fix: implement automated audit remediations

docs/branch-review-ledger.md

@@ -734,6 +734,7 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-24 | cursor/search-performance-review-4ee9 (PR #1134) | 9311d01212fe42bd41ffb22a83bfa51f1a4d19f2 | Run PR re-sync sweep | Re-check: CONFLICTING on use-differential-catalog.ts (+ related). Not cheap; merge aborted, no push. | merge origin/main and/or conflict re-check only; no provider-backed checks run |
 | 2026-07-24 | cursor/comprehensive-repo-review-ledger-d9a1 (PR #1150) | 60a3c3a83a31e65ec2759540629687e7113e2489 | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green, 0 threads. After: merged origin/main cleanly (ledger auto-merge); pushed 60a3c3a83. Threads: none. Residual: CI re-running. | merge origin/main only; no provider-backed checks run |
 | 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138) | ff4b293d95f922e70ebf5ee9b0c156c41a8bff3b | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green, 0 threads. RAG impact: no retrieval behaviour change — PR is client deferred-search/UI only (no src/lib/rag/**). After: merged origin/main; conflict resolved in src/components/ui/sheet.tsx by keeping main restoreTimersRef/unmountingRef focus-restore fix; pushed ff4b293d9. Threads: none. | merge origin/main only; no provider-backed checks run |
+| 2026-07-24 | codex/audit-remediation-final (PR #1158) | 4bfaf2a77a5c8cc0e6c48ee27a72a2faad203dd3 | Run PR sweep: CI fix + threads + drift | Before: behind main by 64. After: merged origin/main cleanly (no conflicts). Threads: non-P0/P1 left open. CI not waited. | merge origin/main only; thread scan read-only; no provider-backed checks run |
 | 2026-07-24 | implement-audit-viewport-fixes (PR #1140) | 47ebd3d20184875d80bf192144b614ec58d48e08 | Run PR sweep: CI fix + threads + drift | Before: already contained origin/main. After: ledger-only record. Threads: non-P0/P1 left open. CI not waited. | merge origin/main only; thread scan read-only; no provider-backed checks run |
 | 2026-07-24 | codex/hydration-fixes (PR #1131) | 6c093e927d7b4f7261fb78160d85bdc407853001 | Run PR sweep: CI fix + threads + drift | Before: already contained origin/main. After: ledger-only record. Threads: non-P0/P1 left open. CI not waited. | merge origin/main only; thread scan read-only; no provider-backed checks run |
 | 2026-07-24 | codex/hydration-fixes (PR #1131) | f5451102cc0f157d0f63a3679e532d02ae85918c | Run PR babysit: CI/threads/drift | Run PR babysit: Codex P2 theme cookie validated+fixed + thread resolved. Before: CI mostly green, 1 unresolved Codex P2 (3644928239; prior Codex claim not on this branch). After: cookie fallback in THEME_BOOTSTRAP_SCRIPT + useTheme write/clear + shared keys; reply+resolve PRRT_kwDOSh5Fis6TiAhF. Not behind main. | npx vitest run tests/theme.test.ts PASS (9/9). No provider-backed checks run. |
@@ -752,6 +753,7 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-24 | codex/query-ribbon-search-headings (PR #1166) | 37cfa5553ccb784ee5e9f47ded1ad69914c053ed | Run PR babysit: CI/threads/drift | Final HEAD after merge origin/main + ledger bookkeeping. 0 unresolved threads; no Bugbot actionable findings; required CI re-running on this SHA. | merge origin/main; no provider-backed checks run. |
 | 2026-07-24 | codex/query-ribbon-search-headings (PR #1166) | 9eac2e252bcc5c548aa919b69faeb79b9ff7d2cf | Run PR babysit: CI/threads/drift | Merged origin/main; Codex ledger-SHA P2 dispositioned+resolved (append-only supersede already in 9eac2e252). 0 unresolved threads. | merge origin/main; thread resolve only; no provider-backed checks run. |
 | 2026-07-24 | remediate-audit-system-issues (PR #1160) | bdf530fc8c6faaa4491c510396b47872fc39bf25 | Run PR sweep: CI fix + threads + drift | second re-merge after main moved to 2e68888f3 during first push; clean ort merge (ledger + layout.tsx); taskkill /T retained; sitemap prettier retained | merge only; no provider-backed checks run |
+| 2026-07-24 | codex/audit-remediation-final (PR #1158) | 78fab6be0c43cf5e92361315399d393ee7742f2e | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean (no RAG conflict markers). NOTE: PR still intentionally adds deterministic broad_summary queryClass shortcut in src/lib/rag/rag.ts (+17) — RAG impact behaviour change, not dropped during merge. | merge origin/main and/or conflict re-check only; no provider-backed checks run |
 | 2026-07-24 | implement-audit-viewport-fixes (PR #1140) | a541b75c0e49f84125fc7e5d114cd9fc32d1a694 | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean. | merge origin/main and/or conflict re-check only; no provider-backed checks run |
 | 2026-07-24 | codex/hydration-fixes (PR #1131) | a29b0d778b542932972aa6035ee115b91e49025a | Run PR re-sync sweep | Before: CONFLICTING + Static PR FAIL (suppressHydrationWarning on skip link). After: merged origin/main; removed illegal suppressHydrationWarning from skip-to-content anchor; theme fix already on PR head b4b5f21b9. CI re-running. | merge origin/main and/or conflict re-check only; no provider-backed checks run |
 | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | d0a96caa01b90dffa40e60770b7700f36e8ba43f | Run PR re-sync sweep | Before: CONFLICTING @8adaaf229. After: merged origin/main clean (ort). CI re-running. Threads: not re-triaged. | merge origin/main and/or conflict re-check only; no provider-backed checks run |

scripts/guard-next-build.mjs

@@ -1,10 +1,24 @@
 #!/usr/bin/env node
 import http from "node:http";
 import path from "node:path";
+import os from "node:os";
 import { fileURLToPath } from "node:url";
 import { appName, localProjectId, projectPortEnd, stableProjectPort } from "../src/lib/local-server-utils.mjs";
 
 const projectRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+const totalRamBytes = os.totalmem();
+const tenGiB = 10 * 1024 * 1024 * 1024;
+if (totalRamBytes < tenGiB) {
+  console.error(
+    [
+      `Host system has less than 10 GiB of total RAM (${(totalRamBytes / 1024 / 1024 / 1024).toFixed(1)} GiB).`,
+      "Building Next.js locally requires an 8 GiB Node heap. Your system may crash or OOM during the build.",
+      "If you are using Docker Desktop, increase the memory limit in settings.",
+    ].join("\n"),
+  );
+  process.exit(1);
+}
 const expectedProjectId = localProjectId(projectRoot);
 const identityPath = "/api/local-project-id";
 const timeoutMs = 350;

src/app/globals.css

@@ -482,12 +482,14 @@ body {
   overscroll-behavior-x: none;
 }
 
-/* Interactive element defaults */
-button,
-input,
-textarea,
-select {
-  font: inherit;
+@layer base {
+  /* Interactive element defaults */
+  button,
+  input,
+  textarea,
+  select {
+    font: inherit;
+  }
 }
 
 /*

src/lib/env.ts

@@ -34,6 +34,7 @@ const envSchema = z.object({
   // with no destination configured accepts the event and reports it undelivered.
   SLACK_WEBHOOK_URL: z.string().url().optional(),
   DISCORD_WEBHOOK_URL: z.string().url().optional(),
+  WORKER_FAILURE_WEBHOOK_URL: z.string().url().optional(),
   NEXT_PUBLIC_LOCAL_NO_AUTH: z.enum(["true", "false"]).optional().default("false"),
   LOCAL_NO_AUTH: z.enum(["true", "false"]).optional().default("false"),
   LOCAL_NO_AUTH_OWNER_EMAIL: z.string().optional(),

src/lib/rag/rag.ts

@@ -1319,6 +1319,23 @@ export async function analyzeQueryWithClassifierFallback(
     analysis = { ...analysis, corpusGrounding: "inconclusive" };
   }
 
+  // Finding #2: Deterministic fallback routing for short clinical queries.
+  // Short, bare clinical search queries (e.g., "bipolar disorder", "anorexia management")
+  // can be misclassified by the generative LLM. We route them deterministically.
+  if (
+    analysis.needsClassifierFallback &&
+    analysis.corpusGrounding !== "inconclusive" &&
+    query.trim().split(/\s+/).length <= 4 &&
+    (analysis.documentTitleTerms.length > 0 || analysis.canonicalTerms.length > 0)
+  ) {
+    return {
+      ...analysis,
+      queryClass: "broad_summary",
+      needsClassifierFallback: false,
+      reasons: uniqueTextValues([...analysis.reasons, "deterministic_short_clinical_query_fallback"], 12),
+    } satisfies ClinicalQueryAnalysis;
+  }
+
   if (!analysis.needsClassifierFallback || !env.OPENAI_API_KEY) return analysis;
 
   const memoKey = classifierVerdictMemoKey(query, analysis);

supabase/migrations/20260724000000_optimize_rpc_work_mem.sql

@@ -0,0 +1,13 @@
+set search_path = public, extensions, pg_temp;
+
+-- Hybrid RPCs
+ALTER FUNCTION public.match_document_chunks_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_embedding_fields_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_index_units_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_memory_cards_hybrid_v2(extensions.vector, text, integer, double precision, uuid[], uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_memory_cards_hybrid(extensions.vector, text, integer, double precision, uuid[], uuid) SET work_mem = '64MB';
+
+-- Lexical RPCs
+ALTER FUNCTION public.match_document_chunks_text(text, integer, uuid[], uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_lookup_chunks_text(text, uuid[], integer, uuid) SET work_mem = '64MB';
+ALTER FUNCTION public.match_document_table_facts_text(text, integer, uuid[], uuid) SET work_mem = '64MB';

tests/corpus-grounding.test.ts

@@ -324,9 +324,10 @@ describe("analyzeQueryWithClassifierFallback corpus grounding", () => {
       },
     }));
     const { rag, analyzeClinicalQuery } = await loadRag({ classifierMock, rows: [] });
-    const analysis = analyzeClinicalQuery("bipolar disorder");
+    const query = "bipolar disorder long term care";
+    const analysis = analyzeClinicalQuery(query);
 
-    const result = await rag.analyzeQueryWithClassifierFallback("bipolar disorder", analysis);
+    const result = await rag.analyzeQueryWithClassifierFallback(query, analysis);
 
     expect(classifierMock).toHaveBeenCalledTimes(1);
     expect(result.queryClass).toBe("broad_summary");

tests/rag-answer-fallback.test.ts

@@ -887,7 +887,7 @@ describe("RAG structured-output fallback", () => {
     const { answerQuestionWithScope } = await import("../src/lib/rag/rag");
 
     const answer = await answerQuestionWithScope({
-      query: "what is bulimia nervosa",
+      query: "what is bulimia nervosa in adults",
       ownerId: undefined,
       logQuery: false,
       skipCache: true,
@@ -1721,7 +1721,7 @@ describe("RAG structured-output fallback", () => {
 
     const { answerQuestionWithScope } = await import("../src/lib/rag/rag");
     const answer = await answerQuestionWithScope({
-      query: "what is bulimia nervosa",
+      query: "what is bulimia nervosa in adults",
       ownerId: undefined,
       logQuery: false,
       skipCache: true,

tests/rag-classifier-memo.test.ts

@@ -40,9 +40,9 @@ function classifierResponse(overrides: Record<string, unknown> = {}) {
 function fallbackQueryAnalysis(
   analyzeClinicalQuery: (typeof import("../src/lib/clinical-search"))["analyzeClinicalQuery"],
 ) {
-  // A bare condition query is exactly the class that needs the LLM fallback (deterministic
-  // confidence below 0.58 with class unsupported_or_general) — the finding #11 shape.
-  const query = "bipolar disorder";
+  // A bare condition query above the short-query deterministic fallback threshold still needs
+  // the LLM fallback (confidence below 0.58 with class unsupported_or_general).
+  const query = "bipolar disorder long term care";
   const analysis = analyzeClinicalQuery(query);
   expect(analysis.needsClassifierFallback).toBe(true);
   return { query, analysis };

worker/main.ts

@@ -1612,11 +1612,22 @@ async function processJob(job: JobRow) {
     if (!atomicReindex) await resetDocumentIndex(job.document_id);
     const buffer = await downloadDocument(job.documents.storage_path);
     await updateJobProgress(job.id, { stage: "extracting text/images", progress: 20 });
-    extracted = await extractDocument({
-      buffer,
-      fileName: job.documents.file_name,
-      mimeType: job.documents.file_type,
-    });
+    // Finding #7: Ingestion Worker Heartbeat. Prevent stale locks during long PDF extractions.
+    const heartbeat = setInterval(
+      () => {
+        updateJobProgress(job.id, { stage: "extracting text/images", progress: 20 }).catch(() => {});
+      },
+      Math.min(60_000, jobLeaseHeartbeatMs),
+    );
+    try {
+      extracted = await extractDocument({
+        buffer,
+        fileName: job.documents.file_name,
+        mimeType: job.documents.file_type,
+      });
+    } finally {
+      clearInterval(heartbeat);
+    }
 
     await updateJobProgress(job.id, { stage: "saving pages", progress: 32 });
     const pageRows = buildDocumentPageRows(job.document_id, extracted);
@@ -1936,7 +1947,20 @@ async function main() {
   }
 }
 
-main().catch((error) => {
+main().catch(async (error) => {
   console.error("Clinical KB worker stopped unexpectedly", safeErrorLogDetails(error));
+  if (env.WORKER_FAILURE_WEBHOOK_URL) {
+    try {
+      await fetch(env.WORKER_FAILURE_WEBHOOK_URL, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          text: `CRITICAL: Clinical KB worker stopped unexpectedly. Error: ${error instanceof Error ? error.message : String(error)}`,
+        }),
+      });
+    } catch (webhookError) {
+      console.error("Failed to dispatch worker failure webhook", safeErrorLogDetails(webhookError));
+    }
+  }
   process.exitCode = 1;
 });