Rules get the last word on every model-drafted plan

The problem

A wellness plan can never say cure, heal, or patient. It can never name a protocol or a practitioner from the knowledge base. A rule in the prompt gets you most of the way, and most of the way is not good enough when the plan goes out under a clinic's name. The model also sometimes refuses, or returns a fragment, and the clinic still needs a plan.

What we built

Three ordered passes run on every plan after synthesis and before it is stored, so the PDF only ever renders scrubbed text. The first rewrites ten banned terms with case-preserving replacements and is always on. The second replaces named protocols with a plain description of what they are. The third replaces a practitioner's name in every form it shows up in a plan. The second and third are configured per clinic. The practitioner-name pass also runs on the intake's free text before it reaches a prompt, and all three re-run on every staff edit. A hit is rewritten in place, never blocked; the counts are stored with the plan version and the activity row says how many were rewritten.

When the model refuses or returns a fragment, a detector flags it, a retry ladder regenerates with progressively less sensitive context, and a deterministic fallback assembles a plan from the briefs if every attempt fails. Every outcome is recorded, and a partial fallback marks the plan "review recommended."

The proof is a golden set: ten intakes, each paired with a draft deliberately seeded with the exact names and protocols the scrubber must remove. Sixty-two test cases assert zero leaks. None of them call a model, so the guardrail is tested for free and the result is the same every time.