damusix · Oct 14, 2026
diff --git a/docs/design/model-change-review.md b/docs/design/model-change-review.md
@@ -52,6 +52,7 @@ The diff alone shows what changed but never why. Notes alone are only as accurat
 - `.ignatius/` is review state, never committed. A `.gitignore` next to `ignatius.yml` lists it. The modeling skill writes that file for every model it generates; ignatius adds the line when it creates `.ignatius/` and the line is missing.
 - The diff runs on the parsed model, not file text. Reordering YAML keys or reformatting produces no change item.
 - A body-only edit is its own kind (`doc`), so prose edits do not read as structural changes.
+- `ignatius export` reads the baseline and never writes one, so exporting cannot approve unreviewed edits; it exists because agents hand over exported HTML, and a file that hides the changes defeats the review.
 - Column granularity is required: a note covers a column change only when it names the column.
 - Serve creates the baseline from the current state when none exists, so a first run highlights nothing. The modeling skill runs `approve` before its first write to a model with no baseline, so an agent's edits to a never-served model still show.
 

diff --git a/docs/guides/change-review.md b/docs/guides/change-review.md
@@ -3,6 +3,8 @@
 
 `ignatius serve` shows what changed in a model since you last approved it. When an agent (or a person) edits entity or flow files, the app marks every added, changed, and removed entity, column, relationship, and flow node. A Changes panel lists each change next to the note that explains it. When the changes look right, `ignatius approve` accepts the current files as the new starting point and the highlights clear.
 
+An exported HTML file carries the same review, read-only, so a file an agent hands you shows what it changed. Write the change note before exporting; see [What it does not do](#what-it-does-not-do).
+
 ```bash
 $ ignatius serve models/billing
 # ...an agent adds Invoice.line_total and writes .ignatius/changes/split-invoice-lines.md
@@ -44,7 +46,7 @@ The first `serve` of a model writes the baseline from the files as they are, so
 ## What the app shows
 
 
-Green marks an addition, amber a change. On the Graph and Flows views the mark is a slow pulsing glow; a change no note explains alternates its glow between its color and red. In the Dictionary it carries an `unexplained` label. With reduced motion turned on in your operating system, or on a view too large to animate, the glows hold steady and an unexplained one stays tinted red.
+Green marks an addition, amber a change. On the Graph and Flows views the mark is a pulsing glow; a change no note explains alternates its glow between its color and red. In the Dictionary it carries an `unexplained` label. With reduced motion turned on in your operating system, or on a view too large to animate, the glows hold steady and an unexplained one stays tinted red.
 
 | Where | Added | Changed | Removed |
 |-------|-------|---------|---------|
@@ -57,7 +59,7 @@ Green marks an addition, amber a change. On the Graph and Flows views the mark i
 
 In the flow index (**☰ Process Flows**, or `i`) and the breadcrumb level menus, a row whose diagram holds changes further down shows a steady dot after its label: red if any of them is unexplained, amber if any is a change or removal, green if all are additions.
 
-The Changes panel appears only in `serve`, and only when there is something to review. It lists, in order:
+The Changes panel appears in `serve`, and read-only in an export made from a model with an approved baseline, and only when there is something to review. It lists, in order:
 
 1. Each note: its title, its body, and the changes it covers.
 2. **Unexplained**: changes no note covers.
@@ -155,7 +157,9 @@ To reject a change, edit the files back. The diff empties on its own once the fi
 | Not covered | Instead |
 |-------------|---------|
 | Git history | The baseline is a file ignatius writes; it does not read commits or branches. |
-| `export` and `validate` | Neither diffs. A static export has no highlights and no Changes panel. |
+| `validate` | Does not diff. Review changes in `serve` or `export`. |
+| Approving from an export | A static export shows the changes read-only. Approve with `ignatius approve` or from a served model. |
+| `export` without a baseline | Carries no review. Export never creates a baseline; serve the model once, or run `ignatius approve`, to set one. |
 | Removed flow nodes on the diagram | They are listed in the Changes panel; the DFD canvas draws only what exists now. |
 | Layout | Highlights never move nodes or change saved positions. Ghost nodes are placed near their old neighbours and are not saved. |
 | Keeping notes | Approve deletes them. Copy anything worth keeping into the entity or flow body first. |
@@ -170,7 +174,7 @@ If ignatius cannot build the review, for example in a read-only model folder whe
 ignatius: could not prepare the change-review baseline: <reason>
 ```
 
-On each request for the model, when it cannot build the review:
+On each request for the model, when it cannot build the review (`export` prints the same line to stderr and writes the HTML without a review):
 
 ```
 ignatius: could not build the change review: <reason>

diff --git a/docs/guides/commands.md b/docs/guides/commands.md
@@ -63,6 +63,8 @@ ignatius export [path] -o model.html [--theme light|dark] [--model <key>]
 
 The file includes the Graph, Dictionary, and Flows views with full interactivity: view switching, live Dictionary search, entity dialog, theme toggle, and graph and flow node-position persistence — all offline, from `file://`. The export injects both the entity model and the flow model, so both position-restore keys work without a server.
 
+When the model has an approved baseline (see [Change review](change-review.md)), the export also carries the change review: the same glows, ghost nodes, and Changes panel as a served model, without the Approve button. A model with no baseline exports no review, and export never creates one. The export carries the pending changes and their note text, so run `ignatius approve` first when you want a clean shareable file.
+
 The exit code merges entity global errors, entity Class-B findings, and flow Class-B findings: exit `0` on a clean model, `1` when any of those are present. Warnings (Class A) alone do not fail the command.
 
 Note: the older `dict`, `graph`, and `flow` subcommands have been removed. Invoking one prints a one-line error pointing to `export`.