fix(export): make the standard report a click, not a preselection

The scope picker arrived with the standard doctor's report already ticked,
so someone who opened the panel and pressed Generate sent material they
never chose. Nothing is selected now until a person selects it.

The template keeps its definition and loses its automatic application: it
sits on a button at the top of the picker, named, on both surfaces that
mount the picker, and it stays there so the standard set can be restored
after experimenting. One click still gets a complete doctor's report.

Generate and the share-link create refuse an empty scope, with the scope
line beside them saying what to do rather than reporting a failure after
the press; the line also describes the control, so the disabled state is
not silent for a screen reader.

src/lib/report-selection/__tests__/catalogue-guard.test.ts

@@ -29,7 +29,7 @@ import {
   STRUCTURED_LEAF_IDS,
   leafLabelKey,
 } from "../catalogue";
-import { STANDARD_TEMPLATE_LEAVES } from "../template";
+import { STANDARD_TEMPLATE_LEAVES, standardTemplateFor } from "../template";
 
 const EN = JSON.parse(
   readFileSync(
@@ -112,3 +112,37 @@ describe("template purity", () => {
     );
   });
 });
+
+/**
+ * The set behind the one-click action, checked as a set.
+ *
+ * The button is the only thing that applies the template now, so what it
+ * applies has to be exactly the shipped list and nothing beside it — a leaf
+ * that crept in here would land in a document the person believes they chose
+ * from a named list.
+ *
+ * Mutation check (verified red, then reverted): make `standardTemplateFor`
+ * ignore its argument → "drops only what the surface hides" goes red.
+ */
+describe("the standard-report action", () => {
+  it("applies exactly the shipped set and nothing outside it", () => {
+    expect(standardTemplateFor()).toEqual([...STANDARD_TEMPLATE_LEAVES]);
+    const outside = standardTemplateFor().filter(
+      (leaf) => !STANDARD_TEMPLATE_LEAVES.includes(leaf),
+    );
+    expect(outside).toEqual([]);
+    // Nothing fenced, on any surface: the fence is not a matter of which
+    // button you press.
+    expect(
+      standardTemplateFor().filter((leaf) => SENSITIVE_LEAF_IDS.includes(leaf)),
+    ).toEqual([]);
+  });
+
+  it("drops only what the surface hides", () => {
+    const onShare = standardTemplateFor(["INSURANCE"]);
+    expect(onShare).not.toContain("INSURANCE");
+    expect(onShare).toEqual(
+      STANDARD_TEMPLATE_LEAVES.filter((leaf) => leaf !== "INSURANCE"),
+    );
+  });
+});

src/lib/report-selection/template.ts

@@ -1,14 +1,15 @@
 /**
  * The one shipped template: what a general doctor's visit usually needs.
  *
- * It is applied on the FIRST run only, with the panel open, so the user
- * presses Generate having seen twelve named groups and an empty fenced tier.
- * That is consent to a named bundle, not a server-chosen default — nothing
- * here is applied to a stored selection, to a share link, or to any surface
- * that cannot ask a human.
+ * Nothing applies it on its own. It reaches a selection only when a person
+ * presses the button that carries its name, on a panel they are looking at —
+ * never on load, never on a stored selection, never on a share link, never on
+ * a surface that cannot ask a human. A set that arrives without being asked
+ * for is a preselection whatever it is called, and the one thing this release
+ * refuses is material in a report nobody ticked.
  *
  * The template intersects the fenced tier at zero leaves, and
- * `report-template-purity.test.ts` fails the build if that stops being true.
+ * `catalogue-guard.test.ts` fails the build if that stops being true.
  */
 import { SENSITIVE_LEAF_IDS, type ReportLeafId } from "./catalogue";
 
@@ -39,8 +40,23 @@ export const STANDARD_TEMPLATE_LEAVES: readonly ReportLeafId[] = [
   "ILLNESS_EPISODES",
 ];
 
-/** The template's i18n label — it is named in the panel, never anonymous. */
+/** The template's i18n label — it is named on the button, never anonymous. */
 export const STANDARD_TEMPLATE_LABEL_KEY = "reportSelection.templateStandard";
 
+/**
+ * The template as one surface can offer it: the shipped set minus the leaves
+ * that surface may not carry (the share-link form hides the insurance leaf,
+ * which the server refuses anyway).
+ *
+ * Pure, so "one click applies exactly the standard set and nothing outside it"
+ * is provable without a DOM.
+ */
+export function standardTemplateFor(
+  hiddenLeaves: readonly ReportLeafId[] = [],
+): ReportLeafId[] {
+  const hidden = new Set(hiddenLeaves);
+  return STANDARD_TEMPLATE_LEAVES.filter((leaf) => !hidden.has(leaf));
+}
+
 /** Exported so the purity guard reads the same set the panel does. */
 export const SENSITIVE_LEAVES = SENSITIVE_LEAF_IDS;