<!-- source: openspec/changes/surface-entity-identification/design.md -->

# Design — surface-entity-identification

Decisions are prefixed `D-SEI-`. They ratify on merge and are amended into
`openspec/current/home/blocks.md` (Footer block) at archive time.

## D-SEI-1 — One `EntityIdentity` source module

A single module, `apps/web/src/config/entity-identity.ts`, is the only non-test location of any
entity fact — and in particular the **only** place the IDNO literal `1026023043928` appears. Both
public surfaces (footer micro-line, imprint page) read from it.

**Rationale.** Entity facts are referenced in more than one place; duplicating them invites drift
(a renamed entity or a corrected IDNO would have to be chased across surfaces). The repo already
uses the "facts in a module, labels in i18n" split for `generated/legal-data.ts`; this mirrors it
with a hand-authored config module (the facts are not derived from `_legal/` markdown, so no codegen
step is warranted). App-local placement (`apps/web/src/config/`) keeps it next to its only two
consumers; lifting it into the shared `@rapoport-studio/config` package is deferred until a second
app needs it (rule of three).

## D-SEI-2 — Two-depth disclosure

Identity is legible at two depths: a **footer micro-line** (legal name + IDNO, on every page) and
the full **`/legal/imprint`** register. The footer answers "who runs this?" at a glance; the imprint
answers "what is the full legal identity?" in one click. The imprint link already exists in the
footer legal column — unchanged.

## D-SEI-3 — Honest pending-state for unconfirmed fields

`EntityField` is a discriminated union: `{ status: "confirmed"; value }` or `{ status: "to-verify" }`.
The imprint page renders confirmed fields' values and renders unconfirmed fields as a localized
**pending string** — never a fabricated value, never a misleading blank. Today `registeredOffice`,
`vat`, and `itParkResidency` are `to-verify`; each flips to `confirmed` independently as its
registration milestone closes, with no page edit required.

**Why not just omit unconfirmed fields?** An Art. 5 register that silently drops the registered
office reads as complete when it is not. An explicit pending string is the honest disclosure.

## D-SEI-4 — Art. 5 field set and order

The imprint renders the identification set in this order:

1. Legal name — *confirmed* → `Rapoport Studio SRL`
2. Legal form — *confirmed* → `Societate cu Răspundere Limitată (SRL)`
3. Registered office — *to-verify* → pending string
4. Registration number (IDNO) — *confirmed* → `1026023043928`
5. Administrator (legal representative) — *confirmed* → `Pavel Rapoport`
6. Contact (email, `mailto:`) — *confirmed* → `pavel@rapoport.studio`
7. VAT (TVA) number — *to-verify* → pending string
8. IT Park residency — *to-verify* → pending string
9. Controlling-language notice — the RO version controls; translations are convenience-only.

## D-SEI-5 — No watermark, no trust imagery

The imprint carries **no** `DraftWatermark` — it states confirmed fact, not a draft contract under
counsel review (unlike `/terms` and `/privacy`, which legitimately watermark). No trust badges,
seals, or certification imagery; no homepage-hero entity block. Identity is disclosed as plain fact.

## D-SEI-6 — i18n separation

The module carries **language-neutral facts**. i18n (`web.legal.imprint.*`, `common.footer.entity.*`)
carries field **labels**, **pending phrasing**, and the **controlling-language notice**. The IDNO
literal must not appear in i18n. Three locales (en/ru/ro); RO is the controlling text.

## Open questions

- **Q-SEI-1** — When the registered office / VAT / IT Park facts are confirmed, does the studio also
  want them mirrored into the footer micro-line, or kept imprint-only? Current answer: imprint-only;
  the footer stays name + IDNO to remain a one-line glance. Revisit if a counterparty asks.

## Verification-drift note (source verification.md was AI-drafted)

The originating `verification.md` referenced conventions this repo does not use. This change adapts
to the real ones and the corrected acceptance lives in this folder's `verification.md`:

| source assumed | actual repo convention |
|---|---|
| `pages.imprint.*` namespace | `web.legal.imprint.*` |
| `footer.entity.*` namespace | `common.footer.entity.*` (footer i18n lives in `common.json`) |
| `grep '"imprint"' web.json` returns 1 | returns 2 (`legal.imprint` + `meta.imprint`); not a meaningful gate |

The source's literal-IDNO requirement vs its "no fabricated value" rule is **not** a contradiction
here: the operator confirmed `1026023043928` is the real issued IDNO, so the literal is a fact.
