Is the stamp a privacy problem or a correctness problem?

Both. The path names a machine no recipient should see, and the date sits where a reader looks for the as-of date, which invites them to read a closed period's figures as current ones.

Where should the header and page numbers come from?

The page's own print CSS: the report name, the as-of date and the page numbers. Finance reads packs page by page in meetings, so see page 4 has to mean the same page for everyone in the room.

How is this caught before shipping?

The round-trip gate extracts the text of every page and fails on a build timestamp or a local file path, and its fire test stamps one in deliberately to prove the gate can still go red.

Failure catalogue · The wrapper betrays the numbers · 44 of 51

OBSERVED FAILURE MODE

The board pack that names your temp folder.

Browser print chrome adds its own header and footer to every page of a printed PDF: the moment the button was pressed, and the local path of the file it printed. A board pack stamped with the build machine's scratch directory dies on first forward, and the date it carries is the run stamp, not the period the figures describe.

What we saw

On a Meridian Journal Group board pack, the printed PDF carried the build timestamp and a local file path across all 25 pages, added by the print step rather than by the page. Every figure in it reconciled. The pack was still unsendable: the path named a machine no recipient should see, and the stamped date sat where a reader looks for the as-of date, inviting them to read a closed period as the current one. Nobody caught it, because the cover page was clean.

Why it passes a glance

The stamp is added after the page is written, so it appears in no source file anyone reviews, and the cover page usually escapes it. Print output gets checked by opening the first page, where a running header looks deliberate. A date near a heading reads as provenance, which is the one thing on a page a reader is least likely to question.

What addresses it

The certified-exports skill disables the browser's own header and footer at the print step, takes the running header, the as-of date and the page numbers from the page's print CSS, and fails the round-trip gate if any page carries a build timestamp or a local file path. Doctrine principle 5, Fail closed and stale, decides the outcome: the leak blocks the ship, and the last known-good pack stays live and marked.

Check your own file in two minutes

Open a middle page of the PDF and read the top and bottom bands.
Extract the text of every page and search for a path separator and the build date.
Confirm the as-of date printed on the page comes from the data's period rather than from the clock.

What this does not catch

Suppressing print chrome addresses the leak the renderer adds. It does not audit what the page itself prints, so a hardcoded footer or a path written into the content passes this rule untouched. Search the emitted text as well as configuring the renderer.

Quick answers

Is the stamp a privacy problem or a correctness problem?: Both. The path names a machine no recipient should see, and the date sits where a reader looks for the as-of date, which invites them to read a closed period's figures as current ones.
Where should the header and page numbers come from?: The page's own print CSS: the report name, the as-of date and the page numbers. Finance reads packs page by page in meetings, so see page 4 has to mean the same page for everyone in the room.
How is this caught before shipping?: The round-trip gate extracts the text of every page and fails on a build timestamp or a local file path, and its fire test stamps one in deliberately to prove the gate can still go red.

Nearby failures

The gate that certified the leakThe verification is theater The certified page that opens as garbageThe wrapper betrays the numbers The stack trace deliverableThe wrapper betrays the numbers

Last updated 2026-09-02 · Dylan, founder · one of 51 observed failure modes, every one seen in a real build or in our own audits, none invented.

Get the free skill → The doctrine All 51 failure modes