From 21f443263a8a4fd3aa89ddb060fc90750c3d5b14 Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 18:57:36 +1000
Subject: [PATCH 1/4] =?UTF-8?q?feat(ux):=20P1+P2=20of=20the=20UX=20review?=
 =?UTF-8?q?=20=E2=80=94=20cycle-ordered=20nav,=20one=20save=20model,=20fee?=
 =?UTF-8?q?d=20delivery=20reasons?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The second half of the Claude Design UX handoff, on top of the P0 change set.
Same routes, same forms, same Alpine bindings — reorganisation only.

Nav · ordered by the intelligence cycle. Analysts get Workspace · Collect
(notebooks, feed reader, tasking) · Produce (reports) · Discover; Tasking moves
out of Administration, where it never belonged. The admin rail's eleven links
collapse to four, with the six integration/governance consoles behind the /admin
hub. Nothing becomes unreachable: every collapsed console is still a ⌘K jump
target, and a new test walks each role's palette and asserts every destination
resolves. "Matrix" becomes "ATT&CK coverage", and the palette trigger gets its
own glyph — it and Search were both magnifiers, which read as one feature.

Editor · one save model, one place to publish. "Save draft" is gone: the editor
already autosaved, so two controls reported one thing. A <noscript> submit keeps
the form usable if Alpine never loads. The dock tabs are verb-labelled and kept
to four — Cite / Classify / Link / Publish (plus Assist, conditional on AI being
enabled). Link merges the requirement and audience forms; Publish holds the
lifecycle stepper and the rendered PDFs, with the one available transition pinned
in the dock footer, replacing the separate subhead stepper + submit row. The
repeated per-tab ARIA wiring becomes a single Jinja macro.

Notebook · every add-form sits behind a consistent "+ Add …" <details>, opened by
default only when its section is empty. Native, so it costs no JS and no CSP
surface.

Feed · every row says why it reached you — own requirement ("Answers your RFI") →
tag subscription → audience group → level preference. The reason is re-derived
from the same rules dissemination.matched_stakeholders routes by rather than
stored on the event, so there is no second copy to drift. Rows bucket into Today
/ This week / Earlier server-side and an All ⇄ Unread pill filters them
client-side. A row answering your own requirement offers "Mark satisfied →",
which deep-links to the product's #feedback card with that requirement
preselected — deliberately not a one-click POST, because the feedback endpoint
requires a usefulness rating and inventing one would put a verdict in the
reader's mouth. The ?requirement= parameter only preselects a requirement the
reader owns and the report answers.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ARCHITECTURE.md                            |   6 +-
 CLAUDE.md                                  |   2 +-
 src/iceberg/services/feed.py               |  65 ++++++-
 src/iceberg/static/css/iceberg.css         |   7 +-
 src/iceberg/static/js/tags.js              |   5 +
 src/iceberg/templates/base.html            |  81 +++++----
 src/iceberg/templates/feed.html            |  89 +++++++--
 src/iceberg/templates/notebook_detail.html |  67 ++++---
 src/iceberg/templates/report_edit.html     | 177 +++++++++---------
 src/iceberg/templates/report_view.html     |   7 +-
 src/iceberg/web/feed.py                    |  26 ++-
 src/iceberg/web/reports.py                 |  17 +-
 tests/test_feed_delivery_reason.py         | 198 +++++++++++++++++++++
 tests/test_portal.py                       |  71 ++++++++
 14 files changed, 626 insertions(+), 192 deletions(-)
 create mode 100644 tests/test_feed_delivery_reason.py

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index ff9735c..7dbb9b2 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -131,14 +131,16 @@ The portal is a **"command-center" design** — a light, print-like, authoritati
 
 **Alpine under the CSP build — no inline JS (`static/js/tags.js`).** The CSP build cannot `eval`, so two rules hold: (1) **every component is registered** via `Alpine.data()` in `static/js/tags.js` (one registry, loaded *before* the Alpine `<script>` so its `alpine:init` listener is in place; `x-data="name(arg)"` names a registered component) — there are **no inline `x-data` object literals with methods**; (2) the build **prohibits `x-html`** (use `x-ref` + `x-effect="renderX()"` writing `innerHTML` in native JS) and **all inline `on*=` handlers / inline `<script>` blocks** (use Alpine `@`-handlers bound to component methods). Server state reaches a component through a **`<script type="application/json">` island** read with `JSON.parse` in the factory (the CSP interpreter does **not** decode `tojson`'s `\uXXXX` escapes, so HTML/SVG/prose passed via an attribute expression would corrupt) — small scalar args (ids, enum values) may still be passed inline. `tests/test_frontend_assets.py` guards these invariants (no inline handlers, no inline `<script>`, no `x-html`).
 
-**App shell (`base.html`).** A fixed-height flex shell: a **persistent role-aware left rail** (240px, deep cool charcoal — `--rail*` tokens) with grouped nav + identity card + logout, and a **workspace** column = a sticky 56px **topbar** (breadcrumb · ⌘K trigger · stakeholder feed bell) over a scrolling **`.canvas`** that wraps the unchanged `{% block content %}` in a `.canvas-inner` (max ~1340px; `page-narrow`/`page-wide`/`canvas--flush` modifiers). The rail nav is server-rendered from `user.role` (groups differ per role) with **active state still derived from `request.url.path`**; a hidden inline SVG **icon sprite** (`#ic-*` symbols) feeds `<use>` references. Collapses to an icon strip under 960px. The iceberg mark is inline SVG in `templates/_glyph.html` (included by `base.html` and `login.html`; login renders with no rail/topbar since `user` is falsy).
+**App shell (`base.html`).** The rail is ordered by the **intelligence cycle** — analysts get Workspace · Collect (notebooks, feed reader, tasking) · Produce (reports) · Discover; admins get Workspace · Discover · Administration, whose six integration/governance consoles collapse behind the `/admin` hub (eleven links → four). Nothing becomes unreachable: every collapsed console stays a ⌘K jump target, and a test asserts each palette destination still resolves. A fixed-height flex shell: a **persistent role-aware left rail** (240px, deep cool charcoal — `--rail*` tokens) with grouped nav + identity card + logout, and a **workspace** column = a sticky 56px **topbar** (breadcrumb · ⌘K trigger · stakeholder feed bell) over a scrolling **`.canvas`** that wraps the unchanged `{% block content %}` in a `.canvas-inner` (max ~1340px; `page-narrow`/`page-wide`/`canvas--flush` modifiers). The rail nav is server-rendered from `user.role` (groups differ per role) with **active state still derived from `request.url.path`**; a hidden inline SVG **icon sprite** (`#ic-*` symbols) feeds `<use>` references. Collapses to an icon strip under 960px. The iceberg mark is inline SVG in `templates/_glyph.html` (included by `base.html` and `login.html`; login renders with no rail/topbar since `user` is falsy).
 
 **⌘K command palette.** An additive Alpine overlay in `base.html` (jump-to over the role's nav items, built as a Jinja `jump_items` list); ⌘K/Ctrl-K or the topbar trigger opens it, arrow keys + Enter navigate, Esc closes. It follows the combobox/listbox dialog pattern: focus stays in the palette while open, the active result is exposed with `aria-activedescendant`, and focus returns to the invoking control on close. No backend dependency (live `/api/search` results are a noted future hook).
 
-**Report editor (`report_edit.html`).** A full-height 3-pane workspace (`.editor-shell`): a command header (inline title + **marking chips** + lifecycle flow + save-state + Submit/Approve/Publish), then a `1fr 1fr 340px` grid of **markdown ∣ live preview ∣ docked tabbed panel** (Citations · Tags · AI review for editable drafts · Reqs · Audience for admins · Render). Intel level, TLP and analytic confidence are the header chips and *only* the header chips — one source of truth, always visible while writing. Each chip lays its real `<select form="reportform">` transparently over itself, so a click opens the native dropdown: no popover code, keyboard- and screen-reader-navigable, and correct before Alpine hydrates (the component only mirrors the chosen option's own text back into the chip, so there is no label map to keep in sync with the enums). The dock uses standard tab/tablist/tabpanel semantics with arrow/Home/End roving selection; the taxonomy picker is a combobox/listbox with keyboard add, removal and dismissal. The AI review tab requests advisory judgement, controlled-tag and analytic-challenge suggestions only: analysts edit them locally, explicitly apply them through the ordinary report/tag save flows, and accepted report fields receive AI provenance after a successful save. Disabled/TLP/provider messages remain inline and fail-soft. The markdown pane's **Insert ▾** toolbar drops `[[diamond|figure|ach:ID]]` tokens at the cursor. The single product `<form id="reportform">` is wired across header/pane/footer via the HTML `form=` attribute (no nested forms); it keeps the existing per-section POSTs and live-preview `POST /api/preview/product` binding verbatim, plus **debounced autosave** (1.2s) to the same `/reports/{id}` endpoint behind the header save-state indicator.
+**Report editor (`report_edit.html`).** A full-height 3-pane workspace (`.editor-shell`): a command header (inline title + **marking chips** + lifecycle flow + save-state + Submit/Approve/Publish), then a `1fr 1fr 340px` grid of **markdown ∣ live preview ∣ docked tabbed panel**, verb-labelled and kept to four — **Cite · Classify · Link · Publish** (plus **Assist** only when the AI backend is available to an editor). *Link* merges the requirement and audience forms; *Publish* holds the lifecycle stepper, the rendered-PDF list, and — pinned in the dock footer under every tab — the one lifecycle transition available to this user, replacing the separate subhead stepper + submit row. There is **one save model**: the editor autosaves and the header `save-state` is the only report of it (the old "Save draft" button is gone; a `<noscript>` submit keeps the form usable if Alpine never loads). Intel level, TLP and analytic confidence are the header chips and *only* the header chips — one source of truth, always visible while writing. Each chip lays its real `<select form="reportform">` transparently over itself, so a click opens the native dropdown: no popover code, keyboard- and screen-reader-navigable, and correct before Alpine hydrates (the component only mirrors the chosen option's own text back into the chip, so there is no label map to keep in sync with the enums). The dock uses standard tab/tablist/tabpanel semantics with arrow/Home/End roving selection; the taxonomy picker is a combobox/listbox with keyboard add, removal and dismissal. The AI review tab requests advisory judgement, controlled-tag and analytic-challenge suggestions only: analysts edit them locally, explicitly apply them through the ordinary report/tag save flows, and accepted report fields receive AI provenance after a successful save. Disabled/TLP/provider messages remain inline and fail-soft. The markdown pane's **Insert ▾** toolbar drops `[[diamond|figure|ach:ID]]` tokens at the cursor. The single product `<form id="reportform">` is wired across header/pane/footer via the HTML `form=` attribute (no nested forms); it keeps the existing per-section POSTs and live-preview `POST /api/preview/product` binding verbatim, plus **debounced autosave** (1.2s) to the same `/reports/{id}` endpoint behind the header save-state indicator.
 
 **Dashboard (`dashboard.html`, `web/notebooks.py`).** Every KPI card is a link to the work behind it, and a **"Needs you now"** queue sits above the fold: the products waiting on a reviewer (for anyone who can review) ahead of the viewer's own drafts, capped at five. Both halves are existing lifecycle state (`Report.status` / `author_id`) surfaced as actions — no new model, no new query pattern. Notebook creation is demoted to a collapsed `<details>` so content leads.
 
+**Stakeholder feed (`feed.html`, `services/feed.delivery_reason`, `feedFilter` in `tags.js`).** Every row now says *why* it reached you: own-requirement ("Answers your RFI") → tag subscription → audience group → level preference, in that order. The reason is **re-derived** from the same rules `dissemination.matched_stakeholders` routes by, not stored on `DisseminationEvent` — no schema change, and no stored copy that can drift from the rule that actually applied. Rows are bucketed server-side into Today / This week / Earlier, and an All ⇄ Unread pill filters the already-rendered rows client-side (All is the default, so the server render is complete without Alpine). Closing the loop: a row whose reason is your own requirement offers **Mark satisfied →**, which deep-links to the product's `#feedback` card with that requirement preselected. It deliberately does *not* POST: the feedback endpoint requires a usefulness rating, and inventing one to save a click would put a verdict in the reader's mouth. The `?requirement=` parameter only ever preselects a requirement the reader owns *and* the report answers.
+
 **Notebook phases (`notebook_detail.html`, `notebookTabs` in `tags.js`).** The notebook is worked in phases rather than scrolled end to end: the nine sections are grouped into **Collect** (sources, notes, files, figures, indicators) · **Analyze** (Diamond, ACH) · **Produce** (products) · **Trace** (requirements), and one phase's sections render at a time. The old anchor-link collection strip becomes the phase tab bar, carrying the same per-section counts. Nothing is removed or gated: the tabs are real `#section` anchors, the server renders Collect as the default (the other phases are `x-cloak`ed), and a `<noscript>` rule cancels `x-cloak` so a browser without Alpine still gets every section on one page — exactly the previous behaviour.
 
 This is a skin + layout reorganisation over the same routes/forms/Alpine bindings (`tagPicker`/`taxonomyFilter`, the preview/ach/diamond `x-data` blocks, citation autosave) — no behavioural coupling. **Two additive read-only index routes** back the rail: `GET /notebooks` (`notebooks_list.html`, writer-only) and `GET /tags` (`entities_list.html`, named-threat entity browse).
diff --git a/CLAUDE.md b/CLAUDE.md
index 060d82c..7ed0cb4 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -93,7 +93,7 @@ src/iceberg/
                    #    feeds [analyst RSS reader], discovery [search/taxonomy/audience], admin_audit, admin_feeds [RSS config],
                    #    admin_proxy [outbound proxy config], admin_oidc [multi-provider SSO config], admin_ai [AI provider config], admin_misp [MISP push config], admin_webhook [publication webhook config], admin_config [read-only effective-config viewer], admin_home [/admin Settings & integrations hub: status-pill tiles over the config pages])
   auth/oidc/       # multi-provider OIDC adapters (base StandardOIDCAdapter + registry + entra/authentik/auth0/okta claim extraction)
-  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles; also `admin_hub_tiles` — the per-subsystem status pills behind /admin)
+  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers + delivery_reason: why a product reached this reader, re-derived from the dissemination match rules), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles; also `admin_hub_tiles` — the per-subsystem status pills behind /admin)
   rendering/       # markdown->HTML, report->PDF (typst), svg (shared diagram helpers: escape/fonts/wrap/placard)
   data/            # starter_tags.json (importable starter taxonomy)
   templates/       # Jinja2 + Alpine: base (command-center shell: rail+topbar+canvas+⌘K palette), _glyph, _macros,
diff --git a/src/iceberg/services/feed.py b/src/iceberg/services/feed.py
index a184ca3..885b394 100644
--- a/src/iceberg/services/feed.py
+++ b/src/iceberg/services/feed.py
@@ -9,9 +9,60 @@
 from . import reports as report_service
 
 
+class DeliveryReason(TypedDict):
+    """Why this product reached this reader — the answer to "why am I seeing
+    this?", which the feed could previously never give."""
+
+    kind: str  # requirement | tag | audience | level | all
+    label: str
+    requirement_id: int | None
+
+
 class FeedItem(TypedDict):
     event: DisseminationEvent
     report: Report
+    reason: DeliveryReason
+
+
+def delivery_reason(user: User, report: Report) -> DeliveryReason:
+    """Re-derive why ``report`` matched ``user``, in the order the reader cares
+    about it.
+
+    This mirrors the match rules in ``dissemination.matched_stakeholders`` (the
+    only place delivery is decided) rather than storing a second copy of them on
+    ``DisseminationEvent`` — no schema change, and no way for a stored reason to
+    drift from the rule that actually routed the product.
+    """
+    own = [r for r in report.requirements if r.stakeholder_id == user.id]
+    if own:
+        return {
+            "kind": "requirement",
+            "label": "Answers your RFI",
+            "requirement_id": own[0].id,
+        }
+    subscribed = {t.id: t for t in user.tag_subscriptions}
+    matched_tags = [t for t in report.tags if t.id in subscribed]
+    if matched_tags:
+        return {
+            "kind": "tag",
+            "label": matched_tags[0].label,
+            "requirement_id": None,
+        }
+    user_groups = {g.id for g in user.audience_groups}
+    matched_groups = [g for g in report.audience_groups if g.id in user_groups]
+    if matched_groups:
+        return {
+            "kind": "audience",
+            "label": matched_groups[0].name,
+            "requirement_id": None,
+        }
+    if user.preferred_intel_level is not None:
+        return {
+            "kind": "level",
+            "label": f"Matched level · {report.intel_level.value}",
+            "requirement_id": None,
+        }
+    return {"kind": "all", "label": "All levels", "requirement_id": None}
 
 
 def visible_items(session: Session, user: User) -> list[FeedItem]:
@@ -24,14 +75,16 @@ def visible_items(session: Session, user: User) -> list[FeedItem]:
     items: list[FeedItem] = []
     for event in events:
         try:
-            items.append(
-                {
-                    "event": event,
-                    "report": report_service.ensure_visible(event.report, user),
-                }
-            )
+            report = report_service.ensure_visible(event.report, user)
         except HTTPException:
             continue
+        items.append(
+            {
+                "event": event,
+                "report": report,
+                "reason": delivery_reason(user, report),
+            }
+        )
     return items
 
 
diff --git a/src/iceberg/static/css/iceberg.css b/src/iceberg/static/css/iceberg.css
index 0dc4f48..af74a93 100644
--- a/src/iceberg/static/css/iceberg.css
+++ b/src/iceberg/static/css/iceberg.css
@@ -533,6 +533,8 @@ a.row:hover, .row-hover:hover { background: var(--surface-2); }
 .queue-dot { width: 8px; height: 8px; flex: none; border-radius: 50%; background: var(--faint); }
 .queue-dot.is-draft { background: var(--c-warn); }
 .queue-dot.is-review { background: var(--accent); }
+.queue-dot.is-unread { background: var(--accent-ink); }
+.queue-dot.is-blank { background: transparent; }
 
 /* Audit log — one block per security event (admin console) */
 .audit-log { display: flex; flex-direction: column; }
@@ -1196,11 +1198,6 @@ label.marking-chip:hover { border-color: var(--accent-line); }
   appearance: none;
 }
 
-.editor-subhead {
-  flex: none; display: flex; align-items: center; gap: 14px;
-  padding: 8px 20px; border-bottom: 1px solid var(--line); background: var(--surface-2);
-}
-
 .editor-body { flex: 1; min-height: 0; display: grid; grid-template-columns: 1fr 1fr 340px; }
 .editor-pane { min-width: 0; display: flex; flex-direction: column; overflow: hidden; border-right: 1px solid var(--line); }
 .editor-pane:last-child { border-right: 0; }
diff --git a/src/iceberg/static/js/tags.js b/src/iceberg/static/js/tags.js
index 11bdc0d..f1238f0 100644
--- a/src/iceberg/static/js/tags.js
+++ b/src/iceberg/static/js/tags.js
@@ -436,6 +436,11 @@ document.addEventListener('alpine:init', () => {
     show(phase, section) { this.phase = phase; this.section = section; },
   }));
 
+  /* ---- Stakeholder feed filter (feed.html) --------------------------------
+     All ⇄ Unread over the already-rendered rows. All is the server-rendered
+     default, so the page is complete before (and without) hydration. */
+  Alpine.data('feedFilter', () => ({ unreadOnly: false }));
+
   Alpine.data('citationForm', () => ({
     error: false,
     async save() {
diff --git a/src/iceberg/templates/base.html b/src/iceberg/templates/base.html
index bf124db..3d03f16 100644
--- a/src/iceberg/templates/base.html
+++ b/src/iceberg/templates/base.html
@@ -31,7 +31,9 @@
     <symbol id="ic-taxonomy" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M5 4h9l5 5v11H5z"/><path d="M9 9h4M9 13h6M9 17h6"/></symbol>
     <symbol id="ic-feed" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M4 11a9 9 0 0 1 9 9"/><path d="M4 4a16 16 0 0 1 16 16"/><circle cx="5" cy="19" r="1.4" fill="currentColor"/></symbol>
     <symbol id="ic-prefs" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><path d="M12 3v2.5M12 18.5V21M4.2 7l2.1 1.2M17.7 15.8l2.1 1.2M4.2 17l2.1-1.2M17.7 8.2l2.1-1.2"/></symbol>
-    <symbol id="ic-cmd" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><circle cx="11" cy="11" r="7"/><path d="M21 21l-4.3-4.3"/></symbol>
+    {# Deliberately NOT the magnifier: the palette jumps between screens, Search
+       queries the corpus, and two magnifiers made them look like one feature. #}
+    <symbol id="ic-cmd" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M9 6a3 3 0 1 0-3 3h12a3 3 0 1 0-3-3v12a3 3 0 1 0 3-3H6a3 3 0 1 0 3 3z"/></symbol>
     <symbol id="ic-bell" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round"><path d="M18 8a6 6 0 0 0-12 0c0 7-3 9-3 9h18s-3-2-3-9"/><path d="M13.7 21a2 2 0 0 1-3.4 0"/></symbol>
     <symbol id="ic-plus" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.1" stroke-linecap="round" stroke-linejoin="round"><path d="M12 5v14M5 12h14"/></symbol>
     <symbol id="ic-arrow" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M5 12h14M13 6l6 6-6 6"/></symbol>
@@ -52,9 +54,9 @@
   {% set _seg = (path.strip('/').split('/')[0]) if path != '/' else '' %}
   {% set _crumbs = {
     '': 'Dashboard', 'reports': 'Reports', 'notebooks': 'Notebooks',
-    'search': 'Search', 'tags': 'Entities', 'matrix': 'ATT&CK matrix',
+    'search': 'Search', 'tags': 'Entities', 'matrix': 'ATT&CK coverage',
     'requirements': 'Tasking', 'feed': 'Feed', 'feeds': 'Feed reader', 'preferences': 'Preferences',
-    'maturity': 'Program maturity', 'help': 'Help', 'admin': 'Administration'
+    'maturity': 'Program maturity', 'help': 'Help', 'admin': 'Settings & integrations'
   } %}
   {% set crumb_default = _crumbs.get(_seg, _seg | replace('-', ' ') | title) %}
   {% set role = (user.role.value if user.role is not string else user.role) if (user is defined and user) else none %}
@@ -65,20 +67,23 @@
       {'label': 'Feed', 'href': '/feed', 'group': 'Intelligence'},
       {'label': 'Reports', 'href': '/reports', 'group': 'Intelligence'},
       {'label': 'Search', 'href': '/search', 'group': 'Intelligence'},
-      {'label': 'ATT&CK matrix', 'href': '/matrix', 'group': 'Intelligence'},
+      {'label': 'ATT&CK coverage', 'href': '/matrix', 'group': 'Intelligence'},
       {'label': 'My requirements', 'href': '/requirements', 'group': 'My inputs'},
       {'label': 'Preferences', 'href': '/preferences', 'group': 'My inputs'},
       {'label': 'Help', 'href': '/help', 'group': 'Help'}
     ] %}
   {% elif role == 'ADMIN' %}
+    {# The rail collapses the integration/governance consoles behind /admin; the
+       palette stays exhaustive so a power user can still jump straight in. #}
     {% set jump_items = [
       {'label': 'Dashboard', 'href': '/', 'group': 'Workspace'},
       {'label': 'Reports', 'href': '/reports', 'group': 'Workspace'},
-      {'label': 'Feed reader', 'href': '/feeds', 'group': 'Collection'},
-      {'label': 'Search', 'href': '/search', 'group': 'Discovery'},
-      {'label': 'Entities', 'href': '/tags', 'group': 'Discovery'},
-      {'label': 'ATT&CK matrix', 'href': '/matrix', 'group': 'Discovery'},
-      {'label': 'Program maturity', 'href': '/maturity', 'group': 'Discovery'},
+      {'label': 'Tasking', 'href': '/requirements', 'group': 'Workspace'},
+      {'label': 'Feed reader', 'href': '/feeds', 'group': 'Collect'},
+      {'label': 'Search', 'href': '/search', 'group': 'Discover'},
+      {'label': 'Entities', 'href': '/tags', 'group': 'Discover'},
+      {'label': 'ATT&CK coverage', 'href': '/matrix', 'group': 'Discover'},
+      {'label': 'Program maturity', 'href': '/maturity', 'group': 'Discover'},
       {'label': 'Settings & integrations', 'href': '/admin', 'group': 'Administration'},
       {'label': 'Taxonomy', 'href': '/admin/tags', 'group': 'Administration'},
       {'label': 'Audience groups', 'href': '/admin/audience', 'group': 'Administration'},
@@ -90,20 +95,19 @@
       {'label': 'AI provider', 'href': '/admin/ai', 'group': 'Administration'},
       {'label': 'MISP push', 'href': '/admin/misp', 'group': 'Administration'},
       {'label': 'Publication webhook', 'href': '/admin/webhook', 'group': 'Administration'},
-      {'label': 'Tasking', 'href': '/requirements', 'group': 'Administration'},
       {'label': 'Help', 'href': '/help', 'group': 'Help'}
     ] %}
   {% elif role %}
     {% set jump_items = [
       {'label': 'Dashboard', 'href': '/', 'group': 'Workspace'},
-      {'label': 'Notebooks', 'href': '/notebooks', 'group': 'Workspace'},
-      {'label': 'Reports', 'href': '/reports', 'group': 'Workspace'},
-      {'label': 'Search', 'href': '/search', 'group': 'Discovery'},
-      {'label': 'Entities', 'href': '/tags', 'group': 'Discovery'},
-      {'label': 'ATT&CK matrix', 'href': '/matrix', 'group': 'Discovery'},
-      {'label': 'Program maturity', 'href': '/maturity', 'group': 'Discovery'},
-      {'label': 'Feed reader', 'href': '/feeds', 'group': 'Collection'},
-      {'label': 'Tasking', 'href': '/requirements', 'group': 'Collection'},
+      {'label': 'Notebooks', 'href': '/notebooks', 'group': 'Collect'},
+      {'label': 'Feed reader', 'href': '/feeds', 'group': 'Collect'},
+      {'label': 'Tasking', 'href': '/requirements', 'group': 'Collect'},
+      {'label': 'Reports', 'href': '/reports', 'group': 'Produce'},
+      {'label': 'Search', 'href': '/search', 'group': 'Discover'},
+      {'label': 'Entities', 'href': '/tags', 'group': 'Discover'},
+      {'label': 'ATT&CK coverage', 'href': '/matrix', 'group': 'Discover'},
+      {'label': 'Program maturity', 'href': '/maturity', 'group': 'Discover'},
       {'label': 'Help', 'href': '/help', 'group': 'Help'}
     ] %}
   {% else %}
@@ -136,7 +140,7 @@
                          (feed_unread if feed_unread is defined and feed_unread else '')) }}
             {{ rail_link('/reports', 'ic-reports', 'Reports', path.startswith('/reports')) }}
             {{ rail_link('/search', 'ic-search', 'Search', path.startswith('/search')) }}
-            {{ rail_link('/matrix', 'ic-matrix', 'Matrix', path.startswith('/matrix')) }}
+            {{ rail_link('/matrix', 'ic-matrix', 'ATT&CK coverage', path.startswith('/matrix')) }}
           </div>
           <div class="rail-group">
             <div class="rail-group-label">My inputs</div>
@@ -148,49 +152,50 @@
             <div class="rail-group-label">Workspace</div>
             {{ rail_link('/', 'ic-home', 'Dashboard', path == '/') }}
             {{ rail_link('/reports', 'ic-reports', 'Reports', path.startswith('/reports')) }}
-            {{ rail_link('/feeds', 'ic-feed', 'Feed reader', path == '/feeds') }}
+            {{ rail_link('/requirements', 'ic-tasking', 'Tasking', path.startswith('/requirements')) }}
           </div>
           <div class="rail-group">
-            <div class="rail-group-label">Discovery</div>
+            <div class="rail-group-label">Discover</div>
             {{ rail_link('/search', 'ic-search', 'Search', path.startswith('/search')) }}
             {{ rail_link('/tags', 'ic-entity', 'Entities', path.startswith('/tags')) }}
-            {{ rail_link('/matrix', 'ic-matrix', 'Matrix', path.startswith('/matrix')) }}
+            {{ rail_link('/matrix', 'ic-matrix', 'ATT&CK coverage', path.startswith('/matrix')) }}
             {{ rail_link('/maturity', 'ic-maturity', 'Maturity', path.startswith('/maturity')) }}
           </div>
+          {# The six integration + governance consoles live behind the /admin hub,
+             which stays lit while you are inside any of them; every one of them
+             is still a ⌘K jump target (see jump_items above). #}
+          {% set own_rail_links = ['/admin/tags', '/admin/audience', '/admin/audit'] %}
+          {% set in_hub = path.startswith('/admin') and not own_rail_links | select('in', path) | list %}
           <div class="rail-group">
             <div class="rail-group-label">Administration</div>
-            {{ rail_link('/admin', 'ic-settings', 'Settings & integrations', path == '/admin') }}
             {{ rail_link('/admin/tags', 'ic-taxonomy', 'Taxonomy', path.startswith('/admin/tags')) }}
             {{ rail_link('/admin/audience', 'ic-entity', 'Audience', path.startswith('/admin/audience')) }}
+            {{ rail_link('/admin', 'ic-settings', 'Settings & integrations', in_hub) }}
             {{ rail_link('/admin/audit', 'ic-audit', 'Audit log', path.startswith('/admin/audit')) }}
-            {{ rail_link('/admin/config', 'ic-config', 'Effective config', path == '/admin/config') }}
-            {{ rail_link('/admin/oidc', 'ic-sso', 'Single sign-on', path.startswith('/admin/oidc')) }}
-            {{ rail_link('/admin/feeds', 'ic-rss', 'RSS feeds', path.startswith('/admin/feeds')) }}
-            {{ rail_link('/admin/proxy', 'ic-proxy', 'Outbound proxy', path.startswith('/admin/proxy')) }}
-            {{ rail_link('/admin/ai', 'ic-ai', 'AI provider', path.startswith('/admin/ai')) }}
-            {{ rail_link('/admin/misp', 'ic-misp', 'MISP push', path.startswith('/admin/misp')) }}
-            {{ rail_link('/admin/webhook', 'ic-webhook', 'Webhook', path.startswith('/admin/webhook')) }}
-            {{ rail_link('/requirements', 'ic-tasking', 'Tasking', path.startswith('/requirements')) }}
           </div>
         {% else %}
           <div class="rail-group">
             <div class="rail-group-label">Workspace</div>
             {{ rail_link('/', 'ic-home', 'Dashboard', path == '/') }}
+          </div>
+          {# Ordered by the intelligence cycle: collect → produce → discover. #}
+          <div class="rail-group">
+            <div class="rail-group-label">Collect</div>
             {{ rail_link('/notebooks', 'ic-notebook', 'Notebooks', path.startswith('/notebooks')) }}
+            {{ rail_link('/feeds', 'ic-rss', 'Feed reader', path == '/feeds') }}
+            {{ rail_link('/requirements', 'ic-tasking', 'Tasking', path.startswith('/requirements')) }}
+          </div>
+          <div class="rail-group">
+            <div class="rail-group-label">Produce</div>
             {{ rail_link('/reports', 'ic-reports', 'Reports', path.startswith('/reports')) }}
           </div>
           <div class="rail-group">
-            <div class="rail-group-label">Discovery</div>
+            <div class="rail-group-label">Discover</div>
             {{ rail_link('/search', 'ic-search', 'Search', path.startswith('/search')) }}
             {{ rail_link('/tags', 'ic-entity', 'Entities', path.startswith('/tags')) }}
-            {{ rail_link('/matrix', 'ic-matrix', 'Matrix', path.startswith('/matrix')) }}
+            {{ rail_link('/matrix', 'ic-matrix', 'ATT&CK coverage', path.startswith('/matrix')) }}
             {{ rail_link('/maturity', 'ic-maturity', 'Maturity', path.startswith('/maturity')) }}
           </div>
-          <div class="rail-group">
-            <div class="rail-group-label">Collection</div>
-            {{ rail_link('/feeds', 'ic-feed', 'Feed reader', path == '/feeds') }}
-            {{ rail_link('/requirements', 'ic-tasking', 'Tasking', path.startswith('/requirements')) }}
-          </div>
         {% endif %}
       </nav>
       <div class="rail-foot">
diff --git a/src/iceberg/templates/feed.html b/src/iceberg/templates/feed.html
index b67ba61..a15ef1e 100644
--- a/src/iceberg/templates/feed.html
+++ b/src/iceberg/templates/feed.html
@@ -4,6 +4,9 @@
 {% block crumb %}Feed{% endblock %}
 {% block content %}
 
+{% set new_count = unread_ids | length %}
+
+<div x-data="feedFilter()">
 <div class="head-row mb-4">
   <div>
     <div class="eyebrow eyebrow-accent">Delivered to you</div>
@@ -12,9 +15,18 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
       <a href="/preferences" class="btn-link">Preferences</a>.</p>
     <a href="/help#dissemination" class="help-hint mt-2">How does dissemination work? →</a>
   </div>
+  {% if items %}
+    {# Filter is client-side over the already-rendered rows: All is active by
+       default, so the server-rendered page is complete without Alpine. #}
+    <div class="filter-pills">
+      <button type="button" class="tax-pill" :class="unreadOnly ? '' : 'is-on'"
+              @click="unreadOnly = false" :aria-pressed="unreadOnly ? 'false' : 'true'">All · {{ items | length }}</button>
+      <button type="button" class="tax-pill" :class="unreadOnly ? 'is-on' : ''"
+              @click="unreadOnly = true" :aria-pressed="unreadOnly ? 'true' : 'false'">Unread · {{ new_count }}</button>
+    </div>
+  {% endif %}
 </div>
 
-{% set new_count = unread_ids | length %}
 {% if new_count %}
   <div class="feed-banner mb-5">
     <span class="dot"></span>
@@ -23,25 +35,66 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
 {% endif %}
 
 {% if items %}
-  <div class="rows">
-    {% for item in items %}
-      {% set r = item.report %}
-      <a href="/reports/{{ r.id }}" class="row">
-        {% if item.event.id in unread_ids %}
-          <span style="width:8px;height:8px;border-radius:50%;background:var(--accent-ink);flex:none;" title="New"></span>
-        {% else %}
-          <span style="width:8px;height:8px;flex:none;"></span>
-        {% endif %}
-        <span class="flex-1">
-          <span class="row-title {% if item.event.id in unread_ids %}font-bold{% endif %}">{{ r.title }}</span>
-          <span class="mono text-xs block mt-0.5" style="color:var(--faint);">{{ item.event.created_at.strftime('%Y-%m-%d · %H:%M') }}</span>
-        </span>
-        {{ m.level_badge(r.intel_level) }}
-        {{ m.tlp_badge(r.tlp) }}
-      </a>
+    {% for label, rows in buckets %}
+      {# A bucket with nothing unread disappears wholesale under the Unread
+         filter, rather than leaving an empty heading and border behind. #}
+      {% set unread_here = rows | selectattr('event.id', 'in', unread_ids) | list | length %}
+      <div{% if not unread_here %} x-show="!unreadOnly" x-cloak{% endif %}>
+      <div class="eyebrow mt-6 mb-2">{{ label }}</div>
+      <div class="rows">
+        {% for item in rows %}
+          {% set r = item.report %}
+          {% set is_unread = item.event.id in unread_ids %}
+          {% set reason = item.reason %}
+          <div class="row"{% if not is_unread %} x-show="!unreadOnly" x-cloak{% endif %}>
+            {% if is_unread %}
+              <span class="queue-dot is-unread" title="New"></span>
+            {% else %}
+              <span class="queue-dot is-blank"></span>
+            {% endif %}
+            <a href="/reports/{{ r.id }}" class="flex-1">
+              <span class="row-title {% if is_unread %}font-bold{% endif %}">{{ r.title }}</span>
+              <span class="flex items-center gap-2 mt-1 flex-wrap">
+                {# Why this reached you — derived from the same rules that routed it. #}
+                {% if reason.kind == 'requirement' %}
+                  <span class="tag tag--c is-info" title="This product answers a requirement you raised">
+                    <span class="dot"></span>{{ reason.label }}
+                  </span>
+                {% elif reason.kind == 'tag' %}
+                  <span class="tag tag--c is-info" title="You subscribe to this entity">
+                    <span class="dot"></span>{{ reason.label }}
+                  </span>
+                {% elif reason.kind == 'audience' %}
+                  <span class="tag" title="Delivered to your audience group">
+                    <span class="dot"></span>{{ reason.label }}
+                  </span>
+                {% else %}
+                  <span class="tag" title="Matched your intelligence-level preference">
+                    <span class="dot"></span>{{ reason.label }}
+                  </span>
+                {% endif %}
+                {{ m.level_badge(r.intel_level) }}
+                {{ m.tlp_badge(r.tlp) }}
+              </span>
+              <span class="mono text-xs block mt-1" style="color:var(--faint);">{{ item.event.created_at.strftime('%Y-%m-%d · %H:%M') }}</span>
+            </a>
+            {# Close the intelligence cycle from the feed. The feedback endpoint
+               requires a usefulness rating, so this deep-links to the product's
+               feedback card with the requirement preselected rather than
+               posting a verdict the reader never gave. #}
+            {% if reason.kind == 'requirement' %}
+              <a href="/reports/{{ r.id }}?requirement={{ reason.requirement_id }}#feedback"
+                 class="btn btn--primary btn--sm">Mark satisfied →</a>
+            {% else %}
+              <a href="/reports/{{ r.id }}#feedback" class="btn-link">Give feedback</a>
+            {% endif %}
+          </div>
+        {% endfor %}
+      </div>
+      </div>
     {% endfor %}
-  </div>
 {% else %}
   <div class="well card-pad-lg text-center"><p class="empty">Nothing disseminated to you yet.</p></div>
 {% endif %}
+</div>
 {% endblock %}
diff --git a/src/iceberg/templates/notebook_detail.html b/src/iceberg/templates/notebook_detail.html
index 7435f12..2d08a5c 100644
--- a/src/iceberg/templates/notebook_detail.html
+++ b/src/iceberg/templates/notebook_detail.html
@@ -142,8 +142,8 @@ <h2 class="section-title">Sources</h2>
       <p class="empty">No sources collected yet. Add the first source with a URL, citation, or reference note.</p>
     {% endif %}
     {% if can_write %}
-      <details class="source-add-editor mt-5 pt-5 border-t border-line" {% if not sources %}open{% endif %}>
-        <summary class="btn btn--ghost btn--sm">Add source</summary>
+      <details class="add-block mt-5 pt-5 border-t border-line" {% if not sources %}open{% endif %}>
+        <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add source</summary>
         <form method="post" action="/notebooks/{{ notebook.id }}/sources" class="space-y-2.5 mt-3">
           <input name="title" required placeholder="Source title" class="field">
           <input name="reference" placeholder="URL / reference" class="field">
@@ -189,10 +189,13 @@ <h2 class="section-title">Working notes</h2>
       <p class="empty">No notes yet. Capture observations before they turn into report prose.</p>
     {% endif %}
     {% if can_write %}
-      <form method="post" action="/notebooks/{{ notebook.id }}/notes" class="space-y-2.5 mt-5 pt-5 border-t border-line">
-        <textarea name="body_md" rows="3" placeholder="Working note (markdown)" class="field field-mono"></textarea>
-        <button class="btn btn--ghost btn--sm">Add note</button>
-      </form>
+      <details class="add-block mt-5 pt-5 border-t border-line"{% if not notes %} open{% endif %}>
+        <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add note</summary>
+        <form method="post" action="/notebooks/{{ notebook.id }}/notes" class="space-y-2.5 mt-3">
+          <textarea name="body_md" rows="3" placeholder="Working note (markdown)" class="field field-mono"></textarea>
+          <button class="btn btn--ghost btn--sm">Save note</button>
+        </form>
+      </details>
     {% endif %}
   </section>
 </div>
@@ -224,13 +227,16 @@ <h2 class="section-title">Attachments</h2>
     <p class="empty">No files attached yet. Upload PDFs, images, or office files that should stay with this collection.</p>
   {% endif %}
   {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/attachments" enctype="multipart/form-data"
-          class="space-y-2.5 mt-5 pt-5 border-t border-line">
-      <input type="file" name="file" required class="field">
-      <input name="title" placeholder="Label (optional — defaults to filename)" class="field">
-      <input name="summary" placeholder="Short summary (optional)" class="field">
-      <button class="btn btn--ghost btn--sm">Upload attachment</button>
-    </form>
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not attachments %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add file</summary>
+      <form method="post" action="/notebooks/{{ notebook.id }}/attachments" enctype="multipart/form-data"
+            class="space-y-2.5 mt-3">
+        <input type="file" name="file" required class="field">
+        <input name="title" placeholder="Label (optional — defaults to filename)" class="field">
+        <input name="summary" placeholder="Short summary (optional)" class="field">
+        <button class="btn btn--ghost btn--sm">Upload attachment</button>
+      </form>
+    </details>
   {% endif %}
 </section>
 
@@ -268,12 +274,15 @@ <h2 class="section-title">Figures</h2>
     <p class="empty">No figures yet. Upload an image to embed it inline in a report.</p>
   {% endif %}
   {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/figures" enctype="multipart/form-data"
-          class="space-y-2.5 mt-5 pt-5 border-t border-line">
-      <input type="file" name="file" accept="image/png,image/jpeg,image/gif" required class="field">
-      <input name="title" placeholder="Caption (optional — defaults to filename)" class="field">
-      <button class="btn btn--ghost btn--sm">Upload figure</button>
-    </form>
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not figures %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add figure</summary>
+      <form method="post" action="/notebooks/{{ notebook.id }}/figures" enctype="multipart/form-data"
+            class="space-y-2.5 mt-3">
+        <input type="file" name="file" accept="image/png,image/jpeg,image/gif" required class="field">
+        <input name="title" placeholder="Caption (optional — defaults to filename)" class="field">
+        <button class="btn btn--ghost btn--sm">Upload figure</button>
+      </form>
+    </details>
   {% endif %}
 </section>
 
@@ -364,8 +373,10 @@ <h3 class="text-sm" style="font-weight:600;">Suggest indicators with AI</h3>
     </div>
   {% endif %}
   {% if can_write %}
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not iocs %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add indicator</summary>
     <form method="post" action="/notebooks/{{ notebook.id }}/iocs"
-          class="space-y-2.5 mt-2 pt-5 border-t border-line">
+          class="space-y-2.5 mt-3">
       <div class="flex gap-2 flex-wrap">
         <select name="ioc_type" class="field" style="max-width:200px;">
           {% for t in ioc_types %}
@@ -393,6 +404,7 @@ <h3 class="text-sm" style="font-weight:600;">Suggest indicators with AI</h3>
       </div>
       <button class="btn btn--ghost btn--sm">Add indicator</button>
     </form>
+    </details>
   {% endif %}
 </section>
 
@@ -434,7 +446,9 @@ <h2 class="section-title">Diamond models</h2>
     <p class="empty">No Diamond Model assessments yet. Capture adversary, capability, infrastructure and victim to model an intrusion.</p>
   {% endif %}
   {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/diamonds" class="well card-pad mt-4 space-y-3">
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not diamonds %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add Diamond Model</summary>
+    <form method="post" action="/notebooks/{{ notebook.id }}/diamonds" class="well card-pad mt-3 space-y-3">
       <div class="eyebrow">New Diamond Model</div>
       <div class="grid sm:grid-cols-12 gap-3 items-end">
         <div class="sm:col-span-9">
@@ -457,6 +471,7 @@ <h2 class="section-title">Diamond models</h2>
       <div><label class="field-label">Notes <span class="opt">optional</span></label><textarea name="notes" rows="2" placeholder="Analytic notes" class="field"></textarea></div>
       <button class="btn btn--ink">Create Diamond Model</button>
     </form>
+    </details>
   {% endif %}
 </section>
 
@@ -496,7 +511,9 @@ <h2 class="section-title">ACH analyses
     <p class="empty">No ACH matrices yet. List the competing hypotheses, gather your evidence, and rate each cell for consistency.</p>
   {% endif %}
   {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/ach" class="well card-pad mt-4 space-y-3">
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not ach_models %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add ACH analysis</summary>
+    <form method="post" action="/notebooks/{{ notebook.id }}/ach" class="well card-pad mt-3 space-y-3">
       <div class="eyebrow">New ACH analysis</div>
       <div>
         <label class="field-label">Title</label>
@@ -504,6 +521,7 @@ <h2 class="section-title">ACH analyses
       </div>
       <button class="btn btn--ink">Create ACH analysis</button>
     </form>
+    </details>
   {% endif %}
 </section>
 
@@ -536,7 +554,9 @@ <h2 class="section-title">Intelligence products</h2>
   {% endif %}
 
   {% if can_write %}
-    <form method="post" action="/notebooks/{{ notebook.id }}/reports" class="well card-pad mt-4">
+    <details class="add-block mt-5 pt-5 border-t border-line"{% if not reports %} open{% endif %}>
+      <summary class="add-toggle"><svg class="rail-ic btn-ic"><use href="#ic-plus"/></svg>Add product</summary>
+    <form method="post" action="/notebooks/{{ notebook.id }}/reports" class="well card-pad mt-3">
       <div class="eyebrow mb-3">New product</div>
       <div class="grid sm:grid-cols-12 gap-3 items-end">
         <div class="sm:col-span-6">
@@ -558,6 +578,7 @@ <h2 class="section-title">Intelligence products</h2>
       </div>
       <button class="btn btn--ink mt-4">Create product</button>
     </form>
+    </details>
   {% endif %}
 </section>
 
diff --git a/src/iceberg/templates/report_edit.html b/src/iceberg/templates/report_edit.html
index 568e13e..1672c48 100644
--- a/src/iceberg/templates/report_edit.html
+++ b/src/iceberg/templates/report_edit.html
@@ -13,13 +13,24 @@
 {% block canvas_class %}canvas--flush{% endblock %}
 {% block content %}
 
-{% macro transition_btn(target, label, cls) %}
-  <form method="post" action="/reports/{{ report.id }}/transition">
+{% macro transition_btn(target, label, cls, block=false) %}
+  <form method="post" action="/reports/{{ report.id }}/transition"{% if block %} class="w-full"{% endif %}>
     <input type="hidden" name="target" value="{{ target }}">
-    <button class="btn {{ cls }} btn--sm">{{ label }}</button>
+    <button class="btn {{ cls }}{{ '' if block else ' btn--sm' }}"{% if block %} style="width:100%;"{% endif %}>{{ label }}</button>
   </form>
 {% endmacro %}
 
+{# One dock tab. Every tab shares the same ARIA wiring and keyboard contract, so
+   it is declared once here rather than copied per tab. #}
+{% macro dock_tab(id, label) %}
+  <button type="button" class="dock-tab" id="editor-tab-{{ id }}" data-editor-tab="{{ id }}"
+          role="tab" aria-controls="editor-panel-{{ id }}"
+          :aria-selected="tab === '{{ id }}' ? 'true' : 'false'" :tabindex="tab === '{{ id }}' ? '0' : '-1'"
+          :class="tab==='{{ id }}' ? 'is-active' : ''" @click="selectTab('{{ id }}')"
+          @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
+          @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">{{ label }}</button>
+{% endmacro %}
+
 <div class="editor-shell" x-data="reportEditor('report-editor-data')">
   <script type="application/json" id="report-editor-data">
     {{ {'body': report.body_md, 'kj': report.key_judgements, 'ka': report.key_assumptions,
@@ -86,9 +97,12 @@
     <div class="editor-head-actions">
       {{ m.status_badge(report.status) }}
       {% if can_edit %}
+        {# One save model: the editor autosaves (1.2s debounce) and this is the
+           only report of that state. The <noscript> submit keeps the form
+           usable if Alpine never loads. #}
         <span class="save-state" :class="saving ? '' : (dirty ? 'is-dirty' : 'is-saved')"
-              x-text="saving ? 'Saving…' : (dirty ? 'Unsaved changes' : 'Saved')"></span>
-        <button form="reportform" class="btn btn--ink btn--sm">Save draft</button>
+              x-text="saving ? 'Saving…' : (dirty ? 'Unsaved changes' : 'All changes saved')">All changes saved</span>
+        <noscript><button form="reportform" class="btn btn--ink btn--sm">Save</button></noscript>
       {% endif %}
       <a href="/reports/{{ report.id }}" class="btn btn--ghost btn--sm">
         {% if report.status.value == 'PUBLISHED' %}View published{% else %}Preview{% endif %} →
@@ -96,35 +110,6 @@
     </div>
   </header>
 
-  <!-- ===== lifecycle subhead ===== -->
-  <div class="editor-subhead">
-    <div class="flow">
-      {% for step in lifecycle_steps %}
-        <span class="flow-step {{ 'now' if loop.index0 == current_index else ('done' if loop.index0 < current_index) }}">{{ step.replace('_', ' ') }}</span>
-        {% if not loop.last %}<span class="flow-sep"></span>{% endif %}
-      {% endfor %}
-    </div>
-    <div class="flex items-center gap-2 ml-auto">
-      {% if report.status.value == 'DRAFT' and (is_author or user.role == 'ADMIN') %}
-        {{ transition_btn('IN_REVIEW', 'Submit for review', 'btn--primary') }}
-      {% elif report.status.value == 'IN_REVIEW' and can_review %}
-        {{ transition_btn('DRAFT', 'Send back', 'btn--quiet') }}
-        {{ transition_btn('APPROVED', 'Approve', 'btn--primary') }}
-      {% elif report.status.value == 'APPROVED' and can_review %}
-        {{ transition_btn('IN_REVIEW', 'Back to review', 'btn--quiet') }}
-        {{ transition_btn('PUBLISHED', 'Publish & disseminate', 'btn--ink') }}
-      {% elif report.status.value == 'PUBLISHED' %}
-        <span class="eyebrow" style="color:var(--c-ok);">Published {{ report.published_at and report.published_at.strftime('%Y-%m-%d %H:%M') }}</span>
-      {% elif report.status.value == 'DRAFT' %}
-        <span class="eyebrow">Only the author can submit</span>
-      {% elif report.status.value == 'IN_REVIEW' %}
-        <span class="eyebrow">Awaiting reviewer action</span>
-      {% elif report.status.value == 'APPROVED' %}
-        <span class="eyebrow">Awaiting publication</span>
-      {% endif %}
-    </div>
-  </div>
-
   <!-- ===== 3-pane body ===== -->
   <div class="editor-body">
 
@@ -242,47 +227,16 @@
 
     <!-- docked panel -->
     <aside class="editor-pane dock">
+      {# Verb-labelled and kept to four: Cite / Classify / Link / Publish, plus
+         Assist only when the AI backend is available to an editor. Roving
+         tabindex + arrow/Home/End selection come from `tabOrder`, which the
+         component derives from the rendered [data-editor-tab] set. #}
       <div class="dock-tabs" role="tablist" aria-label="Report editor tools">
-        <button type="button" class="dock-tab" id="editor-tab-cite" data-editor-tab="cite"
-                role="tab" aria-controls="editor-panel-cite"
-                :aria-selected="tab === 'cite' ? 'true' : 'false'" :tabindex="tab === 'cite' ? '0' : '-1'"
-                :class="tab==='cite' ? 'is-active' : ''" @click="selectTab('cite')"
-                @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">Citations</button>
-        <button type="button" class="dock-tab" id="editor-tab-tags" data-editor-tab="tags"
-                role="tab" aria-controls="editor-panel-tags"
-                :aria-selected="tab === 'tags' ? 'true' : 'false'" :tabindex="tab === 'tags' ? '0' : '-1'"
-                :class="tab==='tags' ? 'is-active' : ''" @click="selectTab('tags')"
-                @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">Tags</button>
-        {% if can_edit %}
-          <button type="button" class="dock-tab" id="editor-tab-ai" data-editor-tab="ai"
-                  role="tab" aria-controls="editor-panel-ai"
-                  :aria-selected="tab === 'ai' ? 'true' : 'false'" :tabindex="tab === 'ai' ? '0' : '-1'"
-                  :class="tab==='ai' ? 'is-active' : ''" @click="selectTab('ai')"
-                  @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                  @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">AI review</button>
-        {% endif %}
-        <button type="button" class="dock-tab" id="editor-tab-req" data-editor-tab="req"
-                role="tab" aria-controls="editor-panel-req"
-                :aria-selected="tab === 'req' ? 'true' : 'false'" :tabindex="tab === 'req' ? '0' : '-1'"
-                :class="tab==='req' ? 'is-active' : ''" @click="selectTab('req')"
-                @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">Reqs</button>
-        {% if user.role == 'ADMIN' %}
-          <button type="button" class="dock-tab" id="editor-tab-audience" data-editor-tab="audience"
-                  role="tab" aria-controls="editor-panel-audience"
-                  :aria-selected="tab === 'audience' ? 'true' : 'false'" :tabindex="tab === 'audience' ? '0' : '-1'"
-                  :class="tab==='audience' ? 'is-active' : ''" @click="selectTab('audience')"
-                  @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                  @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">Audience</button>
-        {% endif %}
-        <button type="button" class="dock-tab" id="editor-tab-render" data-editor-tab="render"
-                role="tab" aria-controls="editor-panel-render"
-                :aria-selected="tab === 'render' ? 'true' : 'false'" :tabindex="tab === 'render' ? '0' : '-1'"
-                :class="tab==='render' ? 'is-active' : ''" @click="selectTab('render')"
-                @keydown.arrow-right.prevent="moveTab(1)" @keydown.arrow-left.prevent="moveTab(-1)"
-                @keydown.home.prevent="firstTab()" @keydown.end.prevent="lastTab()">Render</button>
+        {{ dock_tab('cite', 'Cite') }}
+        {{ dock_tab('tags', 'Classify') }}
+        {% if can_edit %}{{ dock_tab('ai', 'Assist') }}{% endif %}
+        {{ dock_tab('link', 'Link') }}
+        {{ dock_tab('publish', 'Publish') }}
       </div>
       <div class="dock-body">
 
@@ -545,9 +499,10 @@ <h3 id="ai-challenge-heading" class="section-title">Analytic challenge notes</h3
         </div>
         {% endif %}
 
-        <!-- Requirements -->
-        <div id="editor-panel-req" role="tabpanel" aria-labelledby="editor-tab-req" tabindex="0"
-             x-show="tab==='req'" x-cloak>
+        {# Link — what this product is tied to: the requirements it answers and,
+           for an admin, the need-to-know audience it is scoped to. #}
+        <div id="editor-panel-link" role="tabpanel" aria-labelledby="editor-tab-link" tabindex="0"
+             x-show="tab==='link'" x-cloak>
           <h2 class="section-title mb-1">Requirements satisfied</h2>
           <p class="text-xs mb-3" style="color:var(--muted);">Establishes traceability back to stakeholder needs.</p>
           {% if updated == 'requirements' %}<div class="inline-notice mb-3">Requirement links updated.</div>{% endif %}
@@ -571,13 +526,9 @@ <h2 class="section-title mb-1">Requirements satisfied</h2>
           {% else %}
             <p class="empty">No open requirements to link.</p>
           {% endif %}
-        </div>
 
         {% if user.role == 'ADMIN' %}
-        <!-- Audience -->
-        <div id="editor-panel-audience" role="tabpanel" aria-labelledby="editor-tab-audience" tabindex="0"
-             x-show="tab==='audience'" x-cloak>
-          <h2 class="section-title mb-1">Need-to-know audience</h2>
+          <h2 class="section-title mb-1 mt-6">Need-to-know audience</h2>
           <p class="text-xs mb-3" style="color:var(--muted);">Restrict this published product to selected stakeholder groups. No groups means all authenticated stakeholders can browse it.</p>
           {% if updated == 'audience' %}<div class="inline-notice mb-3">Audience updated.</div>{% endif %}
           {% if all_audience_groups %}
@@ -600,12 +551,32 @@ <h2 class="section-title mb-1">Need-to-know audience</h2>
           {% else %}
             <p class="empty">No audience groups yet. Create them from <a href="/admin/audience" class="btn-link">Audience groups</a>.</p>
           {% endif %}
-        </div>
         {% endif %}
+        </div>
+
+        {# Publish — everything for moving the product forward in one place: where
+           it is in the lifecycle, the PDF artefacts, and (in the dock footer) the
+           one transition available to this user right now. #}
+        <div id="editor-panel-publish" role="tabpanel" aria-labelledby="editor-tab-publish" tabindex="0"
+             x-show="tab==='publish'" x-cloak>
+          <div class="head-row mb-1">
+            <h2 class="section-title">Publish</h2>
+            {{ m.status_badge(report.status) }}
+          </div>
+          <p class="text-xs mb-3" style="color:var(--muted);">Everything for moving this product forward.</p>
+
+          <div class="well card-pad mb-4">
+            <div class="field-label mb-2">Lifecycle</div>
+            <div class="flow" style="flex-wrap:wrap;gap:6px;">
+              {% for step in lifecycle_steps %}
+                <span class="flow-step {{ 'now' if loop.index0 == current_index else ('done' if loop.index0 < current_index) }}">{{ step.replace('_', ' ') }}</span>
+              {% endfor %}
+            </div>
+            {% if report.status.value == 'PUBLISHED' %}
+              <p class="text-xs mt-2" style="color:var(--c-ok);">Published {{ report.published_at and report.published_at.strftime('%Y-%m-%d %H:%M') }} — the snapshot is frozen.</p>
+            {% endif %}
+          </div>
 
-        <!-- Render -->
-        <div id="editor-panel-render" role="tabpanel" aria-labelledby="editor-tab-render" tabindex="0"
-             x-show="tab==='render'" x-cloak>
           <h2 class="section-title mb-1">Rendered products</h2>
           <p class="text-xs mb-3" style="color:var(--muted);">Typeset PDF artefacts via Typst.</p>
           {% if can_edit or user.role != 'STAKEHOLDER' %}
@@ -644,16 +615,34 @@ <h2 class="section-title mb-1">Rendered products</h2>
         </div>
       </div>
 
-      {# Markings moved to the always-visible header chips (single source of
-         truth); the dock footer now only points at the estimative-language
-         guidance that used to sit beside the confidence select. #}
-      {% if can_edit %}
+      {# The dock footer carries the one lifecycle action available to this user
+         right now — the standalone subhead stepper + submit row is gone, so
+         there is a single place to move the product forward. It stays pinned
+         under whichever tab is open; the Publish tab holds the context. #}
       <div class="dock-foot">
-        <a href="/help#estimative-language" class="help-hint" target="_blank">
-          How should I word likelihood and confidence? →
-        </a>
+        {% if report.status.value == 'DRAFT' and (is_author or user.role == 'ADMIN') %}
+          {{ transition_btn('IN_REVIEW', 'Submit for review →', 'btn--primary', block=true) }}
+        {% elif report.status.value == 'IN_REVIEW' and can_review %}
+          {{ transition_btn('APPROVED', 'Approve →', 'btn--primary', block=true) }}
+          {{ transition_btn('DRAFT', 'Send back', 'btn--quiet', block=true) }}
+        {% elif report.status.value == 'APPROVED' and can_review %}
+          {{ transition_btn('PUBLISHED', 'Publish & disseminate →', 'btn--ink', block=true) }}
+          {{ transition_btn('IN_REVIEW', 'Back to review', 'btn--quiet', block=true) }}
+        {% elif report.status.value == 'PUBLISHED' %}
+          <span class="eyebrow" style="color:var(--c-ok);">Published {{ report.published_at and report.published_at.strftime('%Y-%m-%d %H:%M') }}</span>
+        {% elif report.status.value == 'DRAFT' %}
+          <span class="eyebrow">Only the author can submit</span>
+        {% elif report.status.value == 'IN_REVIEW' %}
+          <span class="eyebrow">Awaiting reviewer action</span>
+        {% elif report.status.value == 'APPROVED' %}
+          <span class="eyebrow">Awaiting publication</span>
+        {% endif %}
+        {% if can_edit %}
+          <a href="/help#estimative-language" class="help-hint" target="_blank">
+            How should I word likelihood and confidence? →
+          </a>
+        {% endif %}
       </div>
-      {% endif %}
     </aside>
   </div>
 </div>
diff --git a/src/iceberg/templates/report_view.html b/src/iceberg/templates/report_view.html
index fced5e6..ceae4e3 100644
--- a/src/iceberg/templates/report_view.html
+++ b/src/iceberg/templates/report_view.html
@@ -136,7 +136,10 @@ <h2 class="section-title mt-9 mb-3">Attachments</h2>
     {% endif %}
 
     {% if feedback_form %}
-    <div class="side-card" x-data="{ req: '{{ feedback_form.existing.requirement_id or '' }}' }">
+    {# #feedback is the anchor the stakeholder feed's "Mark satisfied →" and
+       "Give feedback" links land on. #}
+    <div class="side-card" id="feedback"
+         x-data="{ req: '{{ feedback_form.existing.requirement_id or feedback_form.preselect_requirement_id or '' }}' }">
       <div class="side-card-label">Your feedback</div>
       {% if feedback_form.existing %}
         <p class="eyebrow mb-3">You rated this product — update it below.</p>
@@ -158,7 +161,7 @@ <h2 class="section-title mt-9 mb-3">Attachments</h2>
             <select name="requirement_id" x-model="req" class="field">
               <option value="">— None</option>
               {% for r in feedback_form.requirements %}
-                <option value="{{ r.id }}">{{ r.title }} ({{ r.kind.value }})</option>
+                <option value="{{ r.id }}" {% if r.id == (feedback_form.existing.requirement_id if feedback_form.existing else feedback_form.preselect_requirement_id) %}selected{% endif %}>{{ r.title }} ({{ r.kind.value }})</option>
               {% endfor %}
             </select>
           </div>
diff --git a/src/iceberg/web/feed.py b/src/iceberg/web/feed.py
index 16f94bf..e7c794d 100644
--- a/src/iceberg/web/feed.py
+++ b/src/iceberg/web/feed.py
@@ -1,5 +1,6 @@
 """Dissemination feed, preferences & help portal routes."""
 
+from datetime import timedelta
 from typing import Annotated
 
 from fastapi import (
@@ -14,6 +15,7 @@
     IntelLevel,
     Role,
     TagKind,
+    utcnow,
 )
 from ..services import feed as feed_service
 from ..services import tags as tag_service
@@ -24,6 +26,23 @@
     router,
 )
 
+def _buckets(items: list, now) -> list[tuple[str, list]]:
+    """Group feed items into Today / This week / Earlier, dropping empty
+    buckets. Computed server-side so the grouping survives without Alpine."""
+    today = now.date()
+    week_ago = today - timedelta(days=7)
+    grouped: dict[str, list] = {"Today": [], "This week": [], "Earlier": []}
+    for item in items:
+        created = item["event"].created_at.date()
+        if created >= today:
+            grouped["Today"].append(item)
+        elif created > week_ago:
+            grouped["This week"].append(item)
+        else:
+            grouped["Earlier"].append(item)
+    return [(label, rows) for label, rows in grouped.items() if rows]
+
+
 @router.get("/feed")
 def feed_view(request: Request, session: SessionDep, user: CurrentUser):
     items = feed_service.visible_items(session, user)
@@ -33,7 +52,12 @@ def feed_view(request: Request, session: SessionDep, user: CurrentUser):
     return templates.TemplateResponse(
         request,
         "feed.html",
-        {"user": user, "items": items, "unread_ids": unread_ids},
+        {
+            "user": user,
+            "items": items,
+            "unread_ids": unread_ids,
+            "buckets": _buckets(items, utcnow()),
+        },
     )
 
 
diff --git a/src/iceberg/web/reports.py b/src/iceberg/web/reports.py
index c22fbf9..9611c45 100644
--- a/src/iceberg/web/reports.py
+++ b/src/iceberg/web/reports.py
@@ -11,6 +11,7 @@
     BackgroundTasks,
     Form,
     HTTPException,
+    Query,
     Request,
     Response,
     status,
@@ -105,7 +106,11 @@ def _get_report(session: Session, report_id: int) -> Report:
 
 @router.get("/reports/{report_id}")
 def report_view(
-    report_id: int, request: Request, session: SessionDep, user: CurrentUser
+    report_id: int,
+    request: Request,
+    session: SessionDep,
+    user: CurrentUser,
+    requirement: Annotated[int | None, Query()] = None,
 ):
     report = ensure_visible(_get_report(session, report_id), user)
 
@@ -115,9 +120,17 @@ def report_view(
     received_feedback: list = []
     if user.role == Role.STAKEHOLDER:
         if feedback_service.was_delivered(session, report, user):
+            own = feedback_service.linked_requirements(report, user)
             feedback_form = {
                 "existing": feedback_service.existing_feedback(session, report, user),
-                "requirements": feedback_service.linked_requirements(report, user),
+                "requirements": own,
+                # "Mark satisfied →" in the feed deep-links here with the
+                # requirement it answers. Preselect it (only if it really is the
+                # reader's own, so the param can't surface anything else) — the
+                # verdict is still theirs to submit.
+                "preselect_requirement_id": next(
+                    (r.id for r in own if r.id == requirement), None
+                ),
             }
     elif user.role in (Role.ANALYST, Role.REVIEWER, Role.ADMIN):
         received_feedback = feedback_service.feedback_for_report(session, report)
diff --git a/tests/test_feed_delivery_reason.py b/tests/test_feed_delivery_reason.py
new file mode 100644
index 0000000..f6ab6b6
--- /dev/null
+++ b/tests/test_feed_delivery_reason.py
@@ -0,0 +1,198 @@
+"""Why a product reached a reader — the stakeholder feed's delivery reason.
+
+The reason is *derived* from the same rules that routed the product
+(``dissemination.matched_stakeholders``) rather than stored on the event, so
+these tests pin the derivation to those rules. A stored copy could drift; this
+cannot.
+"""
+
+import pytest
+from sqlmodel import Session, select
+
+from iceberg.models import (
+    AudienceGroup,
+    DisseminationEvent,
+    IntelLevel,
+    Notebook,
+    Report,
+    ReportStatus,
+    Requirement,
+    RequirementKind,
+    Tag,
+    TagKind,
+    User,
+)
+from iceberg.services import feed as feed_service
+
+
+@pytest.fixture
+def reader(engine):
+    with Session(engine) as session:
+        user = User(email="reader@example.com", display_name="Reader")
+        session.add(user)
+        session.commit()
+        session.refresh(user)
+        yield user.id
+
+
+def _report(session, **fields) -> Report:
+    notebook = session.exec(select(Notebook)).first()
+    if notebook is None:
+        author = session.exec(select(User)).first()
+        notebook = Notebook(title="Feed nb", owner_id=author.id)
+        session.add(notebook)
+        session.commit()
+        session.refresh(notebook)
+    report = Report(notebook_id=notebook.id, author_id=notebook.owner_id, title="Product", **fields)
+    session.add(report)
+    session.commit()
+    session.refresh(report)
+    return report
+
+
+def test_own_requirement_outranks_every_other_reason(engine, reader):
+    """A product that answers your own RFI is the strongest thing the feed can
+    say about it, even when a tag subscription also matched."""
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        tag = Tag(kind=TagKind.ACTOR, label="Volt Typhoon", slug="volt-typhoon")
+        session.add(tag)
+        session.commit()
+        user.tag_subscriptions.append(tag)
+        report = _report(session, intel_level=IntelLevel.STRATEGIC)
+        report.tags.append(tag)
+        req = Requirement(
+            title="What is the CNI risk?",
+            kind=RequirementKind.RFI,
+            stakeholder_id=user.id,
+        )
+        session.add(req)
+        session.commit()
+        report.requirements.append(req)
+        session.commit()
+
+        reason = feed_service.delivery_reason(user, report)
+        assert reason["kind"] == "requirement"
+        assert reason["requirement_id"] == req.id
+
+
+def test_someone_elses_requirement_is_not_your_reason(engine, reader):
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        other = User(email="other@example.com", display_name="Other")
+        session.add(other)
+        session.commit()
+        report = _report(session)
+        req = Requirement(
+            title="Their question",
+            kind=RequirementKind.RFI,
+            stakeholder_id=other.id,
+        )
+        session.add(req)
+        session.commit()
+        report.requirements.append(req)
+        session.commit()
+
+        assert feed_service.delivery_reason(user, report)["kind"] != "requirement"
+
+
+def test_tag_subscription_names_the_matching_entity(engine, reader):
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        subscribed = Tag(kind=TagKind.ACTOR, label="Sandworm", slug="sandworm")
+        ignored = Tag(kind=TagKind.SECTOR, label="Energy", slug="energy")
+        session.add_all([subscribed, ignored])
+        session.commit()
+        user.tag_subscriptions.append(subscribed)
+        report = _report(session)
+        report.tags.extend([ignored, subscribed])
+        session.commit()
+
+        reason = feed_service.delivery_reason(user, report)
+        assert (reason["kind"], reason["label"]) == ("tag", "Sandworm")
+
+
+def test_audience_group_membership_is_a_reason(engine, reader):
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        group = AudienceGroup(name="CNI leads", slug="cni-leads")
+        session.add(group)
+        session.commit()
+        user.audience_groups.append(group)
+        report = _report(session)
+        report.audience_groups.append(group)
+        session.commit()
+
+        reason = feed_service.delivery_reason(user, report)
+        assert (reason["kind"], reason["label"]) == ("audience", "CNI leads")
+
+
+def test_level_preference_and_the_no_preference_default(engine, reader):
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        report = _report(session, intel_level=IntelLevel.TACTICAL)
+
+        # No preference set = "send me everything".
+        assert feed_service.delivery_reason(user, report)["kind"] == "all"
+
+        user.preferred_intel_level = IntelLevel.TACTICAL
+        session.add(user)
+        session.commit()
+        reason = feed_service.delivery_reason(user, report)
+        assert reason["kind"] == "level"
+        assert "TACTICAL" in reason["label"]
+
+
+def test_feed_page_shows_the_reason_and_a_way_to_close_the_loop(client, login, engine):
+    email = login("STAKEHOLDER", email="feedreader@example.com")
+    with Session(engine) as session:
+        user = session.exec(select(User).where(User.email == email)).one()
+        report = _report(
+            session, intel_level=IntelLevel.STRATEGIC, status=ReportStatus.PUBLISHED
+        )
+        req = Requirement(
+            title="Ransomware outlook?",
+            kind=RequirementKind.RFI,
+            stakeholder_id=user.id,
+        )
+        session.add(req)
+        session.commit()
+        report.requirements.append(req)
+        session.add(DisseminationEvent(report_id=report.id, stakeholder_id=user.id))
+        session.commit()
+        req_id = req.id
+        report_id = report.id
+
+    page = client.get("/feed")
+    assert page.status_code == 200
+    assert "Answers your RFI" in page.text
+    assert f"/reports/{report_id}?requirement={req_id}#feedback" in page.text
+    # Time buckets replace the flat list.
+    assert "Today" in page.text
+
+
+def test_preselected_requirement_must_be_the_readers_own(client, login, engine):
+    """The ?requirement= deep-link only ever preselects a requirement the reader
+    owns *and* the report answers — it can never surface anything else."""
+    email = login("STAKEHOLDER", email="picky@example.com")
+    with Session(engine) as session:
+        user = session.exec(select(User).where(User.email == email)).one()
+        other = User(email="stranger@example.com", display_name="Stranger")
+        session.add(other)
+        session.commit()
+        report = _report(session, status=ReportStatus.PUBLISHED)
+        theirs = Requirement(
+            title="Someone else's secret question",
+            kind=RequirementKind.RFI,
+            stakeholder_id=other.id,
+        )
+        session.add(theirs)
+        session.commit()
+        report.requirements.append(theirs)
+        session.add(DisseminationEvent(report_id=report.id, stakeholder_id=user.id))
+        session.commit()
+        report_id, foreign_req_id = report.id, theirs.id
+
+    page = client.get(f"/reports/{report_id}?requirement={foreign_req_id}")
+    assert page.status_code == 200
+    assert "Someone else's secret question" not in page.text
diff --git a/tests/test_portal.py b/tests/test_portal.py
index 0432426..1cb402d 100644
--- a/tests/test_portal.py
+++ b/tests/test_portal.py
@@ -573,3 +573,74 @@ def test_analyze_phase_redirects_land_on_a_resolvable_anchor(client, login):
     page = client.get(f"/notebooks/{nb['id']}").text
     raw = re.search(r'id="notebook-phase-data">(.*?)</script>', page, re.S).group(1)
     assert json.loads(raw.replace("&#34;", '"'))[anchor] == "analyze"
+
+
+def test_analyst_rail_follows_the_intelligence_cycle(client, login):
+    login("ANALYST", email="cycle@example.com")
+    page = client.get("/").text
+    rail = page.split('class="rail-nav"', 1)[1].split("</nav>", 1)[0]
+    labels = ["Workspace", "Collect", "Produce", "Discover"]
+    positions = [rail.index(f">{label}</div>") for label in labels]
+    assert positions == sorted(positions), "rail groups are out of cycle order"
+    # Tasking is collection, not administration.
+    collect = rail.split(">Collect</div>", 1)[1].split(">Produce</div>", 1)[0]
+    assert "/requirements" in collect and "/notebooks" in collect
+
+
+def test_admin_rail_collapses_the_config_consoles_behind_the_hub(client, login):
+    """Eleven admin links become four; every collapsed console is still one ⌘K
+    keystroke away, so nothing became unreachable."""
+    login("ADMIN", email="railadmin@example.com")
+    page = client.get("/").text
+    rail = page.split('class="rail-nav"', 1)[1].split("</nav>", 1)[0]
+    admin = rail.split(">Administration</div>", 1)[1]
+    assert admin.count("<a href=") == 4
+    for collapsed in ("/admin/ai", "/admin/misp", "/admin/proxy", "/admin/webhook",
+                      "/admin/oidc", "/admin/config", "/admin/feeds"):
+        assert f'href="{collapsed}"' not in admin
+        assert f"'href': '{collapsed}'" in page or f'"href": "{collapsed}"' in page
+
+
+def test_every_command_palette_destination_resolves(client, login):
+    """The palette is the safety net for the collapsed rail — a dead entry in it
+    would strand a whole console."""
+    import json
+    import re
+
+    for role in ("ANALYST", "ADMIN", "STAKEHOLDER"):
+        login(role, email=f"palette-{role.lower()}@example.com")
+        page = client.get("/").text
+        raw = re.search(r"x-data='appShell\((\[.*?\])\)'", page, re.S).group(1)
+        items = json.loads(raw.replace("&#34;", '"').replace("&amp;", "&"))
+        assert items, f"{role} has an empty palette"
+        for item in items:
+            resp = client.get(item["href"], follow_redirects=False)
+            assert resp.status_code in (200, 303), f"{role} → {item['href']}"
+
+
+def test_editor_has_one_save_model_and_a_publish_tab(client, login):
+    """Autosave is the only save path (plus a <noscript> fallback), and the
+    lifecycle + render + transition all live under Publish rather than being
+    spread over a subhead and a separate tab."""
+    login("ANALYST", email="publish@example.com")
+    nb = client.post("/api/notebooks", json={"title": "Publish nb"}).json()
+    rid = client.post(
+        "/api/reports", json={"notebook_id": nb["id"], "title": "Publishable"}
+    ).json()["id"]
+
+    page = client.get(f"/reports/{rid}/edit").text
+    assert "Save draft" not in page
+    assert "All changes saved" in page
+    assert "<noscript><button form=\"reportform\"" in page
+    assert 'class="editor-subhead"' not in page
+
+    # Four verb-labelled tabs (+ Assist, which is conditional on AI being on).
+    tabs = page.split('class="dock-tabs"', 1)[1].split("</div>", 1)[0]
+    assert tabs.count("data-editor-tab") in (4, 5)
+    for label in (">Cite<", ">Classify<", ">Link<", ">Publish<"):
+        assert label in tabs
+    # Publish owns the lifecycle stepper, the renders, and the transition.
+    publish = page.split('id="editor-panel-publish"', 1)[1]
+    assert 'class="flow"' in publish
+    assert "Rendered products" in publish
+    assert "Submit for review" in page.split('class="dock-foot"', 1)[1]

From 8252706c0e68ebc627160b5dd55ee5eb1f9767b0 Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 20:33:59 +1000
Subject: [PATCH 2/4] fix(ux): feed must stay visible without JS, and must not
 claim a routing cause it cannot know (review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two review findings on the feed, both correct.

**Read rows were cloaked.** `[x-cloak]` is `display:none !important`, so putting
it on rows whose default state is *shown* meant a fully-read feed rendered empty
whenever Alpine failed to load — the exact opposite of the "complete server
render" this PR claimed. x-cloak belongs on content that should be hidden until
hydration; these must be visible before it. Removed from the rows and the
all-read bucket wrappers, with a test asserting no feed row carries it.

**The delivery reason claimed to be the routing cause; it could not be.**
`delivery_reason` presented "Answers your RFI" as why a product was delivered,
but requirements are not a predicate in `matched_stakeholders` — an RFI link is
never the reason something was routed. Worse, subscriptions, audience membership
and level preference were read from current mutable state, so a subscription
added after delivery would be shown as the historical cause.

Split into `delivery_context`, which reports two independent, present-tense
facts: whether the product answers a requirement the reader raised, and how it
matches their preferences as they stand ("Matches your Volt Typhoon interest").
Neither claims to reconstruct the publish-time decision, because the event
records none. Where that matters, the honest fix is to persist the match on
`DisseminationEvent` at publish time rather than infer harder here — noted in
the module docstring and ARCHITECTURE.md rather than left implicit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ARCHITECTURE.md                               |  2 +-
 CLAUDE.md                                     |  2 +-
 src/iceberg/services/feed.py                  | 81 ++++++++++--------
 src/iceberg/templates/feed.html               | 42 ++++-----
 ...elivery_reason.py => test_feed_context.py} | 85 ++++++++++++++-----
 vulture_whitelist.py                          |  4 +
 6 files changed, 134 insertions(+), 82 deletions(-)
 rename tests/{test_feed_delivery_reason.py => test_feed_context.py} (64%)

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 7dbb9b2..2bbf0b1 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -139,7 +139,7 @@ The portal is a **"command-center" design** — a light, print-like, authoritati
 
 **Dashboard (`dashboard.html`, `web/notebooks.py`).** Every KPI card is a link to the work behind it, and a **"Needs you now"** queue sits above the fold: the products waiting on a reviewer (for anyone who can review) ahead of the viewer's own drafts, capped at five. Both halves are existing lifecycle state (`Report.status` / `author_id`) surfaced as actions — no new model, no new query pattern. Notebook creation is demoted to a collapsed `<details>` so content leads.
 
-**Stakeholder feed (`feed.html`, `services/feed.delivery_reason`, `feedFilter` in `tags.js`).** Every row now says *why* it reached you: own-requirement ("Answers your RFI") → tag subscription → audience group → level preference, in that order. The reason is **re-derived** from the same rules `dissemination.matched_stakeholders` routes by, not stored on `DisseminationEvent` — no schema change, and no stored copy that can drift from the rule that actually applied. Rows are bucketed server-side into Today / This week / Earlier, and an All ⇄ Unread pill filters the already-rendered rows client-side (All is the default, so the server render is complete without Alpine). Closing the loop: a row whose reason is your own requirement offers **Mark satisfied →**, which deep-links to the product's `#feedback` card with that requirement preselected. It deliberately does *not* POST: the feedback endpoint requires a usefulness rating, and inventing one to save a click would put a verdict in the reader's mouth. The `?requirement=` parameter only ever preselects a requirement the reader owns *and* the report answers.
+**Stakeholder feed (`feed.html`, `services/feed.delivery_context`, `feedFilter` in `tags.js`).** A row states **two independent things**, both deliberately present-tense: whether the product answers a requirement the reader raised, and how it matches their routing preferences (tag subscription → audience group → level → all). They are separate because requirements are **not** a predicate in `dissemination.matched_stakeholders` — an RFI link is never *why* a product was routed, however useful it is to surface. Neither claims to reconstruct the publish-time routing decision: `DisseminationEvent` records no routing metadata, so a subscription added after delivery would make any "this is why it was sent" claim false. If historical fidelity is ever needed, the honest fix is to persist the match on the event at publish time, not to infer harder. Rows bucket server-side into Today / This week / Earlier; an All ⇄ Unread pill filters them with `x-show` and **no `x-cloak`** — cloaking content whose default state is *shown* would make a fully-read feed look empty whenever Alpine fails to load. Closing the loop: a row answering the reader's own requirement offers **Mark satisfied →**, deep-linking to the product's `#feedback` card with that requirement preselected. It deliberately does *not* POST — the feedback endpoint requires a usefulness rating, and inventing one would put a verdict in the reader's mouth. The `?requirement=` parameter only ever preselects a requirement the reader owns *and* the report answers.
 
 **Notebook phases (`notebook_detail.html`, `notebookTabs` in `tags.js`).** The notebook is worked in phases rather than scrolled end to end: the nine sections are grouped into **Collect** (sources, notes, files, figures, indicators) · **Analyze** (Diamond, ACH) · **Produce** (products) · **Trace** (requirements), and one phase's sections render at a time. The old anchor-link collection strip becomes the phase tab bar, carrying the same per-section counts. Nothing is removed or gated: the tabs are real `#section` anchors, the server renders Collect as the default (the other phases are `x-cloak`ed), and a `<noscript>` rule cancels `x-cloak` so a browser without Alpine still gets every section on one page — exactly the previous behaviour.
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 7ed0cb4..99d898c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -93,7 +93,7 @@ src/iceberg/
                    #    feeds [analyst RSS reader], discovery [search/taxonomy/audience], admin_audit, admin_feeds [RSS config],
                    #    admin_proxy [outbound proxy config], admin_oidc [multi-provider SSO config], admin_ai [AI provider config], admin_misp [MISP push config], admin_webhook [publication webhook config], admin_config [read-only effective-config viewer], admin_home [/admin Settings & integrations hub: status-pill tiles over the config pages])
   auth/oidc/       # multi-provider OIDC adapters (base StandardOIDCAdapter + registry + entra/authentik/auth0/okta claim extraction)
-  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers + delivery_reason: why a product reached this reader, re-derived from the dissemination match rules), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles; also `admin_hub_tiles` — the per-subsystem status pills behind /admin)
+  services/        # users (OIDC provisioning keyed on (auth_provider,issuer,sub)), oidc_settings (multi-provider config row + enabled_providers resolver, env-only secrets), notebooks, lifecycle, citations/rendering (reports), publication (immutable publish snapshots + atomic publish), requirements, attachments, figures, upload_validation (magic-byte content sniffing for uploads), source_grading (offline Admiralty heuristic), diamond, ach, iocs (light-touch IOC staging CRUD + AI-candidate normalisation: refang + IOCType constraint), product_html (shared report-HTML assembler + inline-embed registry), dissemination (feed delivery + email/webhook job enqueue), jobs (durable OutboxJob outbox: enqueue/lease/retry + worker pass), singleton (conflict-safe settings-row seeding), webhook_settings (publication-webhook config row, env-only token), email, feed (stakeholder feed helpers + delivery_context: the RFI link and the current preference match, reported separately — the event stores no publish-time routing metadata), feedback (intel-cycle feedback loop / RFI-satisfaction), feeds (inbound RSS ingestion: admin CRUD + bounded SSRF-guarded fetch/parse/sanitise + send-to-notebook), inbound (writer-triggered TAXII/MISP pull → notebook sources/IOCs), misp + misp_settings (outbound MISP push: report indicators → one MISP event, env-only API key), proxy + proxy_settings (global outbound-proxy resolution for httpx), tags, search (FTS dispatch + paginated search_page), attack (ATT&CK Navigator export + coverage matrix), attack_import (Enterprise ATT&CK bundle → TECHNIQUE tags), stix, taxii (read-only TAXII 2.1-shaped serving), related, audience (fail-closed audience-group mutations), ai + ai_settings (governed AI assist + admin-editable provider config row, env-only key, resolver overlays row onto Settings), tradecraft (advisory estimative-language lint), maturity (CTI program maturity & effectiveness dashboard), audit + audit_settings + siem (security audit logging → SIEM), effective_config (read-only resolved-config snapshot for /admin/config: provenance + secret-redaction + prod-guard validation + feature tiles; also `admin_hub_tiles` — the per-subsystem status pills behind /admin)
   rendering/       # markdown->HTML, report->PDF (typst), svg (shared diagram helpers: escape/fonts/wrap/placard)
   data/            # starter_tags.json (importable starter taxonomy)
   templates/       # Jinja2 + Alpine: base (command-center shell: rail+topbar+canvas+⌘K palette), _glyph, _macros,
diff --git a/src/iceberg/services/feed.py b/src/iceberg/services/feed.py
index 885b394..e58758d 100644
--- a/src/iceberg/services/feed.py
+++ b/src/iceberg/services/feed.py
@@ -9,60 +9,67 @@
 from . import reports as report_service
 
 
-class DeliveryReason(TypedDict):
-    """Why this product reached this reader — the answer to "why am I seeing
-    this?", which the feed could previously never give."""
+class FeedMatch(TypedDict):
+    """How this product **currently** matches the reader's routing preferences.
+
+    Deliberately *present tense*. ``DisseminationEvent`` stores no routing
+    metadata, so the publish-time cause cannot be reconstructed: a subscription
+    added after delivery, or a preference since changed, would make any
+    "this is why it was sent" claim false. What can be stated truthfully is the
+    relationship as it stands now, and that is what the chip says.
+
+    (If historical fidelity is ever needed — "why did this arrive in March?" —
+    the honest fix is to persist the match on the event at publish time, not to
+    infer harder here.)
+    """
 
-    kind: str  # requirement | tag | audience | level | all
+    kind: str  # tag | audience | level | all
     label: str
-    requirement_id: int | None
+
+
+class FeedContext(TypedDict):
+    """The two independent things a feed row can say about a product: how it
+    matches the reader's preferences, and whether it answers a requirement the
+    reader raised. They are separate on purpose — requirements are **not** a
+    predicate in ``dissemination.matched_stakeholders``, so an RFI link is never
+    the reason a product was routed, however useful it is to surface."""
+
+    match: FeedMatch
+    answers_requirement_id: int | None
 
 
 class FeedItem(TypedDict):
     event: DisseminationEvent
     report: Report
-    reason: DeliveryReason
+    context: FeedContext
 
 
-def delivery_reason(user: User, report: Report) -> DeliveryReason:
-    """Re-derive why ``report`` matched ``user``, in the order the reader cares
-    about it.
-
-    This mirrors the match rules in ``dissemination.matched_stakeholders`` (the
-    only place delivery is decided) rather than storing a second copy of them on
-    ``DisseminationEvent`` — no schema change, and no way for a stored reason to
-    drift from the rule that actually routed the product.
-    """
-    own = [r for r in report.requirements if r.stakeholder_id == user.id]
-    if own:
-        return {
-            "kind": "requirement",
-            "label": "Answers your RFI",
-            "requirement_id": own[0].id,
-        }
-    subscribed = {t.id: t for t in user.tag_subscriptions}
+def _match(user: User, report: Report) -> FeedMatch:
+    """The strongest current match, in the order ``matched_stakeholders`` gates
+    on: tag subscription → audience group → level preference → no preference."""
+    subscribed = {t.id for t in user.tag_subscriptions}
     matched_tags = [t for t in report.tags if t.id in subscribed]
     if matched_tags:
-        return {
-            "kind": "tag",
-            "label": matched_tags[0].label,
-            "requirement_id": None,
-        }
+        return {"kind": "tag", "label": f"Matches your {matched_tags[0].label} interest"}
     user_groups = {g.id for g in user.audience_groups}
     matched_groups = [g for g in report.audience_groups if g.id in user_groups]
     if matched_groups:
-        return {
-            "kind": "audience",
-            "label": matched_groups[0].name,
-            "requirement_id": None,
-        }
+        return {"kind": "audience", "label": f"For {matched_groups[0].name}"}
     if user.preferred_intel_level is not None:
         return {
             "kind": "level",
-            "label": f"Matched level · {report.intel_level.value}",
-            "requirement_id": None,
+            "label": f"Matches your {report.intel_level.value} preference",
         }
-    return {"kind": "all", "label": "All levels", "requirement_id": None}
+    return {"kind": "all", "label": "You receive all levels"}
+
+
+def delivery_context(user: User, report: Report) -> FeedContext:
+    """What the feed can honestly tell this reader about this product."""
+    own = [r for r in report.requirements if r.stakeholder_id == user.id]
+    return {
+        "match": _match(user, report),
+        "answers_requirement_id": own[0].id if own else None,
+    }
 
 
 def visible_items(session: Session, user: User) -> list[FeedItem]:
@@ -82,7 +89,7 @@ def visible_items(session: Session, user: User) -> list[FeedItem]:
             {
                 "event": event,
                 "report": report,
-                "reason": delivery_reason(user, report),
+                "context": delivery_context(user, report),
             }
         )
     return items
diff --git a/src/iceberg/templates/feed.html b/src/iceberg/templates/feed.html
index a15ef1e..e6b0884 100644
--- a/src/iceberg/templates/feed.html
+++ b/src/iceberg/templates/feed.html
@@ -39,14 +39,18 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
       {# A bucket with nothing unread disappears wholesale under the Unread
          filter, rather than leaving an empty heading and border behind. #}
       {% set unread_here = rows | selectattr('event.id', 'in', unread_ids) | list | length %}
-      <div{% if not unread_here %} x-show="!unreadOnly" x-cloak{% endif %}>
+      {# No x-cloak: these must be visible before (and without) hydration —
+         [x-cloak] is display:none !important, so cloaking content whose default
+         state is *shown* would make a fully-read feed look empty whenever
+         Alpine fails to load. #}
+      <div{% if not unread_here %} x-show="!unreadOnly"{% endif %}>
       <div class="eyebrow mt-6 mb-2">{{ label }}</div>
       <div class="rows">
         {% for item in rows %}
           {% set r = item.report %}
           {% set is_unread = item.event.id in unread_ids %}
-          {% set reason = item.reason %}
-          <div class="row"{% if not is_unread %} x-show="!unreadOnly" x-cloak{% endif %}>
+          {% set ctx = item.context %}
+          <div class="row"{% if not is_unread %} x-show="!unreadOnly"{% endif %}>
             {% if is_unread %}
               <span class="queue-dot is-unread" title="New"></span>
             {% else %}
@@ -55,24 +59,20 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
             <a href="/reports/{{ r.id }}" class="flex-1">
               <span class="row-title {% if is_unread %}font-bold{% endif %}">{{ r.title }}</span>
               <span class="flex items-center gap-2 mt-1 flex-wrap">
-                {# Why this reached you — derived from the same rules that routed it. #}
-                {% if reason.kind == 'requirement' %}
-                  <span class="tag tag--c is-info" title="This product answers a requirement you raised">
-                    <span class="dot"></span>{{ reason.label }}
-                  </span>
-                {% elif reason.kind == 'tag' %}
-                  <span class="tag tag--c is-info" title="You subscribe to this entity">
-                    <span class="dot"></span>{{ reason.label }}
-                  </span>
-                {% elif reason.kind == 'audience' %}
-                  <span class="tag" title="Delivered to your audience group">
-                    <span class="dot"></span>{{ reason.label }}
-                  </span>
-                {% else %}
-                  <span class="tag" title="Matched your intelligence-level preference">
-                    <span class="dot"></span>{{ reason.label }}
+                {# Two independent statements, both true in the present tense:
+                   whether this answers a requirement you raised (a fact about
+                   the product), and how it matches your routing preferences
+                   (a fact about your settings as they stand). Neither claims to
+                   be the publish-time routing decision — the event does not
+                   record one. #}
+                {% if ctx.answers_requirement_id %}
+                  <span class="tag tag--c is-info" title="This product addresses a requirement you raised">
+                    <span class="dot"></span>Answers your RFI
                   </span>
                 {% endif %}
+                <span class="tag" title="Why this is in your feed, based on your current preferences">
+                  <span class="dot"></span>{{ ctx.match.label }}
+                </span>
                 {{ m.level_badge(r.intel_level) }}
                 {{ m.tlp_badge(r.tlp) }}
               </span>
@@ -82,8 +82,8 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
                requires a usefulness rating, so this deep-links to the product's
                feedback card with the requirement preselected rather than
                posting a verdict the reader never gave. #}
-            {% if reason.kind == 'requirement' %}
-              <a href="/reports/{{ r.id }}?requirement={{ reason.requirement_id }}#feedback"
+            {% if ctx.answers_requirement_id %}
+              <a href="/reports/{{ r.id }}?requirement={{ ctx.answers_requirement_id }}#feedback"
                  class="btn btn--primary btn--sm">Mark satisfied →</a>
             {% else %}
               <a href="/reports/{{ r.id }}#feedback" class="btn-link">Give feedback</a>
diff --git a/tests/test_feed_delivery_reason.py b/tests/test_feed_context.py
similarity index 64%
rename from tests/test_feed_delivery_reason.py
rename to tests/test_feed_context.py
index f6ab6b6..e7e0c6a 100644
--- a/tests/test_feed_delivery_reason.py
+++ b/tests/test_feed_context.py
@@ -1,9 +1,11 @@
-"""Why a product reached a reader — the stakeholder feed's delivery reason.
-
-The reason is *derived* from the same rules that routed the product
-(``dissemination.matched_stakeholders``) rather than stored on the event, so
-these tests pin the derivation to those rules. A stored copy could drift; this
-cannot.
+"""What the stakeholder feed can honestly say about a delivered product.
+
+Two independent statements, both present-tense: whether it answers a requirement
+the reader raised (a fact about the product) and how it matches their routing
+preferences (a fact about their settings *now*). ``DisseminationEvent`` records
+no routing metadata, so neither claims to reconstruct the publish-time decision —
+these tests pin that separation, because conflating them is what makes a feed
+lie after a subscription changes.
 """
 
 import pytest
@@ -50,9 +52,10 @@ def _report(session, **fields) -> Report:
     return report
 
 
-def test_own_requirement_outranks_every_other_reason(engine, reader):
-    """A product that answers your own RFI is the strongest thing the feed can
-    say about it, even when a tag subscription also matched."""
+def test_requirement_and_match_are_reported_independently(engine, reader):
+    """An RFI link is *not* why a product was routed — requirements are not a
+    predicate in ``dissemination.matched_stakeholders``. So the RFI badge and
+    the preference match must both appear, not compete."""
     with Session(engine) as session:
         user = session.get(User, reader)
         tag = Tag(kind=TagKind.ACTOR, label="Volt Typhoon", slug="volt-typhoon")
@@ -71,12 +74,14 @@ def test_own_requirement_outranks_every_other_reason(engine, reader):
         report.requirements.append(req)
         session.commit()
 
-        reason = feed_service.delivery_reason(user, report)
-        assert reason["kind"] == "requirement"
-        assert reason["requirement_id"] == req.id
+        ctx = feed_service.delivery_context(user, report)
+        assert ctx["answers_requirement_id"] == req.id
+        # The tag subscription is still reported as the routing match.
+        assert ctx["match"]["kind"] == "tag"
+        assert "Volt Typhoon" in ctx["match"]["label"]
 
 
-def test_someone_elses_requirement_is_not_your_reason(engine, reader):
+def test_someone_elses_requirement_is_not_your_rfi(engine, reader):
     with Session(engine) as session:
         user = session.get(User, reader)
         other = User(email="other@example.com", display_name="Other")
@@ -93,7 +98,10 @@ def test_someone_elses_requirement_is_not_your_reason(engine, reader):
         report.requirements.append(req)
         session.commit()
 
-        assert feed_service.delivery_reason(user, report)["kind"] != "requirement"
+        assert (
+            feed_service.delivery_context(user, report)["answers_requirement_id"]
+            is None
+        )
 
 
 def test_tag_subscription_names_the_matching_entity(engine, reader):
@@ -108,8 +116,9 @@ def test_tag_subscription_names_the_matching_entity(engine, reader):
         report.tags.extend([ignored, subscribed])
         session.commit()
 
-        reason = feed_service.delivery_reason(user, report)
-        assert (reason["kind"], reason["label"]) == ("tag", "Sandworm")
+        match = feed_service.delivery_context(user, report)["match"]
+        assert match["kind"] == "tag"
+        assert "Sandworm" in match["label"]
 
 
 def test_audience_group_membership_is_a_reason(engine, reader):
@@ -123,8 +132,9 @@ def test_audience_group_membership_is_a_reason(engine, reader):
         report.audience_groups.append(group)
         session.commit()
 
-        reason = feed_service.delivery_reason(user, report)
-        assert (reason["kind"], reason["label"]) == ("audience", "CNI leads")
+        match = feed_service.delivery_context(user, report)["match"]
+        assert match["kind"] == "audience"
+        assert "CNI leads" in match["label"]
 
 
 def test_level_preference_and_the_no_preference_default(engine, reader):
@@ -133,14 +143,14 @@ def test_level_preference_and_the_no_preference_default(engine, reader):
         report = _report(session, intel_level=IntelLevel.TACTICAL)
 
         # No preference set = "send me everything".
-        assert feed_service.delivery_reason(user, report)["kind"] == "all"
+        assert feed_service.delivery_context(user, report)["match"]["kind"] == "all"
 
         user.preferred_intel_level = IntelLevel.TACTICAL
         session.add(user)
         session.commit()
-        reason = feed_service.delivery_reason(user, report)
-        assert reason["kind"] == "level"
-        assert "TACTICAL" in reason["label"]
+        match = feed_service.delivery_context(user, report)["match"]
+        assert match["kind"] == "level"
+        assert "TACTICAL" in match["label"]
 
 
 def test_feed_page_shows_the_reason_and_a_way_to_close_the_loop(client, login, engine):
@@ -196,3 +206,34 @@ def test_preselected_requirement_must_be_the_readers_own(client, login, engine):
     page = client.get(f"/reports/{report_id}?requirement={foreign_req_id}")
     assert page.status_code == 200
     assert "Someone else's secret question" not in page.text
+
+
+def test_read_rows_are_never_cloaked(client, login, engine):
+    """`[x-cloak]` is `display:none !important`, so cloaking a row whose default
+    state is *shown* would make a fully-read feed look empty whenever Alpine
+    fails to load. The Unread filter must degrade to "everything visible", not
+    "nothing visible"."""
+    email = login("STAKEHOLDER", email="nojs@example.com")
+    with Session(engine) as session:
+        user = session.exec(select(User).where(User.email == email)).one()
+        report = _report(session, status=ReportStatus.PUBLISHED)
+        report.title = "Already read product"
+        session.add(report)
+        session.add(DisseminationEvent(report_id=report.id, stakeholder_id=user.id))
+        session.commit()
+
+    client.get("/feed")  # first visit marks it read
+    page = client.get("/feed").text
+
+    import re
+
+    assert "Already read product" in page
+    # Scope to the feed rows: base.html's ⌘K overlay legitimately uses x-cloak
+    # (it *should* be hidden until hydration).
+    rows = re.findall(r'<div class="row"[^>]*>', page)
+    assert rows, "no feed rows rendered"
+    assert not [row for row in rows if "x-cloak" in row], (
+        f"a read feed row is cloaked and would vanish without Alpine: {rows}"
+    )
+    # The bucket wrapper around an all-read group must not be cloaked either.
+    assert 'x-show="!unreadOnly" x-cloak' not in page
diff --git a/vulture_whitelist.py b/vulture_whitelist.py
index 18c18fc..6843b98 100644
--- a/vulture_whitelist.py
+++ b/vulture_whitelist.py
@@ -120,6 +120,10 @@
 fetch_all_enabled_once  # unused function (src/iceberg/services/feeds.py)
 _.connect_unix_socket  # unused attribute (httpcore backend protocol method)
 
+# Feed row context fields — read only in templates/feed.html.
+answers_requirement_id  # unused variable (src/iceberg/services/feed.py)
+context  # unused variable (src/iceberg/services/feed.py)
+
 # /admin Settings-hub tile fields — read only in templates/admin_home.html.
 tone  # unused variable (src/iceberg/services/effective_config.py)
 meta  # unused variable (src/iceberg/services/effective_config.py)

From 0f24cbde960955bcc81bcd7d46ea74f62559df38 Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 20:49:58 +1000
Subject: [PATCH 3/4] fix(ux): a level preference changed since delivery is not
 a match (review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`_match` treated any non-null `preferred_intel_level` as a level match without
comparing it to the report, and then labelled the chip with the *report's*
level dressed as the reader's preference. A TACTICAL product delivered when
they preferred TACTICAL still read "Matches your TACTICAL preference" after
they switched to STRATEGIC — false twice over, and precisely the present-tense
claim the previous commit set out to eliminate.

Delivery is never retracted, so a product legitimately stays in the feed after
a preference change; the chip now names the product's level *and* the
preference it no longer satisfies ("TACTICAL · outside your current STRATEGIC
preference"). Regression test covers the changed, non-matching case.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/iceberg/services/feed.py | 18 +++++++++++++++---
 tests/test_feed_context.py   | 19 +++++++++++++++++++
 2 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/src/iceberg/services/feed.py b/src/iceberg/services/feed.py
index e58758d..4a2e2c6 100644
--- a/src/iceberg/services/feed.py
+++ b/src/iceberg/services/feed.py
@@ -23,7 +23,7 @@ class FeedMatch(TypedDict):
     infer harder here.)
     """
 
-    kind: str  # tag | audience | level | all
+    kind: str  # tag | audience | level | level_changed | all
     label: str
 
 
@@ -56,9 +56,21 @@ def _match(user: User, report: Report) -> FeedMatch:
     if matched_groups:
         return {"kind": "audience", "label": f"For {matched_groups[0].name}"}
     if user.preferred_intel_level is not None:
+        # Compare, don't assume. A product delivered under a preference the
+        # reader has since changed is still in their feed (delivery is not
+        # retracted), and claiming it "matches" would be exactly the false
+        # present-tense statement this split was meant to avoid.
+        if user.preferred_intel_level == report.intel_level:
+            return {
+                "kind": "level",
+                "label": f"Matches your {report.intel_level.value} preference",
+            }
         return {
-            "kind": "level",
-            "label": f"Matches your {report.intel_level.value} preference",
+            "kind": "level_changed",
+            "label": (
+                f"{report.intel_level.value} · outside your current "
+                f"{user.preferred_intel_level.value} preference"
+            ),
         }
     return {"kind": "all", "label": "You receive all levels"}
 
diff --git a/tests/test_feed_context.py b/tests/test_feed_context.py
index e7e0c6a..6983ab9 100644
--- a/tests/test_feed_context.py
+++ b/tests/test_feed_context.py
@@ -153,6 +153,25 @@ def test_level_preference_and_the_no_preference_default(engine, reader):
         assert "TACTICAL" in match["label"]
 
 
+def test_a_preference_changed_since_delivery_is_not_claimed_as_a_match(engine, reader):
+    """Delivery is never retracted, so a product stays in the feed after the
+    reader changes their level preference. Saying it "matches" would be the
+    exact false present-tense claim this split exists to prevent — it must name
+    the product's level *and* the preference it no longer satisfies."""
+    with Session(engine) as session:
+        user = session.get(User, reader)
+        report = _report(session, intel_level=IntelLevel.TACTICAL)
+        user.preferred_intel_level = IntelLevel.STRATEGIC
+        session.add(user)
+        session.commit()
+
+        match = feed_service.delivery_context(user, report)["match"]
+        assert match["kind"] == "level_changed"
+        assert "TACTICAL" in match["label"]      # what the product is
+        assert "STRATEGIC" in match["label"]     # what they now prefer
+        assert "Matches your" not in match["label"]
+
+
 def test_feed_page_shows_the_reason_and_a_way_to_close_the_loop(client, login, engine):
     email = login("STAKEHOLDER", email="feedreader@example.com")
     with Session(engine) as session:

From d87f7302baee95349662cf2ffdc556d139d0e622 Mon Sep 17 00:00:00 2001
From: Richard Hope <richmhope@gmail.com>
Date: Tue, 21 Jul 2026 20:58:58 +1000
Subject: [PATCH 4/4] fix(ux): the match chip's tooltip must not be causal
 either (review)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The label was fixed to stop claiming a `level_changed` product matches the
reader's preferences, but the tooltip it sits inside still read "Why this is in
your feed, based on your current preferences" — and for that state those
preferences would not deliver the product at all. The chip and its own tooltip
contradicted each other, restoring the causal claim one layer up.

Now "How this product relates to your current preferences": a description of a
relationship, not an explanation of a delivery. Covered by a test that renders
the changed-preference state end to end and asserts the causal phrasing is
absent from the page.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/iceberg/templates/feed.html |  6 +++++-
 tests/test_feed_context.py      | 26 ++++++++++++++++++++++++++
 2 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/src/iceberg/templates/feed.html b/src/iceberg/templates/feed.html
index e6b0884..29230dd 100644
--- a/src/iceberg/templates/feed.html
+++ b/src/iceberg/templates/feed.html
@@ -70,7 +70,11 @@ <h1 class="page-title mt-1">Intelligence feed</h1>
                     <span class="dot"></span>Answers your RFI
                   </span>
                 {% endif %}
-                <span class="tag" title="Why this is in your feed, based on your current preferences">
+                {# Non-causal wording on purpose: for a `level_changed` match the
+                   reader's current preferences would *not* deliver this product,
+                   so a "why this is in your feed" tooltip would contradict the
+                   label it sits on. #}
+                <span class="tag" title="How this product relates to your current preferences">
                   <span class="dot"></span>{{ ctx.match.label }}
                 </span>
                 {{ m.level_badge(r.intel_level) }}
diff --git a/tests/test_feed_context.py b/tests/test_feed_context.py
index 6983ab9..26723af 100644
--- a/tests/test_feed_context.py
+++ b/tests/test_feed_context.py
@@ -256,3 +256,29 @@ def test_read_rows_are_never_cloaked(client, login, engine):
     )
     # The bucket wrapper around an all-read group must not be cloaked either.
     assert 'x-show="!unreadOnly" x-cloak' not in page
+
+
+def test_feed_renders_the_changed_preference_state_without_a_causal_claim(
+    client, login, engine
+):
+    """The rendered mismatch state: the chip must say the product is outside the
+    reader's current preference, and nothing around it may claim those
+    preferences are why it arrived — they would not deliver it today."""
+    email = login("STAKEHOLDER", email="changed@example.com")
+    with Session(engine) as session:
+        user = session.exec(select(User).where(User.email == email)).one()
+        report = _report(
+            session, intel_level=IntelLevel.TACTICAL, status=ReportStatus.PUBLISHED
+        )
+        report.title = "Delivered before the switch"
+        session.add(report)
+        user.preferred_intel_level = IntelLevel.STRATEGIC
+        session.add(user)
+        session.add(DisseminationEvent(report_id=report.id, stakeholder_id=user.id))
+        session.commit()
+
+    page = client.get("/feed").text
+    assert "Delivered before the switch" in page
+    assert "outside your current STRATEGIC preference" in page
+    assert "Why this is in your feed" not in page
+    assert "How this product relates to your current preferences" in page