The claim receipt: news once, and a fold that keeps it (§17)

[cevheri]

The claim summary had stopped being a receipt. The complaint was that the block
on the home screen was left-aligned and cluttered, and that meeting it on
arrival was uncomfortable. It measured, on the deployed build at 1440×900:

CSS written for .hl-claim-shell	none — padding: 0, max-width: none, no border, transparent
its box	x: 0, width: 1440, while the page column starts at x≈143
its place	y: 1165, with the footer at 1092–1165 — below the footer, and below the fold
TWO RECORDS	clipped at the viewport edge
DISMISS	underneath the fixed mascot

Those are five layout faults. The sixth changed what this section is about.

The panel was not a receipt — it came back on every full page load

AccountSync's own comment already said it: "this effect runs on EVERY mount
with a session, so every page load with an existing account row takes the
merged branch." That branch called setSummary unconditionally. Measured,
with a real session and a real magic link:

signed in                → RECORD CLAIMED · NO RECORD IN ACCOUNT   (news, correct)
reload 1                 → RECORD CLAIMED · TWO RECORDS · here 1 · account 1 · in both 1 · merged 1
reload 2                 → the same
reload 3                 → the same
full load of /sheets/    → the same

here == account == shared == merged is not an event, it is a state. DISMISS
silenced only the current document, and dismissing destroyed the reader's only
account of what had happened to their own signatures.

The identity lines reported a provenance, not a change

claim.ts states the rule — "stated only where they changed something the
reader can see. A rule that fired invisibly is not news." — and did not keep
it. sourceOf (claim.ts:188) returns 'account' whenever the merged value
equals the account's, even when this browser held the identical value, so
The name on the record is the one your account holds. printed on every load.
markChanged was already a real change test; two fields were not.

What ships

claimIsNews — eight terms, every one a change test. The steady state is
not news, so nothing is written and nothing is shown. nameChanged and
roleChanged join markChanged, and the two copy lines move onto them.

meta.lastClaim — one slot, written only when the claim was news, by one
writer (noteClaim, which stamps no day: signing in is not a day the reader
worked). mergeRecords already resolves meta local-wins, so a receipt is a
fact about this browser and never travels; carriesNothing ignores it, so a
receipt alone is not a record; an erase drops it.

One line, in the page column — RECORD CLAIMED · 1 MERGED · 0 LOST · DETAILS, rendered by PageShell inside the column every page's content is in.
Navigation closes it; there is no dismiss button, because nothing is lost by
closing it. When something is unaccounted for (claimNeedsExport) it does not
collapse: it keeps the sentences and the export affordance.

/profile/ › Last claim, the register's eleventh fold — the whole summary,
for as long as the record exists. Its closed reading and the arrival line come
from one function (§16.4.2), and DETAILS opens the fold rather than landing
on a closed one.

Two defects from §16, found on the way

• The credentialed e2e suite has been unrunnable since The drafter block and the register: /profile/, rebuilt (§16) #12. getByText(<email>)
  on /profile/ resolves to two elements — SignInPanel's identity line and
  AuthPanels' session readout — a strict-mode violation in test 2 of a
  serial describe. Measured at this branch's merge base: 1 passed, 1
  failed, 9 did not run. The assertion now names the surface it means.
• One manager-view test (E2E Manager) fails behind it. Measured pre-existing:
  identical at the merge base with only the fix above applied, and twice here.
  Its cause is unknown and one hypothesis was disproved by probing the live
  schema — a profile-row upsert that omits display_name does not destroy
  it. Marked test.fixme with all of that recorded, so the serial chain reaches
  the tests behind it; §17's own two gates now execute in a whole-file run for
  the first time.

Gates

• npm run typecheck — clean
• npm test — 97 files, 2894 tests
• npm run build — 57 pages; SITE_BASE_PATH=/ai-engineering-bazaar npm run build — 57 pages
• npm run test:e2e — 368 passed, 17 skipping cleanly
• E2E_ACCOUNTS=1 accounts.spec.ts — 13 run, 12 passed, 1 fixme, 0 "did not run"

Mutation-proven rather than asserted: replacing nameChanged with the old
provenance turns the steady-state tests red; disabling the news guard turns the
reload gate red on reload 1 reported a claim that moved nothing; freezing
ClaimReading turns §16.4.1's per-row table red on the claim row; offsetting
.hl-receipt turns the alignment gate red. Each was applied, observed, and
restored.

Schema

meta gains one nullable field, lastClaim. A widening, not a migration:
coerceRecordData defaults it and reads it defensively (a bad count or an
unknown outcome loses the receipt, never the record; the three provenance
fields, which nothing reads, default rather than reject), records written before
it still load, and carriesNothing does not consult it. No table, no policy, no
RLS change.

Known and left

• tests/e2e/accounts.spec.ts:161's comment states the wrong reason for a
  correct assertion — the account is not signing in for the first time there.
• ClaimSummary's heading='p' branch and the needs-export wrapper are
  exercised by no test; three lines of renderToStaticMarkup would pin both.
• The action-needed receipt state has an honest marker but no browser gate.
• Outside §17: sync.ts:498-504 pushes an empty envelope on the adopted
  branch, creating a record_state row for a reader who signed in with nothing.

Spec: §17, docs/superpowers/specs/2026-09-02-lms-claim-receipt-design.md