-diary-bugs.md](standalone-diary-bugs.md), [standalone-photo-stories.md](standalone-photo-stories.md). Growing budget/invoice cluster (20+) → propose a "Budget/Invoice UX Polish" epic next planning cycle.
+
+- Budget/invoice batches: #1369-#1373, #1389-#1390, #1401, #1421-#1425, #1439-#1441, #1553
+- Auto-itemize (standalone, no parent epic): #1545-#1547 mini-epic, #1600, #1833 duplicate budget lines on commit retry
+- Diary: #1426 critical photo data loss | Photo: #1723 lightbox picker UX
+- **#1970 auth rate limits** — PR #1989 approved R3, all 7 ACs met, Done on merge; follow-ups #1990/#1991/#1992 open. See [auth-rate-limits-1970.md](auth-rate-limits-1970.md)
+- **#1955 DataTable two-column toggle race** (Should Have, Backlog) — fast clicking is the SAFE case; #1920's E2E-only fix makes CI green without fixing production. See [datatable-column-preference-race.md](datatable-column-preference-race.md)
+- **#1957 E2E test-isolation hazard** (shared-admin `user_preferences` writes under `fullyParallel`) — Should Have, Backlog; an audit + per-spec sweep, not a single-file fix. See [e2e-shared-admin-preference-hazard.md](e2e-shared-admin-preference-hazard.md)
+- **#2005 CLOSED** — dashboard "New Invoice" shard 8/16 failure; all 16 shards green on `df7d2c73`, promotion blocker cleared.
+
+## Bank Report Wizard mini-epic (no parent epic)
+
+All rulings, contract facts, per-PR review outcomes and filed follow-ups live in [bank-report-wizard.md](bank-report-wizard.md) — consult it before any work on this cluster.
+
+- Shipped: #1876-#1879, #1898-#1901, #1929-#1933, #1958, #1959, #1965, #2001, #2003, #1973
+- Open: #1888, #1891, #1895-#1897, #1910, #1912, #1917, #1937-#1941, #1946 (Must Have), #1947, #1950, #1952, #1953, #1966-#1972, #2011-#2014
+- Merged but **not Done** (awaiting live-LLM UAT): #1931 (ACs 3.2/3.3)
+- **#1973** column visibility → PDF: PR #2010 approved R1, 28/33 ACs, → **UAT, stays In Progress**. Follow-ups #2011-#2014 all Backlog + blocked-by #1973.
+- **#1911** `splitKind`: ACs refined 2026-08-05 onto an orchestrator-filed body → **UAT, not Done-on-merge**. Privacy: no objection. Legend: no new sentence. Addendum ruling (pre-merge): zero-line-contribution row now shows `(Deposit)`+`(partial)` — **intended, do not narrow**, AC 3.6/3.7/4.7 added.
 
 ## Requirements Coverage
 
@@ -55,15 +58,15 @@ Full detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md)
 - Household Items are explicitly NOT work items (Section 5, Key Decisions).
 - Budget sub-domains: categories, vendors, creditors, subsidies — all in EPIC-05.
 - EPIC-11 covers cross-cutting non-functional: testing, Docker, security.
+- Glossary/terminology decisions: [glossary-decisions.md](glossary-decisions.md)
 
 ## GitHub Projects Board — operational
 
-- Project ID: `PVT_kwHOAGtLQM4BOlve` | Status Field ID: `PVTSSF_lAHOAGtLQM4BOlvezg9P0yo`
-- Status Option IDs: Backlog=`7404f88c`, Todo=`dc74a3b0`, In Progress=`296eeabe`, Done=`c558f50d`, Wont-Do=`90c1bc33`
-- Native `gh project` commands (not raw GraphQL) for board mgmt: `item-edit --id <ITEM> --project-id <PID> --field-id <FID> --single-select-option-id <STATUS>`; `item-add 4 --owner steilerDev --url <url>`
-- **`gh project item-list` has NO `--query` flag** in the installed gh (only `--format`/`--jq`/`--limit`/`--owner`/`--template`) — the `--query "is:issue #<N>"` form documented in the agent definition fails with `unknown flag`. Resolve an item node ID via `gh api graphql '{ repository(owner:"steilerDev",name:"cornerstone"){ issue(number:N){ projectItems(first:5){ nodes{ id project{number} } } } } }'` and verify status by node ID with `node(id:"PVTI_…"){ ... on ProjectV2Item { fieldValueByName(name:"Status"){ ... on ProjectV2ItemFieldSingleSelectValue { name } } } }`. Confirmed 2026-08-01 (#1917).
-- GraphQL still needed for `addSubIssue` and `addBlockedBy` (`addBlockedBy` uses `blockingIssueId`, NOT `blockedByIssueId`)
-- If `item-list` is empty right after `item-add` (indexing lag), resolve item node ID via issue `projectItems` GraphQL and set status by that ID. See [board-operations.md](board-operations.md)
+- Board status changes go through `bash scripts/board.sh <issue> <backlog|todo|in-progress|done|wont-do>` — it owns the project/field/option IDs.
+- GraphQL still needed for `addSubIssue` and `addBlockedBy` (`addBlockedBy` uses `blockingIssueId`, NOT `blockedByIssueId`).
+- **`gh project item-list` has NO `--query` flag** in the installed gh — the form in the agent definition fails. Resolve item node IDs via the issue's `projectItems` GraphQL field instead.
+- **`gh issue view <N>` fails** with a Projects-classic deprecation error — use `gh api repos/steilerDev/cornerstone/issues/<N> --jq '.body'` instead (confirmed 2026-08-05).
+- If `item-list` is empty right after `item-add` (indexing lag), resolve the item node ID via the issue's `projectItems` GraphQL field and set status by that ID.
 
 ## Patterns and Conventions
 
@@ -71,6 +74,31 @@ Full detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md)
 - Epic body has task list of story issues; story body references `**Parent Epic**: #NN`.
 - IMPORTANT: GitHub issue numbers ≠ epic numbers (EPIC-11 is issue #12). See [epic-patterns.md](epic-patterns.md).
 
+## Standing rulings (reusable across clusters)
+
+Full derivations and the incidents behind each are in [pr-review-patterns.md](pr-review-patterns.md) and [bank-report-wizard.md](bank-report-wizard.md).
+
+- **Merge is a code gate; Done is an acceptance gate.** An unverifiable AC *with* a substitute assertion = documented deviation; *without* one → UAT, reopen on failure.
+- **A finding that defeats the PR's own AC belongs in that PR, not a follow-up.** Conversely: **a green PR is not reopened to absorb non-blocking findings — file, don't expand.**
+- **Closed/released ACs get a dated supersession comment, never a rewrite.** When a body *is* rewritten, always report "body rewritten, numbering reassigned" — omitting that let two agents spec from a stale revision.
+- **ACs that misdescribe reality fail correct implementations at UAT** (seen 4×). Amend the text; don't design around it.
+- **An issue filed by another agent is a snapshot of that round's codebase** — re-verify the *mechanism*, not just the defect, and correct the mechanism while keeping the story.
+- **When an AC's correct predicate is one plausible misreading away from a no-op, write the misreading into the AC** and demand a test pinning that shape.
+- **Check the other direction of any reported boolean defect** — the mirror case is often live too.
+- **When a change looks like new behaviour, check whether the underlying field already carried the right value and only a downstream gate was lying.** If so it is a fix, and the burden flips to whoever wants the old output. If the only available narrowing is the removed gate under a new name, there is no narrowing — say so plainly.
+- **A corrected assumption appearing independently in code + docs + tests is one spec gap, not three bugs** — and is the argument for writing the AC down even when the code is already right.
+- **"Dominated by an existing measurement, do not re-measure" is as valuable as demanding the measurement.** Rank flagged risks against each other instead of treating every new co-occurrence as equally alarming.
+- **When a fix removes a mutual exclusion, ask what combination just became reachable** that never rendered before.
+- **A documented measurement (glossary space budget, column width) can close a wording debate before it starts.**
+- **Answer boundary/privacy questions about the artifact that leaves the system, not only about the API.**
+- **A finding's severity is capped by my own enumeration failure** — if I missed it in earlier rounds, it can't be blocking now. End mirror-image review cycles by **stating the enumeration as exhaustive**.
+- **Comment keeps the rationale, issue owns the guard.** Bounded-and-quantified earns a tracked owner; unbounded-and-estimated gets documentation only.
+- **Price intrinsic tensions differently from oversights** — offer a documented deviation for genuine conflicts.
+
 ## PR Review
 
-Detailed checklist, recurring violations, and per-PR findings in [pr-review-patterns.md](pr-review-patterns.md). Top recurring items to check FIRST: **CI shard status (`Quality Gates` green ≠ E2E green)**, **test doubles hiding defects (wrong-sign fixtures / key-echoing `t` mocks / mocked libs)**, **every `t()` path actually resolves in `en/<ns>.json`**, dependency pinning (exact versions), keyboard :focus indicators (WCAG AA), test authorship (QA not devs), E2E gate for "Automated (E2E)" scenarios, raw-value display bugs (formatDate/percent/"—" placeholder). Verdict matrix: `--request-changes` for functional AC gaps; `--comment` "MUST FIX" for display/formatting; `--approve` when all met.
+Detailed checklist, verdict matrix, recurring violations, and per-PR findings in [pr-review-patterns.md](pr-review-patterns.md). Check FIRST: **CI shard status** (`Quality Gates` green ≠ E2E green), **test doubles hiding defects**, **vacuous assertions** (invert an inequality's bound to read the measured value; re-run the exact mutations that stayed green last round), **every `t()` path resolves in `en/<ns>.json`**, dependency pinning, keyboard focus indicators, test authorship (QA not devs), raw-value display bugs.
+
+- Verdict matrix: `--request-changes` for functional AC gaps; `--approve` with "MUST FIX" notes for display/formatting; never `--comment` as a verdict.
+- `gh pr review` **cannot** request changes on a human-authored PR — the verdict goes in a comment.
+- `npm run lint` has **no Prettier** and CI has no `format:check`, so formatting drift merges silently.
diff --git a/.claude/agent-memory/product-owner/bank-report-wizard.md b/.claude/agent-memory/product-owner/bank-report-wizard.md
index 57fa090f6..ed030ea4f 100644
--- a/.claude/agent-memory/product-owner/bank-report-wizard.md
+++ b/.claude/agent-memory/product-owner/bank-report-wizard.md
@@ -859,3 +859,140 @@ explicitly, because #2011 is a live candidate for exactly that UAT rejection:**
 #2011; a **design** rejection ("the total should not have left the table at all, at any width") reopens
 #1973, because then the *ruling* was wrong. Worth reusing whenever a follow-up issue overlaps the same
 surface a parent issue is going to UAT on — say which rejection routes where, before UAT runs.
+
+## #1911 `splitKind` — AC refinement (2026-08-05)
+
+Refined ACs onto a **body filed by the orchestrator**, not by me (prior session's subagent budget ran
+out). 7 AC sections + UAT determination + two corrections to the issue's own framing.
+
+**All three premises verified true, but the issue body describes a dead codebase in two places** —
+recorded as an explicit "Corrections to the issue's framing" section:
+
+1. The `†`/`‡` glyph markers **no longer exist** — #1959 replaced them with inline grey word labels
+   (`(partial)` / `(less deposit)` / `(Deposit)`), and #1965 AC 2.2 *forbids* reintroducing them.
+2. The `‡` "This is a deposit." constituted sentence **is absent from `client/src/i18n/`**. So the
+   wording nit's stated premise cannot be fixed by editing that sentence.
+
+**Pattern: when the premise is real but its described mechanism is stale, correct the mechanism and
+keep the story.** The underlying defect (AC 1.2) was untouched by either correction. An issue filed by
+another agent from a review round is a snapshot of *that round's* codebase — re-verify the mechanism,
+not just the defect.
+
+### The trap AC (1.5) — worth reusing
+
+The derivation predicate is **"this arm contains a source ≠ S"**, NOT "this arm contains ≥2 distinct
+sources". The headline case (lines all in A, deposit tagged B, requested A) has arm1=`{A}`, arm2=`{B}`
+— *one source each* — yet must yield `'deposits'`. The naive per-arm-count reading returns `null` and
+silently reproduces the exact bug the story fixes. **When an AC's correct predicate is one plausible
+misreading away from a no-op, write the misreading into the AC and demand a test pinning that shape.**
+
+### Findings I added beyond what was filed
+
+- **A second, opposite defect in the same classifier.** Today `isDepositReduced` is *over*-inclusive:
+  it fires on a line-split invoice carrying an **untagged** deposit, whose legend sentence says
+  "claimed **separately**" — but untagged deposits are apportioned back *into* this source pro-rata
+  (`depositAggregateUtils.ts` L607-620). Given #1965 ruled `separately` audit-load-bearing, that is a
+  **false statement to a report recipient shipping today**. Filed defect was under-inclusive; checking
+  the other direction of the same boolean found the mirror.
+- **The `budgetLines.length > 0` gate is unsound too** — `claim` reports drop zero-contribution lines
+  (service step h), so a line-split invoice can arrive with `budgetLines: []` and lose `(partial)`.
+  **When a story's thesis is "stop inferring the reason from filtered arrays", apply it to every gate
+  that does so, not only the one that was reported.**
+
+### Rulings I made rather than leaving to the implementer
+
+- **Constituted-wording nit: NO string change.** Precision is delivered *structurally* by removing the
+  `if/else` so `(Deposit)` and `(less deposit)` co-occur. Backed by `glossary.json`: the label lives in
+  a **75pt** column where `Abschlagszahlung` alone already measures 72.85pt — **no qualifier of any
+  length fits**, so "reword it more precisely" was never an available option. **A documented
+  measurement can close a wording debate before it starts — check the glossary for a space budget
+  before specifying any label change.**
+- **`splitKind` is `… | null`, REQUIRED not optional.** `null` matches the file's own `T | null`
+  convention; *required* because `splitKind?:` lets a construction site omit it → `undefined` → reads
+  as "not split" at the classifier. Required makes `tsc` enumerate the sites, which is the point.
+- **Non-goal stated explicitly:** decoupling `isDeposit` from `isSplit` (a real gap — a wholly
+  single-source invoice funded by an S-tagged deposit gets no `(Deposit)` badge) is **out of scope**;
+  it changes non-split rows. Named it so it isn't silently absorbed.
+- **New max-label row is newly reachable:** removing the `else` makes
+  `(Deposit) (partial) (less deposit) (refund)` — four runs — possible for the first time. Demanded a
+  **measured** geometry AC (#1929 pattern) in en+de under #1973's column subsets. `glossary.json`
+  records a prior wrap-mid-bracket break in this exact column. **Whenever a fix removes a mutual
+  exclusion, ask what combination just became reachable that never rendered before.**
+
+### Privacy ruling (asked for explicitly)
+
+**No objection.** There is *no authorization boundary between budget sources* — `GET /api/source-reports`
+requires only a session (`sourceReports.ts` L40-42), every `budgetSources` route is "both admin and
+member", no per-user scoping anywhere. So "a source the requester cannot see" **does not exist** in this
+app. The question that *does* matter is the PDF leaving the system: `(partial)` already discloses "funded
+from >1 source", so `splitKind` only picks between two already-shipped sentences and adds no new fact
+class; AC 1.10 forbids ever carrying the other source's id/name/count. **Answer the boundary question
+about the artifact that leaves the system, not only about the API.**
+
+### Legend ruling (#1965)
+
+**No new sentence.** The legend populates by set membership, so changing *which rows enter the sets* is
+handled by existing machinery. AC 7.2 pins "two entries max, not three" — there is no constituted
+legend sentence and none is added.
+
+### UAT determination
+
+**Goes to UAT, does not close on merge** (same call as #1973). Machine-checkable: everything except
+**AC 4.3/4.4 mixed-case legibility** — whether `€1,234.00 (Deposit) (partial) (less deposit)` reads as
+three compatible facts or as self-contradiction is a judgment no assertion makes. German is the sharper
+case: `(Abschlagszahlung) (abzgl. Abschlag)` is **the same root twice with opposite senses** on one
+line, and `glossary.json` already records these as "a different fact" from each other. Reopen #1911 on
+UAT failure — the wording is this story's deliverable, so it is not follow-up material.
+
+### #1911 addendum — the zero-line-contribution row (ruled 2026-08-05, pre-merge)
+
+Coordinator escalated a behaviour change my ACs **implied but never named**, found by the
+`e2e-test-engineer` grepping every `createDepositViaApi` fixture instead of trusting the spec's
+"purely additive, no E2E changes needed" claim. That claim was mine by implication and **it was
+wrong**. Two scenarios affected, not the one that had been spotted.
+
+**Shape:** invoice lines entirely on source A + deposit tagged to source B, reported for **B**.
+`hasForeignLineSource` true, `hasForeignDepositSource` false → `splitKind: 'lines'` → row now shows
+`(Deposit)` **and** `(partial)` where it previously showed `(Deposit)` alone.
+
+**Ruled: intended and correct, do not narrow, merge.** Added AC 3.6 + 3.7 + UAT 4.7.
+
+**The argument that settled it — the server field was always right; only the client's inference was
+wrong.** Arm1=`{A}`, arm2=`{B}`, count=2, so `SourceReportInvoice.isSplit` was **already true** on
+this row pre-#1911 — provably, because the old `(Deposit)` badge itself required `invoice.isSplit`
+to render. The `budgetLines.length > 0` gate was **discarding a correct signal the client already
+had**, on the false theory that an empty array means "not split" when it means "none of the split's
+lines belong to you". **Reusable: when a change looks like new behaviour, check whether the
+underlying field already carried the right value and only a downstream gate was lying. If so it's a
+fix, and the burden flips to whoever wants the old output.**
+
+**Why narrowing was refused:** any suppressing predicate must be "…and the reported source has ≥1
+line of its own" = `budgetLines.length > 0` under a new name, which re-breaks AC 3.1's claim-report
+case. **When the only available narrowing is the removed gate wearing a hat, there is no narrowing —
+say so plainly instead of negotiating.**
+
+**Non-goal held:** my §3 non-goal was the `isDeposit` *trigger* (still `isSplit && hasOwnTaggedDeposit`,
+AC 3.3, unchanged). This changed the `isSplit` trigger — the converse. **Check which side of a pair a
+"converse" escalation actually touches before conceding the non-goal was breached.**
+
+**Layout: explicitly declined a re-measurement.** `(Deposit) (partial)` is a strict subset of AC 4.5's
+already-measured four-run maximum. **Saying "dominated by an existing measurement, do not re-measure"
+is as valuable as demanding the measurement** — it stops a reflexive second geometry pass.
+
+**UAT: extended the existing pass, didn't add one.** Assessed the new pair as *lower* risk than my
+original AC 4.4 flag — `(Abschlagszahlung) (Teilbetrag)` is two different roots, vs. the sharp
+`(Abschlagszahlung) (abzgl. Abschlag)` same-root-opposite-senses collision. Same reader, same pass,
+zero marginal cost. **Rank the flagged risks against each other rather than treating every new
+co-occurrence as equally alarming.**
+
+**The three-places signal.** The stale "a constituted-deposit row carries no other note" invariant
+lived in the `if/else`, in **two** page-object JSDoc blocks, and in a Scenario 18 assertion. It was
+**believed, not specified** — three readers encoded an invariant the server data never supported,
+because the client gate made it look true. **When a corrected assumption turns up independently in
+code + docs + tests, that's one spec gap, not three bugs — and it's the argument for writing the AC
+down even though the code is already correct.**
+
+**Scenario 18 separately confirmed the over-inclusive defect was real and shipped:** its `invoice3`
+seeded an *untagged* deposit and asserted `isDepositReduced: true` — the E2E suite had encoded the
+bug as expected behaviour. QA also verified the new behaviour genuinely fails against pre-#1911 code
+(9 of 70 tests fail on restore), which is the anti-vacuity check AC 5.5 asked for.
diff --git a/.claude/agent-memory/qa-integration-tester/MEMORY.md b/.claude/agent-memory/qa-integration-tester/MEMORY.md
index 054a8d286..efb3d0b9b 100644
--- a/.claude/agent-memory/qa-integration-tester/MEMORY.md
+++ b/.claude/agent-memory/qa-integration-tester/MEMORY.md
@@ -15,6 +15,7 @@
 
 ## Recent bug/story notes (2026-08)
 
+- [Issue #1911 — splitKind field](story-1911-splitkind.md) (2026-08-05) — server UNION `origin`-column trap (AC1.5: "≠S per arm" not "≥2 distinct per arm"); UNION-dedup regression guard (AC1.9); `jest.spyOn(db,'all')` pass-through + drizzle `queryChunks` introspection for round-trip proof; client-side ripple broke 9 pre-existing tests in 2 files beyond the "add splitKind default" checklist item (found by just running the file); AC1.2 git-stash anti-vacuity proof (9/70 genuinely fail on reverted code).
 - [Issue #2001 — remove TFunction from reportPdf](story-2001-remove-tfunc-reportpdf.md) (2026-08-05, 2 rounds) — 7 test files total; realRender.test.ts has renderOverviewPdfContent (KEEP its t) vs buildOverviewContent/generateReportPdf (REMOVE); perl regex targets `{ attachDocuments: }` context to avoid removing renderOverviewPdfContent args; comment on same line blocks regex → explicit Edit; 218 tests pass round 2.
 
 - [Bug #1897 — deposit-blind drill-down fix](bug-1897-deposit-blind-drilldown.md) (2026-08-04) — `getBudgetSourceBudgetLines` was deposit-blind; fix routes through `getInvoiceAggregates`; 7 tests in new `describe('deposit-aware drill-down')` block appended to `budgetSourceService.test.ts`; local WI/HI/deposit helpers; AC1 is the reproduction case.
diff --git a/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md b/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md
new file mode 100644
index 000000000..39b7222cb
--- /dev/null
+++ b/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md
@@ -0,0 +1,116 @@
+---
+name: story-1911-splitkind
+description: Issue #1911 (splitKind field) test coverage — server derivation trap tests, client flag-rewrite ripple across 6 files, AC1.2 anti-vacuity git-stash proof
+metadata:
+  type: project
+---
+
+## What landed (implementer's diff, not mine)
+
+- `shared/src/types/sourceReport.ts`: new **required** `SourceReportInvoice.splitKind: 'lines' | 'deposits' | 'both' | null`.
+- `server/src/services/sourceReportService.ts` step f: UNION query gains an `origin` literal per arm
+  + two `MAX(CASE...)` conditional aggregates (`has_foreign_line_source`/`has_foreign_deposit_source`),
+  same `db.all` call, `COUNT(DISTINCT source_id)` untouched as the `isSplit` basis.
+- `client/src/lib/reportContent/buildReportContent.ts`: pre-pass rewritten — `isSplit`/`isDepositReduced`
+  driven purely by `splitKind` (`'lines'|'both'` / `'deposits'|'both'`); `isDeposit`'s trigger is
+  UNCHANGED (`invoice.isSplit(raw) && hasOwnTaggedDeposit`) — the old `if/else` between constituted
+  and reduced is gone, so `isDeposit` and `isDepositReduced` can now co-occur (§3.4 mixed case).
+
+## The trap (AC 1.5) — pin this in any future touch of the step-f query
+
+The predicate is **"this arm contains a source ≠ S"**, NOT "this arm contains ≥2 distinct sources".
+AC 1.2's shape (lines all in A, one deposit tagged to B) has exactly ONE source per arm (`{A}` in
+the line arm, `{B}` in the deposit arm) yet must resolve to `splitKind: 'deposits'`. A naive
+"count distinct sources per arm" implementation returns `null` here and silently reproduces the bug.
+Test: `sourceReportService.test.ts` "AC 1.5 (the trap)".
+
+## AC 1.9 regression-guard mechanism (UNION dedup)
+
+Adding the `origin` column to each UNION arm **defeats UNION's cross-arm row dedup** — a source
+appearing in BOTH arms (e.g. S has both a budget line AND a tagged deposit, both tagged to S) now
+yields two rows (`(S, 'line')` and `(S, 'deposit')`) instead of collapsing to one. `COUNT(DISTINCT
+source_id)` must stay the `isSplit` basis (not `COUNT(*)` over the subquery) or this fixture flips
+`isSplit` from false to true. Fixture: source S has both a line AND a tagged deposit, both tagged S,
+nothing else → `isSplit === false && splitKind === null`.
+
+## AC 1.8 round-trip proof technique (drizzle `sql`` introspection)
+
+`jest.spyOn(db, 'all')` with **no** `.mockImplementation` is a genuine pass-through (jest's default
+spy behavior calls through to the real method) — proves "same statement, not a second query" without
+faking the DB layer. To find the step-f call among all `db.all` calls without a real SQL-to-string
+API (`SQL.toQuery()` throws without dialect config), reconstruct static text from drizzle's internal
+`SQL.queryChunks` array: string segments are `{ value: string[] }`-shaped, bound params appear as
+raw (unwrapped) values interleaved — join only the string-chunk `.value` arrays, skip everything
+else, and check the result contains a literal from the query (`'split_data'` in this case, which
+never straddles an interpolation boundary in the source).
+
+## Client-side ripple: `splitKind` isn't just a factory default — it changes WHICH tests are real
+
+Adding `splitKind: null` to a `SourceReportInvoice` factory default is not cosmetic. Any pre-existing
+test that constructed `isSplit: true` + `budgetLines`/`deposits` shapes to drive the OLD
+`isSplit && budgetLines.length>0` / `isSplit && deposits.length>0 && !tagged` gates goes **vacuously
+green with the wrong assertions silently passing** — or breaks outright — because those gates are
+gone. Found and fixed 9 broken pre-existing tests this way, entirely OUTSIDE the "add splitKind"
+checklist item, by just running the file after the factory-default edit and reading every failure:
+
+- `buildReportContent.test.ts`: the whole `describe('isSplit / isDepositReduced / isDeposit flags')`
+  block (rewrite, not append) AND the whole footnote/legend describe block below it — both drove
+  behavior from `isSplit`+array-shape, both needed `splitKind` on every fixture. One test's assertion
+  was **exactly backwards** post-fix (`isSplit=true, budgetLines:[], deposits:[]` used to assert
+  `isSplit(row)===false`; post-#1911 with `splitKind:'lines'` it must assert `true` — this is the
+  explicit AC 3.1 zero-contribution-line regression case, not a mistake to "fix back").
+- `realRender.test.ts`: 5 pre-existing tests broke (`makeMixedReport`'s two line-split fixtures needed
+  `splitKind:'lines'`; `makeUsageFeatureReport`'s "Reduced Vendor" fixture used an UNTAGGED deposit
+  to drive `isDepositReduced` — that's now the AC 3.2 *over-inclusive* bug shape and must NOT fire;
+  rewrote it to `splitKind:'both', deposits:[]` to preserve the original test's intent (this ONE
+  fixture alone produced both legend entries under the old code) without relying on the now-fixed
+  bug to do it; two `#1980` legend tests needed the same treatment). Also proactively fixed 2 more
+  "worst-case content" fixtures that DIDN'T fail (column widths are content-independent since #1929
+  round 3, so a missing `splitKind` doesn't break an assertion there) but WOULD silently under-render
+  their documented "worst case" intent without it — worth doing when found, not just when red.
+- 4 files needed **only** the factory default (`isSplit:` literal always paired 1:1 with a
+  `splitKind:` default, no fixture-specific overrides anywhere in the file): `reportExclusions.test.ts`,
+  `reportPdf/merge.test.ts`, `ReportInvoiceList.test.tsx`, `shared/reportMath.test.ts`.
+- `ReportWizardPage.test.tsx`/`.aiGeneration.test.tsx`: 10+2 raw literals, all `isSplit: false,`
+  immediately followed by `documents: [],` — safe to batch-fix with a scoped `perl -pi -e
+  's/^(\s*)isSplit: false,$/$1isSplit: false,\n$1splitKind: null,/'` on just these two files (verified
+  every match was this exact shape via grep count parity with the spec's line list before running it).
+- CONFIRMED NOT needing changes (verified via `makeRow`/type import inspection, not just doc trust):
+  `ReportContentEditor.test.tsx`, `overviewPdf.test.ts`, `applyAiContent.test.ts`,
+  `applyOverrides.test.ts` — all build `ReportContentRow` (client-only content-model type with its
+  own unrelated `isSplit` boolean), never `SourceReportInvoice`.
+
+## AC 1.2 anti-vacuity verification (git-stash technique, [[story-1929-round2-real-render-technique]])
+
+Both the `buildReportContent.test.ts` AC1.2 test and its own AC5.5 mutation test were verified via
+`git show HEAD:<file> > <file>` (production files were uncommitted working-tree changes, so `HEAD`
+IS the pre-#1911 code — no need to find a prior commit). 9 of 70 tests in the file genuinely failed
+against the reverted code, including the AC1.2 headline test itself (`isDepositReduced: Expected
+true, Received false`) — confirms these are not vacuous. Restore via `cp` from a `/tmp` backup taken
+before the swap, re-run to confirm 70/70 green again.
+
+## Gap found in review: a green Jest run is NOT proof a new required field was threaded everywhere
+
+Review round found `client/src/pages/ReportWizardPage/wizardReducer.test.ts`'s `makeInvoice` factory
+(untouched by my diff, not in the spec's file list) still missing `splitKind` — a real
+`tsc --noEmit -p client/tsconfig.json` break (TS2741), invisible to `npx jest` because **ts-jest
+runs no type diagnostics in this repo**. All 495 tests were green and coverage was accurate; the
+build was still broken. Grepping the spec's named files for `isSplit:` is not a substitute for a
+compiler sweep when a shared type gains a required field — the compiler enumerates every
+construction site, a targeted grep only finds the ones you already thought to look for.
+
+**Action for future stories that add a required field to a shared type**: after finishing the test
+sweep, run `npx tsc --noEmit -p client/tsconfig.json` and `-p server/tsconfig.json` as a final check,
+scoped to "does this introduce any error in a file this PR touches or any file that constructs the
+changed type" — do not judge by the raw error count alone, since a worktree can carry pre-existing
+unrelated errors. In this case both projects came back fully clean (0 errors) after the one-line fix
+(`splitKind: null,` next to `isSplit: false,`), so whatever pre-existing error count the coordinator
+warned about didn't materialize for this run — but the scoped-check discipline is the reusable
+lesson, not the specific number.
+
+## Coverage
+
+`sourceReportService.ts`: 100% stmts/lines/funcs, 93.75% branch (whole-file; the new splitKind lines
+269-317 are 100% branch-covered themselves — the uncovered branches are pre-existing, unrelated
+`markInvoicesClaimed`/Rail-B-metadata defensive paths at lines 233-237/372/437/458/462/609/688).
+`buildReportContent.ts`: 100% stmts/lines/funcs, 97.54% branch.
diff --git a/client/src/components/reports/ReportInvoiceList.test.tsx b/client/src/components/reports/ReportInvoiceList.test.tsx
index 42c753171..22300d60c 100644
--- a/client/src/components/reports/ReportInvoiceList.test.tsx
+++ b/client/src/components/reports/ReportInvoiceList.test.tsx
@@ -74,6 +74,7 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
     allocatedAmount: 1000,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [],
     deposits: [],
diff --git a/client/src/lib/reportContent/buildReportContent.test.ts b/client/src/lib/reportContent/buildReportContent.test.ts
index 75f92a008..ddad8b2e7 100644
--- a/client/src/lib/reportContent/buildReportContent.test.ts
+++ b/client/src/lib/reportContent/buildReportContent.test.ts
@@ -45,6 +45,7 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
     allocatedAmount: 1000,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [],
     deposits: [],
@@ -342,9 +343,16 @@ describe('buildReportContent — rows', () => {
     });
   });
 
-  describe('isSplit / isDepositReduced / isDeposit flags', () => {
-    it('sets isSplit=true when isSplit and budgetLines.length > 0, no deposits', () => {
+  // #1911: rewritten to derive isSplit/isDepositReduced/isDeposit from `splitKind` (§3), not from
+  // the old `invoice.isSplit && budgetLines.length > 0` / `isSplit && deposits.length > 0 &&
+  // !hasOwnTaggedDeposit` gates — those were unsound (claim reports drop zero-contribution budget
+  // lines, and a foreign-tagged deposit is invisible in deposits[] server-side; see PO AC §3.1/3.2).
+  // isDeposit's trigger is UNCHANGED (§3.3: invoice.isSplit && hasOwnTaggedDeposit, still read from
+  // the visible deposits[]) — only isSplit/isDepositReduced move onto splitKind.
+  describe('isSplit / isDepositReduced / isDeposit flags (#1911: driven by splitKind)', () => {
+    it('AC 3.1: splitKind "lines" → row.isSplit true, others false, WITH budget lines present', () => {
       const invoice = makeInvoice({
+        splitKind: 'lines',
         isSplit: true,
         budgetLines: [makeBudgetLine()],
         deposits: [],
@@ -356,11 +364,26 @@ describe('buildReportContent — rows', () => {
       expect(content.rows[0]!.isDeposit).toBe(false);
     });
 
-    it('sets isDepositReduced=true when isSplit and the deposit is untagged (reduced), no budget lines', () => {
+    it('AC 3.1 (regression, #1898/claim zero-contribution-line drop): splitKind "lines" → row.isSplit true even with an EMPTY budgetLines array — the old array-length gate is gone, splitKind alone decides', () => {
       const invoice = makeInvoice({
+        splitKind: 'lines',
+        isSplit: true,
+        budgetLines: [], // claim reports drop zero-contribution lines (step h) — must not suppress isSplit
+        deposits: [],
+      });
+      const report = makeReport([invoice]);
+      const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
+      expect(content.rows[0]!.isSplit).toBe(true);
+      expect(content.rows[0]!.isDepositReduced).toBe(false);
+      expect(content.rows[0]!.isDeposit).toBe(false);
+    });
+
+    it('AC 1.2/3.2 (THE MOST IMPORTANT TEST IN THIS FILE — the filed #1911 bug, under-inclusive direction): splitKind "deposits" with deposits: [] (the exact AC 1.2 server shape — the foreign-tagged deposit is invisible) → isDepositReduced true, isSplit false. Provably impossible to satisfy under the pre-#1911 code (verified via git-stash technique, see PR notes)', () => {
+      const invoice = makeInvoice({
+        splitKind: 'deposits',
         isSplit: true,
         budgetLines: [],
-        deposits: [makeDeposit({ budgetSourceId: null })],
+        deposits: [], // the foreign-tagged deposit that CAUSED this never appears here — that's the bug
       });
       const report = makeReport([invoice], { id: 'src-1' });
       const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
@@ -369,46 +392,56 @@ describe('buildReportContent — rows', () => {
       expect(content.rows[0]!.isDeposit).toBe(false);
     });
 
-    it('AC2.1: sets isDeposit=true (not isSplit/isDepositReduced) when the deposit is tagged to this report source (constituted)', () => {
+    it('AC 3.3: splitKind "deposits" with a deposit tagged to THIS report source → isDeposit true (constituted trigger unchanged: invoice.isSplit && hasOwnTaggedDeposit)', () => {
+      // Realistic shape: an own-tagged (S) deposit is visible AND a foreign-tagged deposit made
+      // splitKind "deposits" (that foreign one stays invisible, per AC 1.10 — not modeled here
+      // since deposits[] only ever carries untagged-or-this-source rows).
       const invoice = makeInvoice({
+        splitKind: 'deposits',
         isSplit: true,
         budgetLines: [],
         deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
       });
       const report = makeReport([invoice], { id: 'src-1' });
       const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
-      expect(content.rows[0]!.isSplit).toBe(false);
-      expect(content.rows[0]!.isDepositReduced).toBe(false);
       expect(content.rows[0]!.isDeposit).toBe(true);
+      // Structural consequence, not incidental: splitKind "deposits" still drives isDepositReduced
+      // regardless of the own-tagged deposit also being present — the two facts coexist (§3.4).
+      expect(content.rows[0]!.isDepositReduced).toBe(true);
+      expect(content.rows[0]!.isSplit).toBe(false);
     });
 
-    it('AC2.4: sets both isSplit and isDepositReduced when split budget lines and a reduced deposit are both present', () => {
+    it('AC 3.4 (the mixed case — resolves the #1911 wording nit): splitKind "both" with an own tagged deposit → isDeposit AND isDepositReduced BOTH true simultaneously. The old if/else made this impossible; this test is the direct proof the else is gone', () => {
       const invoice = makeInvoice({
+        splitKind: 'both',
         isSplit: true,
         budgetLines: [makeBudgetLine()],
-        deposits: [makeDeposit({ budgetSourceId: null })],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
       });
       const report = makeReport([invoice], { id: 'src-1' });
       const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
-      expect(content.rows[0]!.isSplit).toBe(true);
+      expect(content.rows[0]!.isDeposit).toBe(true);
       expect(content.rows[0]!.isDepositReduced).toBe(true);
+      expect(content.rows[0]!.isSplit).toBe(true);
     });
 
-    it('sets isSplit=true and isDeposit=true when split budget lines combined with a constituted (tagged) deposit', () => {
+    it('AC 3.2 (over-inclusive fix): splitKind "lines" with an UNTAGGED deposit present → isDepositReduced false. Untagged deposits are apportioned pro-rata back into THIS source (not claimed "separately") — pre-#1911 code fired isDepositReduced here, producing a false "claimed separately" legend sentence', () => {
       const invoice = makeInvoice({
+        splitKind: 'lines',
         isSplit: true,
         budgetLines: [makeBudgetLine()],
-        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+        deposits: [makeDeposit({ budgetSourceId: null })],
       });
       const report = makeReport([invoice], { id: 'src-1' });
       const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
       expect(content.rows[0]!.isSplit).toBe(true);
       expect(content.rows[0]!.isDepositReduced).toBe(false);
-      expect(content.rows[0]!.isDeposit).toBe(true);
+      expect(content.rows[0]!.isDeposit).toBe(false);
     });
 
-    it('all flags are false when isSplit is false, regardless of budgetLines/deposits content', () => {
+    it('AC 2.1/3: splitKind null → all three flags false, regardless of array contents (isSplit raw field kept false too, matching the real invariant splitKind !== null iff isSplit)', () => {
       const invoice = makeInvoice({
+        splitKind: null,
         isSplit: false,
         budgetLines: [makeBudgetLine()],
         deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
@@ -420,20 +453,13 @@ describe('buildReportContent — rows', () => {
       expect(content.rows[0]!.isDeposit).toBe(false);
     });
 
-    it('all flags are false when isSplit is true but budgetLines and deposits are both empty', () => {
-      const invoice = makeInvoice({ isSplit: true, budgetLines: [], deposits: [] });
-      const report = makeReport([invoice]);
-      const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
-      expect(content.rows[0]!.isSplit).toBe(false);
-      expect(content.rows[0]!.isDepositReduced).toBe(false);
-      expect(content.rows[0]!.isDeposit).toBe(false);
-    });
-
-    it('never sets flags on an excluded invoice, even when isSplit with lines/deposits', () => {
+    it('never sets flags on an excluded invoice, even with splitKind "both" and a tagged deposit', () => {
       const invoice = makeInvoice({
         invoiceId: 'inv-excluded',
+        splitKind: 'both',
         isSplit: true,
         budgetLines: [makeBudgetLine()],
+        deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
       });
       const included = makeInvoice({ invoiceId: 'inv-1' });
       const report = makeReport([invoice, included]);
@@ -441,13 +467,56 @@ describe('buildReportContent — rows', () => {
       expect(content.rows).toHaveLength(1);
       expect(content.footnotes).toEqual([]);
     });
+
+    it('AC 5.5 (anti-vacuity, required): mutating a fixture from splitKind "deposits" to splitKind "lines" flips isSplit/isDepositReduced AND flips which legend footnote appears', () => {
+      const depositsShape = makeInvoice({
+        splitKind: 'deposits',
+        isSplit: true,
+        budgetLines: [],
+        deposits: [],
+      });
+      const linesShape = makeInvoice({
+        ...depositsShape,
+        splitKind: 'lines',
+        budgetLines: [makeBudgetLine()],
+      });
+
+      const depositsContent = buildReportContent(
+        makeReport([depositsShape], { id: 'src-1' }),
+        new Set(['inv-1']),
+        'claim',
+        t,
+        formatters,
+      );
+      const linesContent = buildReportContent(
+        makeReport([linesShape], { id: 'src-1' }),
+        new Set(['inv-1']),
+        'claim',
+        t,
+        formatters,
+      );
+
+      // Row flags flip.
+      expect(depositsContent.rows[0]!.isSplit).toBe(false);
+      expect(depositsContent.rows[0]!.isDepositReduced).toBe(true);
+      expect(linesContent.rows[0]!.isSplit).toBe(true);
+      expect(linesContent.rows[0]!.isDepositReduced).toBe(false);
+
+      // Legend membership flips accordingly — deposit-reduced footnote ONLY under "deposits",
+      // split footnote ONLY under "lines". An assertion that stayed green across this mutation
+      // would not be real coverage (this repo has a documented history of exactly that failure
+      // mode) — this test's whole point is that it does NOT stay green.
+      expect(depositsContent.footnotes.map((f) => f.id)).toEqual(['depositReduced']);
+      expect(linesContent.footnotes.map((f) => f.id)).toEqual(['split']);
+    });
   });
 });
 
-describe('buildReportContent — footnotes (legend sentences for split/depositReduced)', () => {
-  it('AC 1.1 — split flag: one split invoice included produces a footnote with id "split" and the correct keys', () => {
+describe('buildReportContent — footnotes (legend sentences for split/depositReduced) (#1911: re-driven by splitKind)', () => {
+  it('AC 1.1 / §7.1 — split flag: one splitKind "lines" invoice included produces a footnote with id "split" and the correct keys', () => {
     const inv = makeInvoice({
       invoiceId: 'inv-1',
+      splitKind: 'lines',
       isSplit: true,
       budgetLines: [makeBudgetLine()],
       deposits: [],
@@ -460,12 +529,13 @@ describe('buildReportContent — footnotes (legend sentences for split/depositRe
     expect(content.footnotes[0]!.text).toBe('sourceReports.table.splitFootnote');
   });
 
-  it('AC 1.2 — depositReduced flag: one depositReduced invoice produces a footnote with id "depositReduced"', () => {
+  it('AC 1.2 / §7.1 — depositReduced flag: one splitKind "deposits" invoice (the AC 1.2 shape — deposits: []) produces a footnote with id "depositReduced"', () => {
     const inv = makeInvoice({
       invoiceId: 'inv-1',
+      splitKind: 'deposits',
       isSplit: true,
       budgetLines: [],
-      deposits: [makeDeposit({ budgetSourceId: null })],
+      deposits: [],
     });
     const report = makeReport([inv], { id: 'src-1' });
     const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
@@ -473,12 +543,13 @@ describe('buildReportContent — footnotes (legend sentences for split/depositRe
     expect(content.footnotes[0]!.id).toBe('depositReduced');
   });
 
-  it('AC 1.3 — both flags: split and depositReduced present → footnotes length 2, split first, depositReduced second', () => {
+  it('AC 1.3 / §7.2 — both flags: splitKind "both" → footnotes length 2 (never 3 — no constituted legend sentence exists), split first, depositReduced second', () => {
     const inv = makeInvoice({
       invoiceId: 'inv-1',
+      splitKind: 'both',
       isSplit: true,
       budgetLines: [makeBudgetLine()],
-      deposits: [makeDeposit({ budgetSourceId: null })],
+      deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
     });
     const report = makeReport([inv], { id: 'src-1' });
     const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
@@ -487,21 +558,23 @@ describe('buildReportContent — footnotes (legend sentences for split/depositRe
     expect(content.footnotes[1]!.id).toBe('depositReduced');
   });
 
-  it('AC 1.4 — neither flag: normal invoice → footnotes is empty', () => {
-    const inv = makeInvoice({ invoiceId: 'inv-1', isSplit: false });
+  it('AC 1.4 — neither flag: splitKind null invoice → footnotes is empty', () => {
+    const inv = makeInvoice({ invoiceId: 'inv-1', splitKind: null, isSplit: false });
     const report = makeReport([inv]);
     const content = buildReportContent(report, new Set(['inv-1']), 'claim', t, formatters);
     expect(content.footnotes).toEqual([]);
   });
 
-  it('AC 1.5 — deduplication: two split invoices produce only one footnote entry', () => {
+  it('AC 1.5 — deduplication: two splitKind "lines" invoices produce only one footnote entry', () => {
     const inv1 = makeInvoice({
       invoiceId: 'inv-1',
+      splitKind: 'lines',
       isSplit: true,
       budgetLines: [makeBudgetLine()],
     });
     const inv2 = makeInvoice({
       invoiceId: 'inv-2',
+      splitKind: 'lines',
       isSplit: true,
       budgetLines: [makeBudgetLine()],
     });
@@ -514,32 +587,37 @@ describe('buildReportContent — footnotes (legend sentences for split/depositRe
   it('excluded split invoice does not contribute to footnotes', () => {
     const excluded = makeInvoice({
       invoiceId: 'inv-excluded',
+      splitKind: 'both',
       isSplit: true,
       budgetLines: [makeBudgetLine()],
-      deposits: [makeDeposit({ budgetSourceId: null })],
+      deposits: [makeDeposit({ budgetSourceId: 'src-1' })],
+    });
+    const included = makeInvoice({
+      invoiceId: 'inv-included',
+      splitKind: null,
+      isSplit: false,
     });
-    const included = makeInvoice({ invoiceId: 'inv-included', isSplit: false });
     const report = makeReport([excluded, included], { id: 'src-1' });
     const content = buildReportContent(report, new Set(['inv-included']), 'claim', t, formatters);
     expect(content.footnotes).toEqual([]);
   });
 
   it('AC4 (#1980) — depositReduced dedup: two deposit-reduced invoices produce exactly one footnote entry', () => {
-    // Two invoices both with isSplit=true and an untagged deposit (budgetSourceId: null).
-    // Empty budgetLines ensures no splitInvoiceIds entry — the only flag is depositReduced.
-    // buildReportContent accumulates depositReducedInvoiceIds as a Set, so two matching
-    // invoices collapse to a single `{ id: "depositReduced" }` legend entry, not two.
+    // Two invoices both splitKind "deposits" (deposits: [] — the AC 1.2 shape, not an untagged
+    // deposit, which after #1911 AC 3.2 no longer triggers depositReduced at all).
     const inv1 = makeInvoice({
       invoiceId: 'inv-dr-1',
+      splitKind: 'deposits',
       isSplit: true,
       budgetLines: [],
-      deposits: [makeDeposit({ budgetSourceId: null })],
+      deposits: [],
     });
     const inv2 = makeInvoice({
       invoiceId: 'inv-dr-2',
+      splitKind: 'deposits',
       isSplit: true,
       budgetLines: [],
-      deposits: [makeDeposit({ id: 'dep-2', budgetSourceId: null })],
+      deposits: [],
     });
     const report = makeReport([inv1, inv2], { id: 'src-1' });
     const content = buildReportContent(
diff --git a/client/src/lib/reportContent/buildReportContent.ts b/client/src/lib/reportContent/buildReportContent.ts
index fd176af74..935cd3d25 100644
--- a/client/src/lib/reportContent/buildReportContent.ts
+++ b/client/src/lib/reportContent/buildReportContent.ts
@@ -144,7 +144,10 @@ export function buildReportContent(
     generatedAtText,
   };
 
-  // Track invoices for split/deposit markers
+  // Track invoices for split/deposit markers (#1911: driven by splitKind, not isSplit +
+  // budgetLines/deposits shape — the array-shape gate was unsound: claim reports drop
+  // zero-contribution budget lines (§3.1), and a foreign-tagged deposit is filtered out of
+  // deposits[] server-side entirely (§3.2, the bug this story exists to fix).
   const splitInvoiceIds = new Set<string>();
   const depositReducedInvoiceIds = new Set<string>();
   const depositConstitutedInvoiceIds = new Set<string>();
@@ -154,17 +157,22 @@ export function buildReportContent(
       continue;
     }
 
-    if (invoice.isSplit && invoice.budgetLines.length > 0) {
+    // AC 3.1: row.isSplit ⟺ splitKind === 'lines' || splitKind === 'both'
+    if (invoice.splitKind === 'lines' || invoice.splitKind === 'both') {
       splitInvoiceIds.add(invoice.invoiceId);
     }
 
-    if (invoice.isSplit && invoice.deposits.length > 0) {
-      const taggedDeposit = invoice.deposits.some((d) => d.budgetSourceId === report.source.id);
-      if (taggedDeposit) {
-        depositConstitutedInvoiceIds.add(invoice.invoiceId);
-      } else {
-        depositReducedInvoiceIds.add(invoice.invoiceId);
-      }
+    // AC 3.2: row.isDepositReduced ⟺ splitKind === 'deposits' || splitKind === 'both'
+    if (invoice.splitKind === 'deposits' || invoice.splitKind === 'both') {
+      depositReducedInvoiceIds.add(invoice.invoiceId);
+    }
+
+    // AC 3.3: row.isDeposit (constituted) trigger is UNCHANGED — still invoice.isSplit &&
+    // hasOwnTaggedDeposit, still read from the visible deposits[]. Decoupling isDeposit from
+    // isSplit is an explicit non-goal (§3).
+    const hasOwnTaggedDeposit = invoice.deposits.some((d) => d.budgetSourceId === report.source.id);
+    if (invoice.isSplit && hasOwnTaggedDeposit) {
+      depositConstitutedInvoiceIds.add(invoice.invoiceId);
     }
   }
 
diff --git a/client/src/lib/reportExclusions.test.ts b/client/src/lib/reportExclusions.test.ts
index 1cf7c6c75..9fac3b762 100644
--- a/client/src/lib/reportExclusions.test.ts
+++ b/client/src/lib/reportExclusions.test.ts
@@ -16,6 +16,7 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
     allocatedAmount: 1000,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [],
     deposits: [],
diff --git a/client/src/lib/reportPdf/merge.test.ts b/client/src/lib/reportPdf/merge.test.ts
index 5e6e20399..19d19ede3 100644
--- a/client/src/lib/reportPdf/merge.test.ts
+++ b/client/src/lib/reportPdf/merge.test.ts
@@ -163,6 +163,7 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
     allocatedAmount: 1000,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [],
     deposits: [],
diff --git a/client/src/lib/reportPdf/realRender.test.ts b/client/src/lib/reportPdf/realRender.test.ts
index bb397557a..af11d7a35 100644
--- a/client/src/lib/reportPdf/realRender.test.ts
+++ b/client/src/lib/reportPdf/realRender.test.ts
@@ -429,6 +429,7 @@ function makeInvoice(overrides: Partial<SourceReportInvoice> = {}): SourceReport
     allocatedAmount: 100,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [],
     deposits: [],
@@ -454,6 +455,7 @@ async function makeMixedReport(): Promise<{
     vendorName: 'Split Vendor',
     invoiceNumber: 'S-1',
     isSplit: true,
+    splitKind: 'lines', // #1911: a genuine line split (foreign budget-line source)
     invoiceAmount: 800,
     allocatedAmount: 300,
     budgetLines: [
@@ -465,6 +467,7 @@ async function makeMixedReport(): Promise<{
     vendorName: 'Split-Doc Vendor',
     invoiceNumber: 'S-2',
     isSplit: true,
+    splitKind: 'lines', // #1911: a genuine line split (foreign budget-line source)
     invoiceAmount: 700,
     allocatedAmount: 250,
     documents: [{ documentId: 1, archiveSerialNumber: null, title: null, attachmentType: null }],
@@ -824,6 +827,10 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
         vendorName: 'Constituted Vendor',
         invoiceNumber: 'U-5',
         isSplit: true,
+        // #1911: splitKind stays null — this fixture isolates the isDeposit trigger, which is
+        // UNCHANGED (invoice.isSplit && hasOwnTaggedDeposit, §3.3) and does not depend on
+        // splitKind at all. Nothing here is foreign (only an own-tagged deposit is present).
+        splitKind: null,
         invoiceAmount: 250,
         allocatedAmount: 250,
         budgetLines: [],
@@ -845,23 +852,20 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
         vendorName: 'Reduced Vendor',
         invoiceNumber: 'U-6',
         isSplit: true,
+        // #1911 AC 1.2 shape: splitKind "both" — this fixture is what pre-#1911 code (wrongly)
+        // treated as "split (from non-empty budgetLines) AND deposit-reduced (from an untagged
+        // deposit)" simultaneously. Post-#1911, an UNTAGGED deposit no longer triggers
+        // isDepositReduced at all (§3.2 over-inclusive fix) — the reduction must come from a
+        // genuinely foreign-tagged deposit, which is invisible in deposits[] (§1.10). "both"
+        // preserves this row contributing BOTH the split and depositReduced legend entries, same
+        // as the original fixture intended, without relying on the fixed bug to do it.
+        splitKind: 'both',
         invoiceAmount: 150,
         allocatedAmount: 150,
         budgetLines: [
           { id: 'bl-reduced', description: null, allocatedPortion: 150, linkedItem: null },
         ],
-        deposits: [
-          {
-            id: 'dep-reduced',
-            amount: 50,
-            status: 'pending',
-            entryType: 'deposit',
-            dueDate: '2026-02-01',
-            paidDate: null,
-            claimedDate: null,
-            budgetSourceId: null, // untagged -> "reduced" wording
-          },
-        ],
+        deposits: [], // the foreign-tagged deposit causing the reduction is invisible (§1.10)
       });
 
       return {
@@ -1689,6 +1693,7 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
         vendorName: 'Bau- und Sanitärtechnik Schwarzwald e.K.',
         invoiceNumber: 'WORST-0001',
         isSplit: true,
+        splitKind: 'lines', // #1911: genuine line split, drives the ' (partial)' inline label
         invoiceAmount: 1234.56,
         allocatedAmount: 987.65,
         budgetLines: [
@@ -1701,6 +1706,7 @@ describe('report PDF pipeline — real, unmocked end-to-end render', () => {
         vendorName: 'Elektro Müller GmbH & Co. KG',
         invoiceNumber: 'WORST-0002',
         isSplit: true,
+        splitKind: null, // isDeposit trigger is unchanged (isSplit && hasOwnTaggedDeposit), §3.3
         invoiceAmount: 500,
         allocatedAmount: 500,
         budgetLines: [],
@@ -2900,6 +2906,7 @@ describe('production i18n singleton — getFixedT resolves a language independen
       vendorName: 'Constituted Vendor',
       invoiceNumber: 'U-5',
       isSplit: true,
+      splitKind: null, // isDeposit trigger is unchanged (isSplit && hasOwnTaggedDeposit), §3.3
       invoiceAmount: 250,
       allocatedAmount: 250,
       budgetLines: [],
@@ -3230,6 +3237,7 @@ describe('legend sentence layout and occurrence count (#1980)', () => {
       const splitInv = makeInvoice({
         invoiceId: 'inv-leg-split',
         isSplit: true,
+        splitKind: 'lines', // #1911: genuine line split
         invoiceAmount: 300,
         allocatedAmount: 300,
         budgetLines: [
@@ -3240,21 +3248,14 @@ describe('legend sentence layout and occurrence count (#1980)', () => {
       const depositReducedInv = makeInvoice({
         invoiceId: 'inv-leg-deposit',
         isSplit: true,
+        // #1911 AC 1.2 shape: the reduction comes from a foreign-TAGGED deposit, which is
+        // invisible in deposits[] (§1.10) — an untagged deposit no longer triggers
+        // isDepositReduced at all (§3.2 over-inclusive fix).
+        splitKind: 'deposits',
         invoiceAmount: 150,
         allocatedAmount: 150,
         budgetLines: [],
-        deposits: [
-          {
-            id: 'dep-leg',
-            amount: 50,
-            status: 'pending' as const,
-            entryType: 'deposit' as const,
-            dueDate: '2026-02-01',
-            paidDate: null,
-            claimedDate: null,
-            budgetSourceId: null, // untagged → isDepositReduced=true
-          },
-        ],
+        deposits: [],
       });
       const report: SourceReportResponse = {
         type: 'claim',
@@ -3311,6 +3312,7 @@ describe('legend sentence layout and occurrence count (#1980)', () => {
     const inv1 = makeInvoice({
       invoiceId: 'inv-split-a',
       isSplit: true,
+      splitKind: 'lines',
       invoiceAmount: 200,
       allocatedAmount: 200,
       budgetLines: [
@@ -3320,6 +3322,7 @@ describe('legend sentence layout and occurrence count (#1980)', () => {
     const inv2 = makeInvoice({
       invoiceId: 'inv-split-b',
       isSplit: true,
+      splitKind: 'lines',
       invoiceAmount: 150,
       allocatedAmount: 150,
       budgetLines: [
@@ -3411,6 +3414,233 @@ describe('legend sentence layout and occurrence count (#1980)', () => {
   });
 });
 
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// #1911 §5.3 — the AC 1.2 shape (splitKind "deposits", deposits: [] — the foreign-tagged deposit
+// causing the split is invisible server-side) renders the deposit-reduced inline label and legend
+// sentence, and NEVER the split label/sentence, through the real, unmocked pdfmake pipeline in
+// both locales. This is the content-level companion to the AC 1.2 server test (which proves the
+// derivation) and the buildReportContent unit test (which proves the flag) — this one proves the
+// PDF a bank recipient actually reads carries the correct wording.
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+describe('#1911 AC 5.3: the AC 1.2 shape renders (less deposit)/depositReducedFootnote, never (partial)/splitFootnote (real i18n, both locales)', () => {
+  function collectAllStrings(node: unknown, out: string[] = []): string[] {
+    if (typeof node === 'string') {
+      out.push(node);
+    } else if (Array.isArray(node)) {
+      for (const item of node) collectAllStrings(item, out);
+    } else if (node !== null && typeof node === 'object') {
+      for (const value of Object.values(node as Record<string, unknown>)) {
+        collectAllStrings(value, out);
+      }
+    }
+    return out;
+  }
+
+  it.each([['en', 'en-US', () => tEn] as const, ['de', 'de-DE', () => tDe] as const])(
+    '%s locale',
+    async (_label, localeStr, getT) => {
+      const { buildOverviewContent } = await import('./overviewPdf.js');
+      const t = getT();
+      const formatters = formattersFor(localeStr as 'en-US' | 'de-DE');
+
+      const inv = makeInvoice({
+        invoiceId: 'inv-1911-ac12',
+        vendorName: 'AC12 Vendor',
+        isSplit: true,
+        splitKind: 'deposits',
+        invoiceAmount: 500,
+        allocatedAmount: 500,
+        budgetLines: [],
+        deposits: [], // the foreign-tagged deposit causing the split is invisible (§1.10)
+      });
+      const report: SourceReportResponse = {
+        type: 'claim',
+        source: {
+          id: 'src-ac12',
+          name: 'Source AC12',
+          sourceType: 'bank_loan',
+          reference: null,
+          contactAddress: null,
+        },
+        invoices: [inv],
+        totalAmount: 500,
+        unallocatedInvoices: [],
+        generatedAt: '2026-03-01T00:00:00.000Z',
+      };
+
+      const content = buildReportContent(
+        report,
+        new Set(['inv-1911-ac12']),
+        'claim',
+        t,
+        formatters,
+        { includeCoverLetter: false, household: null },
+      );
+      // Sanity at the model level before rendering.
+      expect(content.rows[0]!.isDepositReduced).toBe(true);
+      expect(content.rows[0]!.isSplit).toBe(false);
+      expect(content.footnotes.map((f) => f.id)).toEqual(['depositReduced']);
+
+      const pdfContent = buildOverviewContent(content, new Map());
+      await renderOverviewPdfContent(
+        pdfContent,
+        { tableTitle: content.tableTitle, sourceName: content.sourceInfo.sourceName },
+        t,
+      );
+
+      const tableItem = pdfContent.find(
+        (c) => typeof c === 'object' && c !== null && 'table' in c,
+      ) as { table: { body: unknown[][] } };
+      const row = tableItem.table.body.find(
+        (r) => usageCellText((r[0] as { text?: unknown })?.text) === 'AC12 Vendor',
+      ) as { text: unknown }[];
+      const allocatedRuns = (row[4] as { text: { text: string }[] }).text;
+      expect(Array.isArray(allocatedRuns)).toBe(true);
+      const allocatedText = allocatedRuns.map((r) => r.text).join('');
+
+      const depositReducedLabel = ` (${content.labels.depositReducedNote})`;
+      const splitLabel = ` (${content.labels.splitNote})`;
+      expect(allocatedText).toContain(depositReducedLabel);
+      expect(allocatedText).not.toContain(splitLabel);
+
+      // Legend sentence present in the rendered PDF content tree exactly once; split sentence absent.
+      const depositReducedSentence = content.footnotes.find((f) => f.id === 'depositReduced')!.text;
+      const splitSentence = t('sourceReports.table.splitFootnote');
+      const allStrings = collectAllStrings(pdfContent);
+      expect(allStrings.filter((s) => s.includes(depositReducedSentence))).toHaveLength(1);
+      expect(allStrings.some((s) => s.includes(splitSentence))).toBe(false);
+    },
+  );
+});
+
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+// #1911 AC 4.5 (highest-risk criterion) — the maximal four-run allocated-amount row:
+// splitKind "both" + an own-tagged deposit + lineKind "refund-adjustment" produces FOUR appended
+// runs — (Deposit) (partial) (less deposit) refundNote — reachable for the first time because §3.4
+// removes the if/else that previously capped a row at three labels. A real render at the report's
+// configured page size must paint no text outside the printable area and drop none of the four
+// labels, in both locales and under the #1973 column-visibility subsets that narrow the allocated
+// column (glossary.json records a prior wrap-mid-bracket break in exactly this column, #1959).
+// ─────────────────────────────────────────────────────────────────────────────────────────────
+describe('#1911 AC 4.5: maximal four-run allocated-amount row — real render, no overflow, no label drop', () => {
+  function makeMaximalReport(): SourceReportResponse {
+    const inv = makeInvoice({
+      invoiceId: 'inv-1911-maximal',
+      vendorName: 'Maximal Vendor',
+      invoiceNumber: 'MAX-0001',
+      isSplit: true,
+      splitKind: 'both',
+      lineKind: 'refund-adjustment',
+      invoiceAmount: 500,
+      allocatedAmount: -150,
+      budgetLines: [
+        { id: 'bl-maximal', description: 'Materials', allocatedPortion: -150, linkedItem: null },
+      ],
+      deposits: [
+        {
+          id: 'dep-maximal',
+          amount: 100,
+          status: 'paid',
+          entryType: 'deposit',
+          dueDate: '2026-01-01',
+          paidDate: null,
+          claimedDate: null,
+          budgetSourceId: 'src-maximal', // tagged to THIS source -> own-tagged (Deposit) badge
+        },
+      ],
+    });
+    return {
+      type: 'claim',
+      source: {
+        id: 'src-maximal',
+        name: 'Maximal Source',
+        sourceType: 'bank_loan',
+        reference: null,
+        contactAddress: null,
+      },
+      invoices: [inv],
+      totalAmount: -150,
+      unallocatedInvoices: [],
+      generatedAt: '2026-03-01T00:00:00.000Z',
+    };
+  }
+
+  it.each([
+    ['budget-overview 7-col', 'budget-overview' as const, 'en', 'en-US', () => tEn] as const,
+    ['budget-overview 7-col', 'budget-overview' as const, 'de', 'de-DE', () => tDe] as const,
+    ['claim 1-col', 'claim' as const, 'en', 'en-US', () => tEn] as const,
+    ['claim 1-col', 'claim' as const, 'de', 'de-DE', () => tDe] as const,
+  ])('%s, %s locale', async (_shapeLabel, useCase, _localeLabel, localeStr, getT) => {
+    const { buildOverviewContent } = await import('./overviewPdf.js');
+    const { reportColumnsForUseCase, REQUIRED_REPORT_COLUMN } =
+      await import('../reportContent/columns.js');
+    const t = getT();
+    const formatters = formattersFor(localeStr as 'en-US' | 'de-DE');
+    const report = makeMaximalReport();
+    const includedIds = new Set(['inv-1911-maximal']);
+
+    const content = buildReportContent(report, includedIds, useCase, t, formatters, {
+      includeCoverLetter: false,
+      household: null,
+    });
+    // Sanity: this really is the maximal four-run case at the model level.
+    expect(content.rows[0]!.isDeposit).toBe(true);
+    expect(content.rows[0]!.isSplit).toBe(true);
+    expect(content.rows[0]!.isDepositReduced).toBe(true);
+    expect(content.rows[0]!.isRefund).toBe(true);
+
+    // budget-overview: every column visible (the 7-col shape, default hiddenColumns). claim: every
+    // hideable column hidden except the locked allocatedAmount column — the same construction as
+    // the #1973 AC2.7 degenerate single-column block above.
+    const pdfContent =
+      useCase === 'claim'
+        ? buildOverviewContent(
+            content,
+            new Map(),
+            new Set(
+              reportColumnsForUseCase(content.isOverview).filter(
+                (c) => c !== REQUIRED_REPORT_COLUMN,
+              ),
+            ),
+          )
+        : buildOverviewContent(content, new Map());
+
+    const blob = await renderOverviewPdfContent(
+      pdfContent,
+      { tableTitle: content.tableTitle, sourceName: content.sourceInfo.sourceName },
+      t,
+    );
+
+    // AC1: nothing rendered past the printable right edge, in either shape.
+    expect(maxHorizontalRatio(pdfContent)).toBeLessThanOrEqual(1);
+
+    // Single invoice in this report -> table.body[0] is the header, table.body[1] is the one data
+    // row, regardless of which columns are visible (usage content is short: no continuation rows).
+    const tableItem = pdfContent.find(
+      (c) => typeof c === 'object' && c !== null && 'table' in c,
+    ) as { table: { body: unknown[][] } };
+    const dataRow = tableItem.table.body[1] as { text: unknown }[];
+    // allocatedAmount is the sole cell in the 1-col claim shape, or the 6th (index 5) non-usage
+    // cell before the trailing Usage cell in the 7-col budget-overview shape.
+    const allocatedCell = (useCase === 'budget-overview' ? dataRow[5] : dataRow[0]) as {
+      text: { text: string }[];
+    };
+    const allocatedRuns = allocatedCell.text;
+    expect(Array.isArray(allocatedRuns)).toBe(true);
+    const allocatedText = allocatedRuns.map((r) => r.text).join('');
+
+    // All four labels present verbatim, in the documented order — (Deposit) (partial) (less
+    // deposit) refundNote — proves no silent drop under the newly-reachable four-run row.
+    expect(allocatedText).toContain(` (${content.labels.deposit})`);
+    expect(allocatedText).toContain(` (${content.labels.splitNote})`);
+    expect(allocatedText).toContain(` (${content.labels.depositReducedNote})`);
+    expect(allocatedText).toContain(content.rows[0]!.refundNoteText);
+
+    const pdfDoc = await PDFDocument.load(await blob.arrayBuffer());
+    expect(pdfDoc.getPageCount()).toBeGreaterThanOrEqual(1);
+  });
+});
+
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 // #1973 AC 2.7 — the degenerate single-column case ({allocatedAmount} alone), through the REAL,
 // unmocked pdfmake table-layout resolver. This is the strongest guard for AC 2.7 in the whole
diff --git a/client/src/pages/ReportWizardPage/ReportWizardPage.aiGeneration.test.tsx b/client/src/pages/ReportWizardPage/ReportWizardPage.aiGeneration.test.tsx
index 1211cf09a..0d459daac 100644
--- a/client/src/pages/ReportWizardPage/ReportWizardPage.aiGeneration.test.tsx
+++ b/client/src/pages/ReportWizardPage/ReportWizardPage.aiGeneration.test.tsx
@@ -221,6 +221,7 @@ function makeReport(overrides: Partial<SourceReportResponse> = {}): SourceReport
         allocatedAmount: 1000,
         lineKind: 'invoice',
         isSplit: false,
+        splitKind: null,
         documents: [],
         budgetLines: [
           {
@@ -440,6 +441,7 @@ describe('ReportWizardPage — AI generation (Story #1901, revised by #1931)', (
               allocatedAmount: 500,
               lineKind: 'invoice',
               isSplit: false,
+              splitKind: null,
               documents: [],
               budgetLines: [],
               deposits: [],
@@ -1209,7 +1211,7 @@ describe('ReportWizardPage — AI generation (Story #1901, revised by #1931)', (
 
     // H1: a discarded generation's finally block must NOT clear the spinner that
     // belongs to a second, still-in-flight generation started after the discard.
-    it('H1 — discarded generation\'s finally does not clear spinner of new generation', async () => {
+    it("H1 — discarded generation's finally does not clear spinner of new generation", async () => {
       let resolveA!: (value: GenerateReportContentResponse) => void;
       const controlledA = new Promise<GenerateReportContentResponse>((res) => {
         resolveA = res;
diff --git a/client/src/pages/ReportWizardPage/ReportWizardPage.test.tsx b/client/src/pages/ReportWizardPage/ReportWizardPage.test.tsx
index 702159109..32bbb9412 100644
--- a/client/src/pages/ReportWizardPage/ReportWizardPage.test.tsx
+++ b/client/src/pages/ReportWizardPage/ReportWizardPage.test.tsx
@@ -250,6 +250,7 @@ function makeReport(overrides: Partial<SourceReportResponse> = {}): SourceReport
         allocatedAmount: 1000,
         lineKind: 'invoice',
         isSplit: false,
+        splitKind: null,
         documents: [],
         budgetLines: [
           {
@@ -809,6 +810,7 @@ describe('ReportWizardPage', () => {
               allocatedAmount: 1000,
               lineKind: 'invoice',
               isSplit: false,
+              splitKind: null,
               documents: [],
               budgetLines: [
                 {
@@ -1138,6 +1140,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 1000,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [{ id: 'bl-a', description: 'A', allocatedPortion: 0, linkedItem: null }],
             deposits: [],
@@ -1158,6 +1161,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 2000,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [{ id: 'bl-b', description: 'B', allocatedPortion: 0, linkedItem: null }],
             deposits: [],
@@ -1229,6 +1233,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 2000,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [
               { id: 'bl-b2', description: 'B2', allocatedPortion: 0, linkedItem: null },
@@ -1878,6 +1883,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 500,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [],
             deposits: [],
@@ -1929,6 +1935,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 500,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [],
             deposits: [],
@@ -2038,6 +2045,7 @@ describe('ReportWizardPage', () => {
               allocatedAmount: 1000,
               lineKind: 'invoice',
               isSplit: false,
+              splitKind: null,
               documents: [],
               budgetLines: [
                 {
@@ -2148,6 +2156,7 @@ describe('ReportWizardPage', () => {
               allocatedAmount: 1000,
               lineKind: 'invoice',
               isSplit: false,
+              splitKind: null,
               documents: [],
               budgetLines: [
                 {
@@ -2320,6 +2329,7 @@ describe('ReportWizardPage', () => {
             allocatedAmount: 1000,
             lineKind: 'invoice',
             isSplit: false,
+            splitKind: null,
             documents: [],
             budgetLines: [
               {
diff --git a/client/src/pages/ReportWizardPage/wizardReducer.test.ts b/client/src/pages/ReportWizardPage/wizardReducer.test.ts
index 09c01c8d1..ada1077cf 100644
--- a/client/src/pages/ReportWizardPage/wizardReducer.test.ts
+++ b/client/src/pages/ReportWizardPage/wizardReducer.test.ts
@@ -49,6 +49,7 @@ function makeInvoice(id: string): SourceReportResponse['invoices'][0] {
     allocatedAmount: 1000,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: [
       {
diff --git a/e2e/pages/ReportWizardPage.ts b/e2e/pages/ReportWizardPage.ts
index 48125e2ff..5fed28070 100644
--- a/e2e/pages/ReportWizardPage.ts
+++ b/e2e/pages/ReportWizardPage.ts
@@ -208,9 +208,10 @@
  *   appears anywhere in the UI or the PDF any more. `footnotesBlock`/`footnoteItems` had no
  *   producer at this point, but see Issue #1965 below — that changed.
  * - A constituted-deposit row (the allocation is made up entirely by a deposit tagged to the
- *   reported source) carries NO marker/label at all — instead an inline `Badge` (`depositBadge`/
- *   `mobileDepositBadge` below) reading "Deposit"/"Abschlagszahlung". There is correspondingly
- *   no "This is a deposit." footnote anymore (`depositConstitutedFootnote` key removed).
+ *   reported source) carries an inline `Badge` (`depositBadge`/`mobileDepositBadge` below)
+ *   reading "Deposit"/"Abschlagszahlung" — at this point in the story it carried NO other
+ *   marker/label; see Issue #1911 below, which changed that. There is correspondingly no "This is
+ *   a deposit." footnote anymore (`depositConstitutedFootnote` key removed).
  * - `summaryTable`/`summaryTableRows` (declared above) now contains exactly ONE row — `Total`/
  *   `Gesamt` — regardless of how many distinct invoice statuses are included; the old
  *   per-status `Outstanding`/`Paid`/`Quotation`/`Claimed Subtotal` rows are gone
@@ -251,6 +252,21 @@
  *   Not currently covered by any locator/scenario here (coverage gap, deliberately not added on
  *   the #1959 critical path since a new test case reshuffles E2E shard membership).
  *
+ * Issue #1911: `splitKind` — `row.isSplit`/`row.isDepositReduced` are now derived purely from the
+ * server's `splitKind: 'lines' | 'deposits' | 'both' | null` (`buildReportContent.ts`), not from
+ * the old `isSplit(raw) && budgetLines.length>0` / `isSplit(raw) && deposits.length>0` array-shape
+ * gates. Two DOM-visible consequences:
+ * - A row whose OWN budget lines are entirely foreign to the reported source (zero-contribution
+ *   line case) now DOES carry `(partial)`, even when it ALSO carries the constituted-deposit
+ *   `depositBadge` — the old array-length gate used to suppress `(partial)` here; `splitKind`
+ *   alone decides now, and `row.isDeposit`'s trigger is unrelated to it. See Scenario 17 in
+ *   `reportWizardEditableContent.spec.ts`.
+ * - `(less deposit)` now fires ONLY when a deposit is tagged to a source OTHER than the one being
+ *   reported. An UNTAGGED deposit (`budgetSourceId: null`) never triggers it — untagged deposits
+ *   are apportioned pro-rata back INTO the reported source, not claimed separately (Issue #1965's
+ *   "separately" wording is audit-load-bearing, which is what made the old over-inclusive
+ *   behavior a real defect). See the Scenario 18 sibling test in `reportWizardEditableContent.spec.ts`.
+ *
  * Issue #1932: cover letter overhaul — formatted body, editable signature block, personal
  * sender, professional PDF layout.
  * - Signature is now a first-class editable `EditableField` (`letterField('signature')`,
@@ -1176,9 +1192,15 @@ export class ReportWizardPage {
    * The inline "Deposit" `Badge` (`[class*="depositBadge"]`, composed from the shared
    * `.attachmentDeposit` variant) rendered in a desktop content-table row's Allocated Amount
    * cell when `row.isDeposit` — a constituted-deposit row (AC2.1), i.e. the row's allocation is
-   * made up entirely by a deposit tagged to the CURRENTLY reported source. Carries no inline
-   * note of its own (see `inlineNote()` — neither `(partial)` nor `(less deposit)`, and, before
-   * Issue #1959 replaced them, neither `†` nor `‡`).
+   * made up entirely by a deposit tagged to the CURRENTLY reported source.
+   *
+   * Issue #1911: `isDeposit`'s trigger (`invoice.isSplit(raw) && hasOwnTaggedDeposit`) is
+   * independent of `isSplit`/`isDepositReduced`, which are now driven purely by `splitKind`. The
+   * badge CAN co-occur with an `inlineNote()` `(partial)` label when the invoice's own budget
+   * lines are foreign to the reported source (`splitKind: 'lines'` — see Scenario 17 in
+   * `reportWizardEditableContent.spec.ts`) — it is no longer guaranteed to be the row's ONLY
+   * annotation. `(less deposit)` still never co-occurs with the badge on the SAME source's own
+   * tagged deposit (that would require a foreign-tagged deposit, which is a different row shape).
    * Scoped to the row so it never collides with `mobileDepositBadge`'s copy
    * (both trees share the `depositBadge` class and are always in the DOM simultaneously, per
    * the class docstring's dual-DOM-tree convention).
@@ -1219,10 +1241,15 @@ export class ReportWizardPage {
   /**
    * The grey inline note(s) (`[class*="inlineNote"]`) appended INSIDE a desktop row's Allocated
    * Amount cell by Issue #1959, which replaced the `†`/`‡` footnote markers: `(partial)` when
-   * `row.isSplit` (the amount shown is only this source's portion) and `(less deposit)` when
-   * `row.isDepositReduced` (separately-claimed deposits already netted off). A constituted-
-   * deposit row (`row.isDeposit`) gets NEITHER — it gets the inline `depositBadge` instead — so
-   * asserting `toHaveCount(0)` here is a meaningful negative for that case.
+   * `row.isSplit` and `(less deposit)` when `row.isDepositReduced`. Since Issue #1911 both flags
+   * are driven purely by the server's `splitKind` (`'lines'`/`'both'` → `isSplit`;
+   * `'deposits'`/`'both'` → `isDepositReduced`), independently of `row.isDeposit` (the
+   * constituted-deposit badge trigger, unchanged) — a row CAN carry the `depositBadge` AND an
+   * inline note simultaneously (e.g. a constituted-deposit row whose own budget lines are
+   * foreign to the reported source gets the badge AND `(partial)`; see Scenario 17 in
+   * `reportWizardEditableContent.spec.ts`). `toHaveCount(0)` is only a meaningful negative when
+   * BOTH `splitKind` conditions are known to be false for that row — it does not follow merely
+   * from `row.isDeposit` being true.
    *
    * Scoped to the row, so it never collides with `mobileInlineNote`'s copy (both DOM trees are
    * always present simultaneously — see the class docstring's dual-DOM-tree convention).
diff --git a/e2e/tests/budget/reportWizardEditableContent.spec.ts b/e2e/tests/budget/reportWizardEditableContent.spec.ts
index 18a8f8034..af7bbf2d4 100644
--- a/e2e/tests/budget/reportWizardEditableContent.spec.ts
+++ b/e2e/tests/budget/reportWizardEditableContent.spec.ts
@@ -75,20 +75,38 @@
  * attachments note into ONE read-only grey meta line in the Usage cell. See `ReportWizardPage.ts`'s
  * class docstring for the full locator reference (`sourceInfoBlock`, `depositBadge`/
  * `mobileDepositBadge`, `inlineNote`/`mobileInlineNote`, `usageMetaText`/`mobileUsageMetaText`,
- * `summaryTable`/`summaryTableRows`, and `footnotesBlock`/`footnoteItems` — zero for
- * constituted-deposit-only scenarios (Scenario 17), one deduplicated entry for split/
- * deposit-reduced scenarios (Issue #1965)).
+ * `summaryTable`/`summaryTableRows`, and `footnotesBlock`/`footnoteItems` — one deduplicated
+ * entry per active flag (`isSplit`/`isDepositReduced`), absent only when NEITHER flag fires
+ * anywhere in the report (Issue #1965)).
+ *
+ * Issue #1911 (`splitKind`): `isSplit`/`isDepositReduced`/`isDeposit` are now derived purely from
+ * the server's `splitKind: 'lines' | 'deposits' | 'both' | null` rather than the old
+ * `isSplit(raw) && budgetLines.length>0` / `isSplit(raw) && deposits.length>0` array-shape gates.
+ * Two consequences that ripple into Scenario 17/18 below: (1) a ZERO-contribution-line row (all
+ * of the invoice's budget lines point to a DIFFERENT source, `splitKind: 'lines'`) now DOES carry
+ * the `(partial)` label — the old `budgetLines.length>0` gate used to suppress it, which was the
+ * #1911 bug's mirror case; (2) `isDepositReduced` now fires ONLY when a deposit is tagged to a
+ * source OTHER than the one being reported (`splitKind: 'deposits'`/`'both'`) — an UNTAGGED
+ * deposit (`budgetSourceId: null`) never triggers it, because untagged deposits are apportioned
+ * pro-rata back INTO the reported source (`depositAggregateUtils.ts`), not claimed separately.
+ * `isDeposit` (the constituted-deposit badge trigger) is UNCHANGED and can now co-occur with
+ * `isSplit`/`isDepositReduced` on the same row — the old code's implicit either/or is gone.
  * - Scenario 16: A `claim` report omits the source-info metadata block entirely (AC3.1) — the
  *   counterpart to Scenario 1's `budget-overview` regression guard (AC3.3).
  * - Scenario 17: A constituted-deposit row (the row's allocation is made up entirely by a
- *   deposit tagged to the currently reported source) shows the inline "Deposit" badge on
- *   desktop, tablet, AND mobile, carries NO inline `(partial)`/`(less deposit)` note (nor either
- *   legacy `†`/`‡` glyph), and there is no footnotes block at all (AC2.1, AC2.2).
+ *   deposit tagged to the currently reported source, with the invoice's OWN budget lines pointing
+ *   entirely at a DIFFERENT source) shows the inline "Deposit" badge on desktop, tablet, AND
+ *   mobile (AC2.1, AC2.2) — and, since Issue #1911, ALSO the `(partial)` note and one footnote
+ *   entry, because the invoice's lines are foreign to the reported source (`splitKind: 'lines'`).
+ *   It still carries NO `(less deposit)` note (nor either legacy `†`/`‡` glyph): the deposit is
+ *   tagged to the reported source itself, not a foreign one.
  * - Scenario 18: Every split invoice carries its OWN inline `(partial)` label in its Allocated
  *   Amount cell (Issue #1959, superseding AC1.1-AC1.2's shared unnumbered `†` marker). The
  *   footnote list now contains exactly ONE deduplicated legend sentence ("Amount shown reflects
  *   only the portion allocated to this source.") pushed by `buildReportContent.ts` because
- *   `splitInvoiceIds.size > 0` (Issue #1965).
+ *   `splitInvoiceIds.size > 0` (Issue #1965). A sibling test at the end of this describe block is
+ *   the Issue #1911 AC 3.2 regression guard: a split invoice with an UNTAGGED deposit must show
+ *   `(partial)` but never `(less deposit)`.
  * - Scenario 19: Invoices spanning two or more statuses still produce exactly one summary row
  *   (`Total`) — no per-status subtotal rows (AC4.1-AC4.2).
  * - Scenario 20: A budget line linked to an item with an assigned area shows the item's leaf
@@ -326,7 +344,8 @@ async function linkDocumentToInvoiceViaApi(
  * Creates a deposit on `invoiceId`, optionally tagged to a budget source
  * (`data.budgetSourceId`) — mirrors the established pattern in `reportWizardExpansion.spec.ts`
  * (Story #1891/#1895/#1896). Used by Scenario 17 to construct a constituted-deposit row (Story
- * #1923 AC2.1).
+ * #1923 AC2.1) and by Scenario 18 to construct deposit-reduced (`budgetSourceId` tagged to a
+ * DIFFERENT source) and untagged (`budgetSourceId: null`) rows (Issue #1911).
  */
 async function createDepositViaApi(
   page: Page,
@@ -1567,15 +1586,17 @@ test.describe('Report wizard editable content — claim reports omit the metadat
 });
 
 // ─────────────────────────────────────────────────────────────────────────────
-// Scenario 17: Constituted-deposit row shows the inline Deposit badge and no deposit-reduced
-// note (Story #1923 AC2.1, AC2.2; note shape updated by Issue #1959)
+// Scenario 17: Constituted-deposit row shows the inline Deposit badge, a "(partial)" note (the
+// invoice's own budget lines are foreign to the reported source), and no "(less deposit)" note
+// (Story #1923 AC2.1, AC2.2; note shape updated by Issue #1959; `(partial)` addition + rationale
+// per Issue #1911's splitKind-driven derivation)
 // ─────────────────────────────────────────────────────────────────────────────
 
 test.describe(
   'Report wizard editable content — inline deposit badge (Scenario 17)',
   { tag: '@responsive' },
   () => {
-    test('A row whose allocation is made up entirely by a deposit tagged to the reported source shows an inline "Deposit" badge and no "(less deposit)" note, with no footnote entry, on desktop, tablet, and mobile', async ({
+    test('A row whose allocation is made up entirely by a deposit tagged to the reported source shows an inline "Deposit" badge and a "(partial)" note (its own budget lines are foreign to this source), but no "(less deposit)" note, with one footnote entry, on desktop, tablet, and mobile', async ({
       page,
       testPrefix,
     }) => {
@@ -1614,12 +1635,20 @@ test.describe(
           budgetSourceId: sourceBId,
         });
 
-        // View source B's own claim report — this invoice has zero budget lines for B, so its
-        // entire row here is the tagged deposit: isSplit (spans A + B) with an empty
-        // `budgetLines` slice for B → constituted-deposit, so `isSplit` is false (no
-        // budget-line split for B) and `isDepositReduced` is false (the deposit IS tagged to B,
-        // not "reduced") → NEITHER inline note (Issue #1959 replaced the old †/‡ markers with
-        // the `(partial)`/`(less deposit)` labels asserted against here).
+        // View source B's own claim report — this invoice has zero budget lines for B (all of
+        // its budget lines point at source A), so its entire row here is the tagged deposit:
+        // `isDeposit` fires (own-tagged deposit present, raw `isSplit` true — unchanged trigger).
+        // Since Issue #1911, `isSplit`/`isDepositReduced` are driven purely by the server's
+        // `splitKind`, not by whether B itself has a budget-line contribution: the invoice's
+        // lines are ALL foreign to B (they're on A) → `has_foreign_line_source` is true for B's
+        // report → `splitKind: 'lines'` → `isSplit` fires too, even though B's own `budgetLines[]`
+        // slice is empty (AC 3.1's zero-contribution-line case — the old `budgetLines.length>0`
+        // gate used to suppress this; `splitKind` alone decides now). `isDepositReduced` stays
+        // false: the deposit is tagged to B itself (the reported source), not a foreign one, so
+        // `has_foreign_deposit_source` is false and `splitKind` cannot be 'deposits'/'both'.
+        // Net effect: BOTH the "Deposit" badge AND the `(partial)` note render on this row — the
+        // old code's implicit either/or between "constituted" and "split" is gone — but never
+        // `(less deposit)`.
         await reachStep5(wizard, sourceBId);
 
         const vendorName = `${testPrefix} Deposit Vendor`;
@@ -1632,10 +1661,13 @@ test.describe(
           const badge = wizard.mobileDepositBadge(vendorName, invoice.invoiceNumber!);
           await expect(badge).toBeVisible();
           await expect(badge).toHaveText('Deposit');
-          // The badge is the row's ONLY allocated-amount annotation: no `(partial)`/`(less
-          // deposit)` inline note (Issue #1959), and — belt and braces — neither legacy glyph.
-          await expect(wizard.mobileInlineNote(vendorName, invoice.invoiceNumber!)).toHaveCount(0);
+          // The badge co-occurs with exactly one inline note: `(partial)` (Issue #1911 AC 3.1),
+          // never `(less deposit)`, and — belt and braces — neither legacy glyph.
+          const mobileNote = wizard.mobileInlineNote(vendorName, invoice.invoiceNumber!);
+          await expect(mobileNote).toHaveCount(1);
+          await expect(mobileNote).toHaveText('(partial)');
           const cardText = (await card.textContent()) ?? '';
+          expect(cardText).not.toContain('less deposit');
           expect(cardText).not.toContain('†');
           expect(cardText).not.toContain('‡');
         } else {
@@ -1645,20 +1677,26 @@ test.describe(
           const badge = wizard.depositBadge(vendorName, invoice.invoiceNumber!);
           await expect(badge).toBeVisible();
           await expect(badge).toHaveText('Deposit');
-          await expect(wizard.inlineNote(vendorName, invoice.invoiceNumber!)).toHaveCount(0);
+          const note = wizard.inlineNote(vendorName, invoice.invoiceNumber!);
+          await expect(note).toHaveCount(1);
+          await expect(note).toHaveText('(partial)');
+          await expect(row).toContainText('€150.00 (partial)');
           const rowText = (await row.textContent()) ?? '';
+          expect(rowText).not.toContain('less deposit');
           expect(rowText).not.toContain('†');
           expect(rowText).not.toContain('‡');
         }
 
-        // No footnote entry: this is a constituted-deposit row — the allocation is made up
-        // entirely by a deposit tagged to source B, so `isSplit` is false (only source B has
-        // budget lines; the invoice is not split across sources), and `isDepositReduced` is also
-        // false (the deposit constitutes the row, it does not reduce a gross amount).
-        // `buildReportContent.ts` only pushes legend entries when `splitInvoiceIds.size > 0` or
-        // `depositReducedInvoiceIds.size > 0` — neither condition holds here, so
-        // `content.footnotes` stays empty and the block is absent from the DOM (Issue #1965).
-        await expect(wizard.footnotesBlock).toHaveCount(0);
+        // One footnote entry: `splitInvoiceIds.size > 0` now holds (the `splitKind: 'lines'`
+        // shape above), so `buildReportContent.ts` pushes the split legend sentence.
+        // `depositReducedInvoiceIds` stays empty (no foreign-tagged deposit here), so there is
+        // still no "claimed separately" entry — the block holds exactly ONE `<li>`, not two
+        // (Issue #1965, re-verified under Issue #1911's splitKind-driven derivation).
+        await expect(wizard.footnotesBlock).toHaveCount(1);
+        await expect(wizard.footnoteItems).toHaveCount(1);
+        await expect(wizard.footnoteItems.nth(0)).toContainText(
+          'Amount shown reflects only the portion allocated to this source.',
+        );
       } finally {
         if (workItemId) await deleteWorkItemViaApi(page, workItemId);
         if (sourceBId) await deleteBudgetSourceViaApi(page, sourceBId);
@@ -1723,10 +1761,17 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
         250,
       );
 
-      // Third invoice: split across the same two sources AND carrying an untagged deposit
-      // (`budgetSourceId: null` — no source match for `reportedSourceId` → `isDepositReduced:
-      // true` when viewed from `reportedSourceId`). This is the first real-browser fixture that
-      // exercises the deposit-reduced code path (AC5 — Issue #1980).
+      // Third invoice: split across the same two sources AND carrying a deposit TAGGED to the
+      // OTHER source (`otherSourceId` — not `reportedSourceId` and not null). Since Issue #1911,
+      // `isDepositReduced` is driven by `splitKind`, which is 'deposits'/'both' only when a
+      // deposit is tagged to a source OTHER than the one being reported — the server SQL's
+      // `has_foreign_deposit_source` aggregate filters `budget_source_id IS NOT NULL`, so an
+      // UNTAGGED deposit never sets it (that shape moved to the sibling negative-control test
+      // below, Issue #1911 AC 3.2 — it used to live here and was the over-inclusive bug this
+      // story exists to fix). Tagging to `otherSourceId` produces the genuine `splitKind: 'both'`
+      // shape (foreign line from `otherSourceId`'s own budget line AND a foreign deposit also on
+      // `otherSourceId`) — the first real-browser fixture that exercises the deposit-reduced code
+      // path (AC5 — Issue #1980; re-seeded for #1911).
       const invoice3 = await seedSplitInvoice(
         page,
         vendorId,
@@ -1742,7 +1787,7 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
         amount: 50,
         dueDate: '2026-06-20',
         status: 'pending',
-        budgetSourceId: null,
+        budgetSourceId: otherSourceId,
       });
 
       await reachStep5(wizard, reportedSourceId);
@@ -1787,8 +1832,9 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
 
       // Issue #1965 + AC5 (Issue #1980): the footnotes block now contains TWO deduplicated
       // legend entries — one for `isSplit` (all three invoices trigger it) and one for
-      // `isDepositReduced` (invoice3 triggers it via its untagged deposit). Two distinct flag
-      // types → two distinct legend sentences, even though invoice3 triggers both simultaneously.
+      // `isDepositReduced` (invoice3 triggers it via its deposit tagged to `otherSourceId` —
+      // Issue #1911's `splitKind: 'both'` shape). Two distinct flag types → two distinct legend
+      // sentences, even though invoice3 triggers both simultaneously.
       // The block itself is still exactly one element (one `<ul class*="footnotes">`), but now
       // holds two `<li>` items.
       await expect(wizard.footnotesBlock).toHaveCount(1);
@@ -1819,6 +1865,100 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
       if (vendorId) await deleteVendorViaApi(page, vendorId);
     }
   });
+
+  // Issue #1911 AC 3.2 regression guard (the over-inclusive-fix direction): a split invoice
+  // carrying an UNTAGGED deposit must show "(partial)" — the invoice's lines genuinely span two
+  // sources, so `splitKind: 'lines'` and `isSplit` fires normally — but must NEVER show
+  // "(less deposit)", and must contribute exactly ONE legend entry. Before #1911,
+  // `isDepositReduced` fired on ANY untagged deposit sharing an invoice with a split line,
+  // producing a false "claimed separately" legend sentence for a deposit that
+  // `depositAggregateUtils.ts`'s residual-fraction apportionment actually folds pro-rata back
+  // INTO this source — #1965 ruled "separately" audit-load-bearing, which is what makes the old
+  // behavior a real defect rather than a nit. This used to be invoice3's shape above (before it
+  // was re-seeded to a genuinely foreign-tagged deposit for the true deposit-reduced case), so
+  // without a standalone guard here the over-inclusive bug could regress silently. Isolated into
+  // its own invoice/source/vendor set (not folded into the test above) specifically so
+  // `footnoteItems` can assert count 1 cleanly — the scenario above always has 2 (split +
+  // deposit-reduced) for unrelated reasons. Positive control: the `(partial)` note AND the split
+  // footnote sentence both render, proving this isn't passing against a blank/mis-seeded page.
+  test('A split invoice carrying an untagged deposit shows only the "(partial)" note — never "(less deposit)" — and contributes exactly one legend entry', async ({
+    page,
+    testPrefix,
+  }) => {
+    const wizard = new ReportWizardPage(page);
+
+    let vendorId = '';
+    let reportedSourceId = '';
+    let otherSourceId = '';
+    let reportedWorkItemId = '';
+    let otherWorkItemId = '';
+    try {
+      vendorId = await createVendorViaApi(page, { name: `${testPrefix} Untagged Vendor` });
+      reportedSourceId = await createBudgetSourceViaApi(page, {
+        name: `${testPrefix} Untagged Source A`,
+        totalAmount: 10000,
+      });
+      otherSourceId = await createBudgetSourceViaApi(page, {
+        name: `${testPrefix} Untagged Source B`,
+        totalAmount: 10000,
+      });
+      reportedWorkItemId = await createWorkItemViaApi(page, {
+        title: `${testPrefix} WI Untagged A`,
+      });
+      otherWorkItemId = await createWorkItemViaApi(page, { title: `${testPrefix} WI Untagged B` });
+
+      const invoice = await seedSplitInvoice(
+        page,
+        vendorId,
+        reportedSourceId,
+        otherSourceId,
+        reportedWorkItemId,
+        otherWorkItemId,
+        { invoiceNumber: `${testPrefix}-SPLITUNTAG-001`, date: '2026-06-13', status: 'pending' },
+        60,
+        90,
+      );
+      // Untagged: `budgetSourceId: null`. The server SQL's `has_foreign_deposit_source` aggregate
+      // filters `d.budget_source_id IS NOT NULL`, so an untagged deposit is invisible to it —
+      // `splitKind` resolves to 'lines' (from the foreign budget line on `otherSourceId`), never
+      // 'deposits'/'both'. This is the exact AC 3.2 over-inclusive-fix shape.
+      await createDepositViaApi(page, invoice.id, {
+        amount: 25,
+        dueDate: '2026-06-21',
+        status: 'pending',
+        budgetSourceId: null,
+      });
+
+      await reachStep5(wizard, reportedSourceId);
+
+      const vendorName = `${testPrefix} Untagged Vendor`;
+      const row = wizard.contentTableRow(vendorName, invoice.invoiceNumber!);
+
+      // Positive control: the split note renders normally.
+      const note = wizard.inlineNote(vendorName, invoice.invoiceNumber!);
+      await expect(note).toHaveCount(1);
+      await expect(note).toHaveText('(partial)');
+      await expect(row).toContainText('€60.00 (partial)');
+
+      // The regression guard itself: no second inline note, specifically not the deposit-reduced
+      // label (the untagged deposit must not read as "claimed separately").
+      const rowText = (await row.textContent()) ?? '';
+      expect(rowText).not.toContain('less deposit');
+
+      // Exactly one legend entry (the split sentence) — never a second deposit-reduced entry.
+      await expect(wizard.footnotesBlock).toHaveCount(1);
+      await expect(wizard.footnoteItems).toHaveCount(1);
+      await expect(wizard.footnoteItems.nth(0)).toContainText(
+        'Amount shown reflects only the portion allocated to this source.',
+      );
+    } finally {
+      if (reportedWorkItemId) await deleteWorkItemViaApi(page, reportedWorkItemId);
+      if (otherWorkItemId) await deleteWorkItemViaApi(page, otherWorkItemId);
+      if (reportedSourceId) await deleteBudgetSourceViaApi(page, reportedSourceId);
+      if (otherSourceId) await deleteBudgetSourceViaApi(page, otherSourceId);
+      if (vendorId) await deleteVendorViaApi(page, vendorId);
+    }
+  });
 });
 
 // ─────────────────────────────────────────────────────────────────────────────
diff --git a/server/src/routes/sourceReports.test.ts b/server/src/routes/sourceReports.test.ts
index 9d0e15b64..106e145a9 100644
--- a/server/src/routes/sourceReports.test.ts
+++ b/server/src/routes/sourceReports.test.ts
@@ -269,6 +269,9 @@ describe('Source Report Routes', () => {
       expect(body.report.invoices).toHaveLength(1);
       expect(body.report.invoices[0]!.invoiceId).toBe(invId);
       expect(body.report.totalAmount).toBeCloseTo(500);
+      // #1911 AC 2.4: splitKind is present on every element of report.invoices, purely additive.
+      expect(body.report.invoices.every((inv) => 'splitKind' in inv)).toBe(true);
+      expect(body.report.invoices[0]!.splitKind).toBeNull(); // single-source invoice, not split
     });
 
     // Story #1891: response shape now includes budgetLines[]/deposits[] per invoice.
diff --git a/server/src/services/sourceReportService.test.ts b/server/src/services/sourceReportService.test.ts
index 3f4f31884..64e24ea31 100644
--- a/server/src/services/sourceReportService.test.ts
+++ b/server/src/services/sourceReportService.test.ts
@@ -446,6 +446,416 @@ describe('sourceReportService', () => {
       expect(result.invoices[0]!.isSplit).toBe(false);
     });
 
+    // ═══════════════════════════════════════════════════════════════════
+    // #1911 — splitKind: discriminates why an invoice's funding spans multiple budget sources.
+    // PO's binding AC comment: https://github.com/steilerDev/cornerstone/issues/1911#issuecomment-5197987890
+    // ═══════════════════════════════════════════════════════════════════
+    describe('splitKind (#1911)', () => {
+      it('AC 1.1: lines in two sources, no tagged deposits → splitKind "lines" for the requested source', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const budgetB = insertWorkItemBudget(sourceB);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 600);
+        insertInvoiceBudgetLine(invId, budgetB, 400);
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices).toHaveLength(1);
+        expect(result.invoices[0]!.splitKind).toBe('lines');
+      });
+
+      it('AC 1.2 (headline): budget lines all in the requested source, one deposit tagged to a different source → splitKind "deposits" — the exact case the issue is about', async () => {
+        // Byte-identical to a non-split invoice in every OTHER field (budgetLines[] holds only
+        // A's line, deposits[] is empty because the B-tagged deposit is filtered out server-side
+        // — PO's premise-1 verification table). splitKind is the only field that discriminates
+        // this from a genuinely unsplit invoice.
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices).toHaveLength(1);
+        expect(result.invoices[0]!.splitKind).toBe('deposits');
+        expect(result.invoices[0]!.isSplit).toBe(true);
+        // Reproduce the byte-identical-response premise: budgetLines[] carries only A's own line,
+        // deposits[] is empty (the B-tagged deposit is invisible), yet splitKind still tells them
+        // apart.
+        expect(result.invoices[0]!.budgetLines).toHaveLength(1);
+        expect(result.invoices[0]!.deposits).toEqual([]);
+      });
+
+      it('AC 1.3: lines in two sources AND a deposit tagged to a third source → splitKind "both"', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const sourceC = insertSource({ name: 'Source C' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const budgetB = insertWorkItemBudget(sourceB);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 600);
+        insertInvoiceBudgetLine(invId, budgetB, 400);
+        insertDeposit(invId, {
+          amount: 200,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceC,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices).toHaveLength(1);
+        expect(result.invoices[0]!.splitKind).toBe('both');
+      });
+
+      it('AC 1.4: lines and tagged deposit all reference the requested source only → splitKind null', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceA,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices).toHaveLength(1);
+        expect(result.invoices[0]!.splitKind).toBeNull();
+        expect(result.invoices[0]!.isSplit).toBe(false);
+      });
+
+      it('AC 1.5 (the trap): arm 1 = {A} exactly, arm 2 = {B} exactly — ONE source per arm, not two — yet splitKind must still be "deposits", never null. The predicate is "this arm contains a source != S", NOT "this arm contains >= 2 distinct sources": an implementation that counts distinct sources per arm returns null here and silently reproduces the #1911 bug', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        // Arm 1 (lines): exactly one distinct source_id value in this arm, {A} — matches S,
+        // contributes nothing foreign to arm 1 on its own.
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        // Arm 2 (deposits): exactly one distinct source_id value in this arm, {B} — a single
+        // foreign source is sufficient; this arm never contains 2+ distinct sources either.
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices[0]!.splitKind).toBe('deposits');
+      });
+
+      // AC 1.6: for every invoice in every report type, splitKind !== null iff isSplit === true.
+      // Re-runs the EXISTING isSplit fixture set (scenarios 11/12a/12b + the four Story #1891
+      // regression fixtures above) and pins the invariant on each, without modifying those
+      // original tests (which remain the isSplit-only regression guard).
+      describe('AC 1.6 (invariant): splitKind !== null iff isSplit === true, across the existing isSplit fixture set', () => {
+        it('holds for: two-source line split (mirrors scenario 11) — isSplit true', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const sourceB = insertSource({ name: 'Source B' });
+          const vendorId = insertVendor();
+          const budgetA = insertWorkItemBudget(sourceA);
+          const budgetB = insertWorkItemBudget(sourceB);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertInvoiceBudgetLine(invId, budgetA, 600);
+          insertInvoiceBudgetLine(invId, budgetB, 400);
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(true);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: single-source invoice (mirrors scenario 12a) — isSplit false', async () => {
+          const sourceId = insertSource();
+          const vendorId = insertVendor();
+          const budgetId = insertWorkItemBudget(sourceId);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 500 });
+          insertInvoiceBudgetLine(invId, budgetId, 500);
+
+          const result = await getSourceReport(db, 'claim', sourceId, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(false);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: real source + null-source line (mirrors scenario 12b) — isSplit false', async () => {
+          const sourceId = insertSource();
+          const vendorId = insertVendor();
+          const budgetReal = insertWorkItemBudget(sourceId);
+          const budgetNull = insertWorkItemBudget(null);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 700 });
+          insertInvoiceBudgetLine(invId, budgetReal, 500);
+          insertInvoiceBudgetLine(invId, budgetNull, 200);
+
+          const result = await getSourceReport(db, 'claim', sourceId, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(false);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: lines only in B + a deposit tagged to A, requested A (mirrors Story #1891 regression) — isSplit true', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const sourceB = insertSource({ name: 'Source B' });
+          const vendorId = insertVendor();
+          const budgetB = insertWorkItemBudget(sourceB);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertInvoiceBudgetLine(invId, budgetB, 1000);
+          insertDeposit(invId, {
+            amount: 300,
+            status: 'paid',
+            entryType: 'deposit',
+            budgetSourceId: sourceA,
+          });
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(true);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: no budget lines, two deposits tagged to two different sources (mirrors Story #1891 regression) — isSplit true', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const sourceB = insertSource({ name: 'Source B' });
+          const vendorId = insertVendor();
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertDeposit(invId, {
+            amount: 400,
+            status: 'paid',
+            entryType: 'deposit',
+            budgetSourceId: sourceA,
+          });
+          insertDeposit(invId, {
+            amount: 600,
+            status: 'paid',
+            entryType: 'deposit',
+            budgetSourceId: sourceB,
+          });
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(true);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: lines for one source + an UNTAGGED deposit (mirrors Story #1891 regression) — isSplit false', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const vendorId = insertVendor();
+          const budgetA = insertWorkItemBudget(sourceA);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertInvoiceBudgetLine(invId, budgetA, 1000);
+          insertDeposit(invId, { amount: 300, status: 'paid', entryType: 'deposit' }); // untagged
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(false);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: lines for one source + a deposit tagged to that SAME source (mirrors Story #1891 regression) — isSplit false', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const vendorId = insertVendor();
+          const budgetA = insertWorkItemBudget(sourceA);
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertInvoiceBudgetLine(invId, budgetA, 1000);
+          insertDeposit(invId, {
+            amount: 300,
+            status: 'paid',
+            entryType: 'deposit',
+            budgetSourceId: sourceA,
+          });
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(false);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+
+        it('holds for: no lines, a single tagged deposit only (mirrors Story #1891 regression) — isSplit false', async () => {
+          const sourceA = insertSource({ name: 'Source A' });
+          const vendorId = insertVendor();
+          const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+          insertDeposit(invId, {
+            amount: 500,
+            status: 'paid',
+            entryType: 'deposit',
+            budgetSourceId: sourceA,
+          });
+
+          const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+          const inv = result.invoices[0]!;
+          expect(inv.isSplit).toBe(false);
+          expect(inv.splitKind !== null).toBe(inv.isSplit);
+        });
+      });
+
+      it('AC 1.7: splitKind is computed identically across budget-overview, claim, and proof-of-funds for the same split shape (statuses adjusted so each invoice survives its own report type slice)', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const vendorId = insertVendor();
+
+        // budget-overview: any of quotation/pending/paid/claimed survives — use 'paid'.
+        const overviewBudget = insertWorkItemBudget(sourceA);
+        const invOverview = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invOverview, overviewBudget, 1000);
+        insertDeposit(invOverview, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        // claim: pending/paid survives — use 'paid'.
+        const claimBudget = insertWorkItemBudget(sourceA);
+        const invClaim = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invClaim, claimBudget, 1000);
+        insertDeposit(invClaim, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        // proof-of-funds: only 'claimed' survives.
+        const pofBudget = insertWorkItemBudget(sourceA);
+        const invPof = insertInvoice(vendorId, { status: 'claimed', amount: 1000 });
+        insertInvoiceBudgetLine(invPof, pofBudget, 1000);
+        insertDeposit(invPof, {
+          amount: 300,
+          status: 'claimed',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        const overviewResult = await getSourceReport(
+          db,
+          'budget-overview',
+          sourceA,
+          PAPERLESS_DISABLED,
+        );
+        const claimResult = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        const pofResult = await getSourceReport(db, 'proof-of-funds', sourceA, PAPERLESS_DISABLED);
+
+        const overviewInv = overviewResult.invoices.find((i) => i.invoiceId === invOverview);
+        const claimInv = claimResult.invoices.find((i) => i.invoiceId === invClaim);
+        const pofInv = pofResult.invoices.find((i) => i.invoiceId === invPof);
+
+        expect(overviewInv).toBeDefined();
+        expect(claimInv).toBeDefined();
+        expect(pofInv).toBeDefined();
+        expect(overviewInv!.splitKind).toBe('deposits');
+        expect(claimInv!.splitKind).toBe('deposits');
+        expect(pofInv!.splitKind).toBe('deposits');
+      });
+
+      it('AC 1.8 (round-trip): splitKind is derived from the SAME db.all() statement as isSplit — no second query is issued for it', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({ name: 'Source B' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        // Pass-through spy: no mockImplementation, so the real query still executes — this proves
+        // the derivation shares the existing statement's result rows rather than counting calls
+        // against a stub that would trivially satisfy any assertion.
+        const allSpy = jest.spyOn(db, 'all');
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+
+        // Sanity: the real derivation still produced the expected value through the spy.
+        expect(result.invoices[0]!.splitKind).toBe('deposits');
+        expect(result.invoices[0]!.isSplit).toBe(true);
+
+        // drizzle's sql`` tagged template returns an SQL object whose static text lives in
+        // `queryChunks` as StringChunk-like `{ value: string[] }` entries, interleaved with raw
+        // bound-parameter values (not wrapped) — join only the string-chunk text to reconstruct
+        // the query's literal SQL, skipping parameters.
+        function extractSqlText(query: unknown): string {
+          const chunks = (query as { queryChunks?: unknown[] }).queryChunks;
+          if (!Array.isArray(chunks)) return '';
+          return chunks
+            .map((chunk) => {
+              if (chunk && typeof chunk === 'object' && 'value' in chunk) {
+                const value = (chunk as { value: unknown }).value;
+                return Array.isArray(value) ? value.join('') : String(value ?? '');
+              }
+              return '';
+            })
+            .join('');
+        }
+
+        const splitDataCalls = allSpy.mock.calls.filter((call) =>
+          extractSqlText(call[0]).includes('split_data'),
+        );
+        expect(splitDataCalls).toHaveLength(1);
+
+        allSpy.mockRestore();
+      });
+
+      it('AC 1.9 (regression guard): source S has both a budget line AND a tagged deposit, both tagged to S, nothing else → isSplit false, splitKind null. Adding the discriminating `origin` column to the UNION defeats its cross-arm row dedup (a source appearing in both arms now yields two rows), so COUNT(DISTINCT source_id) must remain the isSplit basis — if that basis changes, this fixture flips to isSplit true', async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceA,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices).toHaveLength(1);
+        expect(result.invoices[0]!.isSplit).toBe(false);
+        expect(result.invoices[0]!.splitKind).toBeNull();
+      });
+
+      it("AC 1.10 / §6: splitKind never leaks the other source's id or name across the API boundary — only the categorical value crosses", async () => {
+        const sourceA = insertSource({ name: 'Source A' });
+        const sourceB = insertSource({
+          id: 'source-b-leak-check',
+          name: 'Distinctive Source B Name',
+        });
+        const vendorId = insertVendor();
+        const budgetA = insertWorkItemBudget(sourceA);
+        const invId = insertInvoice(vendorId, { status: 'paid', amount: 1000 });
+        insertInvoiceBudgetLine(invId, budgetA, 1000);
+        insertDeposit(invId, {
+          amount: 300,
+          status: 'paid',
+          entryType: 'deposit',
+          budgetSourceId: sourceB,
+        });
+
+        const result = await getSourceReport(db, 'claim', sourceA, PAPERLESS_DISABLED);
+        expect(result.invoices[0]!.splitKind).toBe('deposits'); // sanity: this is the AC 1.2 shape
+        const serialized = JSON.stringify(result.invoices[0]);
+        expect(serialized).not.toContain(sourceB);
+        expect(serialized).not.toContain('Distinctive Source B Name');
+      });
+    });
+
     it('scenario 13: exactly-zero net contribution is dropped entirely (not in invoices, not in unallocated)', async () => {
       const sourceId = insertSource();
       const vendorId = insertVendor();
diff --git a/server/src/services/sourceReportService.ts b/server/src/services/sourceReportService.ts
index 687a9f70c..1da43e4c9 100644
--- a/server/src/services/sourceReportService.ts
+++ b/server/src/services/sourceReportService.ts
@@ -266,12 +266,20 @@ export async function getSourceReport(
     reportInvoiceIds.map((id) => sql`${id}`),
     sql`, `,
   );
-  const splitRows = db.all<{ invoice_id: string; source_count: number }>(
+  const splitRows = db.all<{
+    invoice_id: string;
+    source_count: number;
+    has_foreign_line_source: number;
+    has_foreign_deposit_source: number;
+  }>(
     sql`SELECT split_data.invoice_id AS invoice_id,
-           COUNT(DISTINCT split_data.source_id) AS source_count
+           COUNT(DISTINCT split_data.source_id) AS source_count,
+           MAX(CASE WHEN split_data.origin = 'line' AND split_data.source_id != ${sourceId} THEN 1 ELSE 0 END) AS has_foreign_line_source,
+           MAX(CASE WHEN split_data.origin = 'deposit' AND split_data.source_id != ${sourceId} THEN 1 ELSE 0 END) AS has_foreign_deposit_source
     FROM (
       SELECT ibl.invoice_id,
-             COALESCE(wib.budget_source_id, hib.budget_source_id) AS source_id
+             COALESCE(wib.budget_source_id, hib.budget_source_id) AS source_id,
+             'line' AS origin
       FROM invoice_budget_lines ibl
       LEFT JOIN work_item_budgets wib ON wib.id = ibl.work_item_budget_id
       LEFT JOIN household_item_budgets hib ON hib.id = ibl.household_item_budget_id
@@ -281,7 +289,8 @@ export async function getSourceReport(
       UNION
 
       SELECT d.invoice_id,
-             d.budget_source_id AS source_id
+             d.budget_source_id AS source_id,
+             'deposit' AS origin
       FROM invoice_deposits d
       WHERE d.invoice_id IN (${joinedInvoiceIds})
         AND d.budget_source_id IS NOT NULL
@@ -290,8 +299,21 @@ export async function getSourceReport(
   );
 
   const isSplitMap = new Map<string, boolean>();
+  const splitKindMap = new Map<string, SourceReportInvoice['splitKind']>();
   for (const row of splitRows) {
     isSplitMap.set(row.invoice_id, row.source_count > 1);
+    const hasForeignLine = row.has_foreign_line_source === 1;
+    const hasForeignDeposit = row.has_foreign_deposit_source === 1;
+    splitKindMap.set(
+      row.invoice_id,
+      hasForeignLine && hasForeignDeposit
+        ? 'both'
+        : hasForeignLine
+          ? 'lines'
+          : hasForeignDeposit
+            ? 'deposits'
+            : null,
+    );
   }
 
   // Step g: Batch fetch document links
@@ -434,6 +456,7 @@ export async function getSourceReport(
       allocatedAmount: roundedAmount,
       lineKind,
       isSplit: isSplitMap.get(invoiceId) ?? false, // true iff invoice's funding spans 2+ distinct budget sources across budget lines and tagged deposits
+      splitKind: splitKindMap.get(invoiceId) ?? null,
       documents,
       budgetLines: budgetLinesByInvoiceId.get(invoiceId) ?? [],
       deposits: depositsByInvoiceId.get(invoiceId) ?? [],
diff --git a/shared/src/lib/reportMath.test.ts b/shared/src/lib/reportMath.test.ts
index 95734ad64..c23b89822 100644
--- a/shared/src/lib/reportMath.test.ts
+++ b/shared/src/lib/reportMath.test.ts
@@ -28,6 +28,7 @@ function makeInvoice(
     allocatedAmount,
     lineKind: 'invoice',
     isSplit: false,
+    splitKind: null,
     documents: [],
     budgetLines: budgetLines.map(({ id, allocatedPortion }) => ({
       id,
diff --git a/shared/src/types/sourceReport.ts b/shared/src/types/sourceReport.ts
index 8098683ed..6f5aee1ad 100644
--- a/shared/src/types/sourceReport.ts
+++ b/shared/src/types/sourceReport.ts
@@ -56,6 +56,14 @@ export interface SourceReportInvoice {
   lineKind: 'invoice' | 'refund-adjustment';
   /** True iff the invoice's funding spans 2+ distinct budget sources across budget lines and tagged deposits. */
   isSplit: boolean;
+  /**
+   * Discriminates why the invoice's funding spans multiple budget sources: 'lines' (a budget
+   * line resolves to a source other than the requested one), 'deposits' (a tagged deposit
+   * references a different source), 'both', or null when the invoice is not split. Structurally,
+   * splitKind !== null iff isSplit === true. Never carries the other source's identity — only
+   * the categorical value crosses the API boundary (#1911).
+   */
+  splitKind: 'lines' | 'deposits' | 'both' | null;
   documents: SourceReportDocument[];
   /** Budget lines allocated to this invoice for the requested source only. Other sources' lines are absent (not present with zero portion). Used as a subtraction basis for line-exclusion math. */
   budgetLines: SourceReportBudgetLine[];
diff --git a/wiki b/wiki
index eb247743c..1f3eb7cb7 160000
--- a/wiki
+++ b/wiki
@@ -1 +1 @@
-Subproject commit eb247743c75495ecdb85e15206021d296a1891be
+Subproject commit 1f3eb7cb72772da44a49945054c0c4b09e4e8777

From e01a1969c5b34e274f78becd0d9ff21b9db14f7c Mon Sep 17 00:00:00 2001
From: Frank Steiler <frank@steiler.dev>
Date: Thu, 6 Aug 2026 01:49:56 +0200
Subject: [PATCH 2/3] fix(reports): falsifiable AC 4.5 geometry checks and
 corrected E2E fixtures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Review-round fixes on PR #2015 (#1911):

- Replace the AC 4.5 geometry assertions, which could not fail. maxHorizontalRatio
  is vacuous on this table (every column is fixed-width and content-independent
  since #1929 round 4, and horizontalRatio is recorded at each line's start x), and
  the "all four labels present verbatim" check read the pdfmake content tree — the
  test's own input — so it could not observe a drop, clip or wrap. Replaced with
  per-cell _minWidth <= _calcWidth per the ADR-034 Deviation Log, plus a differential
  positions.length check against a reduced-label comparator. Both proven to fail by
  mutation: merging labels into an unbreakable atom breaks the first (113.64 > 75 in
  de), gating the split-label push breaks the second in all four cases.
- Correct two stale E2E assertions that made shards 2 and 9 red. Scenario 17 asserted
  a substring spanning the deposit badge, which renders between the amount and the
  note; Scenario 18 kept the untagged-deposit expectation after the fixture was
  re-tagged. EUR 56.25 is correct under #1891's redirect rule and the derivation is
  now recorded in a comment, so the change reads as arithmetic rather than as a
  weakened assertion.
- Switch the step-f UNION to UNION ALL and document the load-bearing DISTINCT. Adding
  the origin column broke the equivalence of COUNT(*) and COUNT(DISTINCT source_id),
  so a future "simplification" to COUNT(*) would flip isSplit for every invoice with
  a same-source line and a same-source tagged deposit.
- Correct an inverted comment on ReportContentRow.isDepositReduced that restated, on
  the shared type, the same false "untagged deposits reduce this source" claim this
  story removes from the bank-facing legend.

Refs #1911

Co-Authored-By: Claude backend-developer <noreply@anthropic.com>
Co-Authored-By: Claude frontend-developer <noreply@anthropic.com>
Co-Authored-By: Claude qa-integration-tester <noreply@anthropic.com>
Co-Authored-By: Claude e2e-test-engineer <noreply@anthropic.com>
Co-Authored-By: Claude product-architect <noreply@anthropic.com>
Co-Authored-By: Claude product-owner <noreply@anthropic.com>
Co-Authored-By: Claude security-engineer <noreply@anthropic.com>
---
 .../issue-1911-splitkind-e2e.md               |  42 +++++
 .../agent-memory/product-architect/MEMORY.md  |   4 +-
 .../source-report-split-inference.md          |  36 +++--
 .claude/agent-memory/product-owner/MEMORY.md  |   4 +-
 .../product-owner/bank-report-wizard.md       |  70 ++++++++
 .../story-1911-splitkind.md                   |  49 ++++++
 .../agent-memory/security-engineer/MEMORY.md  |   4 +-
 .../security-engineer/pr-review-table.md      |   1 +
 client/src/lib/reportContent/types.ts         |   4 +-
 client/src/lib/reportPdf/realRender.test.ts   | 152 +++++++++++++-----
 .../reportWizardEditableContent.spec.ts       |  22 ++-
 server/src/services/sourceReportService.ts    |  19 ++-
 12 files changed, 349 insertions(+), 58 deletions(-)

diff --git a/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md b/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
index 14287609f..68375972f 100644
--- a/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
+++ b/.claude/agent-memory/e2e-test-engineer/issue-1911-splitkind-e2e.md
@@ -81,4 +81,46 @@ not just the ONE scenario the spec happened to mention. The unit test suite (alr
 green) is a fast, authoritative way to derive "what SHOULD this fixture shape now assert" without
 needing a live browser.
 
+## PR #2015 review round: two red shards, both self-inflicted, neither a production defect
+
+`product-architect` and `product-owner` independently traced both E2E failures to stale
+assertions I wrote, not to product behavior:
+
+- **Badge-vs-note DOM order isn't a fact worth asserting.** Scenario 17's rewrite added
+  `toContainText('€150.00 (partial)')`, but the `depositBadge` renders BETWEEN the amount and the
+  note (`ReportContentEditor.tsx`: value → badge → split note → deposit-reduced note, in that
+  literal JSX order), so the DOM text is `€150.00Deposit (partial)` and the substring can never
+  match. Fix was to **delete the assertion**, not rewrite it to encode the ordering — two sibling
+  assertions already pin the same fact against the `inlineNote` locator directly (count 1, text
+  `(partial)`), and hardcoding badge-before-note relative order is exactly the kind of brittleness
+  this area (already reshuffled twice: #1959, #1911) keeps punishing.
+- **Get the money math from the actual formula, not intuition.** Scenario 18's invoice3 retag (see
+  above) changed the deposit from untagged to tagged-to-`otherSourceId`, but I left the OLD
+  expected amount (`€75.00`) on the row assertion below it. The correct value is **€56.25** —
+  `depositAggregateUtils.ts`'s `splitByDepositsExcludingTagged`: `residualFraction` ALWAYS
+  subtracts every deposit (tagged or not) from the invoice total in the denominator
+  ((200−50)/200=0.75), but `depositFractions` (which gets ADDED back per line) only includes
+  UNTAGGED deposits — a tagged one is filtered out entirely (it's handled by Rail B, on a
+  different source's row). So `75 × 0.75 = 56.25`, full stop, no returned fraction. Contrast the
+  sibling negative-control test's untagged deposit (60/90 split, 25 untagged deposit, invoice
+  150): residual `(150−25)/150=0.8333` PLUS the returned `depositFraction` `25/150=0.1667` sum to
+  exactly 1.0 (true whenever there's exactly one deposit, tagged-or-not doesn't matter to the
+  sum-to-1 property when it's the ONLY deposit and it's untagged) → `60 × 1.0 = 60`, i.e. the
+  original `€60.00` assertion was already correct and needed no change, only a comment.
+- **The arithmetic proves the fix in both directions** — worth stating explicitly in test comments
+  next to both numbers, not just implied: foreign-tagged deposit → allocation genuinely drops
+  (75→56.25), so "claimed separately" is true; untagged deposit → residual + returned fraction net
+  to the FULL original amount (no drop at all), so the pre-#1911 "claimed separately" label on
+  that shape was literally false to a bank recipient. This is why the AC 3.2 negative-control test
+  exists, and it's a stronger justification than "the bug fired on the wrong condition" — worth
+  reaching for in future PR descriptions/comments on this area, not just re-deriving silently.
+- **Lesson**: when a fixture retag changes the underlying formula's inputs, don't assume "keep
+  every other assertion the same, just add the new one" — re-derive EVERY downstream numeric
+  assertion from the actual utility function (not from a coordinator's or reviewer's restated
+  number without checking it against the source), and put the derivation in a comment so a future
+  reader (or reviewer) can tell "the fixture changed and the arithmetic followed" apart from
+  "the assertion was made convenient." I re-verified the €56.25 figure independently against
+  `depositAggregateUtils.ts` rather than taking two reviewers' restated arithmetic on faith — it
+  checked out, but the habit is the point: derive, don't just relay.
+
 See [[story-1879-report-wizard]], [[issue-1959-inline-meta-and-labels]].
diff --git a/.claude/agent-memory/product-architect/MEMORY.md b/.claude/agent-memory/product-architect/MEMORY.md
index f74da89ba..884934c75 100644
--- a/.claude/agent-memory/product-architect/MEMORY.md
+++ b/.claude/agent-memory/product-architect/MEMORY.md
@@ -2,9 +2,9 @@
 
 ## Topic Files
 
-- [Recurring patterns & traps](recurring-patterns.md) — polymorphic FK cleanup, XOR CHECK vs SET NULL, forked-function drift, test smells, cross-layer contract drift, ajv `anyOf`, N+1 sites, async writes surviving state resets, the revert test for fixes that only relax an invariant — re-run it yourself on round 2 (#1968/PR #2002), cross-reference rot in documented-bound comments (#1939), usePreferences per-instance store + serialized-write-queue review (#1955), capability-retained-but-producer-removed (#1959), reinstated-producer-vs-negative-guards (#1965), AC reversal by a polish issue (#1959), amount-threshold booleans narrowing status-existence booleans (#1897), prettier is not CI-gated, single-occurrence delimiter guard tests + German ordinals vs list markers + pre-validating regex fix specs (#1952), `Pick<>` is not a forcing function + caller-supplied monotonic seq reintroduces the ref + cascade tables smuggle behaviour changes + neutralised-trigger-left-in-code (#1947), tier factory only forces the cases that spread it (#1988), regex mirroring a third-party grammar + `parseInt` trailing garbage + env vars documented in four places (#1970, PR #1989), guard-deleted-because-it-looked-like-the-bug + rate-limit identity-check gate + `request.ip` nullability types-lie + CVE test needs a negative control (#1995, PR #1998), prettier config resolution is path-based so /tmp baseline checks lie + wiki is not prettier-ignored + document the invariant not the absence-of-code (#1998 wiki pass), comment-refreshed-but-assertion-left-behind + contract inversion makes pre-existing negatives unconditional + surgical tagging misses read-only value nodes (#1910, PR #2004 r2), the-prop-landed-is-not-the-prop-is-wired + redundant-tag-a-test-asserts + `aria-label` cannot be language-tagged (#1910, PR #2004 r3), `count >= 1` + all-match is a per-instance assertion masquerading as coverage — revert each call site individually, use `toBe(N)` (#1910, PR #2004 r4), untyped E2E route fixtures drift from shared contracts + consumer early-return masks an incomplete fixture + duplicate Playwright route globs are an ordering dependency (#2005, PR #2006), widen-then-`as`-narrow defeats union exhaustiveness + a hardening PR falsifies its own ADR in four predictable places + key-echo fixtures are non-discriminating (#2001, PR #2007), a revert test can prove a _different_ proposition than the one it licenses + implementing a documented rule for the first time is when you learn the rule is wrong + three forked `collectAllStrings` copies (#2003, PR #2008)
+- [Recurring patterns & traps](recurring-patterns.md) — polymorphic FK cleanup, XOR CHECK vs SET NULL, forked-function drift, test smells, cross-layer contract drift, ajv `anyOf`, N+1 sites, async writes surviving state resets, the revert test for fixes that only relax an invariant — re-run it yourself on round 2 (#1968/PR #2002), cross-reference rot in documented-bound comments (#1939), usePreferences per-instance store + serialized-write-queue review (#1955), capability-retained-but-producer-removed (#1959), reinstated-producer-vs-negative-guards (#1965), AC reversal by a polish issue (#1959), amount-threshold booleans narrowing status-existence booleans (#1897), prettier is not CI-gated, single-occurrence delimiter guard tests + German ordinals vs list markers + pre-validating regex fix specs (#1952), `Pick<>` is not a forcing function + caller-supplied monotonic seq reintroduces the ref + cascade tables smuggle behaviour changes + neutralised-trigger-left-in-code (#1947), tier factory only forces the cases that spread it (#1988), regex mirroring a third-party grammar + `parseInt` trailing garbage + env vars documented in four places (#1970, PR #1989), guard-deleted-because-it-looked-like-the-bug + rate-limit identity-check gate + `request.ip` nullability types-lie + CVE test needs a negative control (#1995, PR #1998), prettier config resolution is path-based so /tmp baseline checks lie + wiki is not prettier-ignored + document the invariant not the absence-of-code (#1998 wiki pass), comment-refreshed-but-assertion-left-behind + contract inversion makes pre-existing negatives unconditional + surgical tagging misses read-only value nodes (#1910, PR #2004 r2), the-prop-landed-is-not-the-prop-is-wired + redundant-tag-a-test-asserts + `aria-label` cannot be language-tagged (#1910, PR #2004 r3), `count >= 1` + all-match is a per-instance assertion masquerading as coverage — revert each call site individually, use `toBe(N)` (#1910, PR #2004 r4), untyped E2E route fixtures drift from shared contracts + consumer early-return masks an incomplete fixture + duplicate Playwright route globs are an ordering dependency (#2005, PR #2006), widen-then-`as`-narrow defeats union exhaustiveness + a hardening PR falsifies its own ADR in four predictable places + key-echo fixtures are non-discriminating (#2001, PR #2007), a revert test can prove a _different_ proposition than the one it licenses + implementing a documented rule for the first time is when you learn the rule is wrong + three forked `collectAllStrings` copies (#2003, PR #2008), **a spec's own "purely additive, no E2E changes needed" claim is the tell that existing tests encoded the OLD derivation — a derivation change is never purely additive** + re-seeding a fixture without re-deriving its arithmetic expectation + `toContainText('<amount> (label)')` breaks the moment a badge is rendered between them, so assert the note locator not sibling-node adjacency (#1911, PR #2015)
 - [Dual-rail aggregation](dual-rail-aggregation.md) — Rail A/B tagged-deposit invariants (#1891/PR #1894), residual-denominator rule, isSplit UNION
-- [Source-report split inference](source-report-split-inference.md) — budgetLines[]/deposits[] are this-source-scoped, so †/‡ classification is a proxy; proposed `splitKind`; pdfmake `'2*'` width trap; wiki + shared type JSDoc both fixed (API-Contract #1914, sourceReport.ts #1917/PR #1994)
+- [Source-report split inference](source-report-split-inference.md) — budgetLines[]/deposits[] are this-source-scoped so array-shape gates are proxies; **`splitKind` SHIPPED #1911/PR #2015** incl. the ≠S-per-arm predicate, the residual arithmetic proving `(less deposit)` in both directions, the UNION-dedup/`COUNT(*)` trap, and why `isSplit` must be retained as an independent cross-check; pdfmake `'2*'` width trap; wiki + shared type JSDoc fixed (#1914, #1917/PR #1994)
 - [Story reviews](story-reviews.md) — per-story and per-PR review log
 - [Client PDF pipeline](client-pdf-pipeline.md) — ADR-034 report PDF generation, reportContent content/layout split (#1900), `dontBreakRows` silent-drop rule, document-level deduplicated legend (#1965) — ADR-034 B4 rule + legend addendum landed in PR #1979; per-locale header character budget + "no interface `t` in header/footer" (#1937/#1938, PR #1982); pdfmake `Content` is unspreadable (TS2698) but `Object.assign` needs no cast, and per-item `wordBreak`/newline-only-run facts (#1968, PR #2002). **ADR-034 debt fully PAID 2026-08-04 (#1914)**: width rule #1 (`max(horizontalRatio) <= 1`, not `_minWidth`), module table, override keys, dontBreakRows/height-bound section, injection-only locale contract. `merge.ts` footer/header interface-`t` defect **CLOSED** (footer PR #2000/#1993, header #1938); `TFunction` removed from all of `reportPdf/*` in #2001/PR #2007, so the locale contract is now compiler-enforced there and `buildReportContent.ts` is the single legitimate `TFunction` entry point — ADR-034 lines 82/178/186-188/200/219 all state the old weaker contract and needed a wiki pass (flagged in the PR #2007 review). **ADR-034 rule #1 is WRONG A SECOND TIME (proven in the PR #2008 review, 2026-08-05): `horizontalRatio` is a cell-origin bound, not a content-extent check — it is unconditionally `<= 1` on the all-fixed-width production table and cannot detect token overflow. The check that works is per-cell `_minWidth <= _calcWidth` (the ADR's `wordBreak` false-positive rationale for banning `_minWidth` is empirically false). **Third correction PAID 2026-08-05** (wiki `da1324b`): rule #1 leads with per-cell `_minWidth`, `maxHorizontalRatio` re-scoped to table-box positioning with a vacuity warning, `_minWidth` ban split table-level vs per-cell, 3rd Deviation Log row added. Semantics verified by mutation test in the PR #2008 round-2 review; **two follow-ups still open on the page — every quoted figure (69.28/33.54/266.16pt) is stale, and the rule says "every cell" while the test covers only Usage.** **#1973/PR #2010 (2026-08-05, CHANGES REQUESTED): the 2-hardcoded-shapes era is over — 96 legal column subsets via a single-absorber `computeColumnWidths`, `reportContent/columns.ts` as the AC 2.1 single derivation; `USAGE_WIDTH_7COL` 138.28pt is the NARROWEST Usage width so the 650 chunk budget needed no re-measurement (one-sided clamp). ADR-034's "Geometry constraint that blocks a feature" (line 153) was a false prohibition, plus line 144's constant reference and line 155's "hangs" claim (it throws). **All three PAID by me 2026-08-05, wiki `eb24774`**: section replaced with "Column geometry is a computed engine, not two pinned shapes", `columns.ts` added to the module structure, Deviation Log row. Same commit documented the wizard **tier-factory convention** in Architecture.md (never documented anywhere before, born #1947 after #1943/#1946) incl. the "second `DISCARD_EDITS` opt-out must trigger a tier split" limit.**
 - [Diary drafts pattern](diary-drafts-pattern.md) — ADR-022 draft lifecycle via status column on parent table
diff --git a/.claude/agent-memory/product-architect/source-report-split-inference.md b/.claude/agent-memory/product-architect/source-report-split-inference.md
index 06f94f041..d829bfbc1 100644
--- a/.claude/agent-memory/product-architect/source-report-split-inference.md
+++ b/.claude/agent-memory/product-architect/source-report-split-inference.md
@@ -31,17 +31,31 @@ invoice-level residual rule means a B-tagged deposit does reduce A's Rail A shar
 The mirror view is correct: from B's report the same invoice has `budgetLines: []` +
 the tagged deposit → `‡ constituted`, no `†`.
 
-## Proposed fix (not yet filed as of 2026-07-31)
-
-Add to `SourceReportInvoice`, derived in the existing `isSplit` UNION query whose two arms already
-separate line-sourced from deposit-sourced `source_id`s — no extra query, no other-source data leak:
-
-```ts
-/** How the cross-source split arises. Only meaningful when isSplit. */
-splitKind: 'lines' | 'deposits' | 'both';
-```
-
-Client becomes `† iff splitKind !== 'deposits'`, `‡ iff splitKind !== 'lines'` — no `.length` proxies.
+## SHIPPED as `splitKind` — #1911 / PR #2015 (reviewed 2026-08-05)
+
+`splitKind: 'lines' | 'deposits' | 'both' | null` (**required**, `null` when unsplit), derived in the
+existing step-f UNION at zero extra query cost. Predicate per arm is **"a source ≠ S exists in this
+arm"**, NOT "this arm has ≥2 distinct sources" — the headline case has exactly one source per arm.
+`row.isSplit ⟺ 'lines'|'both'`; `row.isDepositReduced ⟺ 'deposits'|'both'`; `row.isDeposit` trigger
+UNCHANGED (`invoice.isSplit && hasOwnTaggedDeposit`). Wiki API-Contract documents all of it (`1f3eb7c`).
+
+**Arithmetic proof AC 3.2 is right in both directions** (`depositAggregateUtils.ts:545-562`, invoice 200,
+line 75, deposit 50): foreign-tagged deposit → residual 0.75, `depositFractions` **empty** (tagged rows
+filtered) → 56.25, allocation genuinely drops, so "claimed **separately**" is TRUE. Untagged deposit →
+residual 0.75 **plus** returned fraction 0.25 → 75.00, net zero, nothing claimed elsewhere, so the old
+`(less deposit)` was literally false to a bank. Use this table whenever the trigger is re-litigated.
+
+**UNION dedup:** adding the `origin` literal defeats *cross-arm* row dedup. Safe only because
+`COUNT(DISTINCT source_id)` and `MAX(CASE …)` are multiplicity-insensitive. Pre-#1911, `COUNT(*)` and
+`COUNT(DISTINCT source_id)` were equivalent; **they are not anymore** — a future "simplification" to
+`COUNT(*) > 1` silently flips isSplit for every invoice with a line and a tagged deposit in the same
+source. Guarded by the AC 1.9 fixture; I asked for a comment at the query itself. `UNION ALL` would be
+semantically identical, cheaper, and more honest about multiplicity.
+
+**Keep `isSplit`, and for a better reason than back-compat:** it and `splitKind` come from two
+*independent* expressions over the same rows, which is what makes `expect(splitKind !== null).toBe(isSplit)`
+a real cross-check instead of a tautology. Deriving one from the other destroys the only test that would
+catch the `COUNT(*)` regression from the other side.
 
 ## `budgetLines[]` scope deviation — wiki FIXED, shared type FIXED
 
diff --git a/.claude/agent-memory/product-owner/MEMORY.md b/.claude/agent-memory/product-owner/MEMORY.md
index 64eae132d..e3228c6f8 100644
--- a/.claude/agent-memory/product-owner/MEMORY.md
+++ b/.claude/agent-memory/product-owner/MEMORY.md
@@ -49,7 +49,7 @@ All rulings, contract facts, per-PR review outcomes and filed follow-ups live in
 - Open: #1888, #1891, #1895-#1897, #1910, #1912, #1917, #1937-#1941, #1946 (Must Have), #1947, #1950, #1952, #1953, #1966-#1972, #2011-#2014
 - Merged but **not Done** (awaiting live-LLM UAT): #1931 (ACs 3.2/3.3)
 - **#1973** column visibility → PDF: PR #2010 approved R1, 28/33 ACs, → **UAT, stays In Progress**. Follow-ups #2011-#2014 all Backlog + blocked-by #1973.
-- **#1911** `splitKind`: ACs refined 2026-08-05 onto an orchestrator-filed body → **UAT, not Done-on-merge**. Privacy: no objection. Legend: no new sentence. Addendum ruling (pre-merge): zero-line-contribution row now shows `(Deposit)`+`(partial)` — **intended, do not narrow**, AC 3.6/3.7/4.7 added.
+- **#1911** `splitKind`: ACs refined 2026-08-05 onto an orchestrator-filed body → **UAT, not Done-on-merge**. Privacy: no objection. Legend: no new sentence. Addendum ruling (pre-merge): zero-line-contribution row now shows `(Deposit)`+`(partial)` — **intended, do not narrow**, AC 3.6/3.7/4.7 added. **PR #2015 CHANGES REQUESTED round 1** — logic correct, evidence layer not: 2 red E2E scenarios (stale assertions, not defects) + AC 4.5's render measurement unfalsifiable by construction.
 
 ## Requirements Coverage
 
@@ -90,6 +90,8 @@ Full derivations and the incidents behind each are in [pr-review-patterns.md](pr
 - **"Dominated by an existing measurement, do not re-measure" is as valuable as demanding the measurement.** Rank flagged risks against each other instead of treating every new co-occurrence as equally alarming.
 - **When a fix removes a mutual exclusion, ask what combination just became reachable** that never rendered before.
 - **A documented measurement (glossary space budget, column width) can close a wording debate before it starts.**
+- **"Real render" ≠ "measured."** An unmocked render whose assertions read the *input* content tree, or read a quantity fixed by construction (e.g. a table width that is `printableWidth()` for any input), is still a vacuous assertion. Ask what *varies* when the guarded content changes — not whether a render happened.
+- **Check that the issue a routing rule points at is still open before restating the rule.**
 - **Answer boundary/privacy questions about the artifact that leaves the system, not only about the API.**
 - **A finding's severity is capped by my own enumeration failure** — if I missed it in earlier rounds, it can't be blocking now. End mirror-image review cycles by **stating the enumeration as exhaustive**.
 - **Comment keeps the rationale, issue owns the guard.** Bounded-and-quantified earns a tracked owner; unbounded-and-estimated gets documentation only.
diff --git a/.claude/agent-memory/product-owner/bank-report-wizard.md b/.claude/agent-memory/product-owner/bank-report-wizard.md
index ed030ea4f..39dd6981f 100644
--- a/.claude/agent-memory/product-owner/bank-report-wizard.md
+++ b/.claude/agent-memory/product-owner/bank-report-wizard.md
@@ -996,3 +996,73 @@ down even though the code is already correct.**
 seeded an *untagged* deposit and asserted `isDepositReduced: true` — the E2E suite had encoded the
 bug as expected behaviour. QA also verified the new behaviour genuinely fails against pre-#1911 code
 (9 of 70 tests fail on restore), which is the anti-vacuity check AC 5.5 asked for.
+
+### PR #2015 (#1911 implementation) — CHANGES REQUESTED round 1 (2026-08-05, head `db982cb1`, comment `5198588590`)
+
+Derivation is correct and well-tested (all of §1, §2, §3.1–3.5/3.7, §5.1/5.2/5.5/5.6, §6, §7 met).
+Both blockers are in the **evidence layer**, not the logic. AC 1.5's trap test is genuinely
+falsifying; AC 2.5's wiki entry states the negative form of the predicate verbatim; AC 5.5's
+mutation test flips legend membership, not just flags, and the whole-suite discrimination figure
+(9/70 fail on restore) was volunteered in the PR body as demanded.
+
+**B1 — the PR's own two E2E scenarios red, both stale assertions in the NEW test code, not product
+defects.** Deterministic (both retries, shards 2 + 9, desktop + tablet).
+
+- *Scenario 17*: asserted `'€150.00 (partial)'`, DOM is `'€150.00Deposit (partial)'` — the assertion
+  was copied from a badge-less row and doesn't allow for the `Deposit` badge sitting between amount
+  and note. **Told them not to loosen it to a bare `€150.00`**: the adjacency IS the AC.
+- *Scenario 18*: asserted `'€75.00 (partial)'`, got `'€56.25 (partial) (less deposit)'`. Labels
+  right, **amount stale**. Re-seeding invoice3's deposit untagged → tagged-to-other changed the
+  arithmetic via the #1891 **redirect** rule: `75/200 × (200 − 50) = 56.25`. #1911 touches no money
+  path. **Demanded the derivation go in a comment** — a bare number change reads as weakening a test.
+  **General: when a fixture re-seed changes a derived amount, the corrected number needs its
+  derivation written down or the next reviewer cannot distinguish it from a weakened assertion.**
+
+**B2 — AC 4.5's measurement is unfalsifiable by the content it claims to guard.** The real-render
+setup is right (unmocked, en+de, 7-col and 1-col endpoints of the #1973 subsets). But:
+`maxHorizontalRatio <= 1` **cannot fail on any input** — after #1929 round 4 there is no `'*'` column
+and `overviewPdf.ts:105` documents table width = `printableWidth()` for ANY input; `horizontalRatio`
+is recorded at each line's *start* x, derived from content-independent column offsets. And "all four
+labels present verbatim" reads the pdfmake **content tree** (the input), so it cannot observe drop,
+clip or wrap. `getPageCount() >= 1` adds nothing. Net: the named risk — #1959's wrap-mid-bracket in
+this exact column, live because `(abzgl. Abschlag)` has an internal space — is unguarded.
+
+**Fix spec given**: pdfmake writes one `positions` entry per rendered *line*, so assert the allocated
+cell's line count — (a) differential (maximal row vs. no-label row, strictly more lines: cannot go
+vacuous) and (b) a ceiling derived from `ALLOCATED_AMOUNT_WIDTH` + font constants, #1929/#1950 style,
+never a typed literal. Offered a documented deviation → fold 4.5 into UAT if neither is achievable.
+
+**Reusable: "real render" is not the same as "measured".** A genuinely unmocked render whose
+assertions read the input tree, or read a quantity fixed by construction, is still a vacuous
+assertion. Ask *what varies* in the assertion when the guarded content changes — not whether a
+render happened. This is the fourth instance of the pattern in this cluster (cf. #2008 C1 "metric is
+a constant", the config-object checks, the never-failing alternations).
+
+**Severity note to self:** I enumerated AC 4.5 explicitly as "highest-risk — measure it" and named the
+#1959 precedent, so the enumeration-failure cap does *not* apply — it was fair to block on it.
+
+**Non-blocking, filed as observations:** (N1) preview emits `refundNoteText` *before* the three labels
+(`ReportContentEditor.tsx:331`) while the PDF emits it *after* (`overviewPdf.ts:856`) — AC 4.4's
+three-label order is identical on both surfaces so the AC is met, and it predates #1911, but the
+newly-reachable four-run row makes it visible; follow-up, do not expand the PR. (N2) AC 5.3's
+preview-DOM half is en-only. (N3) `Fixes #1911` auto-closes on `main` — the UAT pass must run before
+promotion or the UAT disposition evaporates silently.
+
+**PR body assessment (asked for explicitly).** Honest where it counts: it flags the over-inclusive
+defect as *not* in the original issue, and states plainly that the dev-team-lead's own E2E spec was
+wrong to call the change "purely additive". Told them to keep that verbatim — a spec author marking
+their own error in the permanent record is worth more than a tidy body. One **overstatement** (AC 4.5
+"measured … all four labels present verbatim" — the render is real, the measurement isn't sensitive
+to the labels) and one **understatement** ("Both fixed" while CI shows both scenarios red).
+
+**UAT disposition reconfirmed; one leg of the routing was stale.** #1911 still goes to UAT, AC 4.7
+still folded into the existing pass. B2 *strengthens* the case — with the four-run geometry unguarded,
+the human pass is the only thing looking at that row. Corrected routing:
+
+- fix is to **what the labels say** → **reopen #1911** (its deliverable), unchanged;
+- fix is to **column geometry** → **new issue in the #1939 lineage**. My original "route width
+  rejections to the already-filed issue" is **stale: #1937 is closed** and none of #2011–#2014 or
+  #1950 covers the allocated column. #1911's scope boundary never included geometry — AC 4.5 only
+  *measured*, it never authorised a fix.
+
+**General: check that the issue a routing rule points at is still open before restating the rule.**
diff --git a/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md b/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md
index 39b7222cb..f21f121a4 100644
--- a/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md
+++ b/.claude/agent-memory/qa-integration-tester/story-1911-splitkind.md
@@ -108,6 +108,55 @@ unrelated errors. In this case both projects came back fully clean (0 errors) af
 warned about didn't materialize for this run — but the scoped-check discipline is the reusable
 lesson, not the specific number.
 
+## Post-merge review finding: AC 4.5's geometry test was vacuous on both assertions — read ADR-034 first
+
+PR #2015 review (product-owner + product-architect) found the AC 4.5 four-run-row test I wrote could
+not fail on either assertion, and it was **already documented**: the wiki's `ADR-034` Deviation Log
+(2026-08-05 entry, filed off PR #2008's own mutation testing) states `maxHorizontalRatio(pdfContent)
+<= 1` is **proven vacuous on production content** in this exact table — every column is a fixed,
+content-independent width (#1929 round 4 removed the last `'*'`), so `horizontalRatio` (recorded at
+each rendered line's START x) can never move regardless of content width; it only detects a
+mispositioned COLUMN, never an overflowing CELL. Always read an ADR's Deviation Log before writing a
+geometry assertion in `realRender.test.ts` — the falsifiable form for this exact risk class is
+already prescribed there (`ADR-034-Client-Side-Report-PDF-Generation.md`, "Testing requirement: real
+renders, not mocks" section, rule #1): per-cell `_minWidth <= widths[i]._calcWidth`, read AFTER a real
+render — `_minWidth` is pdfmake's own post-render measurement of the widest atom `TextBreaker` could
+not further break, so it is a genuine OUTPUT value, not something the test supplies.
+
+The SECOND assertion ("all four labels present, read from `cell.text`") was independently broken for
+a different reason: pdfmake never modifies `.text` during render (only annotates `_minWidth`,
+`positions`, etc. onto the same objects) — reading `.text` post-render observes exactly what the test
+itself constructed, so it can never detect a drop/clip/wrap. Fixed with a **differential** check using
+`.positions.length` (a real per-render line count, written by pdfmake during layout): render the
+maximal 4-label fixture and a reduced 3-label comparator (same fixture, `splitKind: 'both'` →
+`'deposits'`, which removes exactly the split label) side by side, and assert
+`maximal.positionsLength > reduced.positionsLength`. If a code change silently drops a label from the
+maximal row, the two renders become indistinguishable and the inequality collapses — this is what
+actually caught the mutation (see below), not a hand-derived absolute line-count ceiling.
+
+**Mutation-testing proof (both checks), git-diff-verified restore:**
+- Backed up `overviewPdf.ts` to `/tmp` before either mutation (this file is NOT part of my PR's diff
+  — it's already-committed code from #1959/#1973, so `git diff --stat` after restore showing nothing
+  is the correct "byte-identical" signal here, not `git show HEAD:`).
+- Mutation 1 (overflow): merged the `isDeposit`/`isSplit` label pushes into one run joined by a
+  (accidentally-real, not hand-typed) NBSP — 2 of 4 `it.each` cases (both DE) went red at 113.6pt vs
+  the 75pt column, confirming `_minWidth <= _calcWidth` is genuinely sensitive to an unbreakable atom
+  exceeding the column. EN stayed green because the merged EN label pair happens to still fit under
+  75pt — expected and fine; the proof only needs at least one genuine failure, not all four.
+- Mutation 2 (drop): gated the `isSplit` label push with `&& false`. **All 4 `it.each` cases went red**
+  — `positionsLength` collapsed to an exact equality (e.g. `Expected: > 4, Received: 4`) — directly
+  confirming the differential check catches a silently-dropped label.
+- Restored via `cp` from the `/tmp` backup after each mutation; `diff` against the backup and
+  `git diff --stat`/`git status --short` both confirmed byte-identical before moving to the next step.
+
+**Process lesson for any future geometry assertion in this file:** `maxHorizontalRatio` and reading
+`.text` post-render are both natural-looking but WRONG defaults for "did this overflow/get dropped" —
+the file already has two established, genuinely-falsifiable idioms for these two risk classes
+(per-cell `_minWidth`/`_calcWidth` for overflow, `.positions.length`-based differential/ceiling checks
+for drops) sitting in the same file (`'ADR-034 rule #1: horizontal-overflow...'` describe block,
+`'#2003 usageText'`/`'#2003 areaText'` tests) — copy those idioms rather than reaching for
+`maxHorizontalRatio` or a `.text` substring check on a new fixture.
+
 ## Coverage
 
 `sourceReportService.ts`: 100% stmts/lines/funcs, 93.75% branch (whole-file; the new splitKind lines
diff --git a/.claude/agent-memory/security-engineer/MEMORY.md b/.claude/agent-memory/security-engineer/MEMORY.md
index b593390c8..06b0a9872 100644
--- a/.claude/agent-memory/security-engineer/MEMORY.md
+++ b/.claude/agent-memory/security-engineer/MEMORY.md
@@ -33,7 +33,9 @@ Verified across EPIC-01/02/03/05 — all confirmed STRONG:
 - [Full PR review table](pr-review-table.md) — every PR reviewed since project inception, one line each
 - [Detailed review findings](review-history.md) — full write-ups for PRs with notable findings
 
-Most recent: **#1999** fix(security): null-safe `normalizeIP` keyGenerator (CVE-2026-15144 follow-up) — COMMENTED APPROVED. Adds `keyGenerator: (request) => normalizeIP(request.ip ?? 'unknown')` to rateLimitPlugin.ts. CVE remains closed: normalizeIP is a named export in @fastify/rate-limit 11.2.0 (`export function normalizeIP(ip: string, ipv6Subnet?: number): string`; defaults to /64); `'unknown'` fallback returns `'unknown'`.toLowerCase() (not IPv6 → first branch of function) so null-IP requests share one conservative bucket rather than throwing. 1 low (null path `?? 'unknown'` has no unit test — can't trigger via app.inject which defaults remoteAddress to 127.0.0.1); 1 informational (ipv6Subnet config drift: custom generator hardcodes /64 default, ignores any future `ipv6Subnet` plugin option). Updated Security-Audit.md: fixed stale L91 snippet (`req.ip` → null-safe normalizeIP), updated CVE finding remediation to document two-PR fix + key-must-be-normalizeIP invariant.
+Most recent: **#2015** feat(reports): `SourceReportInvoice.splitKind` ('lines'|'deposits'|'both'|null), SQL UNION rewrite in `sourceReportService.ts` step f (#1911) — APPROVED, no findings. Requested despite missing the literal auth/Dockerfile/dependency triggers because it rewrites a SQL query and adds a field carrying info about *other* budget sources. Verified (not trusted): `sourceId`/`joinedInvoiceIds` genuinely parameter-bound via drizzle `sql\`\`` template + `sql.join(ids.map(id => sql\`${id}\`), sql\`, \`)`; the `'line'`/`'deposit'` origin tags are hardcoded SQL literals, no variable reaches them. Independently re-verified the "no auth boundary between budget sources" premise myself rather than taking product-owner's word: `budgetSources` schema (schema.ts:333) has zero owner/household column, every route in `budgetSources.ts` gates only on `if (!request.user)` — no per-source ACL exists anywhere in the app, so `splitKind` can't leak across a boundary that doesn't exist. Confirmed `splitKind` only ever drives two boolean comparisons client-side (`buildReportContent.ts`) that toggle pre-existing fixed inline labels — the categorical string itself never reaches rendered output, logs, or any other response field. No DoS: new `MAX(CASE...)` aggregates computed in the same GROUP BY pass, pre-existing indexes on `invoice_id` untouched. **Reusable premise-check pattern**: when a reviewer/agent asserts "no auth boundary exists here" as the basis for an info-disclosure verdict, independently confirm via schema (no owner/household FK) + routes (no requireRole/ACL filter) before accepting — don't take it on trust even from a normally-reliable source.
+
+Previous: **#1999** fix(security): null-safe `normalizeIP` keyGenerator (CVE-2026-15144 follow-up) — COMMENTED APPROVED. Adds `keyGenerator: (request) => normalizeIP(request.ip ?? 'unknown')` to rateLimitPlugin.ts. CVE remains closed: normalizeIP is a named export in @fastify/rate-limit 11.2.0 (`export function normalizeIP(ip: string, ipv6Subnet?: number): string`; defaults to /64); `'unknown'` fallback returns `'unknown'`.toLowerCase() (not IPv6 → first branch of function) so null-IP requests share one conservative bucket rather than throwing. 1 low (null path `?? 'unknown'` has no unit test — can't trigger via app.inject which defaults remoteAddress to 127.0.0.1); 1 informational (ipv6Subnet config drift: custom generator hardcodes /64 default, ignores any future `ipv6Subnet` plugin option). Updated Security-Audit.md: fixed stale L91 snippet (`req.ip` → null-safe normalizeIP), updated CVE finding remediation to document two-PR fix + key-must-be-normalizeIP invariant.
 
 Previous: **#1998** fix(security): #1995 — CVE-2026-15144 / GHSA-grpc-p53c-r64v (CVSS 7.3) IPv6 /64 rate-limit bypass. Custom `keyGenerator` in `rateLimitPlugin.ts` returned raw `request.ip` string (full IPv6 address) rather than /64-normalized prefix; an attacker with a /64 allocation could exhaust 2^64 distinct buckets and bypass rate limits on all 4 auth endpoints entirely. Fix: delete the 13-line custom `keyGenerator` — `@fastify/rate-limit` 11.2.0's default generator applies /64 normalization. COMMENTED APPROVED. 1 informational: only login route covered by the new /64-sharing test; setup/password/dav-tokens endpoints share the same plugin instance so normalization is guaranteed, but explicit tests are missing.
 
diff --git a/.claude/agent-memory/security-engineer/pr-review-table.md b/.claude/agent-memory/security-engineer/pr-review-table.md
index 2b5fd665e..56e6452db 100644
--- a/.claude/agent-memory/security-engineer/pr-review-table.md
+++ b/.claude/agent-memory/security-engineer/pr-review-table.md
@@ -85,3 +85,4 @@ Full review status per PR. See `review-history.md` for detailed findings on PRs
 | #1916 | #1901 — server-side AI report content generation (POST /api/source-reports/generate-content, cover letter + invoice descriptions)                                                            | APPROVED (no High/Critical; 2 informational: no per-route rate limit on new LLM endpoint — matches sibling invoiceAutoItemize, not a regression; stale test-file comment claiming a schema-import bug fixed by the PR's own 2nd commit)                                                     | 2026-07-31 |
 | #1998 | fix(security): #1995 — remove custom keyGenerator to restore IPv6 /64 normalization (CVE-2026-15144 / GHSA-grpc-p53c-r64v, CVSS 7.3)                                                         | COMMENTED APPROVED (High finding, same-day resolved; fix deletes 13-line custom keyGenerator so @fastify/rate-limit 11.2.0 default applies /64 normalization; 1 informational: only login route tested for /64 sharing — setup/password/dav-tokens untested but share same plugin instance) | 2026-08-04 |
 | #1999 | fix(security): null-safe normalizeIP keyGenerator — CVE-2026-15144 follow-up (null path on request.ip → TypeError fix)                                                                       | COMMENTED APPROVED (1 low: null path ?? 'unknown' has no unit test — cannot trigger via app.inject which defaults remoteAddress; 1 informational: ipv6Subnet config drift — custom generator hardcodes /64 default, ignores any future ipv6Subnet plugin option. Security-Audit.md stale L91 snippet fixed in this review.) | 2026-08-04 |
+| #2015 | #1911 — SourceReportInvoice.splitKind ('lines'\|'deposits'\|'both'\|null), SQL UNION rewrite in sourceReportService.ts step f                                                                | APPROVED, no findings (SQLi clean: sourceId/joinedInvoiceIds genuinely bound via drizzle sql`` template + sql.join, 'line'/'deposit' are hardcoded literals; info-disclosure premise independently re-verified — budgetSources has zero owner/household scoping in schema or routes, so no auth boundary exists for splitKind to leak across; splitKind never rendered/serialized beyond two boolean comparisons driving pre-existing fixed labels; no DoS — new aggregates computed in the same GROUP BY pass, pre-existing indexes untouched)                                                                                                                                        | 2026-08-05 |
diff --git a/client/src/lib/reportContent/types.ts b/client/src/lib/reportContent/types.ts
index 1ad85ae66..93e52a4f6 100644
--- a/client/src/lib/reportContent/types.ts
+++ b/client/src/lib/reportContent/types.ts
@@ -13,8 +13,8 @@ export interface ReportContentRow {
   statusText: string | null; // null when useCase !== 'budget-overview'
   invoiceAmountText: string;
   allocatedAmountValueText: string; // formatted currency only — no markers/refund note
-  isSplit: boolean; // split invoice with budget lines → inline "partial" label
-  isDepositReduced: boolean; // split invoice reduced by untagged deposits → inline label
+  isSplit: boolean; // splitKind === 'lines' | 'both' → inline "(partial)" label
+  isDepositReduced: boolean; // splitKind === 'deposits' | 'both' → reduced by a deposit tagged to a DIFFERENT source; inline label. Untagged deposits are apportioned back into this source pro-rata and never set this flag.
   isDeposit: boolean; // constituted-deposit row → inline Deposit badge
   isRefund: boolean;
   refundNoteText: string; // shown only when isRefund
diff --git a/client/src/lib/reportPdf/realRender.test.ts b/client/src/lib/reportPdf/realRender.test.ts
index af11d7a35..795d42ab4 100644
--- a/client/src/lib/reportPdf/realRender.test.ts
+++ b/client/src/lib/reportPdf/realRender.test.ts
@@ -3521,15 +3521,28 @@ describe('#1911 AC 5.3: the AC 1.2 shape renders (less deposit)/depositReducedFo
 // configured page size must paint no text outside the printable area and drop none of the four
 // labels, in both locales and under the #1973 column-visibility subsets that narrow the allocated
 // column (glossary.json records a prior wrap-mid-bracket break in exactly this column, #1959).
+//
+// REVIEW FINDING (product-owner + product-architect, PR #2015): the first version of this test
+// asserted `maxHorizontalRatio(pdfContent) <= 1` and "all four labels present in cell.text" —
+// neither is falsifiable. `maxHorizontalRatio` is proven vacuous on production content by the
+// ADR-034 Deviation Log (2026-08-05, filed off PR #2008's mutation testing): every column in this
+// table is a fixed, content-independent width (#1929 round 4 removed the last `'*'` column), so
+// `horizontalRatio` — recorded at each rendered line's START x, from content-independent column
+// offsets — can never move no matter how wide a cell's content is; it detects a mispositioned
+// COLUMN, not an overflowing CELL. And reading `.text` off the pdfmake content tree reads what
+// THIS TEST constructed, never what pdfmake actually laid out — it cannot observe a drop, a clip,
+// or a wrap. Replaced with the two checks below, both read from pdfmake's OWN post-render state.
 // ─────────────────────────────────────────────────────────────────────────────────────────────
 describe('#1911 AC 4.5: maximal four-run allocated-amount row — real render, no overflow, no label drop', () => {
-  function makeMaximalReport(): SourceReportResponse {
+  function makeMaximalReport(
+    splitKindValue: SourceReportInvoice['splitKind'],
+  ): SourceReportResponse {
     const inv = makeInvoice({
       invoiceId: 'inv-1911-maximal',
       vendorName: 'Maximal Vendor',
       invoiceNumber: 'MAX-0001',
       isSplit: true,
-      splitKind: 'both',
+      splitKind: splitKindValue,
       lineKind: 'refund-adjustment',
       invoiceAmount: 500,
       allocatedAmount: -150,
@@ -3565,29 +3578,29 @@ describe('#1911 AC 4.5: maximal four-run allocated-amount row — real render, n
     };
   }
 
-  it.each([
-    ['budget-overview 7-col', 'budget-overview' as const, 'en', 'en-US', () => tEn] as const,
-    ['budget-overview 7-col', 'budget-overview' as const, 'de', 'de-DE', () => tDe] as const,
-    ['claim 1-col', 'claim' as const, 'en', 'en-US', () => tEn] as const,
-    ['claim 1-col', 'claim' as const, 'de', 'de-DE', () => tDe] as const,
-  ])('%s, %s locale', async (_shapeLabel, useCase, _localeLabel, localeStr, getT) => {
+  // Renders `report`'s single invoice for the given use case/locale/column-visibility shape and
+  // reads back pdfmake's own POST-RENDER annotations on the allocated-amount cell — `_minWidth`
+  // (ADR-034 rule #1's falsifiable overflow measurement) and `.positions` (real per-line layout
+  // records, used below for the differential no-drop check) — never just the `.text` we built.
+  async function renderAllocatedCell(
+    report: SourceReportResponse,
+    useCase: 'budget-overview' | 'claim',
+    t: TFunction,
+    formatters: Formatters,
+  ): Promise<{
+    minWidth: number;
+    calcWidth: number;
+    positionsLength: number;
+    pageCount: number;
+  }> {
     const { buildOverviewContent } = await import('./overviewPdf.js');
     const { reportColumnsForUseCase, REQUIRED_REPORT_COLUMN } =
       await import('../reportContent/columns.js');
-    const t = getT();
-    const formatters = formattersFor(localeStr as 'en-US' | 'de-DE');
-    const report = makeMaximalReport();
-    const includedIds = new Set(['inv-1911-maximal']);
-
+    const includedIds = new Set(report.invoices.map((inv) => inv.invoiceId));
     const content = buildReportContent(report, includedIds, useCase, t, formatters, {
       includeCoverLetter: false,
       household: null,
     });
-    // Sanity: this really is the maximal four-run case at the model level.
-    expect(content.rows[0]!.isDeposit).toBe(true);
-    expect(content.rows[0]!.isSplit).toBe(true);
-    expect(content.rows[0]!.isDepositReduced).toBe(true);
-    expect(content.rows[0]!.isRefund).toBe(true);
 
     // budget-overview: every column visible (the 7-col shape, default hiddenColumns). claim: every
     // hideable column hidden except the locked allocatedAmount column — the same construction as
@@ -3611,33 +3624,96 @@ describe('#1911 AC 4.5: maximal four-run allocated-amount row — real render, n
       t,
     );
 
-    // AC1: nothing rendered past the printable right edge, in either shape.
-    expect(maxHorizontalRatio(pdfContent)).toBeLessThanOrEqual(1);
-
     // Single invoice in this report -> table.body[0] is the header, table.body[1] is the one data
     // row, regardless of which columns are visible (usage content is short: no continuation rows).
-    const tableItem = pdfContent.find(
-      (c) => typeof c === 'object' && c !== null && 'table' in c,
-    ) as { table: { body: unknown[][] } };
-    const dataRow = tableItem.table.body[1] as { text: unknown }[];
+    const tableItem = findTableItem(pdfContent);
+    const calcWidths = calcWidthsOf(tableItem.table.widths);
     // allocatedAmount is the sole cell in the 1-col claim shape, or the 6th (index 5) non-usage
     // cell before the trailing Usage cell in the 7-col budget-overview shape.
-    const allocatedCell = (useCase === 'budget-overview' ? dataRow[5] : dataRow[0]) as {
-      text: { text: string }[];
+    const allocatedColIndex = useCase === 'budget-overview' ? 5 : 0;
+    const dataRow = tableItem.table.body[1] as {
+      text: unknown;
+      _minWidth?: number;
+      positions?: unknown[];
+    }[];
+    const allocatedCell = dataRow[allocatedColIndex] as {
+      text: unknown;
+      _minWidth?: number;
+      positions?: unknown[];
     };
-    const allocatedRuns = allocatedCell.text;
-    expect(Array.isArray(allocatedRuns)).toBe(true);
-    const allocatedText = allocatedRuns.map((r) => r.text).join('');
-
-    // All four labels present verbatim, in the documented order — (Deposit) (partial) (less
-    // deposit) refundNote — proves no silent drop under the newly-reachable four-run row.
-    expect(allocatedText).toContain(` (${content.labels.deposit})`);
-    expect(allocatedText).toContain(` (${content.labels.splitNote})`);
-    expect(allocatedText).toContain(` (${content.labels.depositReducedNote})`);
-    expect(allocatedText).toContain(content.rows[0]!.refundNoteText);
+    if (typeof allocatedCell._minWidth !== 'number') {
+      throw new Error(
+        'allocatedCell._minWidth is not a number — was pdfContent rendered before reading it?',
+      );
+    }
+    if (!Array.isArray(allocatedCell.positions)) {
+      throw new Error(
+        'allocatedCell.positions is not an array — was pdfContent rendered before reading it?',
+      );
+    }
 
     const pdfDoc = await PDFDocument.load(await blob.arrayBuffer());
-    expect(pdfDoc.getPageCount()).toBeGreaterThanOrEqual(1);
+    return {
+      minWidth: allocatedCell._minWidth,
+      calcWidth: calcWidths[allocatedColIndex]!,
+      positionsLength: allocatedCell.positions.length,
+      pageCount: pdfDoc.getPageCount(),
+    };
+  }
+
+  it.each([
+    ['budget-overview 7-col', 'en', 'budget-overview' as const, 'en-US', () => tEn] as const,
+    ['budget-overview 7-col', 'de', 'budget-overview' as const, 'de-DE', () => tDe] as const,
+    ['claim 1-col', 'en', 'claim' as const, 'en-US', () => tEn] as const,
+    ['claim 1-col', 'de', 'claim' as const, 'de-DE', () => tDe] as const,
+  ])('%s, %s locale', async (_shapeLabel, _localeLabel, useCase, localeStr, getT) => {
+    const t = getT();
+    const formatters = formattersFor(localeStr as 'en-US' | 'de-DE');
+
+    // Sanity at the model level: this really is the maximal four-flag case, before we render it.
+    const maximalReport = makeMaximalReport('both');
+    const maximalModelCheck = buildReportContent(
+      maximalReport,
+      new Set(['inv-1911-maximal']),
+      useCase,
+      t,
+      formatters,
+      { includeCoverLetter: false, household: null },
+    );
+    expect(maximalModelCheck.rows[0]!.isDeposit).toBe(true);
+    expect(maximalModelCheck.rows[0]!.isSplit).toBe(true);
+    expect(maximalModelCheck.rows[0]!.isDepositReduced).toBe(true);
+    expect(maximalModelCheck.rows[0]!.isRefund).toBe(true);
+
+    const maximal = await renderAllocatedCell(maximalReport, useCase, t, formatters);
+
+    // CHECK 1 — overflow (ADR-034 rule #1, the falsifiable form; see the Deviation Log entry cited
+    // above). `_minWidth` is pdfmake's own post-render measurement of the widest atom TextBreaker
+    // could not further break, computed AFTER the cell's real content laid out — exactly the
+    // quantity that overflows a fixed-width column. This is genuinely sensitive to the maximal
+    // row's content: the allocated-amount column is a tight, PINNED 75pt regardless of shape (it
+    // is never the absorber column), and the individual labels already sit close to that width
+    // (glossary.json: "Abschlagszahlung" alone measures ~72.85pt) — an unbreakable atom wider than
+    // 75pt would fail this.
+    expect(maximal.minWidth).toBeLessThanOrEqual(maximal.calcWidth);
+
+    // CHECK 2 — no silent drop (differential, real OUTPUT not input). Render a REDUCED comparator:
+    // the same fixture with exactly one fact removed — splitKind "deposits" instead of "both",
+    // which is the isSplit flag alone toggling off, dropping exactly the ' (partial)'/
+    // ' (Teilbetrag)' run. `.positions.length` is written by pdfmake DURING layout and reflects
+    // how many real lines the cell's ACTUAL content required — unlike `.text`, it cannot be
+    // satisfied by what the test merely constructed. Given how tight the 75pt column is (no two of
+    // these labels can share a line — each individually approaches the column's full width), the
+    // maximal (4-label) row must lay out into strictly more lines than the reduced (3-label) row.
+    // If a future change silently drops a label from the maximal row — the exact regression this
+    // criterion exists to catch — the two renders become indistinguishable and this collapses to
+    // an equality, failing the assertion.
+    const reducedReport = makeMaximalReport('deposits');
+    const reduced = await renderAllocatedCell(reducedReport, useCase, t, formatters);
+    expect(maximal.positionsLength).toBeGreaterThan(reduced.positionsLength);
+
+    // No throw, at least one page, for the maximal shape.
+    expect(maximal.pageCount).toBeGreaterThanOrEqual(1);
   });
 });
 
diff --git a/e2e/tests/budget/reportWizardEditableContent.spec.ts b/e2e/tests/budget/reportWizardEditableContent.spec.ts
index af7bbf2d4..ebafd067d 100644
--- a/e2e/tests/budget/reportWizardEditableContent.spec.ts
+++ b/e2e/tests/budget/reportWizardEditableContent.spec.ts
@@ -1680,7 +1680,6 @@ test.describe(
           const note = wizard.inlineNote(vendorName, invoice.invoiceNumber!);
           await expect(note).toHaveCount(1);
           await expect(note).toHaveText('(partial)');
-          await expect(row).toContainText('€150.00 (partial)');
           const rowText = (await row.textContent()) ?? '';
           expect(rowText).not.toContain('less deposit');
           expect(rowText).not.toContain('†');
@@ -1818,7 +1817,17 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
       // Issue #1980).
       const note3 = wizard.inlineNote(vendorName, invoice3.invoiceNumber!);
       await expect(note3).toHaveCount(2);
-      await expect(row3).toContainText('€75.00 (partial)');
+      // €56.25, not €75.00: the deposit is now tagged to `otherSourceId` (a source ≠
+      // `reportedSourceId`), so `depositAggregateUtils.ts`'s redirect rule applies —
+      // `computeLineContributionsExcludingTagged` multiplies the reported source's own
+      // itemized line (€75) by the invoice's RESIDUAL fraction after excluding tagged deposits:
+      // (invoiceAmount €200 − taggedDeposit €50) / €200 = 0.75, and `depositFractions` for THIS
+      // source is empty (the deposit is tagged elsewhere, so it's filtered out of this source's
+      // own fractions). 75 × 0.75 = 56.25. This arithmetic is the strongest proof of the AC 3.2
+      // fix: a foreign-tagged deposit genuinely reduces this source's allocation, so "claimed
+      // separately" is a TRUE statement here — contrast the untagged case in the sibling guard
+      // below, where the same residual math nets back to the full amount.
+      await expect(row3).toContainText('€56.25 (partial)');
       await expect(row3).toContainText('(less deposit)');
 
       // Negatives, each paired with the positives above: neither legacy footnote glyph survives
@@ -1938,6 +1947,15 @@ test.describe('Report wizard editable content — inline split and deposit-reduc
       const note = wizard.inlineNote(vendorName, invoice.invoiceNumber!);
       await expect(note).toHaveCount(1);
       await expect(note).toHaveText('(partial)');
+      // €60.00, the FULL itemized line amount, not a reduced one: `depositAggregateUtils.ts`'s
+      // `residualFraction` subtracts ALL deposits (tagged or not) from the invoice total, but an
+      // UNTAGGED deposit is also returned via `depositFractions` pro-rata across every line by
+      // itemized share. With exactly one deposit on this invoice, residual + returned fraction
+      // sum to 1.0 (invoice €150 − deposit €25 = €125 residual, €25 returned = €150 = 100%), so
+      // €60 × 1.0 = €60 — a net-zero change. This is the other half of the AC 3.2 proof (see the
+      // comment on invoice3's foreign-tagged €56.25 above): an untagged deposit changes NOTHING
+      // about this source's allocation, so the pre-#1911 "claimed separately" label on this shape
+      // was literally false to a bank recipient — nothing was, in fact, claimed separately.
       await expect(row).toContainText('€60.00 (partial)');
 
       // The regression guard itself: no second inline note, specifically not the deposit-reduced
diff --git a/server/src/services/sourceReportService.ts b/server/src/services/sourceReportService.ts
index 1da43e4c9..960556282 100644
--- a/server/src/services/sourceReportService.ts
+++ b/server/src/services/sourceReportService.ts
@@ -273,6 +273,16 @@ export async function getSourceReport(
     has_foreign_deposit_source: number;
   }>(
     sql`SELECT split_data.invoice_id AS invoice_id,
+           -- LOAD-BEARING DISTINCT (#1911): the 'origin' column below makes the same
+           -- (invoice_id, source_id) pair produce two rows when both a budget line and a tagged
+           -- deposit resolve to that source, because 'origin' now differs between the arms.
+           -- UNION ALL (see below) no longer collapses that pair at all, so this DISTINCT is the
+           -- only thing standing between this count and double-counting. Do NOT simplify to
+           -- COUNT(*): an invoice with a same-source line AND a same-source tagged deposit would
+           -- get source_count = 2 and isSplit would flip to true for every such invoice, even
+           -- though it funds from exactly one source. COUNT(DISTINCT source_id) is unaffected by
+           -- row duplication because it operates on the source_id column, not row identity — keep
+           -- it that way. AC 1.9's regression fixture pins this.
            COUNT(DISTINCT split_data.source_id) AS source_count,
            MAX(CASE WHEN split_data.origin = 'line' AND split_data.source_id != ${sourceId} THEN 1 ELSE 0 END) AS has_foreign_line_source,
            MAX(CASE WHEN split_data.origin = 'deposit' AND split_data.source_id != ${sourceId} THEN 1 ELSE 0 END) AS has_foreign_deposit_source
@@ -286,7 +296,14 @@ export async function getSourceReport(
       WHERE ibl.invoice_id IN (${joinedInvoiceIds})
         AND COALESCE(wib.budget_source_id, hib.budget_source_id) IS NOT NULL
 
-      UNION
+      -- UNION ALL, not UNION (#1911): with the 'origin' column, UNION's cross-arm dedup on
+      -- (invoice_id, source_id, origin) never fires anyway, since 'origin' always differs between
+      -- the two arms — so UNION here bought nothing but an unnecessary sort/dedup pass, while
+      -- reading as though it still guarantees uniqueness (it doesn't; see the DISTINCT note
+      -- above). Both aggregates that consume this union are multiplicity-insensitive:
+      -- COUNT(DISTINCT source_id) ignores duplicate rows by construction, and MAX(CASE ...) is
+      -- idempotent under duplicates. No other consumer of this query depends on row uniqueness.
+      UNION ALL
 
       SELECT d.invoice_id,
              d.budget_source_id AS source_id,

From c060c459b59e3bf74e6b5578d176c993c0b78b34 Mon Sep 17 00:00:00 2001
From: Frank Steiler <frank@steiler.dev>
Date: Thu, 6 Aug 2026 02:01:45 +0200
Subject: [PATCH 3/3] docs(memory): record #1911 rulings and the
 parent-less-cluster gate lesson

- Records that the Bank Report Wizard cluster is parent-less, so /epic-close
  never runs for it and promotion reaches main through standalone /release,
  which omits the UAT sections. A UAT disposition therefore cannot rely on the
  epic lifecycle to hold the gate, and issues in this cluster must use Refs
  rather than Fixes so they do not auto-close with the appearance of a
  validation that never ran.
- Records the UAT routing for #1911: a labels rejection reopens the issue,
  a geometry rejection opens a new issue in the #1939 lineage.
- Records that a scoped projection is the correct basis for a same-scope
  predicate, which is why hasOwnTaggedDeposit is not the #1911 defect shape.

Refs #1911

Co-Authored-By: Claude product-owner <noreply@anthropic.com>
---
 .claude/agent-memory/product-owner/MEMORY.md  |  4 +-
 .../product-owner/bank-report-wizard.md       | 72 +++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/.claude/agent-memory/product-owner/MEMORY.md b/.claude/agent-memory/product-owner/MEMORY.md
index e3228c6f8..0717aed76 100644
--- a/.claude/agent-memory/product-owner/MEMORY.md
+++ b/.claude/agent-memory/product-owner/MEMORY.md
@@ -46,7 +46,7 @@ Detail in [standalone-bugs-and-stories.md](standalone-bugs-and-stories.md) (budg
 All rulings, contract facts, per-PR review outcomes and filed follow-ups live in [bank-report-wizard.md](bank-report-wizard.md) — consult it before any work on this cluster.
 
 - Shipped: #1876-#1879, #1898-#1901, #1929-#1933, #1958, #1959, #1965, #2001, #2003, #1973
-- Open: #1888, #1891, #1895-#1897, #1910, #1912, #1917, #1937-#1941, #1946 (Must Have), #1947, #1950, #1952, #1953, #1966-#1972, #2011-#2014
+- Open: #1888, #1891, #1895-#1897, #1910, #1912, #1917, #1938, #1940, #1941, #1946 (Must Have), #1947, #1950, #1952, #1953, #1966-#1972, #2011-#2014, #2016-#2021 (#1937/#1939 CLOSED — no open home for allocated-column geometry)
 - Merged but **not Done** (awaiting live-LLM UAT): #1931 (ACs 3.2/3.3)
 - **#1973** column visibility → PDF: PR #2010 approved R1, 28/33 ACs, → **UAT, stays In Progress**. Follow-ups #2011-#2014 all Backlog + blocked-by #1973.
 - **#1911** `splitKind`: ACs refined 2026-08-05 onto an orchestrator-filed body → **UAT, not Done-on-merge**. Privacy: no objection. Legend: no new sentence. Addendum ruling (pre-merge): zero-line-contribution row now shows `(Deposit)`+`(partial)` — **intended, do not narrow**, AC 3.6/3.7/4.7 added. **PR #2015 CHANGES REQUESTED round 1** — logic correct, evidence layer not: 2 red E2E scenarios (stale assertions, not defects) + AC 4.5's render measurement unfalsifiable by construction.
@@ -85,6 +85,8 @@ Full derivations and the incidents behind each are in [pr-review-patterns.md](pr
 - **An issue filed by another agent is a snapshot of that round's codebase** — re-verify the *mechanism*, not just the defect, and correct the mechanism while keeping the story.
 - **When an AC's correct predicate is one plausible misreading away from a no-op, write the misreading into the AC** and demand a test pinning that shape.
 - **Check the other direction of any reported boolean defect** — the mirror case is often live too.
+- **`Refs #N`, not `Fixes #N`, for any issue in a parent-less cluster carrying a UAT disposition** — `/epic-close` (the only skill with a UAT step) never runs without an epic, so standalone `/release` would auto-close it unvalidated. **Before trusting "the lifecycle protects this", check the item actually enters that lifecycle.** The acceptance gate is the board status, which I set — not open/closed, which GitHub sets.
+- **When a review finding invokes a principle, check whether the principle actually condemns the code.** A principle stated only in its prohibiting direction generates false positives; write the permission into the ADR alongside it.
 - **When a change looks like new behaviour, check whether the underlying field already carried the right value and only a downstream gate was lying.** If so it is a fix, and the burden flips to whoever wants the old output. If the only available narrowing is the removed gate under a new name, there is no narrowing — say so plainly.
 - **A corrected assumption appearing independently in code + docs + tests is one spec gap, not three bugs** — and is the argument for writing the AC down even when the code is already right.
 - **"Dominated by an existing measurement, do not re-measure" is as valuable as demanding the measurement.** Rank flagged risks against each other instead of treating every new co-occurrence as equally alarming.
diff --git a/.claude/agent-memory/product-owner/bank-report-wizard.md b/.claude/agent-memory/product-owner/bank-report-wizard.md
index 39dd6981f..85aa6e764 100644
--- a/.claude/agent-memory/product-owner/bank-report-wizard.md
+++ b/.claude/agent-memory/product-owner/bank-report-wizard.md
@@ -1066,3 +1066,75 @@ the human pass is the only thing looking at that row. Corrected routing:
   *measured*, it never authorised a fix.
 
 **General: check that the issue a routing rule points at is still open before restating the rule.**
+
+### #1911 PR #2015 follow-ups + two rulings (2026-08-05)
+
+Filed six non-blockers so #2015 could merge without expanding a PR already through a red-E2E round:
+
+- **#2016** (tech-debt, Should) `ReportContentRow.isSplit` → `isPartial`. Row flag now means "shows
+  `(partial)`" (`splitKind ∈ lines|both`) while `SourceReportInvoice.isSplit` means "split at all"
+  (`splitKind !== null`) — **false-vs-true across the entire `deposits`-only population**, spelled
+  identically, read and written 12 lines apart. frontend-developer added that `deposits`-only splits
+  are common, so the divergence is permanent.
+- **#2017** (tech-debt, Should) `budgetLines` → `budgetLinesForSource`, `deposits` →
+  `depositsVisibleToSource`. Blocked-by #2016 (same file/append points — parallel-worktree collision
+  risk). Flagged AC 1.6: this is a **breaking response-field rename**, safe only because client+server
+  ship as one container from one repo.
+- **#2018** (tech-debt, **Could** — I downgraded it) `hasOwnTaggedDeposit` guard test.
+- **#2019** (documentation, Should) the ADR — **product-architect's page**, I filed the tracker only.
+- **#2020** (bug, Should) preview/PDF refund-label **order** divergence. Verified on disk: PDF emits
+  refund **last** (`overviewPdf.ts` L833-856), preview emits it **first** (`ReportContentEditor.tsx`
+  L331 before the badge at L335). Pre-existing since #1959; #1911 made multi-label rows common enough
+  to see it.
+- **#2021** (tech-debt, Could) AC 5.3's preview-DOM half is `en`-only. **My own AC was
+  under-specified** — it stated a 2×2 matrix in one sentence without saying it was a matrix, so the
+  `en`-only reading was reasonable. Amended via new issue, not by rewriting a released AC.
+
+All six Backlog + blocked-by #1911.
+
+**I downgraded #2018 and disagreed with the architect's framing — worth keeping.** It was flagged as
+"the same shape as the bug we just fixed". It is not. The #1911 bug derived an **unscoped** predicate
+from a scoped projection (impossible to do right — the projection discarded the needed rows).
+`hasOwnTaggedDeposit` derives a **scoped** predicate from a projection at **the same scope**, which is
+the correct and intended use, sound **by construction, not by accident**. Rated Could Have: guard test
++ comment, no refactor. **Then fed the correction back into #2019 as AC 1.2 — the ADR must state the
+converse with equal prominence, or it will condemn correct code and be ignored.**
+**Reusable: when a review finding invokes a principle, check whether the principle actually condemns
+the code — a principle stated only in its prohibiting direction generates false positives, and the
+fix is to write the permission into the ADR alongside it.**
+
+### Ruling: `Fixes` vs `Refs` for UAT-pending issues — **`Refs`**
+
+Coordinator's premise ("UAT runs in `/epic-close` before promotion, so auto-close fires after UAT")
+is **true for epics and false for this cluster**. The Bank Report Wizard cluster is **parent-less**
+(#1965's body: "Parent Epic: none"), so `/epic-close` — the only skill with a UAT step (step 6) —
+**can never run for it**; promotion goes through standalone `/release`, whose step 2b is a
+"Manual Validation Checklist … spot-check" and which explicitly *omits* the UAT sections when no epic
+number is given.
+
+**Ruling: `Refs #N`, not `Fixes #N`, for any issue in a parent-less cluster carrying a UAT
+disposition.** `Fixes` is right when the acceptance gate IS the merge; a UAT disposition means the
+gate is downstream of the merge. Not a broken convention — the convention applied to its actual case.
+
+**#1973 is already merged with `Fixes` and has the same exposure** — noted on the issue with two
+recovery options (walk UAT before promotion, or reopen after). Key line worth reusing:
+**"the acceptance gate is the board status, which I set — not the issue's open/closed state, which
+GitHub sets."** If a board automation flips closed→Done, that is not a PO decision and gets reverted.
+
+**Generalisable: before trusting "the lifecycle protects this", check the work item actually enters
+that lifecycle.** A cluster with no parent epic silently skips every epic-scoped gate.
+
+### Ruling: UAT rejection routing for #1911 (recorded on the issue)
+
+- Rejection about **what the labels say** (AC 4.3/4.4/4.7) → **reopen #1911**; the wording is the
+  deliverable, and a follow-up leaves the shipped document wrong meanwhile.
+- Rejection about **column geometry** → **new issue in the #1939 lineage**. Verified #1937 and #1939
+  are both **closed** and none of #2011-#2014 or #1950 covers the allocated-amount column — no open
+  home exists.
+- The line between them: the first says my *ruling* was wrong (no string change, precision via
+  co-occurrence); the second says the ruling was right but the column can't afford it. Only the first
+  invalidates #1911.
+
+**AC 4.5 now MET, not deviated** — both assertions proven to fail by mutation against the real
+production path, file restored byte-identical. `positions` is written during layout, which is why it
+observes a drop that `.text` (the test's own input) cannot. That is the exact property AC 5.5 demands.