diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md index c13f00fd6..ba22e6ccc 100644 --- a/docs/branch-review-ledger.md +++ b/docs/branch-review-ledger.md @@ -23,22 +23,22 @@ This file is append-only. Never rewrite or delete an existing review record; app | Date | Branch or ref | Reviewed HEAD | Scope | Outcome | Checks | | ---------- | -------------------------------------------------------- | ---------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 2026-07-24 | `mobile-ergonomics-fixes` | `35e96844fc8bd94e7737229cb01174d1a0f9689f` | PR #1156 mobile touch ergonomics review | APPROVE. Found and fixed two findings: a P1 invalid CSS calc syntax breaking horizontal scroll masks (`calc(100%-1.5rem)` -> `calc(100%_-_1.5rem)`), and a P2 transform collision in `globals.css` where global `scale(0.97)` active states overrode Tailwind's composite variables (reverted to `translateY(1px)`). The `modal-landscape-container` safe-area padding correctly uses `max(1rem, var(--safe-area-left))` so it is safe on portrait. No further P0-P2 findings. | Local static inspection and visual review of DOM tree. Heavy tests were locked out by concurrent verification in `remediate-audit-system-issues`. Hosted CI tests will execute automatically on PR push. No provider actions were run. | -| 2026-07-24 | `main` / `037b4808100946f96aee28b8ff51939ae2986851` | `037b4808100946f96aee28b8ff51939ae2986851` | frontend-ui review: clinical-dashboard sidebar streamlining, global-search-shell, mobile-composer-reserve, globals.css forced-colors/reduced-motion, evidence-panels aria, answer-result-surface, visual-evidence-tabs DOM tests | APPROVE with notes (P2 closed on `cursor/frontend-ui-review-docs-e8d9`). No P0/P1. One P2 was docs-only: `docs/codebase-index.md` mode-home list omitted `/therapy-compass`, `/dsm`, `/specifiers`, and `/factsheets` while `isStandaloneModeHome` already handles them — fixed in the follow-up docs PR. What holds: sidebar streamlining (`primarySidebarToolIds` Set) is correct; global reduced-motion CSS covers `animate-spin`; forced-colors token remap is comprehensive; mobile-composer-reserve and overlay CSS contracts intact; tab/tabpanel ARIA associations pass in jsdom; icon-only collapsed rail links carry `aria-label`+`title`; lucide-react defaults SVG `aria-hidden="true"`. | Full unit suite 3261/3264 passed (3 pre-existing skips); typecheck clean; lint clean; static read of globals.css forced-colors/reduced-motion, overlay contracts, aria patterns, and mobile-composer-reserve. Docs mode-home list aligned to `isStandaloneModeHome`. No live Supabase/OpenAI/Railway mutation. | +| 2026-07-24 | `main` / `037b4808100946f96aee28b8ff51939ae2986851` | `037b4808100946f96aee28b8ff51939ae2986851` | frontend-ui review: clinical-dashboard sidebar streamlining, global-search-shell, mobile-composer-reserve, globals.css forced-colors/reduced-motion, evidence-panels aria, answer-result-surface, visual-evidence-tabs DOM tests | APPROVE with notes (P2 closed on `cursor/frontend-ui-review-docs-e8d9`). No P0/P1. One P2 was docs-only: `docs/codebase-index.md` mode-home list omitted `/therapy-compass`, `/dsm`, `/specifiers`, and `/factsheets` while `isStandaloneModeHome` already handles them ??? fixed in the follow-up docs PR. What holds: sidebar streamlining (`primarySidebarToolIds` Set) is correct; global reduced-motion CSS covers `animate-spin`; forced-colors token remap is comprehensive; mobile-composer-reserve and overlay CSS contracts intact; tab/tabpanel ARIA associations pass in jsdom; icon-only collapsed rail links carry `aria-label`+`title`; lucide-react defaults SVG `aria-hidden="true"`. | Full unit suite 3261/3264 passed (3 pre-existing skips); typecheck clean; lint clean; static read of globals.css forced-colors/reduced-motion, overlay contracts, aria patterns, and mobile-composer-reserve. Docs mode-home list aligned to `isStandaloneModeHome`. No live Supabase/OpenAI/Railway mutation. | | 2026-07-24 | PR #1134 / `cursor/search-performance-review-4ee9` | `2a8e045f4a7179ea6fc9b81b1b2173e4c932617e` | Babysit closeout / merge readiness | MERGE-READY for product scope once exact-head required checks finish after final main sync. Fixed: Bugbot pathname searchMode (Compiler-safe previous-state sync); docs index; PR_POLICY_BODY/governance; maintainability extract; prescribing Safety filters (no fields=index); Sheet teardown document guard. Unresolved threads: none. Residual: human approving review; title still stale (gh/ManagePullRequest cannot edit); main may move again. | Hosted on prior tip 973d5d88: PR policy/Static/Unit/Build/Production UI/PR required all SUCCESS. Final sync pushed; awaiting exact-head recheck. No OpenAI/live Supabase writes. | -| 2026-07-24 | `cursor/search-performance-review-4ee9` / PR #1134 | 76d47871c44c607f942a683351378230173dcbe3 | Search performance findings remediation (prescribing, differentials, typeahead docs timeout, shared shell, answer rate-limit fallback) | FIXED. P1 prescribing catalogue now debounces (250 ms), aborts in-flight fetches, and uses `fields=index`. Differentials catalogue + evidence search abort/debounce. Universal documents typeahead timeout 6 s→750 ms (RAG impact: no retrieval behaviour change — typeahead timeout only). Shared `(search-app)` layout keeps GlobalSearchShell mounted across mode homes. Answer rate-limit fails closed only in production; development uses in-memory fallback when durable RPC is unavailable. | Focused Vitest 362 via test:focused; api-rate-limit/search-shell/universal/route/site-map suites green; `npm run ensure` smoke 200 on mode homes; `/api/answer/stream` 200 after fallback. No OpenAI spend beyond local answer stream smoke; no live eval/soak. | -| 2026-07-24 | `main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | Search performance across modes (load + typeahead + submit; local ensure) | CHANGES REQUESTED / findings. No P0. P1: Prescribing `useMedicationCatalog(query)` refetches the full ~2.5–2.9 MB medication catalogue on every keystroke without debounce, abort, or `fields=index` (~25× larger than index). P2: differentials catalogue + evidence `/api/search` lack abort/debounce; universal typeahead `tookMs` dominated by empty live documents domain (~130–340 ms); cross-namespace mode switches remount the search shell; Answer submit returns 503 `rate_limit_unavailable` when durable limiter is down (fail-closed). Mode HTML load medians ~40–75 ms; typeahead wall ~160–180 ms (`ssri`) / ~350–400 ms (`agitation im lorazepam`) + 250 ms client debounce; catalogue submits (differentials) ~45 ms; document `/api/search` demo-degraded ~230–430 ms. Highest residual live risk: cold hybrid RPC tails (docs #25), not re-measured with soak/eval. | `npm run ensure` → http://localhost:4461; `/api/local-project-id` Clinical KB; paced universal typeahead across 13 modes × 2 queries (Server-Timing); `/api/search` + `/api/medications` (+`fields=index`) + differentials APIs + registry payload sizes; NDJSON vs JSON first-byte; browser walkthrough of 13 mode homes; static review of ClinicalDashboard / universal-search / medication+differential hooks. No OpenAI generation, no `eval:retrieval:latency`, no soak, no hosted CI. Environment had Supabase secrets so universal ran live (`publicAccess`); `/api/search` degraded to demo (`supabase_api_key_configuration_unavailable`). | +| 2026-07-24 | `cursor/search-performance-review-4ee9` / PR #1134 | 76d47871c44c607f942a683351378230173dcbe3 | Search performance findings remediation (prescribing, differentials, typeahead docs timeout, shared shell, answer rate-limit fallback) | FIXED. P1 prescribing catalogue now debounces (250???ms), aborts in-flight fetches, and uses `fields=index`. Differentials catalogue + evidence search abort/debounce. Universal documents typeahead timeout 6???s???750???ms (RAG impact: no retrieval behaviour change ??? typeahead timeout only). Shared `(search-app)` layout keeps GlobalSearchShell mounted across mode homes. Answer rate-limit fails closed only in production; development uses in-memory fallback when durable RPC is unavailable. | Focused Vitest 362 via test:focused; api-rate-limit/search-shell/universal/route/site-map suites green; `npm run ensure` smoke 200 on mode homes; `/api/answer/stream` 200 after fallback. No OpenAI spend beyond local answer stream smoke; no live eval/soak. | +| 2026-07-24 | `main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | Search performance across modes (load + typeahead + submit; local ensure) | CHANGES REQUESTED / findings. No P0. P1: Prescribing `useMedicationCatalog(query)` refetches the full ~2.5???2.9???MB medication catalogue on every keystroke without debounce, abort, or `fields=index` (~25?? larger than index). P2: differentials catalogue + evidence `/api/search` lack abort/debounce; universal typeahead `tookMs` dominated by empty live documents domain (~130???340???ms); cross-namespace mode switches remount the search shell; Answer submit returns 503 `rate_limit_unavailable` when durable limiter is down (fail-closed). Mode HTML load medians ~40???75???ms; typeahead wall ~160???180???ms (`ssri`) / ~350???400???ms (`agitation im lorazepam`) + 250???ms client debounce; catalogue submits (differentials) ~45???ms; document `/api/search` demo-degraded ~230???430???ms. Highest residual live risk: cold hybrid RPC tails (docs #25), not re-measured with soak/eval. | `npm run ensure` ??? http://localhost:4461; `/api/local-project-id` Clinical KB; paced universal typeahead across 13 modes ?? 2 queries (Server-Timing); `/api/search` + `/api/medications` (+`fields=index`) + differentials APIs + registry payload sizes; NDJSON vs JSON first-byte; browser walkthrough of 13 mode homes; static review of ClinicalDashboard / universal-search / medication+differential hooks. No OpenAI generation, no `eval:retrieval:latency`, no soak, no hosted CI. Environment had Supabase secrets so universal ran live (`publicAccess`); `/api/search` degraded to demo (`supabase_api_key_configuration_unavailable`). | | 2026-07-24 | `codex/query-ribbon-search-headings` | `16ce57d9615708528e7924b41837210a24414722` + reviewed ledger diff | Universal Query Ribbon implementation and responsive search-heading review | APPROVE after two scoped polish fixes. The shared result header now presents query, progress/result state, scopes, and real sort/view/save controls consistently across Services, Forms, Favourites, Differentials, and Medication/Prescribing search surfaces; the mockup remains available at `/mockups/search-heading`. The review restored the compact `Sort` label at ordinary phone widths and prevents stale/unknown scope IDs from producing an empty utility strip. No P0-P2 finding remains. Retrieval, ranking, source selection, and clinical output behavior are unchanged. Highest residual risk is unexercised browser combinations outside the focused cross-route responsive matrix. | Focused header DOM 4/4; focused ESLint; `git diff --check`; live 1280px route QA with zero overflow and visible keyboard focus; production Playwright build compiled, TypeScript passed, 1,678 pages generated, and focused Chromium responsive/search/prescribing matrix passed 16/16. `verify:pr-local` passed runtime, Prettier, full ESLint, and TypeScript; its complete unit run stopped only when the unrelated load-sensitive `reconciliation-preflight` case exceeded 30 seconds, then that file passed 5/5 in isolation. No OpenAI, Supabase, Railway, deployment, production-data, or clinical provider workflow ran. | | 2026-07-24 | `main` | `037b4808100946f96aee28b8ff51939ae2986851` | Comprehensive repository review (architecture, security/privacy, API/DB, RAG/clinical, UX/a11y, performance/CI/ops) | Changes requested. No P0. Two confirmed P1 clinical-grounding defects: (1) numeric verification skips truncated claims after the 24-claim cap when earlier claims contain numbers; (2) unsupported prescriptive treatment recommendations remain grounded as routine/partial. Multiple P2 privacy/ops findings: signed-URL cache survives sign-out; upload/enrichment/search telemetry can retain raw filenames; negated urgency still labelled Red flag; mixed `partial_invalid_model_citation_ids` evade the invalid-ID gate; readiness probe lacks an explicit dependency timeout; Railway watch patterns miss transitive build controllers. Known tracked residuals reconfirmed: #052 enrichment/reindex overlap, #059 credential containment (operator), #007 Tools route dual entry. Highest residual risk remains live answer-quality/clinical grounding plus operator credential/#053 legal gates. No source fixes applied. | Offline: runtime, migration-role, function-grants (30), owner-scope (40 routes), GitHub Actions pins, PR-policy self-test, gate/CI-scope/Codex autofix guards, lint, typecheck, sitemap, knip, knip architecture budgets, env-parity names-only, docs index/scripts, production-readiness:ci, offline RAG 36 fixtures + 21 suites/308 tests, focused clinical/RAG contract suite 122/122, Chromium accessibility 12/12 and `verify:ui` 267/267 after identity-confirmed `npm run ensure`. Targeted offline red proofs for both P1s and the citation/safety/signed-URL P2s. Provider-gated skipped: live drift, supabase-project (non-dry), migration-history, live RAG/OpenAI evals, hosted CI, Railway mutations. | | 2026-07-24 | `remediate-audit-system-issues` | `ae54de2b10f1c586d90c62fc3e50654dd8e917a1` + fixes | Audit remediation verification and merge readiness review | READY. Fixed the P1 (Unsafe automation) by restoring the WMI process name filter while expanding it to include common node wrappers (`node|npm|npx|tsx|vitest|playwright|bun`). Fixed the P3 (maintainability friction) by adding `rimraf` to `devDependencies`, ensuring offline availability in CI. No high-confidence P0-P2 defects remain. | Static review of diff against origin/main. Fixed issues locally and re-verified. No OpenAI, Supabase, or live provider command ran. | -| 2026-07-24 | `cursor/docs-reliability-review-c38b` | `af5d44abf031581d256006b51a1be98563d441d5` | Documentation reliability review vs repo state (setup, env, ops runbooks, testing safety) | Fixed P1/P2 doc drift: worker region Sydney→Railway Singapore; DR golden gate 23/23→36/36; Railway health `/api/health/ready`; auth checklist aligned to magic-link+OAuth UI; staging identity vars in `.env.example`; provider-approval boundary on testing/readiness docs; mode count 11→13. No P0. Residual: historical `23/23` mentions in point-in-time/archive docs left alone. | `npm run docs:check-links`; `npm run docs:check-index`; `git diff --check`. No provider/OpenAI/Supabase/Railway mutation. | -| 2026-07-24 | `main` / PR #1122 tip `037b4808100946f96aee28b8ff51939ae2986851` | `037b4808100946f96aee28b8ff51939ae2986851` | Code-quality review of tip commit (streamlined sidebar tool list) | No P0-P1. Two P2 maintainability findings: (1) dual catalogue — `sidebarToolItems` still defines specialist tools that `primarySidebarToolIds` always filters out, leaving unused Lucide imports and a footgun where new catalogue rows do not appear unless also added to the Set; (2) favourites-auth-gate asserts primary IDs by regex-parsing the Set initializer source, which couples the suite to TypeScript formatting. Highest residual risk is quiet nav drift if specialists are re-added only to `sidebarToolItems`. #066 in outstanding-issues still describes this sidebar land as open despite the tip merge. | Static diff inspection of `ClinicalSidebar.tsx`, `tests/favourites-auth-gate.test.ts`, `tests/ui-smoke.spec.ts`; no lint/test/provider runs (pure review). | -| 2026-07-24 | `codex/review-search-bar-behavior-and-establish-rules` (PR #1137) | `b10514374ac7640e5d3395f707c6f958764ae131` + ledger bookkeeping | PR babysit: CI fix + Codex threads + drift | COMPLETED for current head. Restored Tools arm in `showDesktopHomeComposer` and moved `0rem` reserve comment to `mobileComposerReserve` (3d82ead2); replaced unresolvable ledger SHA `bcf4571…` with `6ee0484…`; formatted `docs/search-chrome-behaviour.md`; merged `origin/main` (`0cc0ee2d`). 3/3 Codex review threads resolved via GraphQL (inline replies 403 with this token). Prior CI failures (syntax from misplaced comment) cleared on 3d82ead2; Production UI job cancelled mid-aggregate before this merge — CI re-running after push. | Local: format:check on touched files; Vitest `ui-overlay-css-contract` + `mobile-composer-reserve` 15/15. Hosted: static/unit/build/advisory green on 3d82ead2. No provider-backed checks run. | -| 2026-07-24 | PR #1135 / `cursor/sitewide-design-ux-review-6176` | merge `origin/main` @ `3d6954a3` | babysit: re-merge main after #1133; renumber UX archive IDs | CONFLICTING after `main` advanced with database-interface audit. Kept product UX fixes; rebuilt `docs/outstanding-issues.md` from `origin/main` and archived sitewide UX defects as collision-free `#070`–`#074` (provisional PR IDs `#068`–`#072` collided with main `#068` drift-manifest / `#069` table-facts profile). Native-`disabled` CodeRabbit ask remains declined (focusable coming-soon contract). | Local merge conflict resolution only; hosted CI pending on merge commit. No provider-backed gates. | +| 2026-07-24 | `cursor/docs-reliability-review-c38b` | `af5d44abf031581d256006b51a1be98563d441d5` | Documentation reliability review vs repo state (setup, env, ops runbooks, testing safety) | Fixed P1/P2 doc drift: worker region Sydney???Railway Singapore; DR golden gate 23/23???36/36; Railway health `/api/health/ready`; auth checklist aligned to magic-link+OAuth UI; staging identity vars in `.env.example`; provider-approval boundary on testing/readiness docs; mode count 11???13. No P0. Residual: historical `23/23` mentions in point-in-time/archive docs left alone. | `npm run docs:check-links`; `npm run docs:check-index`; `git diff --check`. No provider/OpenAI/Supabase/Railway mutation. | +| 2026-07-24 | `main` / PR #1122 tip `037b4808100946f96aee28b8ff51939ae2986851` | `037b4808100946f96aee28b8ff51939ae2986851` | Code-quality review of tip commit (streamlined sidebar tool list) | No P0-P1. Two P2 maintainability findings: (1) dual catalogue ??? `sidebarToolItems` still defines specialist tools that `primarySidebarToolIds` always filters out, leaving unused Lucide imports and a footgun where new catalogue rows do not appear unless also added to the Set; (2) favourites-auth-gate asserts primary IDs by regex-parsing the Set initializer source, which couples the suite to TypeScript formatting. Highest residual risk is quiet nav drift if specialists are re-added only to `sidebarToolItems`. #066 in outstanding-issues still describes this sidebar land as open despite the tip merge. | Static diff inspection of `ClinicalSidebar.tsx`, `tests/favourites-auth-gate.test.ts`, `tests/ui-smoke.spec.ts`; no lint/test/provider runs (pure review). | +| 2026-07-24 | `codex/review-search-bar-behavior-and-establish-rules` (PR #1137) | `b10514374ac7640e5d3395f707c6f958764ae131` + ledger bookkeeping | PR babysit: CI fix + Codex threads + drift | COMPLETED for current head. Restored Tools arm in `showDesktopHomeComposer` and moved `0rem` reserve comment to `mobileComposerReserve` (3d82ead2); replaced unresolvable ledger SHA `bcf4571???` with `6ee0484???`; formatted `docs/search-chrome-behaviour.md`; merged `origin/main` (`0cc0ee2d`). 3/3 Codex review threads resolved via GraphQL (inline replies 403 with this token). Prior CI failures (syntax from misplaced comment) cleared on 3d82ead2; Production UI job cancelled mid-aggregate before this merge ??? CI re-running after push. | Local: format:check on touched files; Vitest `ui-overlay-css-contract` + `mobile-composer-reserve` 15/15. Hosted: static/unit/build/advisory green on 3d82ead2. No provider-backed checks run. | +| 2026-07-24 | PR #1135 / `cursor/sitewide-design-ux-review-6176` | merge `origin/main` @ `3d6954a3` | babysit: re-merge main after #1133; renumber UX archive IDs | CONFLICTING after `main` advanced with database-interface audit. Kept product UX fixes; rebuilt `docs/outstanding-issues.md` from `origin/main` and archived sitewide UX defects as collision-free `#070`???`#074` (provisional PR IDs `#068`???`#072` collided with main `#068` drift-manifest / `#069` table-facts profile). Native-`disabled` CodeRabbit ask remains declined (focusable coming-soon contract). | Local merge conflict resolution only; hosted CI pending on merge commit. No provider-backed gates. | | 2026-07-24 | PR #1135 / `cursor/sitewide-design-ux-review-6176` | `4ff92ea76f1b4d7962adc47ce88bcb153989c9ba` + post-comment docs | babysit: main merge, CI, CodeRabbit thread disposition | MERGE-READY after prior conflict resolution with `origin/main`. Product UX honesty fixes retained with main answer-relevance trust gating. CodeRabbit MD028 + ledger token fixed; native-`disabled` request declined as it conflicts with the focusable coming-soon placeholder contract. Auto-merge enabled. | Hosted required checks green on that tip. Focused Vitest mobile-interaction + visual-evidence tabs green. No provider-backed gates. | -| 2026-07-24 | `origin/main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | sitewide design/UX review (production pages) | FINDINGS CAPTURED. No P0. Confirmed defects later archived as `#070`–`#074` after ID collision with main `#068`/`#069`. Updated `#010` for Compact/Detailed selected-but-disabled look. Deduped against `#007`/`#016`/`#038`–`#041`/`#063`–`#066`. Residual: large mobile PWA install sheet density; compare URL-state sync; axe coverage beyond home (`#040`). No product code fixes in this pass. | Offline: design-system-contract, type-scale, icon-scale, brand:check, design-sweep evidence. Live: `npm run ensure` → `http://localhost:4461` identity OK; mode-home/detail HTTP 200 + no document overflow at 390/1280; presentation href + forced Overview navigation proof; Tools Sort/More DOM proof; `test:e2e:accessibility` 12/12. Screenshots under `/opt/cursor/artifacts/screenshots/`. No OpenAI/Supabase/GitHub/hosted CI/provider calls. | +| 2026-07-24 | `origin/main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | sitewide design/UX review (production pages) | FINDINGS CAPTURED. No P0. Confirmed defects later archived as `#070`???`#074` after ID collision with main `#068`/`#069`. Updated `#010` for Compact/Detailed selected-but-disabled look. Deduped against `#007`/`#016`/`#038`???`#041`/`#063`???`#066`. Residual: large mobile PWA install sheet density; compare URL-state sync; axe coverage beyond home (`#040`). No product code fixes in this pass. | Offline: design-system-contract, type-scale, icon-scale, brand:check, design-sweep evidence. Live: `npm run ensure` ??? `http://localhost:4461` identity OK; mode-home/detail HTTP 200 + no document overflow at 390/1280; presentation href + forced Overview navigation proof; Tools Sort/More DOM proof; `test:e2e:accessibility` 12/12. Screenshots under `/opt/cursor/artifacts/screenshots/`. No OpenAI/Supabase/GitHub/hosted CI/provider calls. | | 2026-07-24 | `cursor/database-interface-audit-0883` / PR #1133 | `8c4c5556ef470673da492aa5f901513c84637d83` | PR babysit + Bugbot + Codex thread triage | COMPLETED for current head. Fixed Codex P2s: stranded queued recovery pages past open-job rows; bulk retry_failed enrichment lease preflight scopes to failed docs only. Bugbot ClinicalDashboard safety-findings finding is not in this PR unique diff vs main. PR policy Clinical Governance Preflight added in body. Merged origin/main. | Local Bugbot; focused Vitest; gh PR/CI. | | 2026-07-24 | `main` | `6ceaaff50712e10e857bf9a5a7ec88b530bf7b35` | Supabase interface / performance / schema guardian audit | COMPLETED. No P0/P1 live security hole. Confirmed service-role + app-layer ownership model, fail-closed `retrieval_owner_matches`, and project-ref pinning. P2 findings: duplicate unscoped `correct_clinical_query_terms` block in `schema.sql` (safe definition wins at replay); reindex routes miss fresh enrichment-lease gate (`#052`); upload crash can strand `queued` without a job (`#062`); table-facts RPC still `LANGUAGE sql` + `force_custom_plan` (byte-identical plpgsql+EXECUTE remains the latency win). P3: base match RPC execute revokes rely on roles.sql; `invoke_ingestion_worker` hardcodes URL; cold multi-RPC fan-out. Remediation continues on `cursor/database-interface-audit-0883`. | Static schema/RLS/RPC/grant/owner-scope/auth/client inspection; upload/reindex wiring; scale/SLO/deploy docs; outstanding-issues `#052`/`#062`. Provider-gated skipped: `check:supabase-project`, live `check:drift`, `check:indexing`, `profile:retrieval`, `eval:retrieval*`, migration apply. Notion MCP unavailable (`needsAuth`). | -| 2026-07-24 | PR #1125 / `codex/answer-relevance-fail-closed` | `8d9fb2408f13e305138749655214baa0020fcfd4` | Follow-up: clear comparison/`documentBreakdown` in untrusted clinical notes | APPROVE for the scoped P2. `trustGatedAnswerForClinicalNotes` now clears `documentBreakdown`, `comparisonMatrix`, and `comparisonEvaluationState` when relevance is not source-backed, so Clinical Notes → ClinicalOutputPanel cannot rebuild comparison-detail tables from raw `best_quote` values. Prior visual/section/quote gates remain. Residual risk is still deliberate low-trust rendering for legacy payloads without `isSourceBacked: true`. | Focused jsdom/policy regressions: `tests/visual-evidence-tabs.dom.test.tsx` 5/5 after hardening the comparison case (caption + matrix values absent). Thread disposition posted and resolved. No live RAG/OpenAI/Supabase mutation. | +| 2026-07-24 | PR #1125 / `codex/answer-relevance-fail-closed` | `8d9fb2408f13e305138749655214baa0020fcfd4` | Follow-up: clear comparison/`documentBreakdown` in untrusted clinical notes | APPROVE for the scoped P2. `trustGatedAnswerForClinicalNotes` now clears `documentBreakdown`, `comparisonMatrix`, and `comparisonEvaluationState` when relevance is not source-backed, so Clinical Notes ??? ClinicalOutputPanel cannot rebuild comparison-detail tables from raw `best_quote` values. Prior visual/section/quote gates remain. Residual risk is still deliberate low-trust rendering for legacy payloads without `isSourceBacked: true`. | Focused jsdom/policy regressions: `tests/visual-evidence-tabs.dom.test.tsx` 5/5 after hardening the comparison case (caption + matrix values absent). Thread disposition posted and resolved. No live RAG/OpenAI/Supabase mutation. | | 2026-07-24 | `codex/answer-relevance-fail-closed` | `ac0d4305478a0bc8fef03894b78ec5911912c08a` | Missing answer-relevance metadata across render policy and live dashboard grounding | APPROVE after resolving two review P2s. A shared `isAnswerSourceBacked` predicate now requires explicit `isSourceBacked: true`; missing or explicitly negative relevance cannot retain high render trust, a grounded dashboard state, visual/table evidence, or a clinical-notes table bypass. Explicitly source-backed answers preserve supported behavior. Retrieval, ranking, generation, source selection and stored data are unchanged. Highest residual risk is deliberate compatibility tightening for older answer payloads without relevance metadata; they render low-trust and expose review sources rather than richer evidence blocks. | Initial red policy proof failed with `high`; two later red proofs exposed retained visual evidence and the clinical-notes raw-table affordance, then passed after both render-model gates. Focused render/provenance/clinical-safety tests passed 37/37; the focused DOM/policy pair passed 31/31. Offline RAG passed 21 suites/308 tests and 36/36 fixtures; production-readiness was READY against `Clinical KB Database` read-only; `verify:pr-local` passed runtime, formatting, lint, typecheck, all 366 test files (3,254 passed/1 skipped), production build (1,677 pages), client-bundle secret scan and RAG fixture validation; the earlier local `verify:ui` passed 267/267. After the final UI fix, `verify:cheap` again passed all 20 non-test gates, lint, typecheck and 3,254 tests, with only tracked issue #067 timing out under machine load; its isolated retry also exceeded the same 30-second limit and was not repeated. Fresh exact-head hosted checks are required. No live RAG, OpenAI request, Supabase mutation, Railway action, production data operation or deployment ran. | | 2026-07-24 | `codex/safety-plan-no-patient-data-contract` | `b94987c94537f3114a3429848fa908bdecd1d80a` | Safety Plan Generator identifier, local-state, copy, print, privacy-notice and PIA contract | APPROVE. No P0-P2 finding. The patient name/initials field is removed; the builder now asks for identifier-free minimum content, retains working state only in the mounted React component, and makes clipboard/print/PDF export an explicit handling boundary. The PIA and product privacy copy distinguish this local-only tool from provider-backed questions. Highest residual risk is outside Clinical KB: users must handle exported copies under an approved clinical-record process, which the UI now states at the export controls. | Privacy/component DOM 3/3 plus updated privacy-copy 2/2; focused Chromium copy/print/no-fetch-or-XHR 1/1; `verify:cheap` passed all 21 gates, 366 files and 3,245 tests with 1 skip; production-readiness READY using the existing canonical environment without a provider call; production build and client-bundle secret scan passed; offline RAG fixture/manifest 36 cases/21 suites passed. `verify:pr-local` passed runtime, formatting, lint and typecheck, then stopped on the unrelated load-sensitive `reconciliation-preflight` 30-second timeout; that test passed 5/5 isolated and the preceding full suite passed, so the unchanged five-minute gate was not retried. No Supabase, OpenAI, Railway, live RAG, production data or deployment action ran. | | 2026-07-24 | PR #1114 / `codex/universal-ledger-main-followup-20260724` | `eedbe594a89eaa0aad8a517ee8808b089cb5ff57` + reviewed working diff | Streamlined-sidebar handoff in the merged universal ledger | APPROVE. PRs #1112, #1116, and #1117 landed the universal-ledger baseline, two preserved UI tasks, and credential/hook hardening; this follow-up preserves that current-main schema and adds only the still-missing sidebar delivery as collision-free `#066`. The queue remains gap-free and every recommended ID has one open row. Sidebar implementation stays recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54` until its local/browser/build/hosted merge proof is complete. | Focused sidebar/favourites tests previously passed 18/18 on the recorded implementation commit; this ledger follow-up passed Prettier, remote-ref recovery, 36-row contiguous-order/46-open-ID/next-ID invariants, and `git diff --check`. The broader reconciled precursor passed `verify:cheap` (365 files, 3,242 passed/1 skipped); fresh exact-head hosted CI is required on PR #1114. No OpenAI, Supabase, Railway, deployment, live-app, credential, or production-data action ran. | @@ -46,7 +46,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-24 | PR #1106 / `codex/task-ledger-final-11318f` | `5d128a2844c2298d0da36df64e5e2f7dda11e14b` + reviewed follow-up diff | Universal task-ledger workflow and protected-main merge readiness | APPROVE after follow-up. `docs/outstanding-issues.md` is the single durable task ledger, with retained work carrying order, acuity, timing, capability, effort, dependencies, success criteria, verification and stop rules. Four actionable review findings were fixed: filtered `/issues` reads now apply the filter to open items before rendering queued and non-queued results; the session hook excludes queued IDs from its priority summary; `#030` is consistently P2/A2 in the canonical open table and queue; and the sole A1/P1 blocker is first while `#052` is explicitly the first code task. No other actionable review thread remains in the reviewed scope. | Protected CI at the initial reviewed head passed policy, static, safety/config, unit coverage, Semgrep, Gitleaks, GitGuardian and the required aggregate; UI, build, migration replay and release browser matrix were correctly skipped for the docs/workflow scope. Follow-up proof: scoped Prettier; hook syntax/runtime plus exact ID-deduplication, P2-count and A1-first assertions; docs links (1,136 references); canonical skill catalog (32 skills, 8 aliases); `git diff --check`. Exact-head hosted CI remains required after the follow-up push. No OpenAI, Supabase, Railway, deployment or production-data operation ran. | | 2026-07-24 | `codex/supabase-document-change-trigger` | `9c7d9edf509a51478f5bebbabcca64e3926dc877` + reviewed working diff | Document-change ingestion trigger migration, schema mirror, grants, privacy and fail-safe delivery | APPROVE. No P0-P2 finding. The trigger is update-only, acts solely on a strict JSON boolean false/absent-to-true transition, sends only the receiver's allowlisted owner-scoped fields, fails open for document writes when Vault/GUC/pg_net is unavailable, and revokes execution from public/anon/authenticated. No production URL fallback exists. Highest residual risk is deliberate pg_net at-most-once delivery; the clear-then-flip recovery and data-preserving rollback are documented, and the trigger remains inert until both the Vault secret and environment base-URL GUC are configured. | Disposable Supabase Postgres `17.6.1.127` schema replay and drift-manifest regeneration passed (16s; scratch container removed); focused schema/drift/receiver Vitest 89/89; migration-role, function-grant (30 SECURITY DEFINER functions) and owner-scope guards; production-readiness CI mode READY with expected secretless-worktree warnings; offline RAG 21 suites/307 tests; `verify:cheap` 365 files, 3,241 passed/1 skipped; static trace of receiver payload, authoritative owner-scoped reload and idempotent enqueue path. No live provider mutation or migration apply. | | 2026-07-23 | PR #1090 / `cursor/fix-phone-dock-edge-1b1d` | `761de7e9ad623b6bd8d634d849a9eb465d622e48` (merged as `09028ef217209fceb53f1122ac7738b509bce323`) | Phone safe-area and edge-to-edge search-dock UI review | MERGED. No P0-P2 finding. The branch was three commits behind, so current `origin/main` was merged before landing; the actual merge tree matched the reviewed synthetic tree. The dock remains flush to the viewport with safe-area padding inside the form, and the phone shell no longer retains the `dvh` clamp that created the Safari toolbar band. Zero actionable review threads. | `npm run ensure`; focused `ui-tools.spec.ts` phone-home and edge-to-edge scenarios: Chromium 2/2 and WebKit 2/2; refreshed hosted policy, security, unit, build, advisory UI, Production UI and required aggregate checks green; exact-head ancestry and local-main tree equality proved after merge. | -| 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory “never shared” statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible “coming soon” placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | +| 2026-07-22 | PR #1087 / `codex/reconcile-product-truth` | `edbc2260fef59ca2fa7c6973dffb85e32354bce1` (merged as `05dc52fd8408a65117e22a6236e43252203bea92`) | Product-truth copy, account persistence and unavailable-SSO presentation | MERGED. Cross-device claims now match favourites/preferences persistence; recent searches are identified as browser-session data; the contradictory ???never shared??? statement is removed. All unavailable setup providers and Apple elsewhere use the connected accessible ???coming soon??? placeholder pattern. The single review finding was fixed, replied to and resolved. | Red DOM proof; focused 19/19; `verify:cheap` 3,220 passed / 1 skipped; `verify:ui` 265/265; PR-local build/secret scan/offline RAG; final hosted required, Production UI, policy and security checks green. No provider calls or RAG spend. | | 2026-07-22 | PR #1086 / `codex/reconcile-xlsx-budgets` | `5376880a40749b6526fd7e4603a7be9d04bc9624` (merged as `2963fba46eacd644618a588fa283f7597faa2644`) | XLSX resource-boundary review | MERGED. Enforces worksheet, non-empty-row, rendered-cell and UTF-8 output ceilings before result fragments are appended; sparse-column output is preserved. No actionable review threads. | Red 257-sheet reproducer; focused 4/4; `verify:cheap` 3,218 passed / 1 skipped; PR-local build/scan/offline RAG; hosted required/security/policy green. | | 2026-07-22 | PR #1085 / `codex/reconcile-docx-budgets` | `b08c60e1127592f0bc08f88797905f1e871172ce` (merged as `008a92b0fbad652484b6cdde6295bc456f4b7bf9`) | DOCX extraction-budget review | MERGED after two valid allocation-order findings. Declared media/Word-XML sizes are checked before inflate/materialization, with post-read fail-safes; artifact count, single/aggregate bytes and extracted text are bounded. All threads resolved. | Red 1,001-media reproducer; focused 7/7; `verify:cheap` 3,214 passed / 1 skipped; PR-local; hosted coverage/build/security/policy green. | | 2026-07-22 | PR #1084 / `codex/reconcile-bulk-reindex` | `7b7737bd63b9dcd3ba820379a54cfc11595d6e98` (merged as `589fb9b99e18061782b0c7b3fa6b14fa0e8388d5`) | Bulk reindex partial-success contract | MERGED. Completed mixed batches return HTTP 200 with successful, failed and missing results; preflight-wide conflicts retain non-2xx behavior; UI reports counts and refreshes successful work. | Red deletion-race proof; focused 127/127; `verify:cheap` 3,207 passed / 1 skipped; PR-local build/scan/offline RAG; hosted green. | @@ -67,14 +67,14 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-14 | main | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | branch alignment | Fast-forwarded local `main` to latest `origin/main` commit. | Verified main and origin/main revisions and updated ref locally. | | 2026-07-14 | local branches (5 refs) | multiple SHAs | local branch cleanup | Safely deleted 5 local branches that were squash-merged or had no changes (including `claude/canary-latency-recalibration`, `claude/process-hardening-consolidation`, `codex/fix-registry-indexing-health`, `codex/pr-556-sync`, and `codex/pr-597-fix`). | Verified diff was identical to origin/main and confirmed MERGED status on GitHub. | | 2026-07-18 | local repository cleanup against `origin/main` | 1d9fdcfdd | repository-maintenance summary (non-skip aggregate) | Removed 26 clean, exact-proven redundant worktree registrations (58 -> 32 before the temporary cleanup worktree) and deleted 78 unregistered local branches: 73 direct `origin/main` ancestors plus five exact/covered squash-merge refs for PRs #852, #859, #868, #869, and #870. Preserved all dirty, active, open-PR-owned, backup, ledger-protected, and patch-unique/ambiguous work, including the divergent local `main`; no reset, force operation, remote-branch deletion, or source replay was performed. Six unregistered Windows directory residues remain without `.git` markers after Git cleanup. Clean standalone deltas were either already merged/current-main content or owned by active PR/task work, so no product change was duplicated. This aggregate row is audit history only and must not be used to skip a future branch-level cleanup review. | Mandatory task-start preflight; fresh fetch/prune; full local branch/worktree/status and Codex task ownership inventory; 863-PR GitHub snapshot before the API rate limit was exhausted; cherry-pick-aware history, exact merged-head/descendant proof, and synthetic merge-tree checks; exact-old-value `git update-ref` deletion; per-worktree clean/head rechecks; final worktree/prune inventory. No OpenAI, Supabase, deployment, production-data, or live clinical workflow ran. | -| 2026-07-18 | PR batch screenshot queue → #883–#888 / #891 | 8b0a600209 (main tip after #887) | open-PR review + merge babysit | Reviewed and land-safe-merged screenshot PRs. Merged #888 (worker placement dedupe), #891 (PR policy `github.workflow_sha` checkout superseding incorrect #884 `base.sha`), #886 (mobile differentials FAB), #885 (Compare selected href; closed duplicate #883/#882), #887 (Therapy mode-home align + nested-main landmark fix). Closed superseded #884/#883/#882/#881/#877/#875. Fixed PR-policy bodies (Clinical KB governance checkbox), resolved Codex/CodeRabbit threads, Prettier on therapy landmark files, and re-synced branches through main between merges. No high-confidence residual P0-P1 on landed heads. | Hosted required checks green per PR before squash auto-merge (PR policy, Static, Unit, Build, Production UI where UI-scoped, PR required, Semgrep, Gitleaks, GitGuardian). Local: `check:pr-policy`, focused therapy landmark Vitest 5/5, Prettier on touched therapy files. No OpenAI/live Supabase writes. | +| 2026-07-18 | PR batch screenshot queue ??? #883???#888 / #891 | 8b0a600209 (main tip after #887) | open-PR review + merge babysit | Reviewed and land-safe-merged screenshot PRs. Merged #888 (worker placement dedupe), #891 (PR policy `github.workflow_sha` checkout superseding incorrect #884 `base.sha`), #886 (mobile differentials FAB), #885 (Compare selected href; closed duplicate #883/#882), #887 (Therapy mode-home align + nested-main landmark fix). Closed superseded #884/#883/#882/#881/#877/#875. Fixed PR-policy bodies (Clinical KB governance checkbox), resolved Codex/CodeRabbit threads, Prettier on therapy landmark files, and re-synced branches through main between merges. No high-confidence residual P0-P1 on landed heads. | Hosted required checks green per PR before squash auto-merge (PR policy, Static, Unit, Build, Production UI where UI-scoped, PR required, Semgrep, Gitleaks, GitGuardian). Local: `check:pr-policy`, focused therapy landmark Vitest 5/5, Prettier on touched therapy files. No OpenAI/live Supabase writes. | | 2026-07-18 | codex/chat-audit-remediation-pr-0a27 / PR #873 | 4bea60e9fc5c181fee33b2af27a4b6e3176eac27 | CI auto-resolve risk-routing regression and PR handoff | Confirmed the broader audit remediation was already merged through PR #814. Fixed the residual rename-routing gap by classifying both current and previous paths and explicitly covering `src/data`, reusable GitHub actions, and the action-pin/Codex guard scripts. Automated PR review then found one P2: an excluded old test path could still trigger high-risk routing when paired with a non-excluded new docs path. Fixed before handoff by deriving non-excluded paths first and using that same set for risk and complexity checks. No P0-P2 remained; no product runtime, clinical behavior, provider configuration, or production data changed. | Full `verify:pr-local` passed on the initial three-file patch: Node/npm runtime, changed-file format, ESLint, TypeScript, 301 Vitest files/2,788 tests, and 36 offline RAG fixtures; build skipped as unaffected. After the review fix, the Codex workflow guard, action-pin guard, Prettier, focused Vitest 54/54, and `git diff --check` passed. Hosted checks on the initial PR head passed; the review fix was also verified by the focused local checks before the final main merge. GitHub interactions were user-authorized; no Supabase/OpenAI/live-service command ran. | | 2026-07-18 | PR #868 / codex/private-title-privacy-20260718 | 77482fc9e (privacy implementation + rollout-order follow-up) | title-vocabulary privacy, migration safety, and merge-readiness review | Fixed the historical private/non-indexed `document_title_words` exposure with a forward purge, exact indexed-public-title invariant, concurrency-safe `FOR SHARE` guard, constraint/ACL/RLS hardening, and a fail-closed postcondition. Review then found and fixed a P1 rollout interval by purging inside `20260717171000` before its table-backed corrector is installed, while retaining the forward migration for already-applied environments. The review thread was resolved; merged as `0df01d88ac36616a3f47e2e94e758432ef27999c` and verified on fresh `origin/main`. | Disposable Postgres replay and drift-manifest regeneration; focused schema Vitest 66/66 before the final docs-only sync; function-grant check; scoped ESLint; diff/manifest proof. Exact-head hosted Static, Unit coverage, Safety/config, Migration replay, PR required, policy, Semgrep, Gitleaks, and GitGuardian passed. Non-required Supabase Preview failed against a separate preview target and was not touched or rerun. No live Supabase/OpenAI/product-provider command or production migration apply ran. | | 2026-07-18 | PR #865 / codex/docs-migration-runbook-safety-20260718 | 78ea2ccd6 | migration runbook, rollback safety, and clinical-governance review | Replaced stale sole-pending-migration guidance, prohibited restoring the unscoped corrector, added forward-only rollback and exact migration ordering, and marked the historical WIP report superseded. Review uncovered the pre-existing private title-word P1, so the runbook now blocks live rollout until a forward purge/invariant migration is merged and verified. The review thread was resolved; merged as `ec9142628752e6d11531e20a6ebf2e95cf39f865` with exact changed blobs verified on `origin/main`. | Documentation links 915, documented scripts 299, affected Markdown Prettier, static migration-order/rollout-blocker assertions, and `git diff --check` passed. Hosted Static, PR required, policy, Semgrep, Gitleaks, and GitGuardian passed; docs-irrelevant jobs skipped. No Supabase/OpenAI/database migration/deployment/provider call ran. | -| 2026-07-18 | PR #861 / codex/design-audit-main-safe-20260720-final | d8c1916ac (functional head 593d5aa00 + current-main merge) | design-audit/search cancellation merge review | Fixed unsupported Forms pathway claims, propagated cancellation through every retrieval RPC, removed duplicate favourites “Also matches” results, and resolved all four review threads. Merged as `3b2dd9ef76ff1c8c099fc1972065628d23b853b1`; exact `origin/main` commit and tree content were verified after merge. | Exact-head hosted Static PR checks, Unit coverage, Build, Safety and config checks, Production UI, Advisory UI, Migration replay, PR required, PR policy, Semgrep, Gitleaks, and GitGuardian checks passed. No Supabase, OpenAI, or other product-provider call ran. | -| 2026-07-18 | PR batch screenshot queue → #853 / cursor/pr-queue-land-3084 | 11ec0122f (tip of cursor/pr-queue-land-3084) | open-PR review + merge babysit | Reviewed screenshot PRs #833/#837/#845–#852 + Communication #19. #852/#848 already merged. Closed superseded/unsafe: #833/#837 (empty vs main), #845 (clinical-search over-expand; fixed in #853), #846/#847/#849 (Production UI red design-audit dupes), #850 (CONFLICTING), #851 (schema-test regressions), #726 (CONFLICTING CodeRabbit UTG). Unique safe fix landed in #853: agitation chart expansion without bare table/management over-trigger. Communication #19 inaccessible (repo not resolvable). | Focused Vitest clinical-search 42/42. Local verify:cheap unit suite hit pre-existing pdf-extraction-budget failures also on main (2 tests). Hosted #853 required checks green (Static/Unit/Build/PR required/policy/Semgrep/Gitleaks/GitGuardian). Squash-merged to main. Also closed follow-on dupes #854 (same failing tip as #851) and #855 (Clinical KB H1 reverts #814 Clinical Guide contract; Static/PR policy red). Communication #19 inaccessible. No OpenAI/live Supabase writes. | -| 2026-07-18 | PR batch screenshot queue → #808/#812/#814 | 44555ab9e414f615981eb444f46a62333c28ec18 | open-PR review + merge babysit | Screenshot PRs #784–#789 closed as superseded. Unique residual work landed via #808 and #812. Design-audit/Playwright stack landed via #814 after Production UI fixes (Clinical Guide H1, service mocks, reduced-motion dock asserts), presentations empty-query fallback, and CodeRabbit thread resolution (RightRail remount, IS DISTINCT FROM, no-op dropped trigram migration). #783 already merged. Communication #17 inaccessible from this token. | Hosted #808/#812/#814 required checks green including Production UI; migration replay green on #814. No OpenAI/live Supabase writes. | -| 2026-07-18 | PR batch screenshot queue → #808 / cursor/pr-queue-land-bfe7 | 3b54a785c7c6073024b6bae0182b6a9321154595 | open-PR review + merge babysit | Consolidated unique remaining work from screenshot PRs onto current main via #808 (Also matches placement, factsheets, audit metadata minimize with numeric storageRemoved, answer-progress UI gate, global-error role=alert). Superseded already-landed #800/#799/#801/#802 (via #798/#804). Closed conflicted/failing design-audit duplicates #789/#790/#803/#806/#807/#788 and older duplicates #748/#749/#751 without replaying Production UI regressions. | Hosted #808: required checks green (Static/Unit/Build/Production UI/Migration replay/PR required). Supabase Preview failed (non-blocking concurrent preview limit). Local focused Vitest audit+factsheets; sitemap:check; ci-change-scope self-test. verify:cheap PDF budget failures pre-existing on main. No OpenAI/live Supabase writes. | +| 2026-07-18 | PR #861 / codex/design-audit-main-safe-20260720-final | d8c1916ac (functional head 593d5aa00 + current-main merge) | design-audit/search cancellation merge review | Fixed unsupported Forms pathway claims, propagated cancellation through every retrieval RPC, removed duplicate favourites ???Also matches??? results, and resolved all four review threads. Merged as `3b2dd9ef76ff1c8c099fc1972065628d23b853b1`; exact `origin/main` commit and tree content were verified after merge. | Exact-head hosted Static PR checks, Unit coverage, Build, Safety and config checks, Production UI, Advisory UI, Migration replay, PR required, PR policy, Semgrep, Gitleaks, and GitGuardian checks passed. No Supabase, OpenAI, or other product-provider call ran. | +| 2026-07-18 | PR batch screenshot queue ??? #853 / cursor/pr-queue-land-3084 | 11ec0122f (tip of cursor/pr-queue-land-3084) | open-PR review + merge babysit | Reviewed screenshot PRs #833/#837/#845???#852 + Communication #19. #852/#848 already merged. Closed superseded/unsafe: #833/#837 (empty vs main), #845 (clinical-search over-expand; fixed in #853), #846/#847/#849 (Production UI red design-audit dupes), #850 (CONFLICTING), #851 (schema-test regressions), #726 (CONFLICTING CodeRabbit UTG). Unique safe fix landed in #853: agitation chart expansion without bare table/management over-trigger. Communication #19 inaccessible (repo not resolvable). | Focused Vitest clinical-search 42/42. Local verify:cheap unit suite hit pre-existing pdf-extraction-budget failures also on main (2 tests). Hosted #853 required checks green (Static/Unit/Build/PR required/policy/Semgrep/Gitleaks/GitGuardian). Squash-merged to main. Also closed follow-on dupes #854 (same failing tip as #851) and #855 (Clinical KB H1 reverts #814 Clinical Guide contract; Static/PR policy red). Communication #19 inaccessible. No OpenAI/live Supabase writes. | +| 2026-07-18 | PR batch screenshot queue ??? #808/#812/#814 | 44555ab9e414f615981eb444f46a62333c28ec18 | open-PR review + merge babysit | Screenshot PRs #784???#789 closed as superseded. Unique residual work landed via #808 and #812. Design-audit/Playwright stack landed via #814 after Production UI fixes (Clinical Guide H1, service mocks, reduced-motion dock asserts), presentations empty-query fallback, and CodeRabbit thread resolution (RightRail remount, IS DISTINCT FROM, no-op dropped trigram migration). #783 already merged. Communication #17 inaccessible from this token. | Hosted #808/#812/#814 required checks green including Production UI; migration replay green on #814. No OpenAI/live Supabase writes. | +| 2026-07-18 | PR batch screenshot queue ??? #808 / cursor/pr-queue-land-bfe7 | 3b54a785c7c6073024b6bae0182b6a9321154595 | open-PR review + merge babysit | Consolidated unique remaining work from screenshot PRs onto current main via #808 (Also matches placement, factsheets, audit metadata minimize with numeric storageRemoved, answer-progress UI gate, global-error role=alert). Superseded already-landed #800/#799/#801/#802 (via #798/#804). Closed conflicted/failing design-audit duplicates #789/#790/#803/#806/#807/#788 and older duplicates #748/#749/#751 without replaying Production UI regressions. | Hosted #808: required checks green (Static/Unit/Build/Production UI/Migration replay/PR required). Supabase Preview failed (non-blocking concurrent preview limit). Local focused Vitest audit+factsheets; sitemap:check; ci-change-scope self-test. verify:cheap PDF budget failures pre-existing on main. No OpenAI/live Supabase writes. | | 2026-07-17 | PR #732 / claude/edge-to-edge-content-lv9x7k | 354f9bf31b56d811d8611a9b248f7aebc7cde082 | open-PR review + merge babysit | No high-confidence P0-P2. Phone shell/sheet/settings replace dvh clamps with h-full inside fixed inset-0 parents (iOS Safari toolbar collapse). Merged to main via auto-merge. | Hosted required checks + Production UI green; pairwise merge-tree with sibling UI PRs clean. | | 2026-07-17 | PR #733 / claude/follow-up-design-sizing-250cop | 6565815b3bd000cb0224e52f8d0e4d84ae28371d | open-PR review + merge babysit | No high-confidence P0-P2. Follow-up chip row margin-bottom -0.125rem -> 0.4375rem stops overlap with composer pill. Merged to main. | Hosted required checks + Production UI green. | | 2026-07-17 | PR #736 / claude/phone-touch-optimization-673ur4 | 755da28c29bf37e39fe2ab3d355f141a8f6eda35 | open-PR review + merge babysit | No high-confidence P0-P2. Touch floors reuse min-h-tap/size-tap; Therapy Compass phone overflow via tc-stack-sm/tc-scroll-sm. Merged to main. | Hosted required checks + Production UI green; globals.css auto-merges with #733. | @@ -104,7 +104,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-11 | codex/architecture-review-integration | 665103250ccc33b5870862b8d8467607a1ae5d23 | coderabbit-followup | Fixed POSIX project-root identity collisions and closed dynamic-import and self-cycle gaps in the architecture regression guard. | Local-server Vitest passed; architecture-boundaries Vitest passed (6 tests); `npm run typecheck`; focused Prettier; `git diff --check` | | 2026-07-11 | codex/architecture-review-followup | f5deaaee98864f1d32c1060ae14966a4f5975872 | coderabbit-test-followup | Removed probabilistic no-collision assertions from the local identity test and replaced them with deterministic normalization, repeatability, ID-shape, and port-range checks. | Local-server Vitest (2 passed); focused Prettier; `git diff --check`; hosted CI/SAST/Secret Scan passed on the reviewed head | | 2026-07-11 | codex/pr-check-followup | 298e8f5bec2a4673dd225da3f446f008b8f25953 | residual-pr-check-hardening | Ported only the three PR-check improvements not already merged by PR #454: pinned Supabase CLI/cache ownership, advisory Semgrep coverage for Edge Functions, and regression guards for both contracts. | `npm run check:github-actions`; `npm run check:ci-scope`; focused Prettier; `git diff --check` | -| 2026-07-11 | claude/mobile-search-bar-fix (PR #456) | b73196c2e2e4a536804cdcdb50879c29e2c582c5 | PR required-testing review | All 4 Advisory UI regression failures confirmed PR-caused via A/B against pre-merge main (01f2cee0d): the 640px mode-home query moved the phone composer out of the hero, contradicting the design tests; residual ≥640px vanish remained when the slot never mounts. PR merged (b32c17b34) before the rework landed; follow-up fix shipped on `claude/mode-home-composer-hero-fix` (0px hero query restored, portal-outcome inline fallback, new `@critical` composer-presence test). Also found: main CI red on every push — missing `RAG_QUERY_HASH_SECRET` secret fails the deployment boot smoke and skips `release-browser-matrix`; owner adding the secret. | Local chromium A/B (PR head 4/5 fail vs baseline product-pass); rework targeted run 6/6 pass incl. new `@critical`; `npm run typecheck`; `npm run lint`; focused Prettier check | +| 2026-07-11 | claude/mobile-search-bar-fix (PR #456) | b73196c2e2e4a536804cdcdb50879c29e2c582c5 | PR required-testing review | All 4 Advisory UI regression failures confirmed PR-caused via A/B against pre-merge main (01f2cee0d): the 640px mode-home query moved the phone composer out of the hero, contradicting the design tests; residual ???640px vanish remained when the slot never mounts. PR merged (b32c17b34) before the rework landed; follow-up fix shipped on `claude/mode-home-composer-hero-fix` (0px hero query restored, portal-outcome inline fallback, new `@critical` composer-presence test). Also found: main CI red on every push ??? missing `RAG_QUERY_HASH_SECRET` secret fails the deployment boot smoke and skips `release-browser-matrix`; owner adding the secret. | Local chromium A/B (PR head 4/5 fail vs baseline product-pass); rework targeted run 6/6 pass incl. new `@critical`; `npm run typecheck`; `npm run lint`; focused Prettier check | | 2026-07-11 | PR #487 / claude/answer-page-design-polish-ffd5a6 | b2c772606126f8323424bc9c0b636bac77c08789 | open-PR review, unresolved comments, and CI | Two findings fixed: expanded weak/unsupported prior answers retain an explicit source-review warning, and cross-mode search actions no longer log an incorrect detail-open telemetry event. Added a persisted prior-turn browser assertion. No additional high-confidence defect was found in the changed scope. | Focused answer-render and cross-mode Vitest (20/20); TypeScript; focused Prettier; `git diff --check`. Browser assertion delegated to hosted CI because Turbopack rejects the isolated worktree's external node_modules junction. | | 2026-07-11 | PR #469 / claude/response-formatting-cleanup-b57a9c | f1864308e0b287bb83b2a13daca4c3aa2ab95a3e | open-PR review, unresolved comments, and CI | P2 fixed: the OCR bullet sanitizer now preserves line-start O blood values when followed by blood or red-cell noun tails while still stripping non-blood bullets such as `o Negative screen`. No additional high-confidence defect was found in the nine-file diff. | Focused sanitizer/extractive Vitest (75/75); TypeScript; focused Prettier; `git diff --check`. Production-readiness script ran fail-closed with provider variables cleared and reported only expected missing provider configuration. | | 2026-07-11 | PR #466 / claude/search-timeout-failure-s6aiuj | 54d52292eeb9e1c7856b3dad89d1b72e0d49fd53 | open-PR review, unresolved comments, and CI | P2 fixed: SSE progress/token/error emission now tolerates a client cancellation racing an enqueue, so the catch path cannot throw while reporting the original stream error. No additional high-confidence defect was found in the six-file diff. | Focused SSE and search utility Vitest (13/13); TypeScript; focused Prettier. Hosted advisory browser failure was shared stale assertion drift and is rerun after this push. | @@ -121,7 +121,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-13 | codex/repository-review-remediation | 452275824294564a1e08e6bec169bd4af744d09a | live migration apply and post-apply review | Applied the four reviewed forward migrations to `Clinical KB Database`, aligned repository filenames to the generated production versions, and corrected the schema snapshot so the legacy unfenced commit overload remains inaccessible to `service_role`. Live drift is clean and no active ingestion/enrichment overlap or duplicate open ingestion group was found. | Ran `npm run check:drift`: passed clean. Ran `npm run check:production-readiness`: READY. Ran Docker schema replay: passed. Ran focused concurrency/retrieval Vitest: 166/166 passed. Ran offline RAG: 36 fixtures and 60/60 contract tests passed. Ran M13, retrieval-owner, schema-health, lexical-retrieval, concurrency, and ACL live probes: passed; lexical retrieval returned 12 truthfully scored results. Not completed: full provider retrieval-quality evaluation exceeded the local command window; deterministic live retrieval checks passed. | | 2026-07-13 | codex/fix-48h-review-findings-current | 49735663370735a60870d065ed0de3b9d34e077f | last-48-hours PR remediation | Revalidated the last-48-hours findings on current main after PRs #538 and #540; retained only unique fixes across auth/cache isolation, stale-response protection, upload/routing/UI behavior, RAG coalescing, telemetry, worktree tooling, and SAST enforcement. No remaining high-confidence local defect was found in the changed scope. The approved live drift check reported only the five differences already explained by unapplied migrations from #540. | Focused Vitest 107/107; `npm run verify:pr-local` (1,762 passed, 1 skipped; production build and client-bundle scan; offline RAG 60/60); critical Chromium 8/8; live `check:drift`; `git diff --check`. Full Chromium remains advisory after the earlier runner hang; the required critical subset passed on current main. | | 2026-07-13 | codex/public-anonymous-access | 7f3eded3d17c9daf6a443c9cac3f0553e4e9321b | production UI design and accessibility review | Fixed the fullscreen clinical-table focus leak and divergent modal implementation, removed the non-native table-surface control, and lifted meaningful production metadata from 8-10px to the 11px floor with stronger muted contrast. No remaining high-confidence defect was found in the reviewed visual scope. | Baseline/final screenshots at 1440x1000 and 390x820; focused Chromium table expansion 3/3; focused Vitest 6/6; `npm run typecheck`; targeted ESLint; type-scale and focused Prettier checks; `git diff --check`. `verify:cheap` timed out in full lint/test execution; full `verify:ui` deferred under the API confirmation boundary. | -| 2026-07-13 | main (PR #570 squash, glass header) | cc6bfc1c80902ca3c91e5ba2ebe78a80f3fd9e14 | post-merge review: CSS/visual/a11y/perf + logic/regression | No P0/P1. P2s confirmed and fixed in follow-up: build pipeline dropped ALL hand-authored backdrop-filter declarations (manual -webkit- duplicates confused Lightning CSS — header scrim, bottom dock, and composer pill were tint-only in every engine); scrim retuned to carry the bar's frost alone (header backdrop-root removed) with masks fading to true zero; private-scope alert made sticky inside main (was scroll-away in non-answer modes); scroll-hide reporter reset on breakpoint-gate change; non-forced fallback backgrounds layered to preserve the utility-wins contract. | Ran custom Playwright probe (`node scratchpad/probe-blur.mjs`, Chromium 390x844): baseline showed `getComputedStyle(.edge-glass-header-backdrop).backdropFilter === "none"` on all three passes, after fix `blur(14px)/blur(20px)/blur(26px)` — passed; Ran `node scripts/run-playwright.mjs tests/ui-smoke.spec.ts --project=chromium -g "glass header\|collapse hide\|private-scope alert\|phone (short\|long) answer stays"`: 6/6 passed; Ran `node scripts/run-playwright.mjs tests/ui-smoke.spec.ts --project=chromium` (full file): 71 passed, 4 failed (pre-existing `/privacy` heading test, fails identically on clean main); Ran `npm run verify:cheap`: exit 0 (1935 unit tests passed); Ran `npm run format:check`: passed; Not run: WebKit/Safari real-device check (no WebKit runner in this environment — served client chunk verified to pair `-webkit-backdrop-filter` with each declaration for Safari <= 17) | +| 2026-07-13 | main (PR #570 squash, glass header) | cc6bfc1c80902ca3c91e5ba2ebe78a80f3fd9e14 | post-merge review: CSS/visual/a11y/perf + logic/regression | No P0/P1. P2s confirmed and fixed in follow-up: build pipeline dropped ALL hand-authored backdrop-filter declarations (manual -webkit- duplicates confused Lightning CSS ??? header scrim, bottom dock, and composer pill were tint-only in every engine); scrim retuned to carry the bar's frost alone (header backdrop-root removed) with masks fading to true zero; private-scope alert made sticky inside main (was scroll-away in non-answer modes); scroll-hide reporter reset on breakpoint-gate change; non-forced fallback backgrounds layered to preserve the utility-wins contract. | Ran custom Playwright probe (`node scratchpad/probe-blur.mjs`, Chromium 390x844): baseline showed `getComputedStyle(.edge-glass-header-backdrop).backdropFilter === "none"` on all three passes, after fix `blur(14px)/blur(20px)/blur(26px)` ??? passed; Ran `node scripts/run-playwright.mjs tests/ui-smoke.spec.ts --project=chromium -g "glass header\|collapse hide\|private-scope alert\|phone (short\|long) answer stays"`: 6/6 passed; Ran `node scripts/run-playwright.mjs tests/ui-smoke.spec.ts --project=chromium` (full file): 71 passed, 4 failed (pre-existing `/privacy` heading test, fails identically on clean main); Ran `npm run verify:cheap`: exit 0 (1935 unit tests passed); Ran `npm run format:check`: passed; Not run: WebKit/Safari real-device check (no WebKit runner in this environment ??? served client chunk verified to pair `-webkit-backdrop-filter` with each declaration for Safari <= 17) | | 2026-07-13 | codex/rag-review-followup | 755ac9e517a3b81f8e12a119f80f3769dd58ae4e | PR #575 post-merge review finding remediation | Fixed the P1 path that could combine a medication amount and route from separate chunks, expanded the shared explicit amount/route/frequency intent detector, corrected route-only failure classification, and added microgram-symbol coverage. Requested attributes must now be co-located with the medication subject before the text fast path is accepted. No additional high-confidence defect was found in the changed scope after integrating the production answer-budget fix from PR #580. | Focused Vitest 143/143; `npm run eval:rag:offline` (21 files, 265/265); `npm run typecheck`; targeted ESLint; full `npm test` (211 files passed, 1 skipped; 1,946 tests passed, 1 skipped); PR-local dry-run selected runtime, format, lint, typecheck, full tests, build, and offline RAG; `git diff --check`. `verify:cheap` passed all pre-test stages but its 10-minute host bound expired during the full suite; the same suite then passed independently with a longer bound. | | 2026-07-13 | origin/main (detached review worktree) | c523cabeae4b68ebdf569ecbc18d9f5a7b5afbf1 | repo-wide audit | Changes requested: one P1 clinical-answer trust cluster; three P2 tenancy/reindex guardrail issues; three P3 information-disclosure, dead-code, and transitive-deprecation cleanup items. No P0 found. | `npm run verify:cheap` (1,721 passed, 1 skipped); `npm run test:coverage` (thresholds passed); `npm run build`; `npm run verify:ui` (137/137); `npm run eval:rag:offline` (36 fixtures, 60 tests); format, Edge Function, Codex workflow, import/secret/dead-reference scans. Provider-backed checks skipped. | | 2026-07-13 | HEAD / origin/main (detached worktree) | 04c1d0b036cae8af4dabfc692055c7aab93d5888 | OpenAI-facing API and integration review | Read-only review found one P1 clinical-streaming defect and four P2 reliability/API-contract issues: provisional clinical prose is exposed before validation; mid-stream failure can silently trigger a second buffered generation; answer caches are not model/prompt fingerprinted; OpenAI access/model errors are under-classified; and table-fact route IDs are not validated before database access. GPT-5.6 migration also requires replacing the legacy prompt-cache parameter. No application code was changed. | Static call-flow, prompt, model, schema, streaming, cache, error, route, test, and governance inspection; official OpenAI model/Responses/structured-output/streaming/prompt-cache guidance reviewed. Provider-backed checks were not run. Local tests were not run because this worktree has no installed dependencies (`openai`, `vitest`). | @@ -541,10 +541,10 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-14 | origin merged-ref deletion batch (26 refs) | f0eec3ec504bdbaa2a82e2a3f86876c05925a6c2 | branch-cleanup | Deleted 26 origin branch refs whose current remote SHA exactly matched a merged PR head. No checked-out branch, open-PR head, or changed remote ref was included. | Authenticated `gh pr list`; `git ls-remote --heads origin`; exact remote-SHA, open-PR, and worktree guards immediately before three non-force `git push origin --delete` batches; all 26 deletions succeeded. | | 2026-07-14 | fix/accessibility-remaining-findings | e6e735d2668f7383acc45bdb7cc7dc183e7a73a8 | branch-cleanup and merge-readiness | Retained. PR #654 is mergeable and its scoped accessibility diff had no high-confidence review finding, but the required UI regression check remains in progress and GitHub reports the PR blocked. | Authenticated PR metadata and check rollup; five-file diff review; mergeability and exact-head confirmation. No merge attempted. | | 2026-07-14 | codex/release-blocker-remediation | 1ca2f9f372e23f563de0bc4f823cd341d82a562a | branch-cleanup and merge-readiness | Retained. PR #655 has green completed checks but currently conflicts with `main`; its branch remains checked out in an active worktree. | Authenticated PR metadata and check rollup; exact-head, worktree, and mergeability confirmation. No merge, rebase, conflict resolution, or branch deletion attempted. | -| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | clinical governance + RAG full-repo audit (source governance/citations, answer verification/clinical safety, privacy/query-privacy/private-search-scope, generation failure modes/degradation, retrieval/ranking/selection, ingestion/OCR index quality) | No high-confidence P0/P1. Fail-closed governance chokepoint (`buildGovernedAnswerClientResponse`) applies to both `/api/answer` and `/api/answer/stream`; numeric/quote/citation verification, prompt-injection neutralization, owner-scope tenancy, and query/answer redaction all conservative. Two P3 observations: (1) `secondStageScore` demotion penalties can be floored away by `Math.max(hybrid_score, boosted)` at the tail of the list (rag.ts:663); (2) `outdatedPenalty` default-ON uses governance metadata to weight ranking (eval-gated, demotion-only) — in tension with the "no governance weighting" principle but conservative. D4/D5 (#649) levers verified default-OFF with tests. | Pure review, no mutations except this ledger append. Offline: focused Vitest governance/verification/privacy/scope suites 79/79 + 98/98 passed. Provider-backed (Supabase/OpenAI), browser, release, and live retrieval-quality checks not run (confirmation boundary). | -| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | full repo-structure audit (broken imports, dead files, redundant config, module dependency, structural debt) | No P0/P1. P2: `RAG_TEXT_WEAK_OR_RELAXATION=true` in `.env.example` contradicts `default("false")` in `env.ts` (process-hardening hardened this to off); `reindex-eval-gate.ts` (488 lines) has no production importer — test-only orphan; `bundle-budget.json` still has `enforce: false` + `totalGzipBytes: null` after first production build window passed. P3: `client-env.ts` duplicates `isLocalNoAuthMode`/`publicUploadsEnabled` from `env.ts` using raw `process.env` (intentional server-only split, but divergent implementations); `OPENAI_PRICE_*`, `SPEND_ALERT_DAILY_USD` env vars undocumented in `.env.example`; `rag.ts` → extracted-module architecture still has acknowledged runtime back-edges in `rag-extractive-answer` but no import cycles detected by `architecture-boundaries.test.ts`; several `mockup`-named component files not removed from `src/components/` (production use gated via `mockupsEnabled()`). | `npm run verify:cheap` green (2,290 passed/2 skipped, 0 lint errors, typecheck clean, sitemap aligned, type-scale 0 hits, runtime Node 24/npm 11). `npm run check:env-parity` clean. `npm run docs:check-scripts` passed 266 refs. Architecture-boundaries suite (no cycles, server modules isolated, scripts not imported). Provider-backed (Supabase/OpenAI), browser, release, and live-eval checks not run (confirmation boundary). | -| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | RAG retrieval/ranking/selection/answer-generation audit (fresh scoped pass; PR #649 D4/D5 governance levers safe-by-default focus, token/effort waste, provider routing) | No P0/P1. Both #649 levers verified safe-by-default and fail-safe: D4 `unknownCurrentnessPenalty` default 0 (no-op, clamped non-negative, activated only via `RAG_RANKING_CONFIG`); D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` unset=false (only tightens display trust high→medium, never exposes more; `NEXT_PUBLIC` correct as `buildAnswerRenderModel` runs client-side in `ClinicalDashboard.tsx`). Reasoning-effort defaults correct (`OPENAI_STRONG_REASONING_EFFORT`=medium, fast=low; `strongReasoningEffortForQueryClass` never raises, caps routine at medium, keeps dose/threshold at configured). Provider mode default `auto`. P3 (reaffirmed): (1) `Math.max(hybrid_score, boosted)` floor at rag.ts:663 can nullify demotion penalties (outdated/unknown/poor/lowIndex) at the list tail, making D4 partly inert when activated; (2) `document_status` defaults to `"unknown"` (source-metadata.ts:34) for unenriched docs, so activating D4 penalizes the corpus-wide fallback status, not a curated signal — same mechanism that dropped selection doc-recall@5 1.0→0.76 (retrieval-selection.ts:340) — eval gate is the safeguard. | Pure review, no mutations except this ledger append. Offline focused Vitest: answer-render-policy + ranking-config + answer-responsiveness-gate 54/54 passed. Provider-backed (Supabase/OpenAI), `eval:retrieval:quality`, browser, and release checks not run (confirmation boundary). | -| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | frontend/UI/accessibility audit — global-search-shell, master-search-header, composer, answer surfaces, document viewer, clinical dashboard modules; design-token usage, reduced-motion/forced-colors, icon aria, focus traps, composer/header placement | No P0. P2: (1) `aria-describedby`+`aria-hidden="true"` conflict in `mode-action-popup.tsx:622,651` makes menu descriptions invisible to AT; (2) ~25 dynamic `` render sites missing `aria-hidden` across dashboard modules — ESLint `require-lucide-icon-aria` rule gap for LucideIcon-typed variables; (3) Mode menu (`role="menu"` in header) does not close on Tab — keyboard users can Tab away from an open menu without dismissing it; (4) No live region on streaming `NaturalLanguageAnswer` — screen reader users not notified of incremental answer content. P3: (5) `--surface-glass`/`--panel-gloss` not remapped in `@media (forced-colors: active)` block — image-lightbox and PDF toolbar control bars could become invisible in high-contrast; (6) `bg-black/45` on Sheet backdrop instead of `var(--overlay-backdrop)` token; (7) `active:scale-[0.99]` on action-popup buttons without `motion-safe:` — still fires as a visual jump under reduced-motion; (8) Microsoft/Google brand hex squares not `forced-color-adjust:none` — lose brand identity in high-contrast mode. | Pure static review, no mutations. Files read: `master-search-header.tsx`, `global-search-shell.tsx`, `globals.css`, `sheet.tsx`, `mode-action-popup.tsx`, `image-lightbox.tsx`, `answer-content.tsx`, `ClinicalDashboard.tsx` (partial), `use-dismissable-layer.ts`, `layout.tsx`, `eslint-rules/require-lucide-icon-aria.mjs`, `ui-accessibility.spec.ts`, `process-hardening.md`. Browser/live checks not run (confirmation boundary). | +| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | clinical governance + RAG full-repo audit (source governance/citations, answer verification/clinical safety, privacy/query-privacy/private-search-scope, generation failure modes/degradation, retrieval/ranking/selection, ingestion/OCR index quality) | No high-confidence P0/P1. Fail-closed governance chokepoint (`buildGovernedAnswerClientResponse`) applies to both `/api/answer` and `/api/answer/stream`; numeric/quote/citation verification, prompt-injection neutralization, owner-scope tenancy, and query/answer redaction all conservative. Two P3 observations: (1) `secondStageScore` demotion penalties can be floored away by `Math.max(hybrid_score, boosted)` at the tail of the list (rag.ts:663); (2) `outdatedPenalty` default-ON uses governance metadata to weight ranking (eval-gated, demotion-only) ??? in tension with the "no governance weighting" principle but conservative. D4/D5 (#649) levers verified default-OFF with tests. | Pure review, no mutations except this ledger append. Offline: focused Vitest governance/verification/privacy/scope suites 79/79 + 98/98 passed. Provider-backed (Supabase/OpenAI), browser, release, and live retrieval-quality checks not run (confirmation boundary). | +| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | full repo-structure audit (broken imports, dead files, redundant config, module dependency, structural debt) | No P0/P1. P2: `RAG_TEXT_WEAK_OR_RELAXATION=true` in `.env.example` contradicts `default("false")` in `env.ts` (process-hardening hardened this to off); `reindex-eval-gate.ts` (488 lines) has no production importer ??? test-only orphan; `bundle-budget.json` still has `enforce: false` + `totalGzipBytes: null` after first production build window passed. P3: `client-env.ts` duplicates `isLocalNoAuthMode`/`publicUploadsEnabled` from `env.ts` using raw `process.env` (intentional server-only split, but divergent implementations); `OPENAI_PRICE_*`, `SPEND_ALERT_DAILY_USD` env vars undocumented in `.env.example`; `rag.ts` ??? extracted-module architecture still has acknowledged runtime back-edges in `rag-extractive-answer` but no import cycles detected by `architecture-boundaries.test.ts`; several `mockup`-named component files not removed from `src/components/` (production use gated via `mockupsEnabled()`). | `npm run verify:cheap` green (2,290 passed/2 skipped, 0 lint errors, typecheck clean, sitemap aligned, type-scale 0 hits, runtime Node 24/npm 11). `npm run check:env-parity` clean. `npm run docs:check-scripts` passed 266 refs. Architecture-boundaries suite (no cycles, server modules isolated, scripts not imported). Provider-backed (Supabase/OpenAI), browser, release, and live-eval checks not run (confirmation boundary). | +| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | RAG retrieval/ranking/selection/answer-generation audit (fresh scoped pass; PR #649 D4/D5 governance levers safe-by-default focus, token/effort waste, provider routing) | No P0/P1. Both #649 levers verified safe-by-default and fail-safe: D4 `unknownCurrentnessPenalty` default 0 (no-op, clamped non-negative, activated only via `RAG_RANKING_CONFIG`); D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` unset=false (only tightens display trust high???medium, never exposes more; `NEXT_PUBLIC` correct as `buildAnswerRenderModel` runs client-side in `ClinicalDashboard.tsx`). Reasoning-effort defaults correct (`OPENAI_STRONG_REASONING_EFFORT`=medium, fast=low; `strongReasoningEffortForQueryClass` never raises, caps routine at medium, keeps dose/threshold at configured). Provider mode default `auto`. P3 (reaffirmed): (1) `Math.max(hybrid_score, boosted)` floor at rag.ts:663 can nullify demotion penalties (outdated/unknown/poor/lowIndex) at the list tail, making D4 partly inert when activated; (2) `document_status` defaults to `"unknown"` (source-metadata.ts:34) for unenriched docs, so activating D4 penalizes the corpus-wide fallback status, not a curated signal ??? same mechanism that dropped selection doc-recall@5 1.0???0.76 (retrieval-selection.ts:340) ??? eval gate is the safeguard. | Pure review, no mutations except this ledger append. Offline focused Vitest: answer-render-policy + ranking-config + answer-responsiveness-gate 54/54 passed. Provider-backed (Supabase/OpenAI), `eval:retrieval:quality`, browser, and release checks not run (confirmation boundary). | +| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | frontend/UI/accessibility audit ??? global-search-shell, master-search-header, composer, answer surfaces, document viewer, clinical dashboard modules; design-token usage, reduced-motion/forced-colors, icon aria, focus traps, composer/header placement | No P0. P2: (1) `aria-describedby`+`aria-hidden="true"` conflict in `mode-action-popup.tsx:622,651` makes menu descriptions invisible to AT; (2) ~25 dynamic `` render sites missing `aria-hidden` across dashboard modules ??? ESLint `require-lucide-icon-aria` rule gap for LucideIcon-typed variables; (3) Mode menu (`role="menu"` in header) does not close on Tab ??? keyboard users can Tab away from an open menu without dismissing it; (4) No live region on streaming `NaturalLanguageAnswer` ??? screen reader users not notified of incremental answer content. P3: (5) `--surface-glass`/`--panel-gloss` not remapped in `@media (forced-colors: active)` block ??? image-lightbox and PDF toolbar control bars could become invisible in high-contrast; (6) `bg-black/45` on Sheet backdrop instead of `var(--overlay-backdrop)` token; (7) `active:scale-[0.99]` on action-popup buttons without `motion-safe:` ??? still fires as a visual jump under reduced-motion; (8) Microsoft/Google brand hex squares not `forced-color-adjust:none` ??? lose brand identity in high-contrast mode. | Pure static review, no mutations. Files read: `master-search-header.tsx`, `global-search-shell.tsx`, `globals.css`, `sheet.tsx`, `mode-action-popup.tsx`, `image-lightbox.tsx`, `answer-content.tsx`, `ClinicalDashboard.tsx` (partial), `use-dismissable-layer.ts`, `layout.tsx`, `eslint-rules/require-lucide-icon-aria.mjs`, `ui-accessibility.spec.ts`, `process-hardening.md`. Browser/live checks not run (confirmation boundary). | | 2026-07-14 | main / 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | repo-wide multi-skill audit (repo-auditor, security, clinical-governance, RAG, ingestion-worker, API, frontend-ui, release-readiness, testing/code-quality) | Highest code P1: anonymous public catalogs bypass rate limits while serving multi-MB payloads (medications 3.4 MB, services 894 KB, differentials 1.2 MB; `shouldResolvePublicCatalogAccess()` early-return in registry/medications/differentials routes skips `consumeSubjectApiRateLimit()` for requests without session cookie or bearer token). Active OPERATOR/LEGAL launch blockers: PIA-1 APP 8 overseas processing (Railway SG + OpenAI US), PIA-2 Railway `RAG_QUERY_HASH_SECRET` verify, unrun `verify:release`/golden evals, staging soak, Eval Canary trust, operator-backlog staleness vs runbooks. Confirmed code P2 cluster: public-doc DTO leaks (`storage_path`), single-layer service-role tenancy, commit-RPC unreachable fallback (`worker/main.ts:545-547`), recovery plan pending+failed unique-index crash, unwired `decideReindexGate`, CI scope misses (`src/lib/app-modes.ts`/`clinical-safety.ts` skip UI/RAG gates), a11y describedby/icon/Tab/live-region gaps, soft `@critical` safety UI assert, unenforced bundle budget, `.env.example` weak-OR flag. Residual risk: OCR quality upstream labels + hybrid-RPC latency tail. | Specialist audits + `ci-change-scope` probe; structure `verify:cheap` (2,290/2 skipped); focused Vitest governance/RAG/ingestion suites; no provider/live Supabase/OpenAI/`verify:release`/`check:drift` (confirmation boundary). | | 2026-07-14 | codex/dsm-diagnosis-mode | f6cda83ca6aed3a24d999ef4ccd38bff167d4788 | DSM diagnosis mode, local clinical catalogue, search/comparison/differential UI, accessibility, and merge-readiness review | One P2 mobile tap-target defect was fixed across the DSM header, filters, comparison controls, and result actions. No remaining high-confidence P0-P2 finding after preserving current `main` and its Specifiers integration during conflict resolution. Residual risk is formal clinical governance and regulatory review of the paraphrased local DSM reference content before broader clinical deployment. | Focused Vitest 48/48; `npm run verify:cheap` passed with 2,321 tests/1 skipped; targeted Chromium DSM redirect/search/detail journey 1/1; CI-mode production readiness READY; `git diff --check`. Provider-backed Supabase/OpenAI and full advisory `verify:ui`/release checks were not run. | | 2026-07-14 | PR #655 / codex/release-blocker-remediation | 1ca2f9f372e23f563de0bc4f823cd341d82a562a | review-followup | One P1 offline-startup defect was confirmed: production instrumentation still required OpenAI after readiness and health accepted explicit offline mode. Fixed the boot guard so only explicit `offline` may omit OpenAI while `auto` and `openai` remain fail-closed. | GitHub review-thread inspection; focused instrumentation/readiness/health Vitest 21/21; scoped ESLint; Prettier; `git diff --check`. Hosted required checks on the reviewed head were green, including Gitleaks, PR required, unit coverage, build, UI, SAST, Docker images, and migration replay. | @@ -554,7 +554,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-14 | PR #655 / codex/release-blocker-remediation | dedb38a4a1bb05f87b94a89f5cade7b4a8109c99 + reviewed follow-up diff | late automated-review safety follow-up | Fixed two newly raised scoped issues: provider-free governance now rejects public differential projections while continuing to allow the three intentionally public registry kinds, and owner-scoped answer-thread clearing also removes the unscoped legacy session/local key so old clinical text is not retained. | GitHub review-thread inspection; focused Vitest 13/13; scoped ESLint; Prettier; `git diff --check`. | | 2026-07-14 | detached review worktree (origin/main at scan start) | 0696ded585ff9611e5a1325bc6e6c85d0c74bb50 | repository-wide comprehensive and security audit | Eight security findings survived final calibration: two P2 (uncapped full-page PDF OCR raster; broad indexed-document public promotion) and six P3 (PDF deadline and aggregate budgets, delete/reindex lifecycle race, staged-generation document search, cross-tenant correction vocabulary, and fail-open future-object default privileges). Seven additional candidates were rejected. One P2 operational documentation drift was also confirmed between the operator backlog and launch runbook. No source fix was applied. | Codex Security standard scan completed with 763 ranked source-like files and 70 deep-reviewed selections; seven safe offline finding probes passed; local action-pin, documentation-link/script-reference, codebase-index, CI-scope, and autofix-workflow guards passed; offline npm audit reported zero cached advisories; `git diff --check` passed. Lint, typecheck, full tests, build, browser, live Supabase/OpenAI, hosted CI, drift, and production checks were not run because this checkout lacked `node_modules` and provider access was not authorized. | | 2026-07-14 | PR #655 / codex/release-blocker-remediation | 1ece1b891ed2d7f9577a060ae481e33cd4925ea4 + reviewed follow-up diff | offline release latency follow-up | The offline quality release gate reproducibly isolated one live timeout: a generic agitation table-lookup question was expanded into an unnecessary ten-term dose/route AND query, making lexical retrieval take about 39 seconds. Dose/route expansion now requires an actual dosing/route signal; the same case retrieves its expected source and four citations in 1.27 seconds without a model. | Focused clinical-search/retrieval Vitest 111/111; scoped ESLint; Prettier; `git diff --check`; live provider-free single-case quality eval passed with zero model/request/token/cost/generation evidence. | -| 2026-07-14 | PR #655 / codex/release-blocker-remediation | 3ed3a7a2df37d7d15143ab7606e5748ac7ecca09 + reviewed follow-up diff | offline dose-route latency follow-up | The next isolated timeout was a short IM/PO agitation question receiving the same blanket ten-term AND expansion. Agitation dose/route retrieval now keeps only the dose and route signals present in the question; the exact case retrieves its expected source and five citations in 1.54 seconds without a model. All remaining RAG cases 23–44 passed individually, so no further deadline crash remains. | Focused clinical-search/retrieval Vitest 111/111; scoped ESLint; Prettier; `git diff --check`; live provider-free case 22 passed; live provider-free cases 23–44 passed individually. | +| 2026-07-14 | PR #655 / codex/release-blocker-remediation | 3ed3a7a2df37d7d15143ab7606e5748ac7ecca09 + reviewed follow-up diff | offline dose-route latency follow-up | The next isolated timeout was a short IM/PO agitation question receiving the same blanket ten-term AND expansion. Agitation dose/route retrieval now keeps only the dose and route signals present in the question; the exact case retrieves its expected source and five citations in 1.54 seconds without a model. All remaining RAG cases 23???44 passed individually, so no further deadline crash remains. | Focused clinical-search/retrieval Vitest 111/111; scoped ESLint; Prettier; `git diff --check`; live provider-free case 22 passed; live provider-free cases 23???44 passed individually. | | 2026-07-14 | PR #655 / codex/release-blocker-remediation | a3f3a89676015cd5f018c07e8c3ad9483f91cef6 + reviewed follow-up diff | offline adversarial-latency follow-up | The final blocking offline-quality failure was an adversarial secret-exfiltration query that correctly refused but first spent about 25 seconds in lexical retrieval. Adversarial manipulation now short-circuits at the search boundary before provider-client creation, cache access, classification, aliases, or Supabase work, and is never cached. | Focused Vitest 2/2; scoped ESLint; Prettier; full TypeScript; `git diff --check`; live provider-free adversarial case completed in 100 ms with 0 ms RPC time; `eval:quality:release:offline` passed with zero blocking failures and zero model, request-ID, token, cost, or generation-latency evidence. Flaky local browser/composite suites intentionally not repeated; hosted CI remains authoritative. | | 2026-07-14 | PR #666 / codex/release-blocker-remediation | 9b56eebe4b23ab783207445fb827c317c8d59be8 + reviewed follow-up diff | review-followup | One late P2 retrieval-contract gap was confirmed: the optimized agitation query retained IM/PO but could drop other already-supported amount, route, and frequency aliases. Medication evidence intent is now shared with retrieval selection, and focused agitation queries preserve requested numeric units, SC, SL, PRN, and frequency signals without restoring the broad ten-term expansion. | GitHub review-thread inspection; focused clinical-search/retrieval Vitest 112/112; scoped ESLint; Prettier; `git diff --check`. Hosted final-head TypeScript/build/CI and exact-head staging evidence remain required after push. | | 2026-07-15 | PR #673 / cursor/audit-remediation-plan-0411 | 03fe72683d83606b73c951914278eabe897fc395 + reviewed follow-up diff | docs audit remediation plan review + CI | Fixed the hosted Prettier failure and all actionable review comments: preserved the real branch ref for the generic ledger parser, corrected `npm run` commands, scoped the no-P0/P1 verdict without obscuring the M4 code P1, disambiguated finding IDs from wave IDs, aligned wave-to-ledger update instructions with the review protocol, and made B3 require the Supabase project-identity preflight before provider-backed release gates. No additional high-confidence defect remains in the changed docs. | GitHub unresolved-thread inventory; focused Prettier on all changed docs; docs link/script reference checks; `git diff --check`. Docs-only; no Supabase, OpenAI, or other live-service checks. | @@ -566,59 +566,59 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-14 | claude/calculators-search-page | ed600b8bf5a07ef48f464d36f099e5f1cd1e5d13 | branch-cleanup | Retained (user decision): clinical-calculators mockup feature; note PR #670 has since merged to origin/main so this content is now also on main. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. No remote mutation attempted. No OpenAI/Supabase/live-eval checks. | | 2026-07-14 | codex/domain-1-governance-remediation | 4470bad93bcd659651f1f61ffce503f77a9b4269 | branch-cleanup | Retained (user decision): novel governance incident runbooks + clinical-production-posture lib + clinical-query-privacy-notice component never merged to main. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. No remote mutation attempted. No OpenAI/Supabase/live-eval checks. | | 2026-07-14 | claude/filter-layout-search-prominence-kwrbwl | 59ced590a932e1c7fe28f26a94eb05105ce0e4dd | branch-cleanup | Retained: newly pushed active work (feat(dsm) compact category filter); single unique commit, no PR yet. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. No remote mutation attempted. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/codebase-review-ade6ed | a96b8ffafb88da22f667b41edf01b215866dde32 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/document-page-redesign-7dd487 | c2cfd57b4e7ec602d96e7f042eb60ff0b10a9e8e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/document-viewer-redesign-55b68b | 0dbd83c73d2783cbe8e8d00bf04c9947a33518fc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/medication-alerts-database-cb8o83 | a0ca895015df8ebe6ae57fa8a811a1fbb240e623 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/perf-r2-bundle-hygiene | 95ce39f7715caeadc8197c35c2c41500183a715e | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/perf-r2-hot-path | 843dcf8d287950b2ddf86a121701dfbb95ac86c0 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/perf-r2-network-caching | 424ae6b045d9ec38443292a1569de4b04d6a295d | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/perf-r2-payload-trim | 5a6ce71153198c746fab96859d5895374ac05bb9 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/pr-672-specifiers-formulation-3n123f | 059398c962711f57e5f9ee7c6b4783066cd6718f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/site-performance-speed-61d154 | cb0bcf35498385bca1180462c8ab79b6f8293708 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | claude/therapy-compass-pages-rz0m5l | 5a89a521add5a02dc4f6dd640b393c5bdd690183 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/dsm-diagnosis-mode | f6cda83ca6aed3a24d999ef4ccd38bff167d4788 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/dsm-main-integration-20260714 | 9e013894b2e45d6be39af1ef4593a14604886476 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/formulation-workspace | ce6baa31ffe9647d736a18e95f9d95a95bda313c | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/live-migration-history-alignment | c9853c7acdc80e3c33354c3b1a32e5df2682f521 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/offline-retrieval-signal-followup | ef448e212d12c1cadbeb3ea053ca6639e6f0ada4 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/please-thoroughly-review-this-repo | 47e850ee93dd5281c792eb60618f98ba2e972b8e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/rag-canary-recovery | d6bd7fa7c0b9b29e9b7eddfd28e0478e042a0455 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/release-blocker-remediation | 8a7ec72b22bff98b8d4b31d533ae9a0738dee071 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/repository-review-remediation | 29c598cd2db4fc9c00ed56f60e8ef2adb969cccf | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/universal-search-domain-exclusions | 6b2c4ffbc81b9a35746ee2fa8795c73a2f65d4fc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | codex/universal-search-mode-ranking | 6a0c37f8e3b4b23fa52c49fec28dcbc8d635b80f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/29199485110 | 4e09b838bda6a774f067b8e13717af2103502857 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/29202241308-fix-database-issue | 29db1aa1b29a812bf4c7eb7af5ea33371f086157 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/database-ci-setup | 45fa392a24987e4b596d80fc81528912e62d95c9 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix | 060b2cd9c0cb38fa0cb0521ce3f67ead13a9ab87 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-961c247e-5acb-45db-b4ed-62fcf97681cd | b6097f0fbf19f82527ea95a385efb2ca7b8ec794 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-accessibility-test-timeouts | 17e11e45835510d2a43b8ea6fdfeed10df11e0d7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-again | 0b2d29a143926279b327ff302c2de3d5fe0edbc5 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-another-one | f1864308e0b287bb83b2a13daca4c3aa2ab95a3e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-barriers | 8711ee2b15c3b9a1a0e8444ba2ee799d6c5e6ab7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-ci-error | e6e735d2668f7383acc45bdb7cc7dc183e7a73a8 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-ci-issue | a95b282433e6b01bdd6444eb9b2de9148daf2363 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-ci-issues | 5f1c6f64a544705df9df970e09da3b85f0d90efa | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-ci-test-to-pass | 660e5789f56a0a54f68616392fb456e1ad10e48c | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-database-action-error | 7ff6c547e55100d7dfff912530e006f0a5ee70a2 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-database-action-issue | b367aeb084a60fc46d3e4e8d3b318491a1530ac6 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-database-action-run-issues | de36fd3ef8aa101e75a22fab8ff15940bb241e00 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-database-actions | 50cf0744df83708405d0bd215e22f19dc1f27815 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci | d248707d09f62bb153d0eece69b4f7f4e8aeb7dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci-again | 28dacd7f19320bcbf2b03e5e40c7e97fc46a80cd | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci-another-one | 59207b23fe88a23b0e2f3a6d7f1a288e0cca5132 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci-one-more-time | 00b61456b3f4fd528b24476865fde3b046b105ea | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci-test | 1de23d35e534c33cf444bc5e81e60c7384e8d072 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-failing-ci-yet-again | 8f2928b9dc925ac9ccc31e413ab422d2ffa77118 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-issue-in-database-action | 82c0e87224880ccbeee39f4101e98cf29683f74f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-issue-with-database-connection | 67f5bb2744939922ceb280fab8785ee0259b26f2 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-one-more-time | 2682cbade791fc07f09d23fa11908eead223d3c7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-please-work | 2f55346e72555500d17a08be02e6b649daa1a7cc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/fix-yet-again | c57bc8af5570a5fc69fa0f804f67cfa98df76b89 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | copilot/rerun-all-ci-again | 4615e39557112515cc9e4938fb5dd397f19ff70d | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | cursor/fix-pr654-ci-53b4 | 9f880853ea7d268186d982f4623b71f46e77d3dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | -| 2026-07-14 | fix/accessibility-remaining-findings | 9f880853ea7d268186d982f4623b71f46e77d3dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD — operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/codebase-review-ade6ed | a96b8ffafb88da22f667b41edf01b215866dde32 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/document-page-redesign-7dd487 | c2cfd57b4e7ec602d96e7f042eb60ff0b10a9e8e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/document-viewer-redesign-55b68b | 0dbd83c73d2783cbe8e8d00bf04c9947a33518fc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/medication-alerts-database-cb8o83 | a0ca895015df8ebe6ae57fa8a811a1fbb240e623 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/perf-r2-bundle-hygiene | 95ce39f7715caeadc8197c35c2c41500183a715e | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/perf-r2-hot-path | 843dcf8d287950b2ddf86a121701dfbb95ac86c0 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/perf-r2-network-caching | 424ae6b045d9ec38443292a1569de4b04d6a295d | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/perf-r2-payload-trim | 5a6ce71153198c746fab96859d5895374ac05bb9 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/pr-672-specifiers-formulation-3n123f | 059398c962711f57e5f9ee7c6b4783066cd6718f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/site-performance-speed-61d154 | cb0bcf35498385bca1180462c8ab79b6f8293708 | branch-cleanup-deletion-pending | Pending deletion (user decision): redundant perf-r2 duplicate; unmerged batch-endpoint work preserved in retained claude/perf-r2-plan-cache-migration. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | claude/therapy-compass-pages-rz0m5l | 5a89a521add5a02dc4f6dd640b393c5bdd690183 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/dsm-diagnosis-mode | f6cda83ca6aed3a24d999ef4ccd38bff167d4788 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/dsm-main-integration-20260714 | 9e013894b2e45d6be39af1ef4593a14604886476 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/formulation-workspace | ce6baa31ffe9647d736a18e95f9d95a95bda313c | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/live-migration-history-alignment | c9853c7acdc80e3c33354c3b1a32e5df2682f521 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/offline-retrieval-signal-followup | ef448e212d12c1cadbeb3ea053ca6639e6f0ada4 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/please-thoroughly-review-this-repo | 47e850ee93dd5281c792eb60618f98ba2e972b8e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/rag-canary-recovery | d6bd7fa7c0b9b29e9b7eddfd28e0478e042a0455 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/release-blocker-remediation | 8a7ec72b22bff98b8d4b31d533ae9a0738dee071 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/repository-review-remediation | 29c598cd2db4fc9c00ed56f60e8ef2adb969cccf | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/universal-search-domain-exclusions | 6b2c4ffbc81b9a35746ee2fa8795c73a2f65d4fc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | codex/universal-search-mode-ranking | 6a0c37f8e3b4b23fa52c49fec28dcbc8d635b80f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/29199485110 | 4e09b838bda6a774f067b8e13717af2103502857 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/29202241308-fix-database-issue | 29db1aa1b29a812bf4c7eb7af5ea33371f086157 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/database-ci-setup | 45fa392a24987e4b596d80fc81528912e62d95c9 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix | 060b2cd9c0cb38fa0cb0521ce3f67ead13a9ab87 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-961c247e-5acb-45db-b4ed-62fcf97681cd | b6097f0fbf19f82527ea95a385efb2ca7b8ec794 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-accessibility-test-timeouts | 17e11e45835510d2a43b8ea6fdfeed10df11e0d7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-again | 0b2d29a143926279b327ff302c2de3d5fe0edbc5 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-another-one | f1864308e0b287bb83b2a13daca4c3aa2ab95a3e | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-barriers | 8711ee2b15c3b9a1a0e8444ba2ee799d6c5e6ab7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-ci-error | e6e735d2668f7383acc45bdb7cc7dc183e7a73a8 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-ci-issue | a95b282433e6b01bdd6444eb9b2de9148daf2363 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-ci-issues | 5f1c6f64a544705df9df970e09da3b85f0d90efa | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-ci-test-to-pass | 660e5789f56a0a54f68616392fb456e1ad10e48c | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-database-action-error | 7ff6c547e55100d7dfff912530e006f0a5ee70a2 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-database-action-issue | b367aeb084a60fc46d3e4e8d3b318491a1530ac6 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-database-action-run-issues | de36fd3ef8aa101e75a22fab8ff15940bb241e00 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-database-actions | 50cf0744df83708405d0bd215e22f19dc1f27815 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci | d248707d09f62bb153d0eece69b4f7f4e8aeb7dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci-again | 28dacd7f19320bcbf2b03e5e40c7e97fc46a80cd | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci-another-one | 59207b23fe88a23b0e2f3a6d7f1a288e0cca5132 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci-one-more-time | 00b61456b3f4fd528b24476865fde3b046b105ea | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci-test | 1de23d35e534c33cf444bc5e81e60c7384e8d072 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-failing-ci-yet-again | 8f2928b9dc925ac9ccc31e413ab422d2ffa77118 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-issue-in-database-action | 82c0e87224880ccbeee39f4101e98cf29683f74f | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-issue-with-database-connection | 67f5bb2744939922ceb280fab8785ee0259b26f2 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-one-more-time | 2682cbade791fc07f09d23fa11908eead223d3c7 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-please-work | 2f55346e72555500d17a08be02e6b649daa1a7cc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/fix-yet-again | c57bc8af5570a5fc69fa0f804f67cfa98df76b89 | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | copilot/rerun-all-ci-again | 4615e39557112515cc9e4938fb5dd397f19ff70d | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | cursor/fix-pr654-ci-53b4 | 9f880853ea7d268186d982f4623b71f46e77d3dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | +| 2026-07-14 | fix/accessibility-remaining-findings | 9f880853ea7d268186d982f4623b71f46e77d3dc | branch-cleanup-deletion-pending | Pending deletion: content already on origin/main or superseded old-lineage snapshot / throwaway CI-retry branch; branch-only-file sweep found no novel work. Remote deletion DENIED (HTTP 403, session lacks ref-delete permission); branch still exists at this HEAD ??? operator must complete deletion. Scope is deletion-pending so future cleanup passes re-evaluate rather than skip. | Provider-backed GitHub PR inventory via MCP (400 PRs #264-#674, all merged=false); local read-only git: rewritten-main-aware cherry-pick + two-dot tree + branch-only-file novelty sweep vs origin/main e75fad90; adversarial re-check. Remote `git push --delete` attempted (provider-backed write) and DENIED with HTTP 403. No OpenAI/Supabase/live-eval checks. | | 2026-07-15 | PR #677 / claude/cleanup-branches-worktrees-mxov4x | a93db73a29ca6a19619a6592e2e30ca9ea2f8218 | active PR review and remediation | All three actionable review findings are fixed: every branch namespace is parsed from the ledger table, only an exact completed cleanup review at the current HEAD suppresses repeat work, pending deletions remain actionable, and GitHub provider provenance is accurate. No additional high-confidence defect remains in the changed scope. | GitHub unresolved-thread inventory (0 remaining); hosted required CI green; exact-head focused Vitest `tests/repo-hygiene.test.ts` (9/9); `node scripts/sweep-branch-ledger.mjs --no-fetch --json`; `git diff --check`. No Supabase, OpenAI, or other live-service checks. | | 2026-07-15 | PR #656 / claude/specifiers-v2-design-r55baf | 58ce935758c31672a0a051c5b3e6b888a7d8d153 | full DSM/ICD specifier catalogue and clinical-content gate review | No remaining high-confidence code defect after the review sequence corrected source provenance, verified-content wording, search ranking/deduplication, empty-state behavior, and neutral mixed-source labelling. The 494 unverified definitions remain withheld from display and ranking. Residual risk is the PR-declared qualified-clinician and TGA classification review before broader clinical deployment. | GitHub review-thread inventory (0 unresolved); exact-head hosted required CI, build, critical UI, UI regression, coverage, static, and security checks green. No live Supabase/OpenAI or provider-backed clinical workflow run. | | 2026-07-15 | PR #679 / claude/therapy-compass-pages-rz0m5l | f5ca25f8b6b14f41e63f708933fe4bb311994795 | Therapy Compass production promotion and review-followup | All five review findings are fixed on the reviewed head: run-enabled shared-composer links stay on the Therapy Compass route, production data loads outside `/mockups`, deep links seed the in-tool search, and same-route query changes remount the provider. No additional high-confidence defect remains in the changed scope. | GitHub review-thread inventory; exact-head hosted build, critical UI smoke, UI regression, unit coverage, static, security, and image checks green; focused Vitest 28/28; TypeScript; `git diff --check`. No live Supabase/OpenAI checks run. | @@ -646,91 +646,91 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-17 | codex/performance-latency-remediation-20260717 | f277d13512e85dcaae4f9b94d028a8087e41375a | end-to-end database, network, middleware, client rendering, migration, privacy, and merge-readiness review | Fixed all confirmed performance findings plus three final review blockers: title-vocabulary backfill now installs its privacy trigger first, canonical schema replay preserves hardened trigger-function ACLs, and medication auto-seeding no longer aborts its own owner-cache flight. The isolated worktree also uses Next's supported Webpack fallback only when shared dependencies resolve outside the project. No remaining high-confidence P0-P2 defect was found in the reviewed diff. | Docker scratch replay and drift-manifest regeneration passed; live read-only plans selected lexical, table-fact trigram, and chunk HNSW indexes; exact TypeScript passed; focused Vitest owner-cache 9/9, runner safety 12/12, bundle budget 10/10, offline RAG 291/291, and earlier aggregate unit run 2,657 passed with its sole corrected schema assertion subsequently validated by direct ordering/ACL checks; production build and bundle budget passed at 1,363,382 gzip bytes; targeted Chromium dashboard deferral and NDJSON search passed, while the viewer trace reached all hydration/preview assertions and its corrected download-control selector remains for exact-head hosted UI. No OpenAI calls, live Supabase writes/migrations, deployment, or production mutation ran. | | 2026-07-17 | codex/mobile-search-phone-refresh-20260717 (supersedes PR #700) | 42a3e3ce65dc5a0e1dce386e0b91fccd23d13d6c + reviewed follow-up diff | phone universal-search command-panel recovery and merge-readiness review | Recovered the still-useful behavior from PR #700 onto current `main`, including its hydration fix and wide-touch regression coverage. Hosted Production UI then exposed one desktop focus race: capability state intentionally initializes false for hydration safety, but an input could receive focus before the post-hydration effect synchronized the real browser state. The follow-up recomputes the same guarded predicate synchronously on focus; it requires the placement breakpoint plus either a fine pointer or a zero-touch desktop fallback, so wide touch devices remain suppressed while desktop keeps the first command-panel interaction. No remaining high-confidence P0-P2 defect was found in the scoped diff. | Focused Vitest 7/7; `npm run ensure` verified the project at `http://localhost:3751`; hosted static, safety, coverage, build, advisory UI, Semgrep, Gitleaks, and GitGuardian passed; the first hosted Production UI run isolated the nine desktop regressions. The focused browser proof reproduced the desktop race while the wide-touch regression passed, and exact-head hosted Production UI remains required after the focus fix. `format:changed -- --check` and `git diff --check` passed before the final follow-up. No Supabase/OpenAI/product-provider command ran. | | 2026-07-17 | final historical branch/worktree cleanup against `origin/main` | 5d195d7ca8752b2ae4006725c6b145c5662bb687 | branch-cleanup | Merged PRs #716 and #717, closed superseded PR #700, and removed the three clean task worktrees. Deleted exact remote refs for `codex/mobile-search-phone-fix-20260717` (`590f32b73`), `claude/audit-findings-review-phgz92` (`ea3b8f95b8`), `codex/chat-forms-import-6914` (`b05da82f82`), `codex/chat-supabase-migration-preflight-b463` (`1ef0faee95`), and `codex/dsm-diagnosis-mode` (`f6cda83ca6`); the merged #716/#717 branches were deleted automatically. Deleted 14 unregistered local refs only after direct-main ancestry, exact ledger deletion-pending proof, or exact merged-PR commit provenance. Final inventory found zero remote branches without an open PR or registered worktree, zero locally merged or exact deletion-pending orphan refs, and no retired target refs or paths. Thirteen non-ancestor local refs and 25 registered worktrees remain preserved because they are backups, patch-unique/unresolved, open-PR-owned, or ownership could not be safely disproved. | Fresh fetch/prune; exact GitHub PR/head/merge associations; cherry-pick-aware logs; DSM PR #661 exact commit/file provenance; exact leased remote deletes; exact-old-value local `update-ref` deletes; clean-worktree and path/process checks; worktree prune; final zero-orphan inventory. The Codex task registry lookup timed out, so ambiguous registered worktrees were conservatively retained. No Supabase, OpenAI, production-data, or live clinical workflow ran. | -| 2026-07-15 | HEAD detached 570e6ba56 + WIP tree | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | thorough multi-lens review: WIP RAG/schema + clinical design/UI + architecture/bug-hunt | Changes requested: no P0. Confirmed P1s in WIP � registryCorpusDetailHref typecheck break; ChunkLoadCache error/null poisoning across parallel hydrations; registry cleanup `::uuid` cast abort; corrector GIN unused by query path; new table-facts trgm index expression mismatch vs trgm_matches. Design: production clinical shell stays token/a11y-aligned; favourites nav multi-gradient bars and mockup hex drift fight clinical density. Residual: concurrent cache race, SECURITY DEFINER revoke gaps, schema/migration lifecycle drift, accidental pnpm-lock.yaml. | `npm run typecheck` (red: registry link callers + stale .next apps types); static SQL/expr/diff review; architecture + bug-hunt agents; design-system grep (tokens, reduced-motion, forced-colors). Not run: vitest, verify:*, ensure/browser screenshots, live Supabase/OpenAI. frontend-ui-reviewer subagent blocked by usage limit � design pass done inline. | +| 2026-07-15 | HEAD detached 570e6ba56 + WIP tree | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | thorough multi-lens review: WIP RAG/schema + clinical design/UI + architecture/bug-hunt | Changes requested: no P0. Confirmed P1s in WIP ??? registryCorpusDetailHref typecheck break; ChunkLoadCache error/null poisoning across parallel hydrations; registry cleanup `::uuid` cast abort; corrector GIN unused by query path; new table-facts trgm index expression mismatch vs trgm_matches. Design: production clinical shell stays token/a11y-aligned; favourites nav multi-gradient bars and mockup hex drift fight clinical density. Residual: concurrent cache race, SECURITY DEFINER revoke gaps, schema/migration lifecycle drift, accidental pnpm-lock.yaml. | `npm run typecheck` (red: registry link callers + stale .next apps types); static SQL/expr/diff review; architecture + bug-hunt agents; design-system grep (tokens, reduced-motion, forced-colors). Not run: vitest, verify:*, ensure/browser screenshots, live Supabase/OpenAI. frontend-ui-reviewer subagent blocked by usage limit ??? design pass done inline. | | 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #826) | 3d9ee5f44dea9edb1ef5af28f5f265d88d8b9f29 | PWA hardening implementation (plan Phase 1) | Implemented the three open findings from the 2026-07-17 PWA setup review with zero cache-semantics change: committed the rule-6 retirement worker `public/sw-kill-switch.js` with a five-test lock (`tests/pwa-kill-switch.test.ts`), bound the `offline.html` sha256 to the sw.js `CACHE_VERSION` pairing in `tests/pwa-manifest.test.ts` (drift trap closed), added the `?pwa-dev=0` local teardown to `pwa-lifecycle.tsx` with a dom test proving foreign workers and caches stay untouched, and updated `docs/pwa.md` rules 1 and 6 plus the local-dev cleanup step. Phase 0 of the approved plan (pr-policy `base_ref` checkout fix + the Set-Cookie worker-test case) was found already merged to main and skipped. | Focused Vitest 53/53. `verify:cheap` and the `verify:pr-local` unit stage green except `tests/pdf-extraction-budget.test.ts`, which fails identically on clean main in this container (child-process semantics; baselined twice). `verify:ui` 218 passed with 2 container-baselined pre-existing failures: the `ui-pwa` installability test (Chromium `in-incognito` artifact, reproduced from a clean-main detached worktree with its own server) and the `ui-smoke` document-viewer PDF-canvas mobile test (also fails on clean main `54229f0`; flagged as possible upstream regression). `format:check` clean for repo files. Conditional build/bundle stages deferred to the blocking hosted CI Build job on PR #826. No provider-backed checks run. | -| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #835) | d46f381ac27b53b1bd5ac0ef77962fbd48cf3aa7 | PWA manifest and install-UX polish (plan Phase 2) | Implemented Phase 2 of the PWA plan with cache semantics untouched: `launch_handler` navigate-existing/auto and `display_override` standalone/minimal-ui in `manifest.ts`; `monochrome-192/512` icon variants rendered as a white alpha-only silhouette from the shared brand mark via `BRAND_MONOCHROME`; a one-time iOS/iPadOS Add to Home Screen hint in `pwa-lifecycle.tsx` (30-day dismissal key, never in standalone, timer-deferred eligibility for the set-state-in-effect lint rule). Docs Installability section updated; manifest screenshots remain deferred per the production-capture precondition. Phase 2 re-scout confirmed zero upstream drift before implementation. | Focused Vitest 55/55. `verify:cheap` 2773 passed/1 failed and `verify:pr-local` unit stage identical — the lone failure is the known container-only `pdf-extraction-budget` artifact (clean-main baselined; hosted CI green on #826). `test:e2e:pwa`: privacy journey passed; icon probes validated both new monochrome PNGs; sole installability error remains the container `in-incognito` artifact. `verify:ui` 219 passed/2 failed — exactly the two clean-main-baselined container artifacts, no new failures. `format:check` clean. Build/bundle stages deferred to the blocking hosted CI Build job on PR #835. No provider-backed checks run. | -| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (Phase 3, PR #872, final reviewed head ba46c1581a3c4e87d5d5989f3eb77483c9aa8aa5) | ba46c1581a3c4e87d5d5989f3eb77483c9aa8aa5 | PWA offline-page design upgrade (plan Phase 3) | Rebuilt the `public/offline.html` visual shell on mirrored Clinical White / Aegean Graphite tokens (each value annotated with its source token): pure-white canvas, aligned text/border/hover values, system UI font stack, and the clinical-accent focus ring replacing the off-contract amber. Privacy copy, structure, forced-colors behavior, safe-area insets, and target sizes unchanged. `CACHE_VERSION` bumped to the new unique `2026-07-18-v1` with the offline.html sha256 pairing updated — the Phase 1 binding guard exercised for real and enforced the paired move. A transient typecheck failure from stale `.next/dev` route types (cross-branch dev-server state) self-resolved after server regeneration; nothing was deleted. | Focused Vitest 55/55 including the binding guard on the new pairing. `verify:cheap` 2778 passed/1 failed and `verify:pr-local` unit stage identical — the lone failure is the known container-only `pdf-extraction-budget` artifact (clean-main baselined; hosted CI green on #826/#835). `test:e2e:pwa`: the cold-offline journey rendered and asserted the redesigned page through the new-version worker; sole installability error remains the container `in-incognito` artifact. `verify:ui` 219 passed/2 failed — the same two clean-main-baselined container artifacts, no new failures. Build/bundle stages deferred to the blocking hosted CI Build job. No provider-backed checks run. | +| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #835) | d46f381ac27b53b1bd5ac0ef77962fbd48cf3aa7 | PWA manifest and install-UX polish (plan Phase 2) | Implemented Phase 2 of the PWA plan with cache semantics untouched: `launch_handler` navigate-existing/auto and `display_override` standalone/minimal-ui in `manifest.ts`; `monochrome-192/512` icon variants rendered as a white alpha-only silhouette from the shared brand mark via `BRAND_MONOCHROME`; a one-time iOS/iPadOS Add to Home Screen hint in `pwa-lifecycle.tsx` (30-day dismissal key, never in standalone, timer-deferred eligibility for the set-state-in-effect lint rule). Docs Installability section updated; manifest screenshots remain deferred per the production-capture precondition. Phase 2 re-scout confirmed zero upstream drift before implementation. | Focused Vitest 55/55. `verify:cheap` 2773 passed/1 failed and `verify:pr-local` unit stage identical ??? the lone failure is the known container-only `pdf-extraction-budget` artifact (clean-main baselined; hosted CI green on #826). `test:e2e:pwa`: privacy journey passed; icon probes validated both new monochrome PNGs; sole installability error remains the container `in-incognito` artifact. `verify:ui` 219 passed/2 failed ??? exactly the two clean-main-baselined container artifacts, no new failures. `format:check` clean. Build/bundle stages deferred to the blocking hosted CI Build job on PR #835. No provider-backed checks run. | +| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (Phase 3, PR #872, final reviewed head ba46c1581a3c4e87d5d5989f3eb77483c9aa8aa5) | ba46c1581a3c4e87d5d5989f3eb77483c9aa8aa5 | PWA offline-page design upgrade (plan Phase 3) | Rebuilt the `public/offline.html` visual shell on mirrored Clinical White / Aegean Graphite tokens (each value annotated with its source token): pure-white canvas, aligned text/border/hover values, system UI font stack, and the clinical-accent focus ring replacing the off-contract amber. Privacy copy, structure, forced-colors behavior, safe-area insets, and target sizes unchanged. `CACHE_VERSION` bumped to the new unique `2026-07-18-v1` with the offline.html sha256 pairing updated ??? the Phase 1 binding guard exercised for real and enforced the paired move. A transient typecheck failure from stale `.next/dev` route types (cross-branch dev-server state) self-resolved after server regeneration; nothing was deleted. | Focused Vitest 55/55 including the binding guard on the new pairing. `verify:cheap` 2778 passed/1 failed and `verify:pr-local` unit stage identical ??? the lone failure is the known container-only `pdf-extraction-budget` artifact (clean-main baselined; hosted CI green on #826/#835). `test:e2e:pwa`: the cold-offline journey rendered and asserted the redesigned page through the new-version worker; sole installability error remains the container `in-incognito` artifact. `verify:ui` 219 passed/2 failed ??? the same two clean-main-baselined container artifacts, no new failures. Build/bundle stages deferred to the blocking hosted CI Build job. No provider-backed checks run. | | 2026-07-18 | codex/rag-merge-final-20260718-655a | 20e5964bbfdcac0311b89c96931a43544be545a6 | RAG recovery, grounding, and latency merge closure | Reviewed the recovered historical RAG fix series against fresh `origin/main`. No additional source change was needed: current main already contains the stricter source-scoped numeric grounding, blocked-retrieval-only extractive recovery, generic LAI deterministic recovery, per-case answer latency diagnostics, and agitation lexical-path protections. The only residual branch diff was proven unreachable because every medication-chart trigger yields explicit search terms; it was intentionally not carried forward. | Full local Vitest: 301 files / 2,779 tests passed. Offline RAG fixture and production-contract validation: 36 golden cases, 21 suites, 294 tests passed. Prettier and `git diff --check` passed. `verify:cheap` reached its lint stage after all preceding static guards passed, but was blocked twice by active heavyweight jobs in other registered worktrees; it was not retried. No Supabase, OpenAI, live retrieval, production-readiness, deployment, or hosted CI command was run. | | 2026-07-17 | codex/design-audit-20260716 | 47b58ddf95826231a6057b400e7f601c403a129d + reviewed working diff | exhaustive design, accessibility, UX, interaction, route, responsive, HTML/CSS/JS/TSX, and test-coverage audit with remediation | No P0. Fixed two P1 trust/responsive defects and the confirmed P2/P3 set: false Favourites provenance/demo leakage/dead controls, Therapy phone reflow/load recovery/contrast, semantic tabs/search/filters, error focus/theme, deterministic Forms back navigation, honest unavailable actions, application dialog semantics, duplicate differential keys, skip-link target, Playwright project isolation, and route coverage. External visual-target fidelity remains unavailable. | Static 261-file/~67,944-line inventory; independent combined-diff review; focused Vitest 21/21; jsdom 24/24; architecture 6/6; accessibility browser 5/5; focused route/browser recovery; lint; TypeScript; runtime/workflow/sitemap/brand/type/icon checks; production build with 1,043 pages and client-secret scan; `git diff --check`. Canonical aggregate Vitest was Windows-runner inconclusive and full UI was not repeated after focused remediation. No provider/API checks. | | 2026-07-18 | codex/main-merge-51278-final-20260718-late | 45fa3c6c7, 14a0a898c | merge integration of 51278a70d onto fresh origin/main | Replayed the requested historical design-audit commit onto fresh `origin/main`. Kept current-main versions for five conflicts, including the regenerated drift manifest and current schema assertions. Fixed the duplicate sitemap-generator declaration, corrected redirect-section coverage, and restored the current `Clinical Guide` UI contract. | `git diff --check` and `npm run sitemap:check` passed. `npm run test` was attempted twice but blocked by the repository-wide heavy-command lock held by a separate Playwright worktree; no provider-backed checks ran. | | 2026-07-18 | origin/main framework and dependency modernization snapshot | 4057677c8b92a5e1d997ec44958764fa91f5d424 | parallel build/infra, backend, and frontend modernization audit | Changes requested. No P0. Confirmed two P1 defects: Supabase SSR 0.12 auth-cookie responses discard mandatory anti-cache headers, and reindex bypasses the server-only-aware TSX runner after mutation-capable setup. Five P2 blockers cover the Webpack-to-Turbopack production cutover, incomplete Railway image-build watch ownership, missing clean `next typegen`, Node 26 types over a Node 24 runtime, and App Router retry actions that reset without re-fetching. P3 removal-readiness debt remains in Zod and Next Image APIs. Manual rewrite zones are auth response ownership, bundler/CSP/artifact consumers, JSZip resource limits, OpenAI request typing, and React Compiler adoption in the stateful dashboard/viewer roots. | Parallel read-only source/config/test audit against the exact snapshot; Node 24.18.0/npm 11.17.0; exact-version Next 16.2.10 bundled upgrade, Turbopack, error-boundary, and codemod guidance; TypeScript 6 backend no-emit analysis and Node import probes via a separately installed exact-version local dependency tree; `git diff --check`. No install, registry outdated/audit, full repo lint/typecheck/test/build/browser/Docker, Supabase/OpenAI, deployment, or hosted CI run; this worktree had no `node_modules`. | -| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #890, plan Phase 4; single-batch implementation+ledger commit — Phase 3 landed as squash 44a4c511bc1381168474794d6f89273564659ead) | ceabc04d75fd0cea2a120d504418d44edd704bfb | App-wide performance pass: audit-then-fix + budget ratchet (plan Phase 4) | Audit on post-#872 main: enforced gzip budget +3.13% over the 1,363,382-byte baseline; analyzer treemap showed pdfjs-dist (123 KB) and cross-mode-differentials data (121 KB) already correctly lazy, and disproved the suspected forms-catalog dashboard leak (type-only import). Confirmed one real defect: the 143-line `/services` client home page value-imported `defaultServiceSlug` from `@/lib/services`, compiling the ~915 KB services snapshot (~100 KB gzip) into its route chunk. Fixed by computing the slug in the server page (`src/app/services/page.tsx`) and passing it as a prop; the client component builds its task cards from the prop. Measured result: budget swung from +3.13% to −3.97%; baseline ratcheted down 1,363,382 → 1,309,286 bytes gzip so CI locks the win. pdfjs/differentials/#718 paths deliberately untouched per audit rules. Two transient `.next/dev` generated-type corruptions from the long-lived dev server were resolved by stopping the server and setting the generated dir aside (reversible); nothing hand-deleted. | Build + `check:bundle-budget --json` before/after (artifacts in session scratchpad); `check:bundle-budget -- --update` for the ratchet; `npm run test` 2789 passed/1 failed (known container-only `pdf-extraction-budget` artifact, hosted-CI-green through #826/#835/#872); `verify:cheap` green to the same artifact; `verify:ui` 219 passed/2 failed (the two long-established container artifacts; ui-tools spec covering the services surface passed); `verify:pr-local` unit stage identical; typecheck/lint/format clean. Lighthouse not run (dev-server churn; bundle evidence sufficed for this fix set). No provider-backed checks run. | +| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #890, plan Phase 4; single-batch implementation+ledger commit ??? Phase 3 landed as squash 44a4c511bc1381168474794d6f89273564659ead) | ceabc04d75fd0cea2a120d504418d44edd704bfb | App-wide performance pass: audit-then-fix + budget ratchet (plan Phase 4) | Audit on post-#872 main: enforced gzip budget +3.13% over the 1,363,382-byte baseline; analyzer treemap showed pdfjs-dist (123 KB) and cross-mode-differentials data (121 KB) already correctly lazy, and disproved the suspected forms-catalog dashboard leak (type-only import). Confirmed one real defect: the 143-line `/services` client home page value-imported `defaultServiceSlug` from `@/lib/services`, compiling the ~915 KB services snapshot (~100 KB gzip) into its route chunk. Fixed by computing the slug in the server page (`src/app/services/page.tsx`) and passing it as a prop; the client component builds its task cards from the prop. Measured result: budget swung from +3.13% to ???3.97%; baseline ratcheted down 1,363,382 ??? 1,309,286 bytes gzip so CI locks the win. pdfjs/differentials/#718 paths deliberately untouched per audit rules. Two transient `.next/dev` generated-type corruptions from the long-lived dev server were resolved by stopping the server and setting the generated dir aside (reversible); nothing hand-deleted. | Build + `check:bundle-budget --json` before/after (artifacts in session scratchpad); `check:bundle-budget -- --update` for the ratchet; `npm run test` 2789 passed/1 failed (known container-only `pdf-extraction-budget` artifact, hosted-CI-green through #826/#835/#872); `verify:cheap` green to the same artifact; `verify:ui` 219 passed/2 failed (the two long-established container artifacts; ui-tools spec covering the services surface passed); `verify:pr-local` unit stage identical; typecheck/lint/format clean. Lighthouse not run (dev-server churn; bundle evidence sufficed for this fix set). No provider-backed checks run. | | 2026-07-18 | PR #871 / codex/design-audit-final-pr-20260718 | bb85b546e + ledger closeout | final current-main design/accessibility audit integration, hosted review resolution, and PR-readiness review | No remaining high-confidence P0-P2 defect after current-main reconciliation, two independent read-only reviews, and remediation of every confirmed review finding. The follow-ups made client demo state fail closed in production for both prototype items and set suggestions, separated local no-auth upload capability from Favourites demo treatment, kept unavailable Favourites controls focusable with accessible reasons, restored visible skip-target focus, limited Favourites selection to the wide layout that exposes its workspace, aligned upload/index semantics with each responsive rendering mode, exposed filtered Tools results as a labelled group, and kept Therapy Compass in an honest loading state until its catalogue resolves. The audit also distinguishes completed browser assertions from an incomplete valid document-source redirect case. External design-target fidelity remains unverified without an approved target. | Canonical local PR verification completed through runtime, changed-file formatting, full ESLint, TypeScript, full Vitest, webpack production build/client-secret scan, and offline RAG fixtures. Focused Therapy, navigation/auth, demo-boundary, and unavailable-control regressions passed after correcting one test-order issue; the final demo/upload boundary selection passed 4/4; scoped zero-warning ESLint, changed-file formatting, and `git diff --check` passed. The full local Chromium sweep completed 236/237 with one hydration-timing failure: the app-mode test clicked before React attached its handler. The existing handler-readiness pattern was applied; focused rerun attempts were then lock-blocked by another registered worktree, so exact-head hosted Chromium remains the required proof. Initial hosted checks, including Production UI, passed before these final follow-ups. No OpenAI, Supabase, production-data, deployment, or live clinical workflow ran. | -| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #896, plan Phase 5; content commit + this ledger follow-up) | a6c2b4e92374e9002fb00c547eb5677d01ce538c | Design-polish sweep: audit-then-fix (plan Phase 5, final phase) | Audit on post-#890 main: three strict design guards clean; full re-run of the 07-token-adoption-audit grep method shows all July 3 debt resolved (M1–M3 done, L4 reduced to the deliberate theme-aware `ring-white/N dark:ring-white/10` glass idiom, L5/L7 gone; production hex all legitimate print/brand/console/comment classes); 43-capture live sweep across 15 routes × desktop/phone + 320px spots + dark/reduced-motion/forced-colors spots found 0 overflow and 0 console errors. Three defects found and fixed: (1) forced-colors solid-button labels rendered as blank Canvas-on-Canvas backplate boxes (axe-invisible) — command controls flattened to the native HCM ButtonFace/ButtonText pairing and accent glyph tokens flipped to ButtonText inside the existing forced-colors block, regression-locked by a new ui-accessibility test; (2) tools desktop 6-up quick-action rail truncated card titles at 1440×1000 — card metrics tightened, all six titles verified unclipped; (3) privacy page rendered "systemand" from a JSX newline-adjacent-to-tag drop — explicit space, locked by a privacy-ui assertion. Dated July 18 run appended to docs/redesign/07-token-adoption-audit.md (archived design-qa.md not resurrected). | Guards + focused vitest 14/14; `verify:cheap` chain green to the known container-only pdf-extraction-budget artifact (2806/2809); `verify:ui` 220 passed/2 failed (the two long-baselined container artifacts, hosted-CI-green through #826/#835/#872/#890); `test:e2e:accessibility` 8/8 incl. the new forced-colors token test; production build + client-bundle secret scan passed; `check:bundle-budget` within tolerance vs the Phase 4 ratchet (1290.6 vs 1278.6 KiB baseline); `verify:pr-local` runtime/format/lint/typecheck/build/rag-fixtures green with the same sole unit-suite artifact. `verify:release` not run (provider-backed; awaits explicit confirmation). No provider-backed checks run. | +| 2026-07-18 | claude/clinical-kb-pwa-review-asi3wb (PR #896, plan Phase 5; content commit + this ledger follow-up) | a6c2b4e92374e9002fb00c547eb5677d01ce538c | Design-polish sweep: audit-then-fix (plan Phase 5, final phase) | Audit on post-#890 main: three strict design guards clean; full re-run of the 07-token-adoption-audit grep method shows all July 3 debt resolved (M1???M3 done, L4 reduced to the deliberate theme-aware `ring-white/N dark:ring-white/10` glass idiom, L5/L7 gone; production hex all legitimate print/brand/console/comment classes); 43-capture live sweep across 15 routes ?? desktop/phone + 320px spots + dark/reduced-motion/forced-colors spots found 0 overflow and 0 console errors. Three defects found and fixed: (1) forced-colors solid-button labels rendered as blank Canvas-on-Canvas backplate boxes (axe-invisible) ??? command controls flattened to the native HCM ButtonFace/ButtonText pairing and accent glyph tokens flipped to ButtonText inside the existing forced-colors block, regression-locked by a new ui-accessibility test; (2) tools desktop 6-up quick-action rail truncated card titles at 1440??1000 ??? card metrics tightened, all six titles verified unclipped; (3) privacy page rendered "systemand" from a JSX newline-adjacent-to-tag drop ??? explicit space, locked by a privacy-ui assertion. Dated July 18 run appended to docs/redesign/07-token-adoption-audit.md (archived design-qa.md not resurrected). | Guards + focused vitest 14/14; `verify:cheap` chain green to the known container-only pdf-extraction-budget artifact (2806/2809); `verify:ui` 220 passed/2 failed (the two long-baselined container artifacts, hosted-CI-green through #826/#835/#872/#890); `test:e2e:accessibility` 8/8 incl. the new forced-colors token test; production build + client-bundle secret scan passed; `check:bundle-budget` within tolerance vs the Phase 4 ratchet (1290.6 vs 1278.6 KiB baseline); `verify:pr-local` runtime/format/lint/typecheck/build/rag-fixtures green with the same sole unit-suite artifact. `verify:release` not run (provider-backed; awaits explicit confirmation). No provider-backed checks run. | | 2026-07-19 | all remote feature branches and registered worktrees against `origin/main` through PR #899 | 8242fa63d5f5b79fc770c9ae4f633e3a784b80e1 | branch/worktree cleanup, useful-work recovery, and protected-main merge closure | Deleted 122 stale or closed remote feature refs with exact SHA leases; four additional merged PR branches were removed by the protected-main PR workflow. Removed 32 obsolete, superseded, or merge-proven worktree registrations. Recovered useful dirty RAG work into PR #901 (deterministic and opt-in semantic reranking) and PR #902 (retrieval phase latency telemetry), preserved follow-up decisions in `docs/process-hardening.md`, and recovered four missing historical review rows. PRs #897, #899, #901, and #902 are merged with green exact-head checks and zero unresolved review threads. A detached full-repo-review worktree is deliberately retained because its ownership/activity could not be safely disproved; one unregistered `node_modules` junction residue is also retained because deletion was denied by local safety policy. | Fresh fetch/prune; full GitHub PR/check/thread inventory; `git worktree list --porcelain`; cherry-pick-aware right-only logs; exact leased remote deletes; exact-old-value local ref deletes; clean-worktree, path, and merged-PR proof before every removal. PR #899 local proof: focused Vitest 31/31, changed-file ESLint, `verify:cheap` 317 files / 2,879 tests, and `verify:ui` 239/239; exact-head hosted checks all passed. PR #901 local proof: `verify:cheap` 316 files / 2,870 tests; PR #902 focused Vitest 8/8 plus ESLint and typecheck. No OpenAI, Supabase, live clinical, deployment, or production-data workflow ran; provider-backed semantic canary evaluation remains approval-gated. | | 2026-07-19 | main / `codex/supabase-database-review` | 4034d2e60ebb6616130ff17bf3cb69368f36f8f6 + reviewed working diff | live `Clinical KB Database` security, migration, schema-drift, integrity, and performance review against current repo | Confirmed and remediated a P1 privacy defect: 601 private-document title-vocabulary rows were reachable by the service-role query corrector; the live public-only sync/backfill now reports zero private or out-of-scope rows. Applied the committed retrieval-count bound, audit-metadata minimization, registry cleanup/index, public-title corrector, and atomic summary-rate-limit migrations. The missing FK and registry indexes are present and no invalid indexes remain. A second P1 was found in the untracked live `ingestion-worker`: gateway JWT verification accepted any project JWT before privileged direct-Postgres job processing. Recovered the deployed source into the repo, restricted it to POST plus a gateway-verified `service_role` claim, expanded the Deno checker to every tracked Edge Function, and deployed exact-matching v13 with JWT verification enabled. Review also exposed a repo mirror/test gap: the count-clamp migration was not reflected in `schema.sql`; the branch now mirrors it and locks both sources in the focused test. Remaining hosted blocker: `postgres` cannot assume managed `supabase_admin`, so the fail-closed default-ACL migrations and final title-word constraint/trigger migration remain unapplied; the intentional service-role-only table still produces one INFO no-policy advisor. | Supabase connector project identity, migration and Edge Function inventory, full drift snapshot comparison, security/performance advisors, catalog integrity/ACL/index queries, Vault JWT-role compatibility check, post-apply invariants, exact deployed-source hashes, and unauthenticated live rejection (401); focused retrieval/schema/drift Vitest 82/83 with only manifest freshness failing; Edge/retrieval auth 9/9; Deno check for both functions; offline RAG 36 cases / 294 tests; function-grant guard; scoped ESLint, Prettier, and `git diff --check`. `check:supabase-project` was attempted but stopped before provider contact because local project env vars are unset. `drift:manifest` was blocked because Docker Desktop could not start and was cleaned up. `verify:cheap`, `verify:pr-local`, production-readiness, OpenAI, hosted CI, broader deployment, and commit/push were not run. | -| 2026-07-19 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | 87d4a479cd320220c91eba5c91e253e843dcc98f | final Mode phone-sheet review + merge-readiness | No remaining high-confidence P0/P1. Fixed residual P2 Sheet backdrop drag-dismiss (gesture must start on dimmed area). Phone ≤639px Mode menu uses bottom Sheet; desktop absolute dropdown/keyboard/blur contracts preserved. Python PDF extractor resolves python/python3 and process-group kills reliably. Clinical governance: UI + fail-closed extractor binary resolution only; no answer/source/privacy surface change. Safe to merge after hosted required checks green on this HEAD. | `verify:cheap` 2954 passed; Mode Playwright 5/5 (phone sheet/backdrop/desktop/keyboard/a11y); `check:production-readiness:ci` READY; prettier format check fixed for CI Static; no OpenAI/live Supabase writes; full `verify:ui`/`verify:release` not required beyond Mode proofs. | +| 2026-07-19 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | 87d4a479cd320220c91eba5c91e253e843dcc98f | final Mode phone-sheet review + merge-readiness | No remaining high-confidence P0/P1. Fixed residual P2 Sheet backdrop drag-dismiss (gesture must start on dimmed area). Phone ???639px Mode menu uses bottom Sheet; desktop absolute dropdown/keyboard/blur contracts preserved. Python PDF extractor resolves python/python3 and process-group kills reliably. Clinical governance: UI + fail-closed extractor binary resolution only; no answer/source/privacy surface change. Safe to merge after hosted required checks green on this HEAD. | `verify:cheap` 2954 passed; Mode Playwright 5/5 (phone sheet/backdrop/desktop/keyboard/a11y); `check:production-readiness:ci` READY; prettier format check fixed for CI Static; no OpenAI/live Supabase writes; full `verify:ui`/`verify:release` not required beyond Mode proofs. | | 2026-07-20 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | f6522603eedabb88c311a6f7df172505673d087e | main sync + merge-readiness revalidation | Re-merged moving `origin/main` (kept `PR_POLICY_BODY.md` for CI body sync; adopted main `python-bin` helper; retained PDF process-tree kill hardening). Mode phone Sheet path still present. PR Policy had a race with Sync PR policy body on prior tip; body now contains checked governance items matching main policy. No new P0/P1 in product scope. Merge-ready once exact-head required checks are green. | Local after merge: focused Vitest for extractor/sheet 1127 passed; Mode sheet symbols intact in `master-search-header.tsx`. Hosted: awaiting Static/Unit/Build/Production UI/PR policy on this HEAD. No OpenAI/live Supabase writes. | | 2026-07-20 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | ddbc549a6af469b61c112373d6a5099cb04810d0 + ledger | hydration fix + merge-readiness | Fixed P1 UI regression: phone `matchMedia` in `useState` caused React #418 hydration pageerrors on DSM/specifier/differential phone journeys in Production UI. Gate now SSR-safe (`useState(false)`), syncs after mount, and refreshes from live matchMedia on Mode open. Merged `#940` header inset. | Local: route-coverage 3/3 previously failing; Mode smoke 3/3; audit-navigation + focused header/sheet Vitest green. Hosted: awaiting exact-head Production UI/PR required. No OpenAI/live Supabase writes. | | 2026-07-20 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | 792142c88191e201311238984b1530f784430f0e | exact-head merge-ready CI | No remaining high-confidence product defect. Hosted required checks green on tip after Prettier format fix. Residual: branch protection still needs a human approving review (`mergeStateStatus=BLOCKED`, empty `reviewDecision`). | Hosted exact-head: PR policy, Sync PR policy body, Static, Safety, Unit, Build, Production UI, Advisory UI, PR required all SUCCESS. Local Mode Playwright 5/5 + route-coverage hydration 3/3. No OpenAI/live Supabase writes. | | 2026-07-20 | PR #935 / `cursor/mobile-mode-menu-sheet-efee` | e05cd0b8ac1ef4dbc9b30307e3715fc437b1540e + ledger | CodeRabbit findings + merge push | Closed unresolved review threads: removed PR-head `GOVERNANCE_ALL_CHECKED` self-attest (aligned sync with main + workflow guard), restored strict checklist regex, fixed unset `PYTHON_BIN` test path. Hydration Mode-sheet thread already resolved. Local: full unit 2971 passed; Mode Playwright 5/5; route-coverage 3/3; pr-policy self-test + workflow guard green. | Awaiting exact-head hosted CI; then human approving review remains the only merge gate. No OpenAI/live Supabase writes. | | 2026-07-19 | cursor/safari-edge-to-edge-f46b (PR #933) | 15061964dd2fdf9665f72b7282f5cc81c736e57f | final Safari edge-to-edge / phone dock reserve review + merge readiness | No high-confidence P0-P1. Confirmed implementation: shared reserve module collapses to 0.75rem when dock hides; shell uses block scrollport + inner mobile-composer-reserve-pad so clearance contributes to scrollHeight; child dock-sized env(safe-area) pads removed; DocumentViewer owns its dock pad. Review polish: formulation/specifier max-sm:min-h-0 alignment, document-route ownership simplification, hidden-pad CSS token guard. Residual P2/P3 only: differentials compare zero-inset backdrop margin, idle 2rem vs max(2rem,safe-area) ~2px, unused-looking #main-content padding transition still needed by ClinicalDashboard. Merge-ready. | Local: format/lint/typecheck/knip/budgets pass; unit 2952 passed with only pre-existing pdf-extraction-budget (python ENOENT, also fails on clean main); production build + client-bundle secret scan pass; focused Chromium composer suite 6/6 (forms hide, tablet/desktop clearance, differentials compare, service-detail endpoint, document-viewer hide, long-answer dock). Hosted CI on prior head fully green including Production UI; polish head re-checked before merge. No OpenAI/live Supabase/provider calls. | | 2026-07-19 | cursor/hide-favourites-guest-mode-a26d (PR #934) | 23d05539320427ea3f994eaec3c2e95daa481492 | Favourites guest mode-switcher/sidebar auth gate review | No P0/P1. Primary request correctly wired: MasterSearchHeader fails closed; ClinicalDashboard and global-search-shell both pass session favouritesAccessible to mode menu + desktop/mobile showAccountLibrary; selectSearchMode/changeMode guarded; /favourites stays on-page with signup for guests. Residual P2: guest discovery still possible via composer cross-mode Favourites chips and Tools catalog Saved workflows (content remains gated on /favourites). P2 test gap: wiring tests are source-string, not MasterSearchHeader DOM. P3: header passes precomputed access as authenticated plus demoMode (redundant OR, intentional demo reopen). | Focused Vitest favourites-auth-gate + app-modes 26/26; prior verify:cheap green on branch; browser guest check: sidebar omits Your library/Favourites, /favourites shows signup gate; mode-menu automation inconclusive. No OpenAI/Supabase/hosted CI. | -| 2026-07-19 | cursor/hide-favourites-guest-mode-a26d (PR #934) | 04192653 | Final Favourites total guest-blackout review + merge readiness | No P0/P1. Fixed residual P2s: rankToolRecords now fails closed by default; mode/chip filters stop double-ORing demoMode; gated deep-link mode chrome falls back to Answer; MasterSearchHeader mode-menu DOM tests added. Guest discovery closed for mode menu, sidebar, cross-mode chips, Tools Saved, universal tools ranking, also-matches, prefetch. Intentional residual: direct /favourites signup gate; mockup routes. PR body appears overwritten by unrelated Sync PR policy content — agent posted corrective comment (403 on body edit). | Focused Vitest 37/37; verify:cheap green; verify:pr-local green (build + client-secret scan + RAG fixtures); browser guest Tools/sidebar/favourites proof earlier. No OpenAI/Supabase writes. | +| 2026-07-19 | cursor/hide-favourites-guest-mode-a26d (PR #934) | 04192653 | Final Favourites total guest-blackout review + merge readiness | No P0/P1. Fixed residual P2s: rankToolRecords now fails closed by default; mode/chip filters stop double-ORing demoMode; gated deep-link mode chrome falls back to Answer; MasterSearchHeader mode-menu DOM tests added. Guest discovery closed for mode menu, sidebar, cross-mode chips, Tools Saved, universal tools ranking, also-matches, prefetch. Intentional residual: direct /favourites signup gate; mockup routes. PR body appears overwritten by unrelated Sync PR policy content ??? agent posted corrective comment (403 on body edit). | Focused Vitest 37/37; verify:cheap green; verify:pr-local green (build + client-secret scan + RAG fixtures); browser guest Tools/sidebar/favourites proof earlier. No OpenAI/Supabase writes. | | 2026-07-19 | cursor/pr-policy-body-cleanup-f46b (PR #942) + PR #933 closeout | 7c8e6aadf0890b143372fb96f13d9de47a416db9 | post-merge CI triage for #933 PR-policy red check | PR #933 product merge (`bd864de0`) already on main with green post-merge main CI (Static/Unit/Build/Production UI/SAST/Docker). Sole remaining red check on #933 was post-ready PR policy against a stale synced body with unchecked governance boxes (from leftover `PR_POLICY_BODY.md` introduced by #932). Token cannot edit merged PR bodies (403). Removed the stale template via #942 so Sync PR policy body no longer reapplies unchecked governance. Local composer regression 6/6 on main; reserve unit 11/11. No product regression. | Hosted #933 pre-merge + main push green; #942 required checks green then squash-merged; focused Chromium composer 6/6; reserve Vitest 11/11. No OpenAI/Supabase provider calls. | | 2026-07-19 | cursor/documents-search-header-3eab / PR #936 | a7feaa3033180b672cfafaaaf75dc75088ebf052 | documents search header redesign final review + merge readiness | No remaining high-confidence P0-P1. Implemented identity-first results chrome, unified Sort/type-filter/Library toolbar, removed documents Also-in-library strip, relocated ScopeAndGovernanceNotice under controls, fixed Prettier CI failure and memo-busting empty warnings default, synced accurate PR policy body then removed the stale leftover, and repeatedly merged origin/main so squash auto-merge is not blocked behind/dirty. Hosted required checks including Production UI passed on the integrated head. | Local: typecheck/lint/format; focused Playwright documents `@critical` + deferred source/admin + forms sort persistence; design-system/icon-scale/maintainability; build + RAG fixtures; verify:pr-local units with known pdf-extraction-budget env artifact also on clean main. Hosted: PR policy, Static, Unit, Build, Production UI, Advisory UI, PR required green. No OpenAI/live Supabase writes. | | 2026-07-19 | cursor/specifiers-results-ui-7850 (PR #941) | ef9bcf23bb93cbaddddeda3aedf08e6d037e2f18 | Specifiers results UI elevation final review + merge readiness | No high-confidence P0-P1. Ranking blurb removed; solid Aegean subnav kept vs soft family chips; diagnosis control content-sized with min-h-tap; match cards single Open hit target with motion-reduce and guarded typical language. Re-synced origin/main after #936 ledger append conflict. Residual risk: hosted Production UI must finish green on exact head; full verify:cheap still hits known container-only pdf-extraction-budget failures also seen on main. | Local: format:changed; lint/typecheck on touched files; design-system + icon-scale; vitest specifiers+reserve 10/10; Playwright ui-specifiers 5/5 including filter interactions; production build + client-bundle secret scan; offline RAG fixtures 36/21. PR marked ready for review. No OpenAI/live Supabase provider calls. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 2df3181859345339d777ac814908b3095cea36fd | ModeHomeMain contentAlign fix for differentials mobile clipping | No high-confidence P0–P2. Fix correctly introduces exclusive `contentAlign` (`center` \| `start` \| `startOnPhone`), migrates therapy/formulation/specifiers off broken className justify overrides, top-aligns differentials results via `autoRunSearch`, and guards with static + Playwright fold assertions. Residual: DSM/forms/services still default-center; justify-strip leaves variant prefixes; Playwright `0.55*vh` upper bound may flake if header band grows; Chip compact overrides still dual-utility via `cn()`. | Static diff vs `origin/main`; inventory of all `ModeHomeMain` call sites; justify-strip regex probe; `npx vitest run tests/mode-home-main-align.test.ts` 4/4. Not run: Playwright/`verify:ui` (browser), `verify:cheap`/`verify:pr-local`, provider-backed checks. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 74c370d81342dd729398dc2b40ba3158ea30f1db | follow-up review + residual polish (policy body, align API, UI flake) | Prior residuals closed: `PR_POLICY_BODY.md` rewritten for #938 (Sync PR policy body was overwriting with stale #932 text); `withoutJustifyUtilities` strips prefixed utilities; Chip uses exclusive `density` type scale; DSM/forms/services use `startOnPhone`; Best Answer fold bound uses header+240px; `ui-overlap` waits for a single `header#search`. No remaining high-confidence P0–P2 in the ModeHomeMain/differentials mobile scope. | `npx vitest run tests/mode-home-main-align.test.ts` 5/5; Prettier on touched files. Playwright focused rerun and hosted Production UI expected after push. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | b62d414ca9001fbc1ac0d50b315450e107751d67 | merge-readiness after policy + hosted UI | No remaining high-confidence P0–P2. PR description sync + `verify:ui` evidence keep PR policy green; hosted Production UI / PR required green on exact head. | Local: align Vitest 5/5; ui-overlap 12/12; differentials fold Playwright 1/1. Hosted: Production UI, Advisory UI, Static, Unit, Build, PR policy, PR required, Sync PR policy body all pass. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | f6682cc08eb0fcc0b8dd170d5c9358b3fedc0c0d | final meticulous review + safe-merge handoff | No high-confidence P0–P2. Forms/services now centre when unseeded/loading and use `startOnPhone` only when seeded (avoids sparse empty homes). CodeRabbit risk-line comment dispositioned as stale #932 body confusion. Residual: branch protection still requires a human approving review before squash auto-merge can land. | Local: align Vitest 5/5; focused Chromium overlap+fold 13/13; verify:cheap/pr-local unit stages 2953/2955 with only known container `pdf-extraction-budget` Python ENOENT failures; format/lint/typecheck/RAG fixtures pass; local `next build` blocked by running ensure server (hosted Build green). Hosted exact-head: Production UI, PR required, Unit, Static, Build, PR policy all SUCCESS. Enabled squash `--auto` merge. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | e177b5e877aa2f834b3a601fa37679fa3e77b0e3 | merge main (#933) + post-merge revalidation | Merged `origin/main` (Safari edge-to-edge #933) with ledger conflict resolved by keeping both review rows. No product conflicts; `contentAlign`, Chip density, and Best Answer fold asserts intact. No new P0–P2. Still blocked only by required human approving review; squash auto-merge remains enabled. | Local after merge: align+composer-reserve Vitest 9/9; focused Chromium dock-hide + fold + compare-dock 3/3. Hosted on merge head: Production UI, PR required, Unit, Static, Build, PR policy all SUCCESS. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 3a775d4fd9a44e97388c0041cb421f06265a7721 | fresh final review (user-requested) + main sync (#937) | No high-confidence P0–P2. Product delta unchanged vs prior merge-ready head; #933 reserve + #938 contentAlign remain complementary. Merged `origin/main` (#937) cleanly. Follow-up: dropped `PR_POLICY_BODY.md` when syncing #942 so this PR does not reintroduce the stale template; live PR description already correct. Residual: required human approving review. | Local: align+composer-reserve Vitest 9/9; focused Chromium overlap+fold+compare 14/14. Hosted CI green on prior tip. | -| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | efe472fac3489473e2465da2d92980508c20fd81 | merge main (#934 favourites) + #941 sync | Merged favourites guest-gate (#934) then Specifiers results UI (#941). Product conflicts none: kept `contentAlign="startOnPhone"` on Specifiers home while taking #941 results chrome. `ui-overlap` gotoHome wait conflict resolved with settled single-header short-circuit. No new P0–P2. Residual: human approving review required for squash auto-merge. | Local: align Vitest; favourites+app-modes+tools 42 tests; Chromium ui-overlap+ui-tools 95/95; verify:cheap unit stage green. Hosted CI green on pre-#941 tip; re-running after this merge. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 2df3181859345339d777ac814908b3095cea36fd | ModeHomeMain contentAlign fix for differentials mobile clipping | No high-confidence P0???P2. Fix correctly introduces exclusive `contentAlign` (`center` \| `start` \| `startOnPhone`), migrates therapy/formulation/specifiers off broken className justify overrides, top-aligns differentials results via `autoRunSearch`, and guards with static + Playwright fold assertions. Residual: DSM/forms/services still default-center; justify-strip leaves variant prefixes; Playwright `0.55*vh` upper bound may flake if header band grows; Chip compact overrides still dual-utility via `cn()`. | Static diff vs `origin/main`; inventory of all `ModeHomeMain` call sites; justify-strip regex probe; `npx vitest run tests/mode-home-main-align.test.ts` 4/4. Not run: Playwright/`verify:ui` (browser), `verify:cheap`/`verify:pr-local`, provider-backed checks. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 74c370d81342dd729398dc2b40ba3158ea30f1db | follow-up review + residual polish (policy body, align API, UI flake) | Prior residuals closed: `PR_POLICY_BODY.md` rewritten for #938 (Sync PR policy body was overwriting with stale #932 text); `withoutJustifyUtilities` strips prefixed utilities; Chip uses exclusive `density` type scale; DSM/forms/services use `startOnPhone`; Best Answer fold bound uses header+240px; `ui-overlap` waits for a single `header#search`. No remaining high-confidence P0???P2 in the ModeHomeMain/differentials mobile scope. | `npx vitest run tests/mode-home-main-align.test.ts` 5/5; Prettier on touched files. Playwright focused rerun and hosted Production UI expected after push. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | b62d414ca9001fbc1ac0d50b315450e107751d67 | merge-readiness after policy + hosted UI | No remaining high-confidence P0???P2. PR description sync + `verify:ui` evidence keep PR policy green; hosted Production UI / PR required green on exact head. | Local: align Vitest 5/5; ui-overlap 12/12; differentials fold Playwright 1/1. Hosted: Production UI, Advisory UI, Static, Unit, Build, PR policy, PR required, Sync PR policy body all pass. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | f6682cc08eb0fcc0b8dd170d5c9358b3fedc0c0d | final meticulous review + safe-merge handoff | No high-confidence P0???P2. Forms/services now centre when unseeded/loading and use `startOnPhone` only when seeded (avoids sparse empty homes). CodeRabbit risk-line comment dispositioned as stale #932 body confusion. Residual: branch protection still requires a human approving review before squash auto-merge can land. | Local: align Vitest 5/5; focused Chromium overlap+fold 13/13; verify:cheap/pr-local unit stages 2953/2955 with only known container `pdf-extraction-budget` Python ENOENT failures; format/lint/typecheck/RAG fixtures pass; local `next build` blocked by running ensure server (hosted Build green). Hosted exact-head: Production UI, PR required, Unit, Static, Build, PR policy all SUCCESS. Enabled squash `--auto` merge. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | e177b5e877aa2f834b3a601fa37679fa3e77b0e3 | merge main (#933) + post-merge revalidation | Merged `origin/main` (Safari edge-to-edge #933) with ledger conflict resolved by keeping both review rows. No product conflicts; `contentAlign`, Chip density, and Best Answer fold asserts intact. No new P0???P2. Still blocked only by required human approving review; squash auto-merge remains enabled. | Local after merge: align+composer-reserve Vitest 9/9; focused Chromium dock-hide + fold + compare-dock 3/3. Hosted on merge head: Production UI, PR required, Unit, Static, Build, PR policy all SUCCESS. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | 3a775d4fd9a44e97388c0041cb421f06265a7721 | fresh final review (user-requested) + main sync (#937) | No high-confidence P0???P2. Product delta unchanged vs prior merge-ready head; #933 reserve + #938 contentAlign remain complementary. Merged `origin/main` (#937) cleanly. Follow-up: dropped `PR_POLICY_BODY.md` when syncing #942 so this PR does not reintroduce the stale template; live PR description already correct. Residual: required human approving review. | Local: align+composer-reserve Vitest 9/9; focused Chromium overlap+fold+compare 14/14. Hosted CI green on prior tip. | +| 2026-07-19 | PR #938 / `cursor/fix-differentials-results-top-d760` | efe472fac3489473e2465da2d92980508c20fd81 | merge main (#934 favourites) + #941 sync | Merged favourites guest-gate (#934) then Specifiers results UI (#941). Product conflicts none: kept `contentAlign="startOnPhone"` on Specifiers home while taking #941 results chrome. `ui-overlap` gotoHome wait conflict resolved with settled single-header short-circuit. No new P0???P2. Residual: human approving review required for squash auto-merge. | Local: align Vitest; favourites+app-modes+tools 42 tests; Chromium ui-overlap+ui-tools 95/95; verify:cheap unit stage green. Hosted CI green on pre-#941 tip; re-running after this merge. | | 2026-07-20 | cursor/documents-search-header-3eab / PR #936 | bdc333a9fa7e420e2beb2f146c6f271196869cb5 (squash on main) | post-merge closeout + branch-cleanup | Squash-merged to main. Product proof on main: `DocumentResultsControls`, identity-first documents results chrome, governance notice under controls, Also-in-library strip removed from documents results path. Remote feature ref already deleted by protected-main workflow; local tip `fd559a07` retained only merge/review commits with no unique product patch vs main. | Hosted pre-merge and post-merge required checks green (Static/Unit/Build/Production UI/PR required). Squash content proof via main tree symbols; remote `ls-remote` empty after prune; local branch deleted after this ledger row. No OpenAI/Supabase provider calls. | | 2026-07-20 | cursor/fix-ui-overlap-duplicate-header-3eab / PR #944 | 08181b8b45cf23d53ff7fb8682fb5f83f4417fb0 (squash on main) | post-merge closeout + branch-cleanup | Squash-merged to main. Product proof: `gotoHome` pins `/?mode=answer` and waits for exactly one `header#search` before overlap measurement, closing the landing-preference dual-banner flake that failed Production UI then PR required on #936. Remote feature ref already deleted; local tip `418de1b9` is merge-only after squash. | Local before merge: verify:pr-local (2961 unit) + Chromium ui-overlap 12/12. Hosted exact-head and post-merge: Production UI, PR required, Static, Unit green (Build skipped for test-only). No OpenAI/Supabase provider calls. | | 2026-07-19 | cursor/mobile-header-new-chat-inset-66c0 (PR #940) | 84eb0b6c3782e27fbbd1ec79b87b10327802ec1e | final mobile header new-chat edge inset review + merge readiness | No high-confidence P0-P1. Root cause: unlayered `@media (max-width:639px)` zeroed `.edge-glass-header` padding and beat `@layer components`. Fixed with tokenized `--header-edge-pad: 1rem` shared by layered base + unlayered phone guard; Playwright symmetry checks at 360/390; source contract blocks a `max(0px, safe-area)` regression. Merged latest `origin/main` (including #933/#942/#943) while keeping the header-edge-pad token. Residual: headless Chromium cannot exercise asymmetric safe-area `max()`; DocumentViewer gains the same pad but is outside the symmetry test. | Local geometry probe 360/390/640 = 16px/16px symmetric; CSS contract Vitest 5/5; `ui-overlap` Chromium 14/14; prior `verify:ui` 242/242 on the functional head; `verify:cheap` unit suite hit only the known container-only `pdf-extraction-budget` python ENOENT artifact (also fails on clean main / hosted-CI-green elsewhere). PR marked ready; squash auto-merge enabled. No OpenAI/live Supabase/provider calls. | -| 2026-07-20 | origin/main PWA-surface review, window `ef042ca..e128384` (44+ commits; explicit user request) + phone install-sheet redesign (this branch, content commit d8d8c4a) | e1283846647b20cd49ca6ae6920a7c76f2b945d7 | PWA-version review of new progress + install-notification design elevation | Sweep verdict (agent-verified): only #905/#897 (this program's own work) touched PWA surfaces in the window — sw.js CACHE_VERSION `2026-07-18-v1` and its offline.html binding, manifest (7 icons incl. monochrome; screenshots deliberately absent), icons route, kill-switch, and next.config headers all unchanged, so the privacy contract holds by construction. Geometric risk from five composer/dock-space reworks (#933 mobile-composer-reserve, #932, #930, #922, #899) probed live at 390×844: the non-install notice stack keeps correct clearance at rest (offline card bottom 744/844 with the 5.5rem gutter) and the stack's offset is now a custom property (`--pwa-notice-bottom-gap`) for one-line re-anchoring if composer geometry moves again. Redesign: install prompt + iOS hint present as a native bottom sheet on phones (full-bleed, flush bottom, grip bar matching #935's sheet language, real app icon identity via /icons/icon-192, Free/no-store meta row, two accent step chips for Share→Add to Home Screen as aria-hidden reinforcement of the unchanged accessible sentence); ≥640px keeps the #905 card/toast placements; region names, button names, and test-locked sentences unchanged. | Focused vitest 56/56 across the four PWA suites; `verify:cheap` 2971/2975 (sole fail = known container-only pdf-extraction-budget artifact); `test:e2e:pwa` privacy/offline green (installability fail = known container `in-incognito` artifact); `verify:ui` 243 passed/2 failed (the two long-baselined container artifacts); production build + client-bundle secret scan + bundle budget within tolerance (1303.4 vs 1278.6 KiB baseline; sheet adds ~0 JS); visual evidence at 390 light/dark/iOS-hint + 768 + 1440 with bounding-box math (full-bleed flush-bottom on phone; card/toast intact above). No provider-backed checks run. | -| 2026-07-20 | Credentialed release-gate checkpoint closeout (workflow_dispatch on main `7ec25d9`; user-authorized ≤$10, single dispatch each) | 7ec25d9675dea13635fa4a895af88c93da694a42 | Credentialed half of the release gate: CI dispatch + live eval canary | CI dispatch: 9/10 jobs green (unit coverage, build, Chromium production journeys, migration replay on local Supabase emulator, production-readiness CI-safe, policy self-tests, static/safety/scope). `release-browser-matrix` (WebKit/Firefox) CANCELLED twice by main-churn: ci.yml `concurrency: CI-${ref}, cancel-in-progress: true` kills in-flight dispatch runs on every main push and this repo merges every few minutes — livelock confirmed at the 2-attempt cap; WebKit/iOS verification remains outstanding with three human options (quiet-window dispatch, the weekly scheduled run, or a one-line dedicated concurrency group for the matrix job — operational-risk change, not applied). Eval canary: golden retrieval eval FAILED 4/36 (document_recall@5 0.944, ndcg@10 0.923, force_embedding_failure_count 0, no 429s — vector layer healthy, NOT the documented vector-ptsd transient class); the July 17 dispatch PASSED this step pre-#901, so the regression window implicates #901's deterministic semantic reranking (lithium-therapy-monitoring shows three unrelated documents with byte-identical rerank scores burying the lithium guideline; two other failures add fixture-vs-corpus identity components; answer-quality subset — the July 17 failure — never ran). NO canary re-run per plan (deterministic, not transient); retrieval is clinical-path and deferred to a human decision. Provider spend ≈ $1–2 (one canary run's embeddings); matrix/CI runs $0. | actions_run_trigger dispatches + rerun_failed_jobs (attempt 2); job-level conclusions and log excerpts from runs 29675875530 (both attempts), 29675878737 (July 19 canary), and 29567502452 (July 17 baseline). No local provider calls; secrets never left GitHub Actions. | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: ci.yml concurrency) | 79aaacf04e64f753c480dd957a81ac9be6acbb43 | CI workflow concurrency: stop main churn cancelling dispatch/schedule runs | One-line group expression: workflow_dispatch/schedule events now get a per-run concurrency group (github.run_id) while push/PR keep the shared ref group with cancel-in-progress — fixes the release-browser-matrix livelock (cancelled twice on 2026-07-19/20 by main merges mid-run; the weekly Sunday 18:00 UTC scheduled run was subject to the same cancellation). release-browser-matrix is not a required branch-protection check; pin/scope checkers do not constrain the concurrency block. Accepted side effect: deliberate runs can overlap push runs. Rollback: plain revert. | check:github-actions PASS; check:ci-scope PASS; format:check PASS (repo files; local-only .claude/settings.local.json warning is gitignored) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: #901 rerank regression closeout) | fd5dcd1582e1c7aa8bf92ff097575e0c68aa930d | #901 rerank regression: baseline re-eval + offline guard net + saturated-tie fix | Baseline eval-canary dispatch on remediated main b3ae061 (run 29731533081) PASSED — golden retrieval 36/36 + answer-quality green, confirming #913-#926 closed the live 4/36 regression (July 19 failing run tested the raw #901 state; fixes landed 1-8h after it, never re-evaled until now). Residual defect found by new offline repro and fixed: with byte-identical imputed fast-path primaries, selection's clamped keys tie exactly and the chunk-id fallback decides, which secondStageScore's position adjustment launders into releaseRankScore (buried the CIWA answer doc in repro); fix = contentRankScore carried on RetrievalCandidate as tie-break between clamped rerankScore and chunk id, never added to scores. Amended #901's own never-live-validated saturated-tie pin to content-rank-then-id. Guards: tests/rag-fast-path-ordering.test.ts (4 end-to-end eval-shape repros) + ranking-tuning gates (4 golden-mapped hard negatives at production weights + full-snapshot high-risk). Fixture aliases NOT changed (Step C not triggered — identity cases pass live). | Targeted 4-suite vitest 37/37; npm run test 2981 passed (sole fail = container-only pdf-extraction-budget artifact); verify:cheap green through all 18 pre-test checks incl. lint+typecheck; check:production-readiness PASS on substantive checks (2 FAILs = documented missing-secret class in this container); build + client-bundle scan + check:rag:fixtures PASS | -| 2026-07-20 | claude/phone-scroll-fix (PR #993) | f0f4c42e7 | Phone scroll "locks to bottom" regression from #964 + all-pages phone scroll audit + guardrails | Root cause: #964's phone mode-home dock made one hide-on-scroll event release ~180-260px of scroll geometry (header grid collapse + reserve-pad shrink) — more than a short mode home's remaining runway, so scrollTop clamps onto the new bottom and a 12px up-drag snaps it back (oscillation; measured 266→84px runway, 2 flips/gesture on /formulation @390×844). Invisible to all gates because the suite-wide reducedMotion:"reduce" disables the causal transitions. Fix: collapse-budget gate in computeScrollHideUpdate (hosts report the would-be geometry release via readChromeCollapseBudget; hide refused without runway to absorb it; budget-less consumers unchanged; bottom-clamp guard untouched). Bonus latent bug fixed: DocumentViewer's one-shot #main-content discovery could hold a detached node after shell remounts (viewer hide-on-scroll dead); observer now persists. ui-smoke bottom-hide scenario updated to the gate contract. New 18-test sweep tests/ui-phone-scroll.spec.ts (10 mode homes + 3 dashboard modes + 4 long routes, motion enabled, simulated PWA insets) verified to fail red pre-fix. Residual: real-device iOS momentum clamping is device-only — user PWA confirmation requested post-deploy. | vitest focused 24/24 + mobile-composer-reserve; verify:cheap 3020 green; ui-phone-scroll chromium 18/18 + webkit advisory 18/18; ui-formulation+ui-tools+ui-smoke 180/180; verify:ui 264/264; verify:pr-local green (format/build/bundle-scan/RAG fixtures). No provider calls. | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: coverage tie-break follow-up) | 57ec880b306a8e2b31c5f20dacc47256fc93b4e2 | Post-merge live-eval finding on #982 + corrective fix: saturated-tie key rankScore → query-term coverage | Post-#982 golden dispatch (eval-canary run #50, 29735004222, main b9057f0 + deps) came back 35/36: the three verifiable July-19 failures (lithium-therapy-monitoring, clozapine-anc-threshold, patient-safety-plan-include) all PASS live, but alcohol-ciwa-threshold flipped pass→FAIL vs the same-morning pre-#982 run #49 (29731533081, 36/36) — failing top-3 ordered by descending rankScore (1.85/1.75/1.53, all finalScore-saturated, releaseRankScore 1.09/1.086/1.07), i.e. #982's tie-break let generic clinicalSignalBoost stacking outvote the ciwa/score/threshold-bearing chunk; #982 is the only retrieval-path delta in the window. Fix: contentRankScore → contentCoverageScore sourced from lexicalCoverageScore (query-term coverage, immune to boost stacking; ties still fall to chunk id); saturated-tie contract test re-pinned so coverage beats a HIGHER rankScore (discriminating — old key fails it); fast-path CIWA guard gains the run-#50 screening-chunk shape + content-term assertion. Live validation: tonight's 18:00 UTC scheduled canary (dispatch cap 2/2 spent ≈$2-4). Separately: ci.yml dispatch 4012 survived 30+ min of main churn under #979's per-run concurrency group (fix working); duplicate dispatch 4017 cancelled. | Targeted vitest 38/38; npm run test 3012 passed / 1 known container-only pdf-budget artifact; verify:cheap green to the same artifact; build + client-bundle scan + check:rag:fixtures PASS; check:production-readiness expected missing-secret FAILs only (no secrets in container) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: WebKit matrix diagnosis) | caa298972846ef52d472bfbff98c90fc26481ed8 | First completed release-browser-matrix in weeks (run 4012, main b9057f0, 38 min uncancelled under #979) — full triage of 28 failures + fix for the dominant cluster | Run 4012: 716 passed / 28 failed (25 webkit, 3 firefox) / 4 skipped. Dominant cluster (root-caused, FIXED here): all 8 ui-universal-search webkit failures share one signature — typeahead content never enters the DOM — because commandDropdownCanDisplay (added 42a3e3c 2026-07-17, AFTER the last completed matrix; never ran on WebKit until 4012) requires fine-pointer OR zero-touch; headless browsers fail the (hover:hover)+(pointer:fine) query (proven by the zero-touch escape existing for CI at all), Chromium/Firefox pass via maxTouchPoints===0, and Playwright's Linux WebKit build advertises phantom touch points — flunking both branches and disabling useUniversalSearch entirely. Fix: beforeEach addInitScript in ui-universal-search/ui-smoke/ui-tools specs stubbing Navigator.prototype.maxTouchPoints to the runner's true 0 (inert on Chromium/Firefox; product gate + tests/search-command-surface.test.ts pins untouched). Local chromium runs of ui-universal-search fail 16/20 IDENTICALLY on unmodified main (container artifact — hosted CI chromium green in 4012 is authoritative; verified by stash/run/pop baseline). Expected delta next matrix: ≥8 webkit failures clear; candidates ui-tools:1244 + several ui-smoke answer-flow cases (same surface). NOT yet root-caused (triaged remainder, hosted-matrix-only reproduction): webkit ui-stress overflow 330/409 (360px overflow at mobile), webkit ui-accessibility 195/252 (focus dismissal; forced-colors labels), webkit ui-formulation 132, webkit ui-smoke copy-table/retry/recovery/recent-searches/source-only/differential-context/viewer-hydration/document-questions, webkit ui-tools 2087 (goto interrupted by ?q= navigation), webkit ui-universal-search 183 strict-mode duplicate options (fallback-surface rendering; likely clears with the gate fix), firefox ui-smoke 946/2206/2932 (@critical document search fails on BOTH firefox and webkit — cross-browser, highest-priority remainder). | prettier PASS; eslint PASS; typecheck PASS; chromium stash-baseline no-delta (16 fail pre AND post — container artifact); webkit validation lands via tonight's 18:00 UTC scheduled matrix | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: matrix-remainder fixes) | ec070ccb20b9a067216e64e8399d9cd795027024 | Run-4012 remainder: 7 root-caused fixes (SW navigation hijack, WebKit focus/forced-colors/stale-style, Firefox tab order, CIWA alias, helper extraction) | Agent-diagnosed with probe evidence: (1) production-build PWA worker registers in EVERY matrix test (pwa-lifecycle.tsx:287 NODE_ENV gate), clients.claim()s the page and serves all navigations — Chromium probe proved SW-served reloads bypass page.route entirely (routeSawNav=[]); Playwright-Firefox wedges on its only two reloads (ui-smoke 2206/2932, both deterministic) → playwright.config.ts serviceWorkers:'block' + ui-pwa 'allow' opt-in (offline/CacheStorage journey verified passing locally under the opt-in). (2) Mode-menu dismissal relied solely on wrapper focusout; WebKit Tab navigation can move focus nowhere (links excluded) or wrap into the menu → keydown Tab-close in handleModeTriggerKeyDown (agent verified no test depends on old forward-Tab behavior). (3) WebKit has no forced-colors implementation → capability skip on the token-remap test. (4) WebKit stale :disabled computed style feeds axe a phantom 1.93 contrast for the re-enabled Previous button (blend arithmetic exact: 0.4×#475467+0.6×#fff=#b5bbc2) → toBeEnabled+opacity-1 pin before the scan, failure-at-pin = direct proof. (5) Firefox includes scrollable containers in tab order (sheet body scrollHeight 1125 vs 707 measured) → conditional step-over. (6) canary #50/#51 CIWA failure root cause: whitespace-delimited textContainsClinicalTerm can never match hyphenated 'CIWA-Ar' though the dosing-table region ranks top-5 → clinicalContentAliases ciwa:[ciwa, ciwa-ar] (plan-authorized fixture-alias route; content substance unchanged). (7) tests/helpers/zero-touch.ts shared helper replaces six #995 inline stubs (CodeRabbit follow-up). NOT claimed: ui-stress 409 overflow, ui-tools 2087 navigation race, webkit answer-flow subset — next matrix run (post-merge dispatch) measures these vs the 28-failure baseline; ui-smoke 2932 webkit-side is a distinct mock-data class deliberately deferred pending that run. | Targeted vitest 25/25 (eval-retrieval + search-command-surface); npm run test 3012 passed / 1 known container pdf-budget artifact; verify:cheap green to same artifact; build + client-bundle scan PASS; prettier/eslint/typecheck clean; chromium ui-pwa under new SW config: offline/CacheStorage privacy journey PASS, installability = known container in-incognito artifact; UI verification not run locally beyond that: chromium ui suites carry documented container artifacts — hosted ui-critical/ui-advisory + next matrix authoritative | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: eval measurement floor, ADDENDUM 4 A-PR-1) | 81ab9696da4b330ca0b2e5519891a9942f90421b | Measurement floor for evidence-gated ranking tuning: canary artifact emission, alias-aware snapshot builder, snapshot provenance/freshness — no ranking behavior change | Closes the three gaps blocking safe tuning (Phase B): (1) eval-canary's golden step now writes the per-case JSON artifact (--json-out decoupled from --json so the tee'd log keeps the human-readable lines the failure-issue analyzer parses) and uploads .local/eval-canary/ via pinned upload-artifact (30-day retention, include-hidden-files for the dot-dir, contents = same class as the already-public step logs: titles/telemetry/220-char previews of the all-public corpus) — snapshot regeneration stops costing a paid dispatch; (2) clinicalDocumentAliases/clinicalContentAliases moved verbatim to shared scripts/lib/clinical-aliases.ts and the snapshot builder grades documentMatch/contentMatch through them (discriminating tests: EMHS agitation title and spelled-out "absolute neutrophil count" grade as hits only via aliases — raw labelMatches pinned false), ending tuner ground truth disagreeing with the live gates; (3) snapshots carry generatedAt + optional sourceRunId, validator accepts them, exactly-36 relaxed to at-least-36 (floor still rejects truncated artifacts; sourceCaseCount + per-case candidate minimums unchanged), and a 30-day freshness test (activates on first regeneration) blocks silent corpus drift. Builder smoke-verified end-to-end on a synthetic 36-case artifact (alias grading + provenance stamped + validator green). Static hyphen audit of all 36 cases' terms: no currently-blocked term (canary #52 = 36/36); residual risk classes documented for the A-PR-2 artifact-grounded pass — punctuation-joined tokens (IM/PO, schizo-affective, post-natal) and inert stem entries (obsess/compuls/hyperactiv/impuls can never match whole-token) that currently ride on whole-word OR-alternates. | Targeted vitest 52/52 (ranking-tuning + eval-retrieval + eval-quality); npm run test 3019 passed / 1 known container-only pdf-budget artifact; lint + typecheck clean; check:github-actions + check:ci-scope PASS; prettier clean; check:production-readiness expected missing-secret FAILs only (demo-mode container); no provider calls — live validation = tonight's scheduled canary emits the first artifact at $0 | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR #1001: A-PR-2 measurement-floor completion) | 3d8f798 + 5b664f8 + e58c827 | First provenance-stamped snapshot regeneration from a live canary artifact + alias tiering docs + fixture-length pin + lithium doc-gate — Phase A of ADDENDUM 4 functionally complete | Artifact chain: user-authorized paid dispatch (canary #53, run 29763761133, 36/36 green, doc_recall 1.0 / content_recall 1.0 — first perfect content recall, ciwa alias confirmed live; mrr@10 0.8644, irrelevant@10 0.1083) emitted the first eval-canary-output artifact (51787 bytes, sha256 5af5b802… verified byte-identical after user transfer into the sandbox — this container cannot download run artifacts). Work: (1) two-tier alias documentation — investigation of the governance-review P3 showed src/lib/eval-document-matching.ts is a deliberately WIDER captured-case tier (e.g. "Clozapine GP Shared Care"); bulk-merge would loosen golden ground truth, so both files now carry cross-referencing do-not-merge headers instead; (2) snapshot case count pinned to live golden fixture length (regeneration instructions in failure message) — closes the coarse-floor P3; (3) snapshot regenerated via the alias-aware builder with --source-run-id provenance: agitation-im-po-options 0→5 graded positives (EMHS alias working on real data), flowchart-next-step confirmed sole zero-positive case; generatedAt promoted to validator-REQUIRED (closes the hand-edit P3); two stale data pins updated (missing-positives 2→1; broad_summary defaults-equality pin dropped — defaults' provenance was the retired snapshot, fresh recommendations are Phase B input); (4) artifact-grounded punctuation audit: 7 joined-token occurrences in top-5 previews — 3 ciwa-ar (alias-covered, incl. line-broken "ciwa- ar"), 4 ORDINARY-PROSE punctuation ("treatment," / "mood," / "(opioid" / "ptsd.[35]") — matcher word-boundary change proposed as its OWN reviewed follow-up per plan (systemic class, not bundled); (5) lithium-therapy-monitoring was the ONLY ungated case (rr@10 hardcoded 0.00 = measurement noise): expectedDocumentSubstrings ["Lithium"] added from live evidence (deliberately broad across the corpus's multiple legitimate lithium guidelines), snapshot rebuilt in lockstep from the same artifact, measured mrr@10 +~0.028 from de-noising. Deferred with reasons: NEW-query fixture cases (saturated-tie shapes, captured rag_query_misses) need live validation before they may gate — unlocked by Phase D-1 branch-eval dispatch or a dedicated validation dispatch; real ordering headroom for Phase B = flowchart 0.20, alcohol-ciwa 0.25, patient-safety 0.33, opioid 0.33, all text_fast_path. | Targeted vitest 76/76 ×3 (after each stage); npm run test 3019 passed / 1 known container-only pdf-budget artifact; prettier clean; freshness gate ACTIVE and green; no provider calls beyond the user-authorized dispatch (~$1-2, ADDENDUM 4 spend now ~$1-2 of ≤$10) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: B-PR-1 canary dispatch inputs) | see PR head | eval-canary.yml workflow_dispatch gains rag_ranking_config (staged Phase B weight evals, loud malformed-JSON validation to prevent silent fallback corrupting pair comparisons) + ref (Phase D-1 pre-merge branch evals) — schedule runs unaffected (empty inputs = today's behavior) | Tuner (offline, $0) on the A-PR-2 regenerated snapshot recommends 3 constrained per-class improvements (document_lookup titleSectionRelevance→0.9; table_threshold clinicalEvidence→0.95; comparison hybridRelevance→0.95 with proxy mrr 0.833→1.0), all with recall non-regression + zero high-risk hard-negative failures; medication_dose_risk + broad_summary stay neutral. Staged config JSON banked for the live pair; baseline = canary #53 re-gated (mrr@10 ≈0.8922 after lithium de-noising). Targets per approved plan: mrr@10 ≥0.90, irrelevant@10 ≤0.08, zero case regressions. Budget: user raised cap to ≤$20 (spent ≈$1-2). Security note: ref input runs branch code with eval secrets — dispatch requires repo write access (sole trusted collaborator), documented in PR risk. | check:github-actions PASS; check:ci-scope PASS; prettier clean; no provider calls (workflow change only) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (Phase B live pair — no code change; recorded for eval-history completeness) | canary runs 29763761133 (#53 baseline) + 29769050798 (#54 tuned) | ADDENDUM 4 Phase B verdict: staged 3-class tuner weights produced ZERO live movement — NOT adopted per the measured-gain rule | Offline tuner recommendations (document_lookup titleSection→0.9, table_threshold clinicalEvidence→0.95, comparison hybridRelevance→0.95; proxy comparison-mrr 0.833→1.0) staged via the B-PR-1 rag_ranking_config input; #54 log proves the override active (validation step echo). Result vs re-gated baseline: mrr@10 0.8921 vs 0.8922, irrelevant@10 0.1083 vs 0.1083, recalls 1.0/1.0 both, 36/36 both, all four headroom cases byte-identical rr (flowchart 0.20, ciwa-threshold 0.25, patient-safety 0.33, opioid 0.33). Learning: the 5-candidate linear proxy saturates; real headroom lives in fast-path saturated-tie structure (Phase C trigger condition mrr < 0.90 formally met; user authorized C). Nothing to roll back (per-run override). Spend ≈$2-4 of user-raised ≤$20 cap. | Both canary runs green (36/36 + answer-quality); override-active proof in #54 job log; no adoption = no code diff | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: Phase C saturation-tail primaries) | 7572c7f | ADDENDUM 4 Phase C (user-authorized): per-candidate discriminative primaries for saturated fast-path ties — design-agent planned (consumer map + dead-band envelope proof), red-proven, tie-conservation guarded | Mechanism: min(text_rank,1) collapses all tr≥1 candidates to byte-identical imputed primaries; ordering fell to chunk id at release. Fix: saturationTailUnit (pure, monotone, SET-INDEPENDENT — rejected per-query min-max + rank-tier designs for set-dependence/#118 authority risk; rejected full-range log rescale for moving sub-knee values across the 0.62-0.82 gate ladder) scales the excess into DEAD cap bands only: S2 table-fact similarity (0.92, 0.94) with hybrid byte-identical (gates/triggers/selection provably unchanged; similarity = the release tie-break key), S1 lexical-chunk hybrid (0.48, 0.5) behind the truthful-contract signature (sub-0.5 bars hold). Sub-knee byte-identical (fixtures now DERIVE from the helper; 0.45→0.755/0.795 pinned). Discriminating test verified RED on old formulas (2 fail: discriminating + envelope) → green with tail; equal-tr tie-conservation pins the #987 coverage comparator; second-stage-engaged pools documented out of scope (position-derived releaseRankScore sorts first there) — matches live evidence that non-engaged pools (patient-safety, opioid, flowchart) are where id-order decided. S3/S4 = C-PR-2 candidates, evidence-gated on the post-merge canary vs #54 baseline (doc/content recall MUST stay 1.0, zero per-case regressions; success signal = rr lift on the headroom cases). Rollback: single revert (helpers + 2 expression sites + 1 map call; no schema/config/cache surface). | Targeted vitest 121/121 (fast-path 11/11 incl. 6 new, retrieval-selection, rag-routing, rag-answer-fallback, ranking-tuning, second-stage); npm run test 3025 passed / 1 known container pdf-budget artifact; lint + typecheck + prettier clean; red-proof executed and recorded; live validation = post-merge canary dispatch (~$1-2) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: revert Phase C pending review) | revert of f96217c | User-requested revert of #1004 (Phase C saturation-tail primaries): auto-merge fired before the adversarial rag-retrieval-reviewer pass landed; retrieval code returns to the last reviewed state until that verdict is in | Clean single-commit revert (the documented rollback path — helpers + 2 expression sites + 1 map call; no schema/config/cache surface). Ledger history rows from f96217c retained (docs are append-only record, not behavior). The 19:44Z post-merge canary dispatched on f96217c completes regardless and stands as Phase C's live validation datapoint; re-land decision = reviewer verdict + that pair result together. Offline state of the reverted change remains fully proven (red-proof + 121/121 + envelope tests). | Revert verified by vitest fast-path suite returning to pre-C 5/5 shape expected in CI; ladder on the revert = hosted pr-required | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (Phase C live verdict — no code change; main stays reverted at 0a498e6) | canary run 29773198933 (#55, on f96217c) | ADDENDUM 4 Phase C LIVE-REFUTED: canary on the merged tail code FAILED 3/36 (doc_recall 1.0→0.9167, mrr@10 0.8921→0.8138) — the user-ordered revert (#1005) was correct and STANDS | Failures: patient-safety-plan-include (PtSafetyPlan out of top-5, rr 0.33→0.14), patient-property-visual-table (rr 1.00→0.11) and schizophrenia-overview (rr 1.00→0.14) — two previously rank-1 cases destroyed. Root cause (post-hoc): the S1 lexical-chunk lift spreads hybrid_score, which is the PRIMARY release sort key — inside the dead (0.48,0.5) band it still PREEMPTS every downstream key, so raw ts_rank order overrode the boost/title/subject-aware relevance order that previously decided all-tied-at-0.48 pools. Lexically-loud chunks leapfrogged title-boosted correct documents = the #118 mechanism, reproduced live. The offline S1 test used identical-content candidates (coverage tie) and could not see it. The S2 similarity tail (tie-break-position key) remains reviewer-verified safe in isolation — retrieval reviewer verdict on the full diff: APPROVE-WITH-NITS, P3 only (0.49-lowering proven unreachable via the SQL 0.48 cap; no gate crossings in (0.92,0.94); hardening nits recorded). DISPOSITION: no re-land as-is. Any retry = S2-only + S1 redesigned to a key BELOW relevance in the comparator chain, new design + fresh pair. The staged-rollback discipline (canary pair + instant revert) worked exactly as designed. Spend ≈$4-8 of ≤$20. | Canary #55 read from job log (3 FAIL lines + summary); reviewer verdict from subagent report; main verified reverted (0 saturationTailUnit refs at 0a498e6) | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: RAG memory + safeguards) | see PR head | User-directed close-out: durable RAG behaviour memory (docs/rag-behaviour/, 4 files) + AGENTS.md standing protection rules + ENFORCED safeguards — pr-policy blocking `RAG impact:` gate on protected surfaces (self-tested: undeclared/vague blocked, no-change/canary declarations pass) + source-pin contract test on imputation formulas and release comparator key order (red-proven vs a mutated constant). Confirmation canary #56 (29774459706, reverted main 0a498e6): SUCCESS — 36/36 restored, closing the #55-regression→revert→restore arc live. Phase D complete (D-1 ref input #1003, D-2 eval:trend #1006, D-3 policy §3.1 #1006, D-4 latency in trend rows); remaining documented plans: word-boundary matcher (own PR), irrelevant@10 labeling audit, Phase E (separate approval). Spend ≈$5-10 of ≤$20. | pr-policy self-test + workflow guard PASS; contract test 4/4 + red-proof; npm run test 3025 passed / 1 known container pdf-budget artifact; lint+typecheck+prettier clean; docs:check-links 1030 refs PASS; check:github-actions PASS | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: matcher + artifact follow-ups) | ab145f6 | Remaining documented improvements implemented: word-boundary textContainsClinicalTerm + top-10 canary artifact rows | Matcher: boundaries + internal separators widened to any non-alphanumeric run — PROVEN strict superset by artifact replay on canary #53 (1,126 term×alias×result comparisons, 0 lost matches, 7 gained = exactly the previously-documented punctuation-joined occurrences: treatment,/mood,/(opioid/ptsd.[35]/ciwa-ar ×3). More-tolerant measurement cannot fail a passing case → weekly scheduled canary = free live confirmation. Exported + 3 direct unit-test groups (superset preservation, audit classes incl. line-broken 'ciwa- ar' and 'full-blood-count', substring-inside-word rejections). Artifact: topResultSummary 5→10 rows so rr@10/irrelevant@10 metrics' actual inputs are captured — unblocks the offline irrelevant@10 labeling audit next artifact. docs/rag-behaviour updated to implemented state. Phase E remains gated on separate approval. | Targeted vitest 59/59; npm run test 3028 passed / 1 known container pdf-budget artifact; lint+typecheck+prettier clean; audit script run recorded above; no provider calls | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: DB easy wins) | see PR head | User-requested database + process easy-wins pass: read-only Supabase advisor sweep (user-authorized) → canary-liveness probe + advisor-disposition docs; live mutations withheld for per-item confirmation | Advisors (live, read-only): security = 1 INFO (document_title_words RLS-no-policy = the deliberate fail-closed pattern — now comment-documented at the schema block so it is never 'fixed'); performance = ~33 unused-index INFOs + auth connection-strategy note → docs/db-maintenance.md TRIAGE list with retrieval-surface trgm indexes flagged RAG-protected (dropping = full canary protocol), owner-scoped indexes retained for multi-tenant design, operational candidates deferred (negligible benefit at corpus size). Implemented: ci.yml static-pr warn-only eval-canary staleness probe (actions:read, github-script pinned, >8 days → warning; never fails) — needed because #923 (2026-07-19) moved the canary cadence from daily to weekly Sunday 18:00 UTC, where a dropped fire would go unnoticed for a week (the failure-issue step only reacts to runs that happen). CORRECTION (CodeRabbit review on this PR): the initially recorded "2026-07-20 dropped Sunday fire" incident did not occur — 2026-07-20 is a Monday; the Sunday 2026-07-19 slot fired as scheduled run #48 (19:03 UTC, success), and under the weekly cron no 2026-07-20 slot existed. Probe stands as proactive hardening, staleness now measured from updated_at with a finite-timestamp guard. Presented for confirmation (NOT implemented): scheduled telemetry retention (purge:query-logs is owner-scoped + unscheduled; needs owner/window/policy decision), auth percentage connection strategy (dashboard config), any index drops. | check:github-actions PASS; check:ci-scope PASS; check:function-grants 28/28 PASS; docs:check-links 1034 PASS; supabase-schema vitest 66/66; lint+typecheck+prettier clean; Supabase access read-only only | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from e6cd6cb; PR: telemetry-retention correction) | 01368ff (+0144e69 main merge-in) | User-directed "implement your recommendation for all decisions" close-out: the scheduled-retention recommendation is RETRACTED as founded on a false premise — telemetry retention is ALREADY ACTIVE inside the database via pg_cron; docs corrected, nothing built, no live mutations | Fresh read-only cron.job verification (2026-07-20) matches docs/privacy-impact-assessment.md §6 exactly: jobid 11 purge-expired-rag-queries daily 03:30 (30d), jobid 12 purge-rag-retrieval-logs daily 03:00 (90d), jobid 13 purge-rag-query-misses daily 03:45 (90d), jobid 16 purge-rag-response-cache hourly (bounded 1000); v3 worker jobs present-inactive under backlog auto-toggle (jobid 10); obsolete unbounded cache job absent; audit_logs indefinite by design. db-maintenance.md "open decision" section replaced with the resolved state; purge:query-logs clarified as the MANUAL owner-scoped tool (not the retention mechanism). A GitHub-side weekly deleter would have duplicated pg_cron with window drift (a 90d rag_queries sweep can never out-delete the live 30d job). Remaining decisions stand as documented no-action: auth percentage connection strategy deferred to next instance resize; operational index drops not recommended. | prettier + docs:check-links PASS; Supabase access read-only (single cron.job SELECT, user-authorized read-only envelope); no workflow/schema/config changes | -| 2026-07-21 | claude/x4-sast-gate (PR #1012) | 0d4985e63 | Maturity X4: blocking SAST gate on the untrusted-document parsing surface | Triage-first per workorder: CI-pinned semgrep/semgrep:1.168.0 over worker/**, src/lib/ingestion*.ts, src/lib/extractors, src/app/api/{ingestion,upload} = 0 ERROR findings (24 TS rules/17 files; 55 Python rules/3 files) — gate starts green with no suppressions. Shipped `semgrep-ingestion-gate` job (no continue-on-error; container digest-pinned to the triage-verified 1.168.0 image) with p/python added for the worker OCR stack; repo-wide advisory job untouched. check-github-action-pins.mjs now enforces both policy halves fail-closed (advisory repo-wide / blocking-and-scoped gate / digest-pinned gate container). Residuals: registry-pack mutability accepted for the narrow surface; making the workflow a branch-protection required check is an operator decision outside this PR. | Exact gate command exit 0 in pinned container; check:github-actions (new assertions verified fail-closed); check:ci-scope; yaml-contract vitest 1/1; verify:cheap 3031 tests green. No provider calls (local Docker only). | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from f33890a; PR: Phase E instrument input) | see PR head + follow-up SHA pin | Phase E kickoff (user-approved with budget): eval-canary gains opt-in `answer_quality_eval` dispatch input running the 30-case eval:answer-quality fixture (5 quality metrics + per-intent targeting) — the instrument was previously never run in CI. Dispatch-only, default-off, informational (exit 0, no --targeting-floor): scheduled runs and existing dispatch shapes byte-identical; gates stay owned by eval:quality. Follows the #1003 input-only precedent. | E-1 recon (all $0/read-only) recorded here: canary answer gate samples only 8 of 44 eval:quality cases (ANSWER_CASE_LIMIT default); eval:quality --provider-mode offline is a real $0 harness (provider deleted, deterministic source-only path) usable as an E-3 regression guard; live 30-day answer telemetry (34 answer-path rows): 25 full answers, misses = evidence_gap ×4 (avg 26s spent before gap), provider_incomplete_max_output_tokens ×2 (avg 82s wasted then discarded), provider_generation_failed ×1, retrieval_gap_or_conflict ×1, source_only_no_api ×1; success latency avg 13.1s / p90 25.2s. Headroom classes for E-3: truncation waste (rag.ts:4265 self-heal insufficient live), late evidence-gap detection, p90 latency, thin CI answer coverage. Next: E-2 baseline dispatch (answer_case_limit=44 + answer_quality_eval=true, est $3-8 of user-authorized ≤$20 Phase E envelope) after this merges. | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean; no provider calls this PR (workflow change only); RAG impact: none — retrieval steps untouched | -| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from 5b4098d; PR: E-2 baseline record + instrument fix) | see PR head | ADDENDUM Phase E-2 BASELINE BANKED (canary dispatch #57, run 29786560936, main 5b4098d, answer_case_limit=44): golden retrieval 36/36 green in-run (no-regression net held); eval:quality full-44 RED on exactly two gates — citation_failure_rate 0.0227 (1/44: neuroleptic-side-effect-escalation — expected doc never retrieved, generation quality-failed, extractive fallback with 1 citation) and route_ceiling_failure_count 2 (clozapine-anc-withhold-threshold: 13.3s pure retrieval vs 12s extractive budget, RPC 9.3s, zero generation; agitation-arousal-typo-dosing: 25054ms vs 25000ms after provider_timeout ate 22.6s pre-recovery). Green gates: grounded_supported 1.0, unsupported_correct 1.0 (all 14 refusals incl. both prompt-injection probes at 2ms), numeric grounding failures 0, governance danger 0, p95 17.4s. Non-blocking signals: expected_source_hit 0.6136 (both admission-discharge cases miss MHSP.AdmissionCommunityPts.pdf to sibling NMHS/RKPG policies — labeling-vs-ranking question, §3.1 class), source governance warning rate 0.8182 (metadata debt, waivable class). SYSTEMIC E-3 TARGET: ~9 of 19 generation attempts discarded (fast output fails quality gate → extractive fallback wins; ~7 cases carry fast_quality_retry_strong→extractive reasons) = ~half of generation latency+spend wasted. Instrument defect found+fixed this PR: targeting step was skipped after the red gate (GitHub failure-skip semantics) → if: gains !cancelled() so baselines observe red gates. Spend: est ~$1-2 actual (19 OpenAI-request cases; cost rates unset in CI so report shows n/a) of ≤$20 Phase E envelope. Next: cheap re-dispatch (default limit 8 + answer_quality_eval=true) to bank the skipped 30-case targeting baseline. | Gates this PR: check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean. Baseline evidence: job log run 29786560936 (5 failing-case diagnostics + Answer Metrics table read in full) | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from 87815f4; PR: E-3a cost self-reporting) | see PR head + follow-up pin | Phase E-3a wave (all $0 diagnostics complete, recorded here) + I8 fix: eval-canary env gains the three RAG_EVAL_*_USD_PER_MILLION rates (gpt-5.6-terra standard tier, verified from the live OpenAI pricing page 2026-07-21; documented as a LOWER BOUND since gpt-5.6-sol strong retries cost 2x and the estimator applies one rate set) so estimated_cost_usd stops reading n/a in CI. E-3a findings: (1) discarded-generation histogram from run #57 — fast_quality_retry_strong→extractive x6, generation_quality_failed x4, provider_timeout x2; gate sub-reasons fragment_like x2, bad_final_answer_quality x1, ungrounded_extractive_fallback x1 → E-3c targets the fast-attempt-fails-extractive-wins shape first. (2) I2 resolved: routeCeilingExceeded (eval-quality.ts:157/171) keys on the RUNTIME's own route_budget_ms + deadline flag, NOT the cross-region-widened eval gates — clozapine case = 13.3s retrieval vs the runtime's 12s extractive budget, geography-amplified; design → E-3b. (3) FIXTURE-CORPUS DRIFT (major): the live corpus contains ZERO MHSP*-named files; the 44-case fixture's expectedFiles are all MHSP.*/CG.MHSP.* and pass only via the eval-document-matching alias tier. All three expected-doc failures triaged: neuroleptic-side-effect-escalation = REAL retrieval-coverage gap (alias exists; Neuroleptic Side Effects (AKG).pdf indexed 11 chunks, 3 contain escalat%, yet answer retrieval returned a single off-point source) → protected-path item awaiting user go-ahead; admission-discharge x2 = top-5 preference for sibling NMHS/RKPG policies over the existing aliased AKG doc → labeling-vs-ranking decision presented to user. No fixture/alias edits made (ground truth requires sign-off). | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean; Supabase access read-only (documents/document_chunks SELECTs); OpenAI pricing page read via WebFetch | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from c308fdc; PR: labeling widen) | see PR head | USER-APPROVED ground-truth widening (AskUserQuestion 2026-07-21: "Widen to accept siblings") for the two admission-discharge cases: the WIDER alias tier's AdmissionCommunityPts entry gains the two NMHS "Admission to Discharge" titles (Community Mental Health + Mental Health Inpatients). Deliberate exclusions documented in-code: discharge-only docs must not satisfy the admission slot; the MHHITH programme policy is too narrow. STRICT golden tier untouched (bulk-merge prohibition respected). Verified by replaying run #57's actual top-5 lists through expectedFileCoverage: admission-discharge-coverage-paraphrase now passes; admission-discharge-comparison STILL FAILS honestly (its top-5 carries no admission-side doc at all — dup discharge-planning + Falls Prevention) and is retained as a genuine comparison-class retrieval-coverage signal, folded into the same investigation as the neuroleptic case. | typecheck PASS; prettier clean; probe script replay recorded (paraphrase allHit true / comparison allHit false, missing admission slot); no retrieval code touched; protected-file edit (eval-document-matching.ts) per explicit user authorization | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3b budget-aware generation deadlines) | 314d03f | Clinical-governance review of E-3b diff `git diff origin/main...HEAD` (commits 1078264 + 314d03f): answer-side generation timing/gating + telemetry — reserve-aware generation timeout (`generationRequestTimeoutMs`), truncation self-heal budget gate (`deadlineAllowsGenerationRetry`), `route_budget_exhausted_by_retrieval` telemetry, and the cross-region eval carve-out in scripts/eval-quality.ts. | APPROVE-WITH-NITS. No P0/P1/P2. (a) Conservative failure preserved: reserve-aware timeout fires ~2s early producing the SAME error type — an internal SDK timeout is mapped by mapOpenAIError to PublicApiError(openai_timeout) (openai.ts:525-529), NOT a bare DOMException, so the rag.ts:4636 re-throw guard is not tripped and the existing source-backed fallback/extractive recovery is reached; truncation-skip falls through to the terminal throw (rag.ts:4309-4313) into the same catch. No new answer-producing path. (b) Safety gates intact: all recovery answers finalize through finalizeAnswer→finalizeRagAnswerQuality and isSafeExtractiveFallbackCandidate (grounded/confidence/quality/numeric) — none touched. (c) Eval carve-out env-gated: crossRegionRunner && budgetExhaustedByRetrieval && generationMs===0; EVAL_LATENCY_CONTEXT set only in eval-canary.yml:164, prod caller (eval-quality.ts:1095) passes no options → inert in release/local; generationMs===0 requirement means a generation-side failure (generationMs>0) is never suppressed. (d)/(e) Telemetry additions non-PHI (boolean + mechanical retry-reason strings); no privacy/query-privacy/cross-border/verification source files touched; no new provider call. Nits (P3, non-blocking): carve-out also excuses fast/strong routes when generationMs===0 (sound — provably no generation ran); `requestTimeoutMs` now prod-dead (test-only); report label "retrieval-exhausted" (routeDeadlineExceeded && flag) is broader than actual gate suppression (audit label only, gate stays strict). | 88 offline unit tests PASS (tests/rag-route-budget.test.ts, tests/eval-quality.test.ts, tests/rag-offline-answer.test.ts, tests/rag-answer-fallback.test.ts); no provider/Supabase/OpenAI calls; no files mutated except this ledger row | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3b budget-aware generation deadlines) | 314d03f (+eb08ec5 review row) | ADDENDUM 5 wave E-3b implemented per the design-agent plan: generation attempts clamped to route budget minus a measured 2s recovery reserve (single call-site, all four attempt kinds); truncation self-heal gated on retry viability (reserve+5s floor) with observable truncation_retry_skipped_budget_reserve marker; additive route_budget_exhausted_by_retrieval runtime flag; eval route-ceiling gains the triple-condition cross-region carve-out (context + runtime flag + zero generation) with retrieval-exhausted audit cells — local/release gates provably strict. Fixes I3 (54ms budget overrun after 22.6s provider timeout), I5 (82s truncation waste class), resolves I2 (clozapine 13.3s retrieval vs 12s runtime budget = geography, now suppressed ONLY in the sanctioned cross-region context with full auditability). Reviewer verdicts: rag-retrieval-reviewer APPROVE-WITH-NITS (2 P3: prod-dead requestTimeoutMs retained for symmetry; report-cell coupling cosmetic; cached-replay invariant PROVEN — budget-exhausted answers never cached, carve-out unreachable via replay; marker isolation proven — SLO counters key on fallback_reason not answer_retry_reasons); clinical-governance-reviewer APPROVE-WITH-NITS (prior row) — internal-timeout→PublicApiError→existing-fallback path verified, all safety gates still applied to recovery answers. ALSO BANKED — E-2 targeting baseline (canary run #58, 29788404357, all-green incl. first execution of the !cancelled()-fixed instrument, ~$1-2): metric_rates relevance 0.6 / readability 1.0 / artifact_leaks 1.0 / intent_coverage 0.9333 / fail_closed 0.9; targeting_rate 0.5909 (13/22); by intent: document_lookup 5/5, red_result_action 3/3, contraindication 2/2, dose 1/5, monitoring_schedule 1/5, pathway_referral 1/2; all 9 misses = missing dose figure/schedule-interval (answer lengths 73-232 chars) → E-3c co-primary target alongside the wasted-generation class. Phase E spend ≈$3-6 of ≤$20. | Red-proofs: reserve pinned 3 independent ways (exact 23000ms grant, deadline flag clear, total under budget); self-heal skip pins exact marker + single provider call; offline flag pinned true/false. Focused: route-budget 9/9, eval-quality 27/27, fallback+offline 52/52, parser/abort regressions 15/15. Full suite 3043 passed / 1 known container pdf artifact. typecheck+lint+prettier clean. No provider calls; live proof = E-4 paired run | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from e02ba3d; PR: E-3c PR-A instrument) | see PR head | ADDENDUM 5 wave E-3c design accepted (Plan agent, full report in session record) and PR-A delivered: eval-answer-quality gains --dump-answers (per-case answer TEXT + sections + targeting verdict JSON for the canary artifact — answers are not retained at rest by privacy design, so miss diagnosis needs eval-time capture), parseArgs/buildAnswerDumpRecord exported behind an import.meta main-guard (eval-quality precedent), canary targeting step wired with the flag. Design highlights for the record: DEFECT 1 root confirmed as fast-attempt-doomed-then-discarded on strong_routine_retrieval procedural shapes — PR-B generalizes the EXISTING validated-extractive short-circuit pattern (LAI + blocked-recovery precedents, hasValidatedExtractiveCandidate) to the measured shape via a new rag-extractive-first.ts module (net ~-110 rag.ts lines against the 5030 budget); DEFECT 2 rank-1 root = extractive lead-slot selection prefers shortest sentence and admits figure-less leads (sort at rag-extractive-answer.ts:917, 1-slot monitoring leads) — PR-C adds intent-figure-aware lead promotion with a claim-support atom-corpus nuke-proofing guard + dose/threshold fallback candidate preference (find(safe && figure) ?? find(safe)); answer-verification CLEARED as direct cause (whole-answer gap or unbold only, never per-figure deletion). H2 (strong-route comparison/complex residual) explicitly deferred as the named E-3d candidate. E-4 metrics set: discarded-generation <20% from ~47%, dose ≥3/5, monitoring ≥3/5, no intent below #58, recalls pinned 1.0, relevance/fail_closed/readability/artifact_leaks ≥ #58. | PR-A gates: new tests/eval-answer-quality.test.ts 4/4; typecheck, check:github-actions, check:ci-scope, eval-canary-workflow test, prettier all clean; no provider calls | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3c PR-B short-circuit) | f7e6cbb + hardening commit | E-3c PR-B: pre-generation validated-extractive short-circuit for gate-passed routine procedural "What...process/include/required" queries (marker validated_routine_extractive_first), generalizing the LAI + blocked-recovery precedents via new rag-extractive-first.ts (3 predicates moved byte-verbatim, machine-verified; rag.ts 5029→4908 vs 5030 budget). Kills the run-#57 6x wasted-generation class. REVIEWS (both pre-push): rag-retrieval-reviewer APPROVE-WITH-NITS — move fidelity brace-diff verified byte-identical; confidence-gate skip PROVEN safe (passed-gate is a no-op in applyConfidenceGate; markers pairwise mutually exclusive); comparison false-positives blocked by unchanged classifier precedence; offline/source-only idempotent; zero retrieval/ranking/selection/threshold change; P2 = eval-only assertions (intent_coverage/artifact_leaks/expected-file) unverifiable offline for flip candidates (quality-nocc-document-support, quality-form-required-documentation, quality-discharge-documentation, quality-duress-pathway + rag-set siblings) → pre-merge BRANCH canary recommended and ADOPTED (offline-green + review-approved proven insufficient for this surface, 2026-07-20). clinical-governance-reviewer APPROVE-WITH-NITS — full gate-stack trace: nothing bypassed (same finalizeRagAnswerQuality, same citation scoping, numeric verification not fail-open, ungrounded-finalize defense at rag.ts:3694); P2 = pre-existing bare-cross-reference-with-overlap gap, NOT materially widened (new trigger anti-correlates), hardening recommended → APPLIED this PR: !isBareCrossReferenceAnswer screen in hasValidatedExtractiveCandidate (closes all three short-circuit paths; discriminating test added; disclosed post-review delta, strictly narrows shipping). MERGE GATE: draft until the branch canary pair (baseline #57/#58 vs branch run with answer_case_limit=44 + answer_quality_eval=true, est $3-6 of authorized envelope) is green — zero per-case regressions, recalls 1.0, quality/targeting rates >= baseline. | Red-proof + 3 negative guards; focused 61/61 + fallback/offline/contract suites; full suite 3061 passed / 1 known container artifact (pre-hardening tree; hardening re-verified focused); typecheck+lint+prettier clean; maintainability budget passed (4908/5030) | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (pair verdict — no code change; main stays at 22b6a2e) | canary run 29794759627 (#59, branch head 7310cb3 = merged PR-B content) | E-3b + E-3c PR-B LIVE-VALIDATED (pair vs banked #57/#58): route_ceiling_failures 2→0 (E-3b proven: agitation timeout now fits inside budget; clozapine retrieval-exhausted ceiling honestly excused via the triple-condition cross-region carve-out — exactly one "retrieval-exhausted" audit cell in the report); p95 17.4s→15.47s (-11%); golden retrieval SUCCESS 36/36 (stop-ship criterion held); validated_routine_extractive_first fired on 4 of the 6 target cases (patient-safety-plan 3.3s, treatment-team-process 2.6s, ect-procedure 2.2s, illegal-substances 2.2s — all pure extractive, zero generation, was 6-9s each with a discarded attempt), the other 2 (community-home-visits, best-practice-prescribing) stayed on generation+fallback because their extractive candidates legitimately fail validation gates = the designed-conservative outcome; ZERO new failing cases (list 5→2, both known residuals: neuroleptic citation red = Option A territory, admission-comparison expected-doc = non-blocking labeling residual); grounded 1.0 + unsupported_correct 1.0 held; targeting 0.5909→0.619, fail_closed 0.9→0.9333, readability/artifact_leaks/intent_coverage unchanged; relevance 0.6→0.5667 = single-case wobble on n=30, WATCH in E-4, not a gate. Discarded-generation rate materially down (4 conversions; residual = the H2 strong-route slice named as E-3d candidate, per design's 20-33% expectation band). MERGE STANDS (user had armed auto-merge pre-verdict; revert drill not triggered). Spend +~$3-6 → Phase E total ~$6-12 of ≤$20. | Pair evidence: run #59 job log (Blocking failures = citation only; Answer Case Diagnostics markers; metric_rates + targeting blocks); dump artifact populated for PR-C diagnosis | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3c PR-C figure-aware selection) | 043b030 + P2-fix commit | E-3c PR-C: dose/monitoring extractive answers now carry the asked-for figure/schedule when the cited chunk verbatim supports it — lead-slot promotion (dose swaps last of 2 slots, monitoring appends 2nd sentence; no-op when a lead already carries a figure) guarded by the claim-support atom corpus (sourceEvidenceText exported, promotionAtomKey byte-identical to claim-support's atomKey), plus the dose/threshold generation-fallback preferring the safe figure-carrying candidate (safety gate unchanged, filter-order-stable). Fallback helpers extracted to rag-extractive-answer (cycle-check verified); rag.ts 4908→4901. Six discriminating tests each verified red-on-prior-code incl. proving the nuke-guard load-bearing by disabling it. REVIEWS (both pre-push on 043b030): rag-retrieval-reviewer APPROVE-WITH-NITS — no-op path byte-identical verified, atom-key identity verified, filter-vs-find proven side-effect-free, 2-sentence append gate-safe, intent double-gated, zero retrieval/ordering change, imputation contract green; P2 = zero-atom monitoring figures ("every 6 weeks" yields no value atom) pass the guard trivially and can be nuked by claim support if sourced only from adjacent context (fails SAFE — evidence gap, never a wrong figure). clinical-governance-reviewer APPROVE-WITH-NITS — all six clinical concerns CLEARED end-to-end (verbatim-support guarantee, citation binding preserved, conservative failure test-proven, unsafe candidates impossible, wrong-drug risk controlled by pre-existing entity/multi-drug guards, no PHI); same zero-atom finding as P3 + one comment-precision nit. P2 FIXED post-review (disclosed): zero-atom figures now require the matched figure substring verbatim in sourceEvidenceText (intentFigureMatchText); proven both directions by 3 new tests (promotes from content, refuses from adjacent-context-only); comment-precision nit folded in. | Focused post-fix: extractive-formatting 32/32 + fallback/eval-cases/offline/contract/extractive-first 98/98 incl. imputation contract; typecheck+prettier+budgets clean; full-suite 3068-passed baseline pre-P2-fix (fix re-verified focused). Live proof = E-4 pair next | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (E-4 pair verdict — no code change; #1039 merged as 9b655fa) | canary run 29800029819 (#60, main 9b655fa = E-3b+PR-B+PR-C) | PHASE E-3 WAVE CLOSED — E-4 VERDICT: ADOPT (no revert). 44-case: the ONLY blocking red is the KNOWN persisting neuroleptic citation case (0.0227, identical #57 signature: generation quality-failed → extractive fallback 1 citation — the pre-declared Option A carve-out, retrieval-side, untouched by answer waves); route_ceiling_failures 0 CONFIRMED ON MAIN (E-3b: agitation 23.1s < 25s after 20.3s provider timeout; clozapine 14.5s with exactly one retrieval-exhausted audit cell); grounded 1.0 / unsupported_correct 1.0 / numeric 0 / governance-danger 0 all held; expected_source_hit 0.6136→0.6364 (#1020 widen); generation attempts 19→9 across 44 cases (10+ cases short-circuit via validated_routine_extractive_first at 2-6s, zero generation spend — the absolute wasted-generation seconds collapse; residual 6 discarded attempts are the named E-3d H2 strong/comparison slice). Targeting vs #58 baseline: rate 0.5909→0.6667, dose 1/5→2/4 (sertraline + quetiapine still miss), document_lookup 5/5→6/6, contraindication 2/2, red_result 2/2, pathway 1/2; readability/artifact_leaks 1.0. NOT met: monitoring_schedule flat 1/5 — per-miss lens shows answers of 73-232 chars with NO schedule token available to promote (olanzapine-lai 79ch, metabolic 73ch = single-fact extractive answers; the PR-C promotion is a no-op when no figure-bearing fact is extracted) → root is fact-extraction/retrieval depth on monitoring shapes, queued as the Option-A-wave companion diagnosis (dump artifact 8483731630, 30d retention). WATCH escalated: relevance 0.6 (#58) → 0.5667 (#59) → 0.5333 (#60) — two single-case steps coinciding with more terse extractive answers; fail_closed 0.9 = exactly the #58 main baseline (#59's 0.9333 was the outlier), safety texture flat. Adoption per plan criteria: targeting ≥ baseline ✓, grounded/refusal 1.0 ✓, golden 36/36 ✓ (in-run), ceilings 0 ✓, citation red = carved known case ✓. CodeRabbit post-review follow-up landed pre-merge (02b5c78): interval-regex full-match reorder (atom path proven to intercept the claimed exploit; reorder = drift hardening), clinicalValueAtomKey exported (mirror deleted), guard tests made honestly discriminating + genuine zero-atom "annually" coverage both directions. Instrument note: cost rates live on the targeting step env but eval:quality still reports cost n/a (estimator not consuming them in the 44-case path) — minor tooling residual. Spend +~$2-4 → Phase E total ~$8-16 of ≤$20. | Evidence: run #60 job log read in full (Threshold Status: citation-only; Answer Metrics + 44-row diagnostics; targeting metric_rates + 7-miss list); artifact eval-canary-output 8483731630 sha256 d5c7006e… (download blocked in-session — GitHub App scope; log tee carried the targeting output) | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A: title-supported escalation rescue) | 0abf3c9 (parent 1aebf02) | rag-retrieval-reviewer PROTECTED-surface review of the S3 document-lookup escalation rescue: shouldAttemptDocumentLookupFastPath exported + gains medication_dose_risk branch firing ONLY when analysis.intent==="escalation_risk" && documentTitleTerms.length>0; call site passes queryAnalysis; new tests/rag-document-lookup-escalation-rescue.test.ts. | APPROVE-WITH-NITS. No P0/P1/P2. Binding constraints held: released-search-order.ts + retrieval-selection.ts clamp + rag-candidate-sources.ts imputation all byte-identical to parent (git diff empty); imputation-contract test green; 0.66/0.055 floor (rag.ts:1765) unmodified and still gates rescued pools (S3 block sits after the 2513 fast-path return + re-runs decideTextFastPath at 2631). BLAST RADIUS empirically proven via 110-case offline probe (44 ragEvalCases + 30 answerQualityEvalCases + 36 golden): EXACTLY 1 fires (neuroleptic-side-effect-escalation, intent=escalation_risk tt=3); all 8 named dose cases non-firing (clozapine-monitoring general, paraphrase general, agitation-pharm general, im-po drug_dosing, typo-dosing drug_dosing, missed-dose-table drug_dosing, LAI general/tt0, prompt-injection-forge intent=protocol). intentFromSignals precedence (clinical-search.ts:575-585) returns drug_dosing before escalation_risk so pure-dose structurally cannot fire — confirmed by construction AND empirically. ADVERSARIAL: prompt-injection-forge intent=protocol => cannot fire (empirical); unsupported short-circuit (rag.ts:2371) precedes S3 block. DOWNSTREAM: buildRetrievalIntent for the escalation query yields EMPTY requiredTermSignals => demote/promote arms (retrieval-selection.ts:354-355/529/555) + wrong-medication cap (rag.ts:730-737, gated on clinical_subject) all inert; end-to-end test proves neuroleptic-doc rank#1 with >=2 citations, sibling retained, arrival-order invariant. golden vector-\* probes = broad_summary (already allowlisted) => predicate byte-identical => unaffected. TEST HONESTY: S3 fixture (0.92/0.34/0.94/synthetic_text) faithful to searchDocumentLookupFastPath (rag-candidate-sources.ts:570 caps alias documentScore at 0.34 => sim=min(0.92,0.58+0.34+bonus)=0.92, hybrid=min(0.94,0.94)); differently-relevant fixtures (not identical-content); red-proof structurally airtight (e2e gates its own fixture pool on the predicate). EFFORT: one S3 RPC (same call allowlisted classes issue), rescue-only in the non-forceEmbedding path (floor already rejected => query was headed to embedding anyway; successful rescue short-circuits at 2646 pre-embedding = net-neutral/positive). NITS (P3, non-blocking, no code change pre-canary): (1) redundant analysis?. on the documentTitleTerms clause (&& short-circuit already guarantees analysis defined there); (2) a queryMode forcing medication_dose_risk over an originally-escalation-shaped table_threshold could newly fire S3, but table_threshold already ran S3 so behavior-consistent, not a regression; (3) "forceEmbedding discards S3 merges" is imprecise — line 2649 merges S3 even under forceEmbedding; the accurate unaffected-reason for vector-\* probes is broad_summary allowlisting. TRUST GATE = the mandated live canary pair (correctly deferred by the commit). | Offline only, no provider calls: new test 10/10 + imputation-contract 2/2; protected-surface batch 31/31 (escalation-rescue + imputation-contract + fast-path-ordering + released-search-order + retrieval-selection); 110-case classifier probe (temp test, removed); npm run typecheck exit 0. Not run (provider-gated): eval:retrieval:quality, eval:rag, the live canary pair. | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | rag-retrieval-reviewer on the monitoring evidence-gate parity commit: REQUEST-CHANGES (soft) — P2 reproduced: inflected monitoring kind tokens (monitor\w*/annual(?:ly)?/blood tests?/ecgs?/lfts?) steal sole-dose-value sentences from the dose arm; dose-intent answers then reject the monitoring-kind fact ("Quetiapine is monitored at a dose of 200 mg daily" flipped grounded true→false, source-gap — fails CLOSED, never a wrong dose). P3: monitoring figure escape lacked the dose escape's multi-drug bare-row guard. Clean: over-admission bounded (broad vocab lives in gate/filter only, promotion still corpus-guarded, claim-support unchanged); regex cost negligible; mismatched-unit test relaxation legitimate (synopsis is corpus-verbatim; weeks pin enforced by atom identity + adjacent_context exclusion from both gate and claim corpora). | BOTH FINDINGS FIXED in a3b9a54: kind arm classifies legacy tokens byte-identically and new-inflection-only sentences fall through to the dose arm when they carry a clinicalDoseValuePattern value (both repro sentences pinned as dose-intent tests); multi-drug bare-row guard extended to monitoring_schedule with a discriminating test — red-proven both directions. Reviewer checks: formatting 38/38, focused 644/644; targeting eval deferred to the wave's live canary pair. | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | clinical-governance-reviewer on the same commit: APPROVE-WITH-NITS. P2 (independently converged with the retrieval reviewer's P3): monitoring figure-escape lacked the dose-path multi-drug cross-entity guard — a bare wrong-drug schedule/level row in a multi-drug chunk could be entity-prefixed for a named-drug monitoring query; downstream gates verify text-vs-source presence, never attribution (worked lithium/valproate LFT path traced through finalize). FIXED in a3b9a54 exactly as its smallest-fix prescribed (guard at the :872-881 site now fires for monitoring_schedule; negative multi-drug test added, red-proven). Clean: unsupported figures impossible (admission-only change; promotion corpus guard + numeric verification + claim support all byte-unchanged); conservative failure intact (figure-bearing-only escape, schedule-free refusal pinned); adjacent-context safety held (sourceEvidenceText excludes adjacent_context; weeks refusal confirmed by probe); no PHI/provider/ranking surface. P3s: RAG impact line (present in the PR body — behaviour-change form, correct since the PR also carries the Option A retrieval change); multi-drug negative test (landed in a3b9a54). | Offline guard-chain trace + targeted vitest probes (named-drug guard, bare-figure admission, conservative gap, adjacent refusal). Provider/release gates deferred per confirmation boundary. | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A rescue review) | 0abf3c9 | clinical-governance-reviewer on the S3 escalation rescue: APPROVE-WITH-NITS, no P0/P1. P2 = the mandated live canary pair itself (process gate, declared in the PR body; offline-green + review-approved proven insufficient for this surface 2026-07-20). P3s: multi-drug escalation-query recall edge (titled drug + untitled drug — fast-path return can skip the vector leg; recall limitation, not misattribution, mirrors the pre-existing allowlisted-class tradeoff); reviewer probe files must stay uncommitted (relocated to scratchpad). All six clinical concerns verified safe: wrong-document impossible (alias phrases must appear in the query; per-document alias groups, no cross-drug conflation), conservative availability (S3 purely additive via keyed-union merge; sibling retention test-pinned), live expansion acceptable (title-named correct-entity SOP in every firing shape), fail-closed double layer (adversarial short-circuit precedes the predicate; injection-forge case intent=protocol cannot fire — executed), governance metadata unbypassed (same attachDocumentRankingMetadata + status=indexed + access-scope filters), no PHI/provider/schema surface. | Reviewer checks: escalation-rescue suite 8/8, injection-forge intent derivation executed, static trace of the full S3 chain. Live canary pair = the trust gate, dispatched post-merge. | -| 2026-07-21 | claude/patient-profile-input-bounds-123366 (PR #1045: FV-03 fail-safe input bounds) | 75303e8b8 | Clinical-governance verification of FV-03 (patient-profile numeric fields → medication-safety alert engine). 4-agent adversarial workflow (consumer map + suppression audit + physiological bounds + synthesis). | ADJUST→implemented. Consumer map: evaluatePatientAlerts is the ONLY numeric consumer, no dose arithmetic, sanitize() is the sole guaranteed chokepoint. Suppression audit found naive null-routing UNSAFE via the bare-renal both-null hole (medication-patient-alerts.ts:286) — nulling one out-of-range renal input while the other is present-normal → false all-clear; fixed with &&→|| (0 bare-renal contraindication rows in corpus → no-op on current data). Bounds VALIDATED (age 0-130, egfr 0-250, crcl 0-400, qtc 240-800, scr µmol/L 15-3000 unit-aware): never reject a legitimate clinical extreme. Reject-to-null (never clamp). | typecheck, lint, format:check, full unit+jsdom 349 files/3120 passed/0 failed (incl. 38 new/updated FV-03 tests), design-system-contract (baselines unchanged), type-scale, icon-scale, check:production-readiness READY. verify:ui in CI. No provider calls. | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A wave verdict — no code change; #1040 merged as cde6c5c) | canary run 29827012719 (#61, main cde6c5c) vs banked #60 (29800029819) | OPTION A WAVE ADOPTED — FIRST FULLY-GREEN 44-CASE CANARY IN PROGRAM HISTORY (Blocking failures: None). (1) Option A payoff EXCEEDED: citation_failure_rate 0.0227→0; the neuroleptic-side-effect-escalation case flipped from wrong-doc→failed-generation→1-citation-fallback to **strong route, successful gpt-5.6-sol generation, passed in 15.4s with no fallback marker** — the rescued S3 retrieval fixed generation itself, not just the citation count; expected_source_hit 0.6364→0.6591. (2) Golden held exactly as the blast-radius analysis promised: 36/36 PASS, content_recall 1.0, mrr@10 0.8921 BYTE-IDENTICAL to the pre-wave baseline (zero ordering movement — no golden case fires the predicate), irrelevant@10 0.1083→0.0917 (slightly better). (3) Parity payoff PARTIAL: monitoring targeting 1/5→2/5 (olanzapine-lai flipped — previously called a retrieval-depth residual; quetiapine-dose also flipped on the dose side); lithium-range (232ch) + metabolic (73ch, byte-identical answer to #60) did NOT flip despite offline-proven fixes — their live chunk sets evidently contain no admissible schedule sentence even under the widened gate → reclassified as retrieval-depth/live-content residuals joining adhd; below the ≥3/5 target but strictly improved, no regression anywhere. Dose 2/5 vs 2/4: same passing count, applicable set grew (new quality-metformin-renal-dosing miss = eval-set churn, not regression). (4) No-worse EXCEEDED: relevance 0.5333→0.6 (the two-step watch-item slide FULLY REVERSED to the #58 level), targeting_rate 0.6667→0.6957, fail_closed 0.9 held, readability/artifact_leaks 1.0, route ceilings 0, grounded 1.0, unsupported_correct 1.0, numeric 0, p95 22.8s, red_result 3/3. Adoption per the measured-gain rule: primary goal achieved, three case flips, relevance recovered, zero regressions. Residual queue: monitoring retrieval-depth trio (lithium-range/metabolic/adhd), E-3d H2 discards, weekly ANSWER_CASE_LIMIT 8→44 raise now unblocked (gate would be green), comparison-class coverage. Wave spend +~$2-4 → Phase E + Option A total ~$12-20 of ≤$20. | Evidence: run #61 job log read (Threshold Status: None; Answer Metrics; neuroleptic diagnostics row; targeting metric_rates + 6-miss list; golden 36 PASS lines + summary). Revert drill NOT triggered. | -| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: I9 weekly coverage raise) | see PR head | ADDENDUM 5 post-green item I9 (plan-authorized "after reds fixed"): weekly scheduled canary ANSWER_CASE_LIMIT default 8→44 — the Sunday 18:00 UTC cron now guards the FULL answer-quality case set instead of the first 8 (both #57 blocking reds historically lived OUTSIDE the first 8, leaving the weekly gate blind to them). Unblocked by run #61 proving the citation gate green on the full 44. Cost: est +$1-2/week (user-authorized in the plan). Contract test pin updated in lockstep (eval-canary-workflow.test.ts). Dispatch shapes unchanged (input override still wins); operational-risk diff, plain-revert rollback. | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS (20/20); eval-canary-workflow contract 4/4; prettier clean; no provider calls | -| 2026-07-21 | claude/database-governance-audit-10b6ed (PR #1051: source-governance audit — safe subset) | cee396730 | Governance-metadata observability + UI display + provenance flow test; no ranking/retrieval/generation surface touched. | IMPLEMENTED + handed off (not a review of prior work). Resolved audit #1 (logger.warn on unrecognized enum values; return value unchanged), #2 (review_due_source added to frontendVisibleWarningCodes → answer-level badge; warning-severity, no refusal impact), #9 (source_metadata retained on safety-finding citations + governance pill in SafetyFindingsListContent), #13 (new tests/provenance-flow.test.ts: DB-normalize→governance→client payload sources+safety citations→render policy). Deferred #4/5/6/8/10 (RAG-protected ranking/selection/LLM-context/cache — need live eval-canary+approval), #11/#5 flag debt (D5/D4), #3 (is_public schema/RLS), #7 (conflict-detection scope), #12 (canary automation). Rebased onto origin/main (was 18 behind; conflict-free — none of the 18 commits touched the 8 files). PR-policy CI green (confirmed no ragRankingPatterns match). | verify:pr-local exit 0 (351 files/3129 tests, production build, client-bundle secret scan, offline RAG fixtures 36/36); typecheck + lint + prettier green. verify:ui NOT run locally: pre-existing globals.css Tailwind/Turbopack dev-compile error (git-clean, unrelated; prod build passed) — CI Production UI job covers it. check:production-readiness deferred (offline env/config validator; PR changes no env/secret/config inputs; secretless worktree). No provider calls. | +| 2026-07-20 | origin/main PWA-surface review, window `ef042ca..e128384` (44+ commits; explicit user request) + phone install-sheet redesign (this branch, content commit d8d8c4a) | e1283846647b20cd49ca6ae6920a7c76f2b945d7 | PWA-version review of new progress + install-notification design elevation | Sweep verdict (agent-verified): only #905/#897 (this program's own work) touched PWA surfaces in the window ??? sw.js CACHE_VERSION `2026-07-18-v1` and its offline.html binding, manifest (7 icons incl. monochrome; screenshots deliberately absent), icons route, kill-switch, and next.config headers all unchanged, so the privacy contract holds by construction. Geometric risk from five composer/dock-space reworks (#933 mobile-composer-reserve, #932, #930, #922, #899) probed live at 390??844: the non-install notice stack keeps correct clearance at rest (offline card bottom 744/844 with the 5.5rem gutter) and the stack's offset is now a custom property (`--pwa-notice-bottom-gap`) for one-line re-anchoring if composer geometry moves again. Redesign: install prompt + iOS hint present as a native bottom sheet on phones (full-bleed, flush bottom, grip bar matching #935's sheet language, real app icon identity via /icons/icon-192, Free/no-store meta row, two accent step chips for Share???Add to Home Screen as aria-hidden reinforcement of the unchanged accessible sentence); ???640px keeps the #905 card/toast placements; region names, button names, and test-locked sentences unchanged. | Focused vitest 56/56 across the four PWA suites; `verify:cheap` 2971/2975 (sole fail = known container-only pdf-extraction-budget artifact); `test:e2e:pwa` privacy/offline green (installability fail = known container `in-incognito` artifact); `verify:ui` 243 passed/2 failed (the two long-baselined container artifacts); production build + client-bundle secret scan + bundle budget within tolerance (1303.4 vs 1278.6 KiB baseline; sheet adds ~0 JS); visual evidence at 390 light/dark/iOS-hint + 768 + 1440 with bounding-box math (full-bleed flush-bottom on phone; card/toast intact above). No provider-backed checks run. | +| 2026-07-20 | Credentialed release-gate checkpoint closeout (workflow_dispatch on main `7ec25d9`; user-authorized ???$10, single dispatch each) | 7ec25d9675dea13635fa4a895af88c93da694a42 | Credentialed half of the release gate: CI dispatch + live eval canary | CI dispatch: 9/10 jobs green (unit coverage, build, Chromium production journeys, migration replay on local Supabase emulator, production-readiness CI-safe, policy self-tests, static/safety/scope). `release-browser-matrix` (WebKit/Firefox) CANCELLED twice by main-churn: ci.yml `concurrency: CI-${ref}, cancel-in-progress: true` kills in-flight dispatch runs on every main push and this repo merges every few minutes ??? livelock confirmed at the 2-attempt cap; WebKit/iOS verification remains outstanding with three human options (quiet-window dispatch, the weekly scheduled run, or a one-line dedicated concurrency group for the matrix job ??? operational-risk change, not applied). Eval canary: golden retrieval eval FAILED 4/36 (document_recall@5 0.944, ndcg@10 0.923, force_embedding_failure_count 0, no 429s ??? vector layer healthy, NOT the documented vector-ptsd transient class); the July 17 dispatch PASSED this step pre-#901, so the regression window implicates #901's deterministic semantic reranking (lithium-therapy-monitoring shows three unrelated documents with byte-identical rerank scores burying the lithium guideline; two other failures add fixture-vs-corpus identity components; answer-quality subset ??? the July 17 failure ??? never ran). NO canary re-run per plan (deterministic, not transient); retrieval is clinical-path and deferred to a human decision. Provider spend ??? $1???2 (one canary run's embeddings); matrix/CI runs $0. | actions_run_trigger dispatches + rerun_failed_jobs (attempt 2); job-level conclusions and log excerpts from runs 29675875530 (both attempts), 29675878737 (July 19 canary), and 29567502452 (July 17 baseline). No local provider calls; secrets never left GitHub Actions. | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: ci.yml concurrency) | 79aaacf04e64f753c480dd957a81ac9be6acbb43 | CI workflow concurrency: stop main churn cancelling dispatch/schedule runs | One-line group expression: workflow_dispatch/schedule events now get a per-run concurrency group (github.run_id) while push/PR keep the shared ref group with cancel-in-progress ??? fixes the release-browser-matrix livelock (cancelled twice on 2026-07-19/20 by main merges mid-run; the weekly Sunday 18:00 UTC scheduled run was subject to the same cancellation). release-browser-matrix is not a required branch-protection check; pin/scope checkers do not constrain the concurrency block. Accepted side effect: deliberate runs can overlap push runs. Rollback: plain revert. | check:github-actions PASS; check:ci-scope PASS; format:check PASS (repo files; local-only .claude/settings.local.json warning is gitignored) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: #901 rerank regression closeout) | fd5dcd1582e1c7aa8bf92ff097575e0c68aa930d | #901 rerank regression: baseline re-eval + offline guard net + saturated-tie fix | Baseline eval-canary dispatch on remediated main b3ae061 (run 29731533081) PASSED ??? golden retrieval 36/36 + answer-quality green, confirming #913-#926 closed the live 4/36 regression (July 19 failing run tested the raw #901 state; fixes landed 1-8h after it, never re-evaled until now). Residual defect found by new offline repro and fixed: with byte-identical imputed fast-path primaries, selection's clamped keys tie exactly and the chunk-id fallback decides, which secondStageScore's position adjustment launders into releaseRankScore (buried the CIWA answer doc in repro); fix = contentRankScore carried on RetrievalCandidate as tie-break between clamped rerankScore and chunk id, never added to scores. Amended #901's own never-live-validated saturated-tie pin to content-rank-then-id. Guards: tests/rag-fast-path-ordering.test.ts (4 end-to-end eval-shape repros) + ranking-tuning gates (4 golden-mapped hard negatives at production weights + full-snapshot high-risk). Fixture aliases NOT changed (Step C not triggered ??? identity cases pass live). | Targeted 4-suite vitest 37/37; npm run test 2981 passed (sole fail = container-only pdf-extraction-budget artifact); verify:cheap green through all 18 pre-test checks incl. lint+typecheck; check:production-readiness PASS on substantive checks (2 FAILs = documented missing-secret class in this container); build + client-bundle scan + check:rag:fixtures PASS | +| 2026-07-20 | claude/phone-scroll-fix (PR #993) | f0f4c42e7 | Phone scroll "locks to bottom" regression from #964 + all-pages phone scroll audit + guardrails | Root cause: #964's phone mode-home dock made one hide-on-scroll event release ~180-260px of scroll geometry (header grid collapse + reserve-pad shrink) ??? more than a short mode home's remaining runway, so scrollTop clamps onto the new bottom and a 12px up-drag snaps it back (oscillation; measured 266???84px runway, 2 flips/gesture on /formulation @390??844). Invisible to all gates because the suite-wide reducedMotion:"reduce" disables the causal transitions. Fix: collapse-budget gate in computeScrollHideUpdate (hosts report the would-be geometry release via readChromeCollapseBudget; hide refused without runway to absorb it; budget-less consumers unchanged; bottom-clamp guard untouched). Bonus latent bug fixed: DocumentViewer's one-shot #main-content discovery could hold a detached node after shell remounts (viewer hide-on-scroll dead); observer now persists. ui-smoke bottom-hide scenario updated to the gate contract. New 18-test sweep tests/ui-phone-scroll.spec.ts (10 mode homes + 3 dashboard modes + 4 long routes, motion enabled, simulated PWA insets) verified to fail red pre-fix. Residual: real-device iOS momentum clamping is device-only ??? user PWA confirmation requested post-deploy. | vitest focused 24/24 + mobile-composer-reserve; verify:cheap 3020 green; ui-phone-scroll chromium 18/18 + webkit advisory 18/18; ui-formulation+ui-tools+ui-smoke 180/180; verify:ui 264/264; verify:pr-local green (format/build/bundle-scan/RAG fixtures). No provider calls. | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: coverage tie-break follow-up) | 57ec880b306a8e2b31c5f20dacc47256fc93b4e2 | Post-merge live-eval finding on #982 + corrective fix: saturated-tie key rankScore ??? query-term coverage | Post-#982 golden dispatch (eval-canary run #50, 29735004222, main b9057f0 + deps) came back 35/36: the three verifiable July-19 failures (lithium-therapy-monitoring, clozapine-anc-threshold, patient-safety-plan-include) all PASS live, but alcohol-ciwa-threshold flipped pass???FAIL vs the same-morning pre-#982 run #49 (29731533081, 36/36) ??? failing top-3 ordered by descending rankScore (1.85/1.75/1.53, all finalScore-saturated, releaseRankScore 1.09/1.086/1.07), i.e. #982's tie-break let generic clinicalSignalBoost stacking outvote the ciwa/score/threshold-bearing chunk; #982 is the only retrieval-path delta in the window. Fix: contentRankScore ??? contentCoverageScore sourced from lexicalCoverageScore (query-term coverage, immune to boost stacking; ties still fall to chunk id); saturated-tie contract test re-pinned so coverage beats a HIGHER rankScore (discriminating ??? old key fails it); fast-path CIWA guard gains the run-#50 screening-chunk shape + content-term assertion. Live validation: tonight's 18:00 UTC scheduled canary (dispatch cap 2/2 spent ???$2-4). Separately: ci.yml dispatch 4012 survived 30+ min of main churn under #979's per-run concurrency group (fix working); duplicate dispatch 4017 cancelled. | Targeted vitest 38/38; npm run test 3012 passed / 1 known container-only pdf-budget artifact; verify:cheap green to the same artifact; build + client-bundle scan + check:rag:fixtures PASS; check:production-readiness expected missing-secret FAILs only (no secrets in container) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: WebKit matrix diagnosis) | caa298972846ef52d472bfbff98c90fc26481ed8 | First completed release-browser-matrix in weeks (run 4012, main b9057f0, 38 min uncancelled under #979) ??? full triage of 28 failures + fix for the dominant cluster | Run 4012: 716 passed / 28 failed (25 webkit, 3 firefox) / 4 skipped. Dominant cluster (root-caused, FIXED here): all 8 ui-universal-search webkit failures share one signature ??? typeahead content never enters the DOM ??? because commandDropdownCanDisplay (added 42a3e3c 2026-07-17, AFTER the last completed matrix; never ran on WebKit until 4012) requires fine-pointer OR zero-touch; headless browsers fail the (hover:hover)+(pointer:fine) query (proven by the zero-touch escape existing for CI at all), Chromium/Firefox pass via maxTouchPoints===0, and Playwright's Linux WebKit build advertises phantom touch points ??? flunking both branches and disabling useUniversalSearch entirely. Fix: beforeEach addInitScript in ui-universal-search/ui-smoke/ui-tools specs stubbing Navigator.prototype.maxTouchPoints to the runner's true 0 (inert on Chromium/Firefox; product gate + tests/search-command-surface.test.ts pins untouched). Local chromium runs of ui-universal-search fail 16/20 IDENTICALLY on unmodified main (container artifact ??? hosted CI chromium green in 4012 is authoritative; verified by stash/run/pop baseline). Expected delta next matrix: ???8 webkit failures clear; candidates ui-tools:1244 + several ui-smoke answer-flow cases (same surface). NOT yet root-caused (triaged remainder, hosted-matrix-only reproduction): webkit ui-stress overflow 330/409 (360px overflow at mobile), webkit ui-accessibility 195/252 (focus dismissal; forced-colors labels), webkit ui-formulation 132, webkit ui-smoke copy-table/retry/recovery/recent-searches/source-only/differential-context/viewer-hydration/document-questions, webkit ui-tools 2087 (goto interrupted by ?q= navigation), webkit ui-universal-search 183 strict-mode duplicate options (fallback-surface rendering; likely clears with the gate fix), firefox ui-smoke 946/2206/2932 (@critical document search fails on BOTH firefox and webkit ??? cross-browser, highest-priority remainder). | prettier PASS; eslint PASS; typecheck PASS; chromium stash-baseline no-delta (16 fail pre AND post ??? container artifact); webkit validation lands via tonight's 18:00 UTC scheduled matrix | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: matrix-remainder fixes) | ec070ccb20b9a067216e64e8399d9cd795027024 | Run-4012 remainder: 7 root-caused fixes (SW navigation hijack, WebKit focus/forced-colors/stale-style, Firefox tab order, CIWA alias, helper extraction) | Agent-diagnosed with probe evidence: (1) production-build PWA worker registers in EVERY matrix test (pwa-lifecycle.tsx:287 NODE_ENV gate), clients.claim()s the page and serves all navigations ??? Chromium probe proved SW-served reloads bypass page.route entirely (routeSawNav=[]); Playwright-Firefox wedges on its only two reloads (ui-smoke 2206/2932, both deterministic) ??? playwright.config.ts serviceWorkers:'block' + ui-pwa 'allow' opt-in (offline/CacheStorage journey verified passing locally under the opt-in). (2) Mode-menu dismissal relied solely on wrapper focusout; WebKit Tab navigation can move focus nowhere (links excluded) or wrap into the menu ??? keydown Tab-close in handleModeTriggerKeyDown (agent verified no test depends on old forward-Tab behavior). (3) WebKit has no forced-colors implementation ??? capability skip on the token-remap test. (4) WebKit stale :disabled computed style feeds axe a phantom 1.93 contrast for the re-enabled Previous button (blend arithmetic exact: 0.4??#475467+0.6??#fff=#b5bbc2) ??? toBeEnabled+opacity-1 pin before the scan, failure-at-pin = direct proof. (5) Firefox includes scrollable containers in tab order (sheet body scrollHeight 1125 vs 707 measured) ??? conditional step-over. (6) canary #50/#51 CIWA failure root cause: whitespace-delimited textContainsClinicalTerm can never match hyphenated 'CIWA-Ar' though the dosing-table region ranks top-5 ??? clinicalContentAliases ciwa:[ciwa, ciwa-ar] (plan-authorized fixture-alias route; content substance unchanged). (7) tests/helpers/zero-touch.ts shared helper replaces six #995 inline stubs (CodeRabbit follow-up). NOT claimed: ui-stress 409 overflow, ui-tools 2087 navigation race, webkit answer-flow subset ??? next matrix run (post-merge dispatch) measures these vs the 28-failure baseline; ui-smoke 2932 webkit-side is a distinct mock-data class deliberately deferred pending that run. | Targeted vitest 25/25 (eval-retrieval + search-command-surface); npm run test 3012 passed / 1 known container pdf-budget artifact; verify:cheap green to same artifact; build + client-bundle scan PASS; prettier/eslint/typecheck clean; chromium ui-pwa under new SW config: offline/CacheStorage privacy journey PASS, installability = known container in-incognito artifact; UI verification not run locally beyond that: chromium ui suites carry documented container artifacts ??? hosted ui-critical/ui-advisory + next matrix authoritative | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: eval measurement floor, ADDENDUM 4 A-PR-1) | 81ab9696da4b330ca0b2e5519891a9942f90421b | Measurement floor for evidence-gated ranking tuning: canary artifact emission, alias-aware snapshot builder, snapshot provenance/freshness ??? no ranking behavior change | Closes the three gaps blocking safe tuning (Phase B): (1) eval-canary's golden step now writes the per-case JSON artifact (--json-out decoupled from --json so the tee'd log keeps the human-readable lines the failure-issue analyzer parses) and uploads .local/eval-canary/ via pinned upload-artifact (30-day retention, include-hidden-files for the dot-dir, contents = same class as the already-public step logs: titles/telemetry/220-char previews of the all-public corpus) ??? snapshot regeneration stops costing a paid dispatch; (2) clinicalDocumentAliases/clinicalContentAliases moved verbatim to shared scripts/lib/clinical-aliases.ts and the snapshot builder grades documentMatch/contentMatch through them (discriminating tests: EMHS agitation title and spelled-out "absolute neutrophil count" grade as hits only via aliases ??? raw labelMatches pinned false), ending tuner ground truth disagreeing with the live gates; (3) snapshots carry generatedAt + optional sourceRunId, validator accepts them, exactly-36 relaxed to at-least-36 (floor still rejects truncated artifacts; sourceCaseCount + per-case candidate minimums unchanged), and a 30-day freshness test (activates on first regeneration) blocks silent corpus drift. Builder smoke-verified end-to-end on a synthetic 36-case artifact (alias grading + provenance stamped + validator green). Static hyphen audit of all 36 cases' terms: no currently-blocked term (canary #52 = 36/36); residual risk classes documented for the A-PR-2 artifact-grounded pass ??? punctuation-joined tokens (IM/PO, schizo-affective, post-natal) and inert stem entries (obsess/compuls/hyperactiv/impuls can never match whole-token) that currently ride on whole-word OR-alternates. | Targeted vitest 52/52 (ranking-tuning + eval-retrieval + eval-quality); npm run test 3019 passed / 1 known container-only pdf-budget artifact; lint + typecheck clean; check:github-actions + check:ci-scope PASS; prettier clean; check:production-readiness expected missing-secret FAILs only (demo-mode container); no provider calls ??? live validation = tonight's scheduled canary emits the first artifact at $0 | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR #1001: A-PR-2 measurement-floor completion) | 3d8f798 + 5b664f8 + e58c827 | First provenance-stamped snapshot regeneration from a live canary artifact + alias tiering docs + fixture-length pin + lithium doc-gate ??? Phase A of ADDENDUM 4 functionally complete | Artifact chain: user-authorized paid dispatch (canary #53, run 29763761133, 36/36 green, doc_recall 1.0 / content_recall 1.0 ??? first perfect content recall, ciwa alias confirmed live; mrr@10 0.8644, irrelevant@10 0.1083) emitted the first eval-canary-output artifact (51787 bytes, sha256 5af5b802??? verified byte-identical after user transfer into the sandbox ??? this container cannot download run artifacts). Work: (1) two-tier alias documentation ??? investigation of the governance-review P3 showed src/lib/eval-document-matching.ts is a deliberately WIDER captured-case tier (e.g. "Clozapine GP Shared Care"); bulk-merge would loosen golden ground truth, so both files now carry cross-referencing do-not-merge headers instead; (2) snapshot case count pinned to live golden fixture length (regeneration instructions in failure message) ??? closes the coarse-floor P3; (3) snapshot regenerated via the alias-aware builder with --source-run-id provenance: agitation-im-po-options 0???5 graded positives (EMHS alias working on real data), flowchart-next-step confirmed sole zero-positive case; generatedAt promoted to validator-REQUIRED (closes the hand-edit P3); two stale data pins updated (missing-positives 2???1; broad_summary defaults-equality pin dropped ??? defaults' provenance was the retired snapshot, fresh recommendations are Phase B input); (4) artifact-grounded punctuation audit: 7 joined-token occurrences in top-5 previews ??? 3 ciwa-ar (alias-covered, incl. line-broken "ciwa- ar"), 4 ORDINARY-PROSE punctuation ("treatment," / "mood," / "(opioid" / "ptsd.[35]") ??? matcher word-boundary change proposed as its OWN reviewed follow-up per plan (systemic class, not bundled); (5) lithium-therapy-monitoring was the ONLY ungated case (rr@10 hardcoded 0.00 = measurement noise): expectedDocumentSubstrings ["Lithium"] added from live evidence (deliberately broad across the corpus's multiple legitimate lithium guidelines), snapshot rebuilt in lockstep from the same artifact, measured mrr@10 +~0.028 from de-noising. Deferred with reasons: NEW-query fixture cases (saturated-tie shapes, captured rag_query_misses) need live validation before they may gate ??? unlocked by Phase D-1 branch-eval dispatch or a dedicated validation dispatch; real ordering headroom for Phase B = flowchart 0.20, alcohol-ciwa 0.25, patient-safety 0.33, opioid 0.33, all text_fast_path. | Targeted vitest 76/76 ??3 (after each stage); npm run test 3019 passed / 1 known container-only pdf-budget artifact; prettier clean; freshness gate ACTIVE and green; no provider calls beyond the user-authorized dispatch (~$1-2, ADDENDUM 4 spend now ~$1-2 of ???$10) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: B-PR-1 canary dispatch inputs) | see PR head | eval-canary.yml workflow_dispatch gains rag_ranking_config (staged Phase B weight evals, loud malformed-JSON validation to prevent silent fallback corrupting pair comparisons) + ref (Phase D-1 pre-merge branch evals) ??? schedule runs unaffected (empty inputs = today's behavior) | Tuner (offline, $0) on the A-PR-2 regenerated snapshot recommends 3 constrained per-class improvements (document_lookup titleSectionRelevance???0.9; table_threshold clinicalEvidence???0.95; comparison hybridRelevance???0.95 with proxy mrr 0.833???1.0), all with recall non-regression + zero high-risk hard-negative failures; medication_dose_risk + broad_summary stay neutral. Staged config JSON banked for the live pair; baseline = canary #53 re-gated (mrr@10 ???0.8922 after lithium de-noising). Targets per approved plan: mrr@10 ???0.90, irrelevant@10 ???0.08, zero case regressions. Budget: user raised cap to ???$20 (spent ???$1-2). Security note: ref input runs branch code with eval secrets ??? dispatch requires repo write access (sole trusted collaborator), documented in PR risk. | check:github-actions PASS; check:ci-scope PASS; prettier clean; no provider calls (workflow change only) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (Phase B live pair ??? no code change; recorded for eval-history completeness) | canary runs 29763761133 (#53 baseline) + 29769050798 (#54 tuned) | ADDENDUM 4 Phase B verdict: staged 3-class tuner weights produced ZERO live movement ??? NOT adopted per the measured-gain rule | Offline tuner recommendations (document_lookup titleSection???0.9, table_threshold clinicalEvidence???0.95, comparison hybridRelevance???0.95; proxy comparison-mrr 0.833???1.0) staged via the B-PR-1 rag_ranking_config input; #54 log proves the override active (validation step echo). Result vs re-gated baseline: mrr@10 0.8921 vs 0.8922, irrelevant@10 0.1083 vs 0.1083, recalls 1.0/1.0 both, 36/36 both, all four headroom cases byte-identical rr (flowchart 0.20, ciwa-threshold 0.25, patient-safety 0.33, opioid 0.33). Learning: the 5-candidate linear proxy saturates; real headroom lives in fast-path saturated-tie structure (Phase C trigger condition mrr < 0.90 formally met; user authorized C). Nothing to roll back (per-run override). Spend ???$2-4 of user-raised ???$20 cap. | Both canary runs green (36/36 + answer-quality); override-active proof in #54 job log; no adoption = no code diff | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted; PR: Phase C saturation-tail primaries) | 7572c7f | ADDENDUM 4 Phase C (user-authorized): per-candidate discriminative primaries for saturated fast-path ties ??? design-agent planned (consumer map + dead-band envelope proof), red-proven, tie-conservation guarded | Mechanism: min(text_rank,1) collapses all tr???1 candidates to byte-identical imputed primaries; ordering fell to chunk id at release. Fix: saturationTailUnit (pure, monotone, SET-INDEPENDENT ??? rejected per-query min-max + rank-tier designs for set-dependence/#118 authority risk; rejected full-range log rescale for moving sub-knee values across the 0.62-0.82 gate ladder) scales the excess into DEAD cap bands only: S2 table-fact similarity (0.92, 0.94) with hybrid byte-identical (gates/triggers/selection provably unchanged; similarity = the release tie-break key), S1 lexical-chunk hybrid (0.48, 0.5) behind the truthful-contract signature (sub-0.5 bars hold). Sub-knee byte-identical (fixtures now DERIVE from the helper; 0.45???0.755/0.795 pinned). Discriminating test verified RED on old formulas (2 fail: discriminating + envelope) ??? green with tail; equal-tr tie-conservation pins the #987 coverage comparator; second-stage-engaged pools documented out of scope (position-derived releaseRankScore sorts first there) ??? matches live evidence that non-engaged pools (patient-safety, opioid, flowchart) are where id-order decided. S3/S4 = C-PR-2 candidates, evidence-gated on the post-merge canary vs #54 baseline (doc/content recall MUST stay 1.0, zero per-case regressions; success signal = rr lift on the headroom cases). Rollback: single revert (helpers + 2 expression sites + 1 map call; no schema/config/cache surface). | Targeted vitest 121/121 (fast-path 11/11 incl. 6 new, retrieval-selection, rag-routing, rag-answer-fallback, ranking-tuning, second-stage); npm run test 3025 passed / 1 known container pdf-budget artifact; lint + typecheck + prettier clean; red-proof executed and recorded; live validation = post-merge canary dispatch (~$1-2) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: revert Phase C pending review) | revert of f96217c | User-requested revert of #1004 (Phase C saturation-tail primaries): auto-merge fired before the adversarial rag-retrieval-reviewer pass landed; retrieval code returns to the last reviewed state until that verdict is in | Clean single-commit revert (the documented rollback path ??? helpers + 2 expression sites + 1 map call; no schema/config/cache surface). Ledger history rows from f96217c retained (docs are append-only record, not behavior). The 19:44Z post-merge canary dispatched on f96217c completes regardless and stands as Phase C's live validation datapoint; re-land decision = reviewer verdict + that pair result together. Offline state of the reverted change remains fully proven (red-proof + 121/121 + envelope tests). | Revert verified by vitest fast-path suite returning to pre-C 5/5 shape expected in CI; ladder on the revert = hosted pr-required | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (Phase C live verdict ??? no code change; main stays reverted at 0a498e6) | canary run 29773198933 (#55, on f96217c) | ADDENDUM 4 Phase C LIVE-REFUTED: canary on the merged tail code FAILED 3/36 (doc_recall 1.0???0.9167, mrr@10 0.8921???0.8138) ??? the user-ordered revert (#1005) was correct and STANDS | Failures: patient-safety-plan-include (PtSafetyPlan out of top-5, rr 0.33???0.14), patient-property-visual-table (rr 1.00???0.11) and schizophrenia-overview (rr 1.00???0.14) ??? two previously rank-1 cases destroyed. Root cause (post-hoc): the S1 lexical-chunk lift spreads hybrid_score, which is the PRIMARY release sort key ??? inside the dead (0.48,0.5) band it still PREEMPTS every downstream key, so raw ts_rank order overrode the boost/title/subject-aware relevance order that previously decided all-tied-at-0.48 pools. Lexically-loud chunks leapfrogged title-boosted correct documents = the #118 mechanism, reproduced live. The offline S1 test used identical-content candidates (coverage tie) and could not see it. The S2 similarity tail (tie-break-position key) remains reviewer-verified safe in isolation ??? retrieval reviewer verdict on the full diff: APPROVE-WITH-NITS, P3 only (0.49-lowering proven unreachable via the SQL 0.48 cap; no gate crossings in (0.92,0.94); hardening nits recorded). DISPOSITION: no re-land as-is. Any retry = S2-only + S1 redesigned to a key BELOW relevance in the comparator chain, new design + fresh pair. The staged-rollback discipline (canary pair + instant revert) worked exactly as designed. Spend ???$4-8 of ???$20. | Canary #55 read from job log (3 FAIL lines + summary); reviewer verdict from subagent report; main verified reverted (0 saturationTailUnit refs at 0a498e6) | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: RAG memory + safeguards) | see PR head | User-directed close-out: durable RAG behaviour memory (docs/rag-behaviour/, 4 files) + AGENTS.md standing protection rules + ENFORCED safeguards ??? pr-policy blocking `RAG impact:` gate on protected surfaces (self-tested: undeclared/vague blocked, no-change/canary declarations pass) + source-pin contract test on imputation formulas and release comparator key order (red-proven vs a mutated constant). Confirmation canary #56 (29774459706, reverted main 0a498e6): SUCCESS ??? 36/36 restored, closing the #55-regression???revert???restore arc live. Phase D complete (D-1 ref input #1003, D-2 eval:trend #1006, D-3 policy ??3.1 #1006, D-4 latency in trend rows); remaining documented plans: word-boundary matcher (own PR), irrelevant@10 labeling audit, Phase E (separate approval). Spend ???$5-10 of ???$20. | pr-policy self-test + workflow guard PASS; contract test 4/4 + red-proof; npm run test 3025 passed / 1 known container pdf-budget artifact; lint+typecheck+prettier clean; docs:check-links 1030 refs PASS; check:github-actions PASS | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: matcher + artifact follow-ups) | ab145f6 | Remaining documented improvements implemented: word-boundary textContainsClinicalTerm + top-10 canary artifact rows | Matcher: boundaries + internal separators widened to any non-alphanumeric run ??? PROVEN strict superset by artifact replay on canary #53 (1,126 term??alias??result comparisons, 0 lost matches, 7 gained = exactly the previously-documented punctuation-joined occurrences: treatment,/mood,/(opioid/ptsd.[35]/ciwa-ar ??3). More-tolerant measurement cannot fail a passing case ??? weekly scheduled canary = free live confirmation. Exported + 3 direct unit-test groups (superset preservation, audit classes incl. line-broken 'ciwa- ar' and 'full-blood-count', substring-inside-word rejections). Artifact: topResultSummary 5???10 rows so rr@10/irrelevant@10 metrics' actual inputs are captured ??? unblocks the offline irrelevant@10 labeling audit next artifact. docs/rag-behaviour updated to implemented state. Phase E remains gated on separate approval. | Targeted vitest 59/59; npm run test 3028 passed / 1 known container pdf-budget artifact; lint+typecheck+prettier clean; audit script run recorded above; no provider calls | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (PR: DB easy wins) | see PR head | User-requested database + process easy-wins pass: read-only Supabase advisor sweep (user-authorized) ??? canary-liveness probe + advisor-disposition docs; live mutations withheld for per-item confirmation | Advisors (live, read-only): security = 1 INFO (document_title_words RLS-no-policy = the deliberate fail-closed pattern ??? now comment-documented at the schema block so it is never 'fixed'); performance = ~33 unused-index INFOs + auth connection-strategy note ??? docs/db-maintenance.md TRIAGE list with retrieval-surface trgm indexes flagged RAG-protected (dropping = full canary protocol), owner-scoped indexes retained for multi-tenant design, operational candidates deferred (negligible benefit at corpus size). Implemented: ci.yml static-pr warn-only eval-canary staleness probe (actions:read, github-script pinned, >8 days ??? warning; never fails) ??? needed because #923 (2026-07-19) moved the canary cadence from daily to weekly Sunday 18:00 UTC, where a dropped fire would go unnoticed for a week (the failure-issue step only reacts to runs that happen). CORRECTION (CodeRabbit review on this PR): the initially recorded "2026-07-20 dropped Sunday fire" incident did not occur ??? 2026-07-20 is a Monday; the Sunday 2026-07-19 slot fired as scheduled run #48 (19:03 UTC, success), and under the weekly cron no 2026-07-20 slot existed. Probe stands as proactive hardening, staleness now measured from updated_at with a finite-timestamp guard. Presented for confirmation (NOT implemented): scheduled telemetry retention (purge:query-logs is owner-scoped + unscheduled; needs owner/window/policy decision), auth percentage connection strategy (dashboard config), any index drops. | check:github-actions PASS; check:ci-scope PASS; check:function-grants 28/28 PASS; docs:check-links 1034 PASS; supabase-schema vitest 66/66; lint+typecheck+prettier clean; Supabase access read-only only | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from e6cd6cb; PR: telemetry-retention correction) | 01368ff (+0144e69 main merge-in) | User-directed "implement your recommendation for all decisions" close-out: the scheduled-retention recommendation is RETRACTED as founded on a false premise ??? telemetry retention is ALREADY ACTIVE inside the database via pg_cron; docs corrected, nothing built, no live mutations | Fresh read-only cron.job verification (2026-07-20) matches docs/privacy-impact-assessment.md ??6 exactly: jobid 11 purge-expired-rag-queries daily 03:30 (30d), jobid 12 purge-rag-retrieval-logs daily 03:00 (90d), jobid 13 purge-rag-query-misses daily 03:45 (90d), jobid 16 purge-rag-response-cache hourly (bounded 1000); v3 worker jobs present-inactive under backlog auto-toggle (jobid 10); obsolete unbounded cache job absent; audit_logs indefinite by design. db-maintenance.md "open decision" section replaced with the resolved state; purge:query-logs clarified as the MANUAL owner-scoped tool (not the retention mechanism). A GitHub-side weekly deleter would have duplicated pg_cron with window drift (a 90d rag_queries sweep can never out-delete the live 30d job). Remaining decisions stand as documented no-action: auth percentage connection strategy deferred to next instance resize; operational index drops not recommended. | prettier + docs:check-links PASS; Supabase access read-only (single cron.job SELECT, user-authorized read-only envelope); no workflow/schema/config changes | +| 2026-07-21 | claude/x4-sast-gate (PR #1012) | 0d4985e63 | Maturity X4: blocking SAST gate on the untrusted-document parsing surface | Triage-first per workorder: CI-pinned semgrep/semgrep:1.168.0 over worker/**, src/lib/ingestion*.ts, src/lib/extractors, src/app/api/{ingestion,upload} = 0 ERROR findings (24 TS rules/17 files; 55 Python rules/3 files) ??? gate starts green with no suppressions. Shipped `semgrep-ingestion-gate` job (no continue-on-error; container digest-pinned to the triage-verified 1.168.0 image) with p/python added for the worker OCR stack; repo-wide advisory job untouched. check-github-action-pins.mjs now enforces both policy halves fail-closed (advisory repo-wide / blocking-and-scoped gate / digest-pinned gate container). Residuals: registry-pack mutability accepted for the narrow surface; making the workflow a branch-protection required check is an operator decision outside this PR. | Exact gate command exit 0 in pinned container; check:github-actions (new assertions verified fail-closed); check:ci-scope; yaml-contract vitest 1/1; verify:cheap 3031 tests green. No provider calls (local Docker only). | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from f33890a; PR: Phase E instrument input) | see PR head + follow-up SHA pin | Phase E kickoff (user-approved with budget): eval-canary gains opt-in `answer_quality_eval` dispatch input running the 30-case eval:answer-quality fixture (5 quality metrics + per-intent targeting) ??? the instrument was previously never run in CI. Dispatch-only, default-off, informational (exit 0, no --targeting-floor): scheduled runs and existing dispatch shapes byte-identical; gates stay owned by eval:quality. Follows the #1003 input-only precedent. | E-1 recon (all $0/read-only) recorded here: canary answer gate samples only 8 of 44 eval:quality cases (ANSWER_CASE_LIMIT default); eval:quality --provider-mode offline is a real $0 harness (provider deleted, deterministic source-only path) usable as an E-3 regression guard; live 30-day answer telemetry (34 answer-path rows): 25 full answers, misses = evidence_gap ??4 (avg 26s spent before gap), provider_incomplete_max_output_tokens ??2 (avg 82s wasted then discarded), provider_generation_failed ??1, retrieval_gap_or_conflict ??1, source_only_no_api ??1; success latency avg 13.1s / p90 25.2s. Headroom classes for E-3: truncation waste (rag.ts:4265 self-heal insufficient live), late evidence-gap detection, p90 latency, thin CI answer coverage. Next: E-2 baseline dispatch (answer_case_limit=44 + answer_quality_eval=true, est $3-8 of user-authorized ???$20 Phase E envelope) after this merges. | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean; no provider calls this PR (workflow change only); RAG impact: none ??? retrieval steps untouched | +| 2026-07-20 | claude/clinical-kb-pwa-review-asi3wb (restarted from 5b4098d; PR: E-2 baseline record + instrument fix) | see PR head | ADDENDUM Phase E-2 BASELINE BANKED (canary dispatch #57, run 29786560936, main 5b4098d, answer_case_limit=44): golden retrieval 36/36 green in-run (no-regression net held); eval:quality full-44 RED on exactly two gates ??? citation_failure_rate 0.0227 (1/44: neuroleptic-side-effect-escalation ??? expected doc never retrieved, generation quality-failed, extractive fallback with 1 citation) and route_ceiling_failure_count 2 (clozapine-anc-withhold-threshold: 13.3s pure retrieval vs 12s extractive budget, RPC 9.3s, zero generation; agitation-arousal-typo-dosing: 25054ms vs 25000ms after provider_timeout ate 22.6s pre-recovery). Green gates: grounded_supported 1.0, unsupported_correct 1.0 (all 14 refusals incl. both prompt-injection probes at 2ms), numeric grounding failures 0, governance danger 0, p95 17.4s. Non-blocking signals: expected_source_hit 0.6136 (both admission-discharge cases miss MHSP.AdmissionCommunityPts.pdf to sibling NMHS/RKPG policies ??? labeling-vs-ranking question, ??3.1 class), source governance warning rate 0.8182 (metadata debt, waivable class). SYSTEMIC E-3 TARGET: ~9 of 19 generation attempts discarded (fast output fails quality gate ??? extractive fallback wins; ~7 cases carry fast_quality_retry_strong???extractive reasons) = ~half of generation latency+spend wasted. Instrument defect found+fixed this PR: targeting step was skipped after the red gate (GitHub failure-skip semantics) ??? if: gains !cancelled() so baselines observe red gates. Spend: est ~$1-2 actual (19 OpenAI-request cases; cost rates unset in CI so report shows n/a) of ???$20 Phase E envelope. Next: cheap re-dispatch (default limit 8 + answer_quality_eval=true) to bank the skipped 30-case targeting baseline. | Gates this PR: check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean. Baseline evidence: job log run 29786560936 (5 failing-case diagnostics + Answer Metrics table read in full) | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from 87815f4; PR: E-3a cost self-reporting) | see PR head + follow-up pin | Phase E-3a wave (all $0 diagnostics complete, recorded here) + I8 fix: eval-canary env gains the three RAG_EVAL_*_USD_PER_MILLION rates (gpt-5.6-terra standard tier, verified from the live OpenAI pricing page 2026-07-21; documented as a LOWER BOUND since gpt-5.6-sol strong retries cost 2x and the estimator applies one rate set) so estimated_cost_usd stops reading n/a in CI. E-3a findings: (1) discarded-generation histogram from run #57 ??? fast_quality_retry_strong???extractive x6, generation_quality_failed x4, provider_timeout x2; gate sub-reasons fragment_like x2, bad_final_answer_quality x1, ungrounded_extractive_fallback x1 ??? E-3c targets the fast-attempt-fails-extractive-wins shape first. (2) I2 resolved: routeCeilingExceeded (eval-quality.ts:157/171) keys on the RUNTIME's own route_budget_ms + deadline flag, NOT the cross-region-widened eval gates ??? clozapine case = 13.3s retrieval vs the runtime's 12s extractive budget, geography-amplified; design ??? E-3b. (3) FIXTURE-CORPUS DRIFT (major): the live corpus contains ZERO MHSP*-named files; the 44-case fixture's expectedFiles are all MHSP.*/CG.MHSP.* and pass only via the eval-document-matching alias tier. All three expected-doc failures triaged: neuroleptic-side-effect-escalation = REAL retrieval-coverage gap (alias exists; Neuroleptic Side Effects (AKG).pdf indexed 11 chunks, 3 contain escalat%, yet answer retrieval returned a single off-point source) ??? protected-path item awaiting user go-ahead; admission-discharge x2 = top-5 preference for sibling NMHS/RKPG policies over the existing aliased AKG doc ??? labeling-vs-ranking decision presented to user. No fixture/alias edits made (ground truth requires sign-off). | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS; prettier clean; Supabase access read-only (documents/document_chunks SELECTs); OpenAI pricing page read via WebFetch | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from c308fdc; PR: labeling widen) | see PR head | USER-APPROVED ground-truth widening (AskUserQuestion 2026-07-21: "Widen to accept siblings") for the two admission-discharge cases: the WIDER alias tier's AdmissionCommunityPts entry gains the two NMHS "Admission to Discharge" titles (Community Mental Health + Mental Health Inpatients). Deliberate exclusions documented in-code: discharge-only docs must not satisfy the admission slot; the MHHITH programme policy is too narrow. STRICT golden tier untouched (bulk-merge prohibition respected). Verified by replaying run #57's actual top-5 lists through expectedFileCoverage: admission-discharge-coverage-paraphrase now passes; admission-discharge-comparison STILL FAILS honestly (its top-5 carries no admission-side doc at all ??? dup discharge-planning + Falls Prevention) and is retained as a genuine comparison-class retrieval-coverage signal, folded into the same investigation as the neuroleptic case. | typecheck PASS; prettier clean; probe script replay recorded (paraphrase allHit true / comparison allHit false, missing admission slot); no retrieval code touched; protected-file edit (eval-document-matching.ts) per explicit user authorization | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3b budget-aware generation deadlines) | 314d03f | Clinical-governance review of E-3b diff `git diff origin/main...HEAD` (commits 1078264 + 314d03f): answer-side generation timing/gating + telemetry ??? reserve-aware generation timeout (`generationRequestTimeoutMs`), truncation self-heal budget gate (`deadlineAllowsGenerationRetry`), `route_budget_exhausted_by_retrieval` telemetry, and the cross-region eval carve-out in scripts/eval-quality.ts. | APPROVE-WITH-NITS. No P0/P1/P2. (a) Conservative failure preserved: reserve-aware timeout fires ~2s early producing the SAME error type ??? an internal SDK timeout is mapped by mapOpenAIError to PublicApiError(openai_timeout) (openai.ts:525-529), NOT a bare DOMException, so the rag.ts:4636 re-throw guard is not tripped and the existing source-backed fallback/extractive recovery is reached; truncation-skip falls through to the terminal throw (rag.ts:4309-4313) into the same catch. No new answer-producing path. (b) Safety gates intact: all recovery answers finalize through finalizeAnswer???finalizeRagAnswerQuality and isSafeExtractiveFallbackCandidate (grounded/confidence/quality/numeric) ??? none touched. (c) Eval carve-out env-gated: crossRegionRunner && budgetExhaustedByRetrieval && generationMs===0; EVAL_LATENCY_CONTEXT set only in eval-canary.yml:164, prod caller (eval-quality.ts:1095) passes no options ??? inert in release/local; generationMs===0 requirement means a generation-side failure (generationMs>0) is never suppressed. (d)/(e) Telemetry additions non-PHI (boolean + mechanical retry-reason strings); no privacy/query-privacy/cross-border/verification source files touched; no new provider call. Nits (P3, non-blocking): carve-out also excuses fast/strong routes when generationMs===0 (sound ??? provably no generation ran); `requestTimeoutMs` now prod-dead (test-only); report label "retrieval-exhausted" (routeDeadlineExceeded && flag) is broader than actual gate suppression (audit label only, gate stays strict). | 88 offline unit tests PASS (tests/rag-route-budget.test.ts, tests/eval-quality.test.ts, tests/rag-offline-answer.test.ts, tests/rag-answer-fallback.test.ts); no provider/Supabase/OpenAI calls; no files mutated except this ledger row | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3b budget-aware generation deadlines) | 314d03f (+eb08ec5 review row) | ADDENDUM 5 wave E-3b implemented per the design-agent plan: generation attempts clamped to route budget minus a measured 2s recovery reserve (single call-site, all four attempt kinds); truncation self-heal gated on retry viability (reserve+5s floor) with observable truncation_retry_skipped_budget_reserve marker; additive route_budget_exhausted_by_retrieval runtime flag; eval route-ceiling gains the triple-condition cross-region carve-out (context + runtime flag + zero generation) with retrieval-exhausted audit cells ??? local/release gates provably strict. Fixes I3 (54ms budget overrun after 22.6s provider timeout), I5 (82s truncation waste class), resolves I2 (clozapine 13.3s retrieval vs 12s runtime budget = geography, now suppressed ONLY in the sanctioned cross-region context with full auditability). Reviewer verdicts: rag-retrieval-reviewer APPROVE-WITH-NITS (2 P3: prod-dead requestTimeoutMs retained for symmetry; report-cell coupling cosmetic; cached-replay invariant PROVEN ??? budget-exhausted answers never cached, carve-out unreachable via replay; marker isolation proven ??? SLO counters key on fallback_reason not answer_retry_reasons); clinical-governance-reviewer APPROVE-WITH-NITS (prior row) ??? internal-timeout???PublicApiError???existing-fallback path verified, all safety gates still applied to recovery answers. ALSO BANKED ??? E-2 targeting baseline (canary run #58, 29788404357, all-green incl. first execution of the !cancelled()-fixed instrument, ~$1-2): metric_rates relevance 0.6 / readability 1.0 / artifact_leaks 1.0 / intent_coverage 0.9333 / fail_closed 0.9; targeting_rate 0.5909 (13/22); by intent: document_lookup 5/5, red_result_action 3/3, contraindication 2/2, dose 1/5, monitoring_schedule 1/5, pathway_referral 1/2; all 9 misses = missing dose figure/schedule-interval (answer lengths 73-232 chars) ??? E-3c co-primary target alongside the wasted-generation class. Phase E spend ???$3-6 of ???$20. | Red-proofs: reserve pinned 3 independent ways (exact 23000ms grant, deadline flag clear, total under budget); self-heal skip pins exact marker + single provider call; offline flag pinned true/false. Focused: route-budget 9/9, eval-quality 27/27, fallback+offline 52/52, parser/abort regressions 15/15. Full suite 3043 passed / 1 known container pdf artifact. typecheck+lint+prettier clean. No provider calls; live proof = E-4 paired run | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (restarted from e02ba3d; PR: E-3c PR-A instrument) | see PR head | ADDENDUM 5 wave E-3c design accepted (Plan agent, full report in session record) and PR-A delivered: eval-answer-quality gains --dump-answers (per-case answer TEXT + sections + targeting verdict JSON for the canary artifact ??? answers are not retained at rest by privacy design, so miss diagnosis needs eval-time capture), parseArgs/buildAnswerDumpRecord exported behind an import.meta main-guard (eval-quality precedent), canary targeting step wired with the flag. Design highlights for the record: DEFECT 1 root confirmed as fast-attempt-doomed-then-discarded on strong_routine_retrieval procedural shapes ??? PR-B generalizes the EXISTING validated-extractive short-circuit pattern (LAI + blocked-recovery precedents, hasValidatedExtractiveCandidate) to the measured shape via a new rag-extractive-first.ts module (net ~-110 rag.ts lines against the 5030 budget); DEFECT 2 rank-1 root = extractive lead-slot selection prefers shortest sentence and admits figure-less leads (sort at rag-extractive-answer.ts:917, 1-slot monitoring leads) ??? PR-C adds intent-figure-aware lead promotion with a claim-support atom-corpus nuke-proofing guard + dose/threshold fallback candidate preference (find(safe && figure) ?? find(safe)); answer-verification CLEARED as direct cause (whole-answer gap or unbold only, never per-figure deletion). H2 (strong-route comparison/complex residual) explicitly deferred as the named E-3d candidate. E-4 metrics set: discarded-generation <20% from ~47%, dose ???3/5, monitoring ???3/5, no intent below #58, recalls pinned 1.0, relevance/fail_closed/readability/artifact_leaks ??? #58. | PR-A gates: new tests/eval-answer-quality.test.ts 4/4; typecheck, check:github-actions, check:ci-scope, eval-canary-workflow test, prettier all clean; no provider calls | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3c PR-B short-circuit) | f7e6cbb + hardening commit | E-3c PR-B: pre-generation validated-extractive short-circuit for gate-passed routine procedural "What...process/include/required" queries (marker validated_routine_extractive_first), generalizing the LAI + blocked-recovery precedents via new rag-extractive-first.ts (3 predicates moved byte-verbatim, machine-verified; rag.ts 5029???4908 vs 5030 budget). Kills the run-#57 6x wasted-generation class. REVIEWS (both pre-push): rag-retrieval-reviewer APPROVE-WITH-NITS ??? move fidelity brace-diff verified byte-identical; confidence-gate skip PROVEN safe (passed-gate is a no-op in applyConfidenceGate; markers pairwise mutually exclusive); comparison false-positives blocked by unchanged classifier precedence; offline/source-only idempotent; zero retrieval/ranking/selection/threshold change; P2 = eval-only assertions (intent_coverage/artifact_leaks/expected-file) unverifiable offline for flip candidates (quality-nocc-document-support, quality-form-required-documentation, quality-discharge-documentation, quality-duress-pathway + rag-set siblings) ??? pre-merge BRANCH canary recommended and ADOPTED (offline-green + review-approved proven insufficient for this surface, 2026-07-20). clinical-governance-reviewer APPROVE-WITH-NITS ??? full gate-stack trace: nothing bypassed (same finalizeRagAnswerQuality, same citation scoping, numeric verification not fail-open, ungrounded-finalize defense at rag.ts:3694); P2 = pre-existing bare-cross-reference-with-overlap gap, NOT materially widened (new trigger anti-correlates), hardening recommended ??? APPLIED this PR: !isBareCrossReferenceAnswer screen in hasValidatedExtractiveCandidate (closes all three short-circuit paths; discriminating test added; disclosed post-review delta, strictly narrows shipping). MERGE GATE: draft until the branch canary pair (baseline #57/#58 vs branch run with answer_case_limit=44 + answer_quality_eval=true, est $3-6 of authorized envelope) is green ??? zero per-case regressions, recalls 1.0, quality/targeting rates >= baseline. | Red-proof + 3 negative guards; focused 61/61 + fallback/offline/contract suites; full suite 3061 passed / 1 known container artifact (pre-hardening tree; hardening re-verified focused); typecheck+lint+prettier clean; maintainability budget passed (4908/5030) | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (pair verdict ??? no code change; main stays at 22b6a2e) | canary run 29794759627 (#59, branch head 7310cb3 = merged PR-B content) | E-3b + E-3c PR-B LIVE-VALIDATED (pair vs banked #57/#58): route_ceiling_failures 2???0 (E-3b proven: agitation timeout now fits inside budget; clozapine retrieval-exhausted ceiling honestly excused via the triple-condition cross-region carve-out ??? exactly one "retrieval-exhausted" audit cell in the report); p95 17.4s???15.47s (-11%); golden retrieval SUCCESS 36/36 (stop-ship criterion held); validated_routine_extractive_first fired on 4 of the 6 target cases (patient-safety-plan 3.3s, treatment-team-process 2.6s, ect-procedure 2.2s, illegal-substances 2.2s ??? all pure extractive, zero generation, was 6-9s each with a discarded attempt), the other 2 (community-home-visits, best-practice-prescribing) stayed on generation+fallback because their extractive candidates legitimately fail validation gates = the designed-conservative outcome; ZERO new failing cases (list 5???2, both known residuals: neuroleptic citation red = Option A territory, admission-comparison expected-doc = non-blocking labeling residual); grounded 1.0 + unsupported_correct 1.0 held; targeting 0.5909???0.619, fail_closed 0.9???0.9333, readability/artifact_leaks/intent_coverage unchanged; relevance 0.6???0.5667 = single-case wobble on n=30, WATCH in E-4, not a gate. Discarded-generation rate materially down (4 conversions; residual = the H2 strong-route slice named as E-3d candidate, per design's 20-33% expectation band). MERGE STANDS (user had armed auto-merge pre-verdict; revert drill not triggered). Spend +~$3-6 ??? Phase E total ~$6-12 of ???$20. | Pair evidence: run #59 job log (Blocking failures = citation only; Answer Case Diagnostics markers; metric_rates + targeting blocks); dump artifact populated for PR-C diagnosis | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: E-3c PR-C figure-aware selection) | 043b030 + P2-fix commit | E-3c PR-C: dose/monitoring extractive answers now carry the asked-for figure/schedule when the cited chunk verbatim supports it ??? lead-slot promotion (dose swaps last of 2 slots, monitoring appends 2nd sentence; no-op when a lead already carries a figure) guarded by the claim-support atom corpus (sourceEvidenceText exported, promotionAtomKey byte-identical to claim-support's atomKey), plus the dose/threshold generation-fallback preferring the safe figure-carrying candidate (safety gate unchanged, filter-order-stable). Fallback helpers extracted to rag-extractive-answer (cycle-check verified); rag.ts 4908???4901. Six discriminating tests each verified red-on-prior-code incl. proving the nuke-guard load-bearing by disabling it. REVIEWS (both pre-push on 043b030): rag-retrieval-reviewer APPROVE-WITH-NITS ??? no-op path byte-identical verified, atom-key identity verified, filter-vs-find proven side-effect-free, 2-sentence append gate-safe, intent double-gated, zero retrieval/ordering change, imputation contract green; P2 = zero-atom monitoring figures ("every 6 weeks" yields no value atom) pass the guard trivially and can be nuked by claim support if sourced only from adjacent context (fails SAFE ??? evidence gap, never a wrong figure). clinical-governance-reviewer APPROVE-WITH-NITS ??? all six clinical concerns CLEARED end-to-end (verbatim-support guarantee, citation binding preserved, conservative failure test-proven, unsafe candidates impossible, wrong-drug risk controlled by pre-existing entity/multi-drug guards, no PHI); same zero-atom finding as P3 + one comment-precision nit. P2 FIXED post-review (disclosed): zero-atom figures now require the matched figure substring verbatim in sourceEvidenceText (intentFigureMatchText); proven both directions by 3 new tests (promotes from content, refuses from adjacent-context-only); comment-precision nit folded in. | Focused post-fix: extractive-formatting 32/32 + fallback/eval-cases/offline/contract/extractive-first 98/98 incl. imputation contract; typecheck+prettier+budgets clean; full-suite 3068-passed baseline pre-P2-fix (fix re-verified focused). Live proof = E-4 pair next | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (E-4 pair verdict ??? no code change; #1039 merged as 9b655fa) | canary run 29800029819 (#60, main 9b655fa = E-3b+PR-B+PR-C) | PHASE E-3 WAVE CLOSED ??? E-4 VERDICT: ADOPT (no revert). 44-case: the ONLY blocking red is the KNOWN persisting neuroleptic citation case (0.0227, identical #57 signature: generation quality-failed ??? extractive fallback 1 citation ??? the pre-declared Option A carve-out, retrieval-side, untouched by answer waves); route_ceiling_failures 0 CONFIRMED ON MAIN (E-3b: agitation 23.1s < 25s after 20.3s provider timeout; clozapine 14.5s with exactly one retrieval-exhausted audit cell); grounded 1.0 / unsupported_correct 1.0 / numeric 0 / governance-danger 0 all held; expected_source_hit 0.6136???0.6364 (#1020 widen); generation attempts 19???9 across 44 cases (10+ cases short-circuit via validated_routine_extractive_first at 2-6s, zero generation spend ??? the absolute wasted-generation seconds collapse; residual 6 discarded attempts are the named E-3d H2 strong/comparison slice). Targeting vs #58 baseline: rate 0.5909???0.6667, dose 1/5???2/4 (sertraline + quetiapine still miss), document_lookup 5/5???6/6, contraindication 2/2, red_result 2/2, pathway 1/2; readability/artifact_leaks 1.0. NOT met: monitoring_schedule flat 1/5 ??? per-miss lens shows answers of 73-232 chars with NO schedule token available to promote (olanzapine-lai 79ch, metabolic 73ch = single-fact extractive answers; the PR-C promotion is a no-op when no figure-bearing fact is extracted) ??? root is fact-extraction/retrieval depth on monitoring shapes, queued as the Option-A-wave companion diagnosis (dump artifact 8483731630, 30d retention). WATCH escalated: relevance 0.6 (#58) ??? 0.5667 (#59) ??? 0.5333 (#60) ??? two single-case steps coinciding with more terse extractive answers; fail_closed 0.9 = exactly the #58 main baseline (#59's 0.9333 was the outlier), safety texture flat. Adoption per plan criteria: targeting ??? baseline ???, grounded/refusal 1.0 ???, golden 36/36 ??? (in-run), ceilings 0 ???, citation red = carved known case ???. CodeRabbit post-review follow-up landed pre-merge (02b5c78): interval-regex full-match reorder (atom path proven to intercept the claimed exploit; reorder = drift hardening), clinicalValueAtomKey exported (mirror deleted), guard tests made honestly discriminating + genuine zero-atom "annually" coverage both directions. Instrument note: cost rates live on the targeting step env but eval:quality still reports cost n/a (estimator not consuming them in the 44-case path) ??? minor tooling residual. Spend +~$2-4 ??? Phase E total ~$8-16 of ???$20. | Evidence: run #60 job log read in full (Threshold Status: citation-only; Answer Metrics + 44-row diagnostics; targeting metric_rates + 7-miss list); artifact eval-canary-output 8483731630 sha256 d5c7006e??? (download blocked in-session ??? GitHub App scope; log tee carried the targeting output) | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A: title-supported escalation rescue) | 0abf3c9 (parent 1aebf02) | rag-retrieval-reviewer PROTECTED-surface review of the S3 document-lookup escalation rescue: shouldAttemptDocumentLookupFastPath exported + gains medication_dose_risk branch firing ONLY when analysis.intent==="escalation_risk" && documentTitleTerms.length>0; call site passes queryAnalysis; new tests/rag-document-lookup-escalation-rescue.test.ts. | APPROVE-WITH-NITS. No P0/P1/P2. Binding constraints held: released-search-order.ts + retrieval-selection.ts clamp + rag-candidate-sources.ts imputation all byte-identical to parent (git diff empty); imputation-contract test green; 0.66/0.055 floor (rag.ts:1765) unmodified and still gates rescued pools (S3 block sits after the 2513 fast-path return + re-runs decideTextFastPath at 2631). BLAST RADIUS empirically proven via 110-case offline probe (44 ragEvalCases + 30 answerQualityEvalCases + 36 golden): EXACTLY 1 fires (neuroleptic-side-effect-escalation, intent=escalation_risk tt=3); all 8 named dose cases non-firing (clozapine-monitoring general, paraphrase general, agitation-pharm general, im-po drug_dosing, typo-dosing drug_dosing, missed-dose-table drug_dosing, LAI general/tt0, prompt-injection-forge intent=protocol). intentFromSignals precedence (clinical-search.ts:575-585) returns drug_dosing before escalation_risk so pure-dose structurally cannot fire ??? confirmed by construction AND empirically. ADVERSARIAL: prompt-injection-forge intent=protocol => cannot fire (empirical); unsupported short-circuit (rag.ts:2371) precedes S3 block. DOWNSTREAM: buildRetrievalIntent for the escalation query yields EMPTY requiredTermSignals => demote/promote arms (retrieval-selection.ts:354-355/529/555) + wrong-medication cap (rag.ts:730-737, gated on clinical_subject) all inert; end-to-end test proves neuroleptic-doc rank#1 with >=2 citations, sibling retained, arrival-order invariant. golden vector-\* probes = broad_summary (already allowlisted) => predicate byte-identical => unaffected. TEST HONESTY: S3 fixture (0.92/0.34/0.94/synthetic_text) faithful to searchDocumentLookupFastPath (rag-candidate-sources.ts:570 caps alias documentScore at 0.34 => sim=min(0.92,0.58+0.34+bonus)=0.92, hybrid=min(0.94,0.94)); differently-relevant fixtures (not identical-content); red-proof structurally airtight (e2e gates its own fixture pool on the predicate). EFFORT: one S3 RPC (same call allowlisted classes issue), rescue-only in the non-forceEmbedding path (floor already rejected => query was headed to embedding anyway; successful rescue short-circuits at 2646 pre-embedding = net-neutral/positive). NITS (P3, non-blocking, no code change pre-canary): (1) redundant analysis?. on the documentTitleTerms clause (&& short-circuit already guarantees analysis defined there); (2) a queryMode forcing medication_dose_risk over an originally-escalation-shaped table_threshold could newly fire S3, but table_threshold already ran S3 so behavior-consistent, not a regression; (3) "forceEmbedding discards S3 merges" is imprecise ??? line 2649 merges S3 even under forceEmbedding; the accurate unaffected-reason for vector-\* probes is broad_summary allowlisting. TRUST GATE = the mandated live canary pair (correctly deferred by the commit). | Offline only, no provider calls: new test 10/10 + imputation-contract 2/2; protected-surface batch 31/31 (escalation-rescue + imputation-contract + fast-path-ordering + released-search-order + retrieval-selection); 110-case classifier probe (temp test, removed); npm run typecheck exit 0. Not run (provider-gated): eval:retrieval:quality, eval:rag, the live canary pair. | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | rag-retrieval-reviewer on the monitoring evidence-gate parity commit: REQUEST-CHANGES (soft) ??? P2 reproduced: inflected monitoring kind tokens (monitor\w*/annual(?:ly)?/blood tests?/ecgs?/lfts?) steal sole-dose-value sentences from the dose arm; dose-intent answers then reject the monitoring-kind fact ("Quetiapine is monitored at a dose of 200 mg daily" flipped grounded true???false, source-gap ??? fails CLOSED, never a wrong dose). P3: monitoring figure escape lacked the dose escape's multi-drug bare-row guard. Clean: over-admission bounded (broad vocab lives in gate/filter only, promotion still corpus-guarded, claim-support unchanged); regex cost negligible; mismatched-unit test relaxation legitimate (synopsis is corpus-verbatim; weeks pin enforced by atom identity + adjacent_context exclusion from both gate and claim corpora). | BOTH FINDINGS FIXED in a3b9a54: kind arm classifies legacy tokens byte-identically and new-inflection-only sentences fall through to the dose arm when they carry a clinicalDoseValuePattern value (both repro sentences pinned as dose-intent tests); multi-drug bare-row guard extended to monitoring_schedule with a discriminating test ??? red-proven both directions. Reviewer checks: formatting 38/38, focused 644/644; targeting eval deferred to the wave's live canary pair. | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (parity commit review) | 1aebf02 (fix landed a3b9a54) | clinical-governance-reviewer on the same commit: APPROVE-WITH-NITS. P2 (independently converged with the retrieval reviewer's P3): monitoring figure-escape lacked the dose-path multi-drug cross-entity guard ??? a bare wrong-drug schedule/level row in a multi-drug chunk could be entity-prefixed for a named-drug monitoring query; downstream gates verify text-vs-source presence, never attribution (worked lithium/valproate LFT path traced through finalize). FIXED in a3b9a54 exactly as its smallest-fix prescribed (guard at the :872-881 site now fires for monitoring_schedule; negative multi-drug test added, red-proven). Clean: unsupported figures impossible (admission-only change; promotion corpus guard + numeric verification + claim support all byte-unchanged); conservative failure intact (figure-bearing-only escape, schedule-free refusal pinned); adjacent-context safety held (sourceEvidenceText excludes adjacent_context; weeks refusal confirmed by probe); no PHI/provider/ranking surface. P3s: RAG impact line (present in the PR body ??? behaviour-change form, correct since the PR also carries the Option A retrieval change); multi-drug negative test (landed in a3b9a54). | Offline guard-chain trace + targeted vitest probes (named-drug guard, bare-figure admission, conservative gap, adjacent refusal). Provider/release gates deferred per confirmation boundary. | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A rescue review) | 0abf3c9 | clinical-governance-reviewer on the S3 escalation rescue: APPROVE-WITH-NITS, no P0/P1. P2 = the mandated live canary pair itself (process gate, declared in the PR body; offline-green + review-approved proven insufficient for this surface 2026-07-20). P3s: multi-drug escalation-query recall edge (titled drug + untitled drug ??? fast-path return can skip the vector leg; recall limitation, not misattribution, mirrors the pre-existing allowlisted-class tradeoff); reviewer probe files must stay uncommitted (relocated to scratchpad). All six clinical concerns verified safe: wrong-document impossible (alias phrases must appear in the query; per-document alias groups, no cross-drug conflation), conservative availability (S3 purely additive via keyed-union merge; sibling retention test-pinned), live expansion acceptable (title-named correct-entity SOP in every firing shape), fail-closed double layer (adversarial short-circuit precedes the predicate; injection-forge case intent=protocol cannot fire ??? executed), governance metadata unbypassed (same attachDocumentRankingMetadata + status=indexed + access-scope filters), no PHI/provider/schema surface. | Reviewer checks: escalation-rescue suite 8/8, injection-forge intent derivation executed, static trace of the full S3 chain. Live canary pair = the trust gate, dispatched post-merge. | +| 2026-07-21 | claude/patient-profile-input-bounds-123366 (PR #1045: FV-03 fail-safe input bounds) | 75303e8b8 | Clinical-governance verification of FV-03 (patient-profile numeric fields ??? medication-safety alert engine). 4-agent adversarial workflow (consumer map + suppression audit + physiological bounds + synthesis). | ADJUST???implemented. Consumer map: evaluatePatientAlerts is the ONLY numeric consumer, no dose arithmetic, sanitize() is the sole guaranteed chokepoint. Suppression audit found naive null-routing UNSAFE via the bare-renal both-null hole (medication-patient-alerts.ts:286) ??? nulling one out-of-range renal input while the other is present-normal ??? false all-clear; fixed with &&???|| (0 bare-renal contraindication rows in corpus ??? no-op on current data). Bounds VALIDATED (age 0-130, egfr 0-250, crcl 0-400, qtc 240-800, scr ??mol/L 15-3000 unit-aware): never reject a legitimate clinical extreme. Reject-to-null (never clamp). | typecheck, lint, format:check, full unit+jsdom 349 files/3120 passed/0 failed (incl. 38 new/updated FV-03 tests), design-system-contract (baselines unchanged), type-scale, icon-scale, check:production-readiness READY. verify:ui in CI. No provider calls. | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (Option A wave verdict ??? no code change; #1040 merged as cde6c5c) | canary run 29827012719 (#61, main cde6c5c) vs banked #60 (29800029819) | OPTION A WAVE ADOPTED ??? FIRST FULLY-GREEN 44-CASE CANARY IN PROGRAM HISTORY (Blocking failures: None). (1) Option A payoff EXCEEDED: citation_failure_rate 0.0227???0; the neuroleptic-side-effect-escalation case flipped from wrong-doc???failed-generation???1-citation-fallback to **strong route, successful gpt-5.6-sol generation, passed in 15.4s with no fallback marker** ??? the rescued S3 retrieval fixed generation itself, not just the citation count; expected_source_hit 0.6364???0.6591. (2) Golden held exactly as the blast-radius analysis promised: 36/36 PASS, content_recall 1.0, mrr@10 0.8921 BYTE-IDENTICAL to the pre-wave baseline (zero ordering movement ??? no golden case fires the predicate), irrelevant@10 0.1083???0.0917 (slightly better). (3) Parity payoff PARTIAL: monitoring targeting 1/5???2/5 (olanzapine-lai flipped ??? previously called a retrieval-depth residual; quetiapine-dose also flipped on the dose side); lithium-range (232ch) + metabolic (73ch, byte-identical answer to #60) did NOT flip despite offline-proven fixes ??? their live chunk sets evidently contain no admissible schedule sentence even under the widened gate ??? reclassified as retrieval-depth/live-content residuals joining adhd; below the ???3/5 target but strictly improved, no regression anywhere. Dose 2/5 vs 2/4: same passing count, applicable set grew (new quality-metformin-renal-dosing miss = eval-set churn, not regression). (4) No-worse EXCEEDED: relevance 0.5333???0.6 (the two-step watch-item slide FULLY REVERSED to the #58 level), targeting_rate 0.6667???0.6957, fail_closed 0.9 held, readability/artifact_leaks 1.0, route ceilings 0, grounded 1.0, unsupported_correct 1.0, numeric 0, p95 22.8s, red_result 3/3. Adoption per the measured-gain rule: primary goal achieved, three case flips, relevance recovered, zero regressions. Residual queue: monitoring retrieval-depth trio (lithium-range/metabolic/adhd), E-3d H2 discards, weekly ANSWER_CASE_LIMIT 8???44 raise now unblocked (gate would be green), comparison-class coverage. Wave spend +~$2-4 ??? Phase E + Option A total ~$12-20 of ???$20. | Evidence: run #61 job log read (Threshold Status: None; Answer Metrics; neuroleptic diagnostics row; targeting metric_rates + 6-miss list; golden 36 PASS lines + summary). Revert drill NOT triggered. | +| 2026-07-21 | claude/clinical-kb-pwa-review-asi3wb (PR: I9 weekly coverage raise) | see PR head | ADDENDUM 5 post-green item I9 (plan-authorized "after reds fixed"): weekly scheduled canary ANSWER_CASE_LIMIT default 8???44 ??? the Sunday 18:00 UTC cron now guards the FULL answer-quality case set instead of the first 8 (both #57 blocking reds historically lived OUTSIDE the first 8, leaving the weekly gate blind to them). Unblocked by run #61 proving the citation gate green on the full 44. Cost: est +$1-2/week (user-authorized in the plan). Contract test pin updated in lockstep (eval-canary-workflow.test.ts). Dispatch shapes unchanged (input override still wins); operational-risk diff, plain-revert rollback. | check:github-actions PASS; check:ci-scope PASS; check:gate-manifest PASS (20/20); eval-canary-workflow contract 4/4; prettier clean; no provider calls | +| 2026-07-21 | claude/database-governance-audit-10b6ed (PR #1051: source-governance audit ??? safe subset) | cee396730 | Governance-metadata observability + UI display + provenance flow test; no ranking/retrieval/generation surface touched. | IMPLEMENTED + handed off (not a review of prior work). Resolved audit #1 (logger.warn on unrecognized enum values; return value unchanged), #2 (review_due_source added to frontendVisibleWarningCodes ??? answer-level badge; warning-severity, no refusal impact), #9 (source_metadata retained on safety-finding citations + governance pill in SafetyFindingsListContent), #13 (new tests/provenance-flow.test.ts: DB-normalize???governance???client payload sources+safety citations???render policy). Deferred #4/5/6/8/10 (RAG-protected ranking/selection/LLM-context/cache ??? need live eval-canary+approval), #11/#5 flag debt (D5/D4), #3 (is_public schema/RLS), #7 (conflict-detection scope), #12 (canary automation). Rebased onto origin/main (was 18 behind; conflict-free ??? none of the 18 commits touched the 8 files). PR-policy CI green (confirmed no ragRankingPatterns match). | verify:pr-local exit 0 (351 files/3129 tests, production build, client-bundle secret scan, offline RAG fixtures 36/36); typecheck + lint + prettier green. verify:ui NOT run locally: pre-existing globals.css Tailwind/Turbopack dev-compile error (git-clean, unrelated; prod build passed) ??? CI Production UI job covers it. check:production-readiness deferred (offline env/config validator; PR changes no env/secret/config inputs; secretless worktree). No provider calls. | | 2026-07-24 | implement-audit-recommendations-fix (PR #1141) | 864f738e6 | Run PR sweep: CI fix + threads + drift | Before: PR required green, 2 unresolved duplicate sm:max-h command-surface threads, branch behind main. After: merged origin/main cleanly; removed generic duplicate sm:max-h cap; both threads resolved via GraphQL; reply mutations 403 noted in commit 864f738e. | node scripts/run-vitest.mjs run --reporter=dot tests/search-command-surface.test.ts PASS (8/8); git diff --check PASS; no Supabase/OpenAI/live eval gates run. | | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | e3dc87000 | Run PR sweep: CI fix + threads + drift | Before: PR required green, 1 unresolved guest-favourites dock thread, branch behind main. After: merged origin/main cleanly; gated favourites hero composer slot on favouritesAccessible; thread resolved via GraphQL; reply mutation 403 noted in commit e3dc8700. | node scripts/run-vitest.mjs run --reporter=dot tests/mobile-composer-reserve.test.ts PASS (9/9); git diff --check PASS; no Supabase/OpenAI/live eval gates run. | -| 2026-07-24 | repo-auditor (detached HEAD 037b4808 — explicit full-repo structural audit) | 037b4808100946f96aee28b8ff51939ae2986851 | Full-repo structural audit: broken imports, dead files, consolidation. Scope: src/, scripts/, worker/, tests/. Pure triage — no files mutated. | P0/P1: none. P2: confirmed dead file src/components/clinical-dashboard/prior-answer-turn-surface.tsx (115 lines, zero importers; superseded by answer-thread-turn.tsx per its 'Extracted from ClinicalDashboard.tsx maturity X3' comment; old file exports PriorAnswerTurn type + PriorAnswerTurnSurface component — both replaced). P3: three duplicate package.json script pairs (test:e2e = test:e2e:all; promote:public-documents = promote:public-documents:batch; postinstall = hooks:install — last pair intentional lifecycle). Unused public exports: authorization.ts (administratorRoleClaim/Value internal-only), api-client-error.ts (ApiClientError — only parseApiErrorResponse imported), rag/rag.ts (answerQuestion — superseded by answerQuestionWithScope), supabase/project.ts (isExpectedSupabaseProjectConfig + 2 types). RAG surface note only (do not touch): rag-extractive-first.ts exports hasValidatedRoutineExtractiveRecovery/hasValidatedGenericLaiManagementExtractiveAnswer with no external consumers. Knip false positives: taskkill (win32-gated), railway (opt-in --railway flag). No broken imports (typecheck + lint both exit 0, zero relative ../ imports in src/). | npm run typecheck (exit 0); npm run lint (exit 0); npm run check:knip (exit 0); knip --reporter json full export/file/type analysis; rg import-graph probes across all source trees | -| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138) | 46597a9b | Explicit performance + frontend-ui review of search/interactive surfaces; low-risk client deferral/cache/abort/progressive-reveal pass | Prior document/universal search latency work retained (NDJSON stream, LRU, lazy PDF, content-first detail). New work: differential debounce+abort+LRU; useDeferredValue on catalogue ranking; document results Show more window; RelatedDocumentsPanel memo; universal LRU 100+TTL; deferred registry search extracted from ClinicalDashboard. No RAG/retrieval/ranking edits. No high-confidence P0–P2 defect found in the shipped scope; residual risk = deferred paint lag on large catalogues and progressive reveal missing deep cards until Show more. | Focused Vitest 10/10 (differential + universal + performance boundaries); verify:cheap exit 0 (3262 tests); typecheck clean; verify:ui exit 0 (Chromium). No provider calls. | -| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 follow-up) | 7e2ccee0 | Bugfix pass on search interactive performance diff | Fixed P1 auth-stale differential matches; P2 progressive-reveal hiding selected card; P2 deferred empty/full-catalogue flash on services/forms/formulation/therapy-compass; Prettier CI failure on universal-search test. No remaining high-confidence P0–P2 in scoped diff. Residual: differential debounce skeleton flicker; RelatedDocumentsPanel memo limited by unstable callbacks. | Focused Vitest 11/11; typecheck; format:check; maintainability budgets. No provider calls. | +| 2026-07-24 | repo-auditor (detached HEAD 037b4808 ??? explicit full-repo structural audit) | 037b4808100946f96aee28b8ff51939ae2986851 | Full-repo structural audit: broken imports, dead files, consolidation. Scope: src/, scripts/, worker/, tests/. Pure triage ??? no files mutated. | P0/P1: none. P2: confirmed dead file src/components/clinical-dashboard/prior-answer-turn-surface.tsx (115 lines, zero importers; superseded by answer-thread-turn.tsx per its 'Extracted from ClinicalDashboard.tsx maturity X3' comment; old file exports PriorAnswerTurn type + PriorAnswerTurnSurface component ??? both replaced). P3: three duplicate package.json script pairs (test:e2e = test:e2e:all; promote:public-documents = promote:public-documents:batch; postinstall = hooks:install ??? last pair intentional lifecycle). Unused public exports: authorization.ts (administratorRoleClaim/Value internal-only), api-client-error.ts (ApiClientError ??? only parseApiErrorResponse imported), rag/rag.ts (answerQuestion ??? superseded by answerQuestionWithScope), supabase/project.ts (isExpectedSupabaseProjectConfig + 2 types). RAG surface note only (do not touch): rag-extractive-first.ts exports hasValidatedRoutineExtractiveRecovery/hasValidatedGenericLaiManagementExtractiveAnswer with no external consumers. Knip false positives: taskkill (win32-gated), railway (opt-in --railway flag). No broken imports (typecheck + lint both exit 0, zero relative ../ imports in src/). | npm run typecheck (exit 0); npm run lint (exit 0); npm run check:knip (exit 0); knip --reporter json full export/file/type analysis; rg import-graph probes across all source trees | +| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138) | 46597a9b | Explicit performance + frontend-ui review of search/interactive surfaces; low-risk client deferral/cache/abort/progressive-reveal pass | Prior document/universal search latency work retained (NDJSON stream, LRU, lazy PDF, content-first detail). New work: differential debounce+abort+LRU; useDeferredValue on catalogue ranking; document results Show more window; RelatedDocumentsPanel memo; universal LRU 100+TTL; deferred registry search extracted from ClinicalDashboard. No RAG/retrieval/ranking edits. No high-confidence P0???P2 defect found in the shipped scope; residual risk = deferred paint lag on large catalogues and progressive reveal missing deep cards until Show more. | Focused Vitest 10/10 (differential + universal + performance boundaries); verify:cheap exit 0 (3262 tests); typecheck clean; verify:ui exit 0 (Chromium). No provider calls. | +| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 follow-up) | 7e2ccee0 | Bugfix pass on search interactive performance diff | Fixed P1 auth-stale differential matches; P2 progressive-reveal hiding selected card; P2 deferred empty/full-catalogue flash on services/forms/formulation/therapy-compass; Prettier CI failure on universal-search test. No remaining high-confidence P0???P2 in scoped diff. Residual: differential debounce skeleton flicker; RelatedDocumentsPanel memo limited by unstable callbacks. | Focused Vitest 11/11; typecheck; format:check; maintainability budgets. No provider calls. | | 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 babysit) | e27df0fa | Bugbot + merge babysit | Merged origin/main. Fixed Bugbot medium findings: deferred clear left stale service/registry matches. No unresolved review threads. | Focused Vitest (deferred registry + differential + boundaries); typecheck; maintainability budgets. Watching hosted CI. | | 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 merge-ready) | 36d86fd0 | Babysit closeout | CodeRabbit: stable RelatedDocuments callbacks, identity-based progressive reveal, clear differential LRU on 401, Sheet unmount focus-restore via layout flag, formulation/therapy clear. Bugbot: live therapy filters with deferred query text. CI PR required green; 0 unresolved threads. | Focused Vitest; hosted CI PR required PASS. | | 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 bugbot) | 8d712183 | Bugbot babysit | Fixed medium: formulation builder/home cleared live query still ranked against lagging deferredQuery. Merged main (#1137 search-chrome). No unresolved review threads. | Focused Vitest deferred registry; typecheck pending in CI. | | 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138 babysit close) | 2f8509cc | Babysit to merge-ready | Merged main; fixed Bugbot deferred-clear findings; fixed Sheet focus-restore teardown flake that failed Unit coverage; no unresolved review threads. Hosted PR required green. | Hosted CI: Static PR, Unit coverage, Build, Production UI, Advisory UI, PR required PASS. No provider calls. | | 2026-07-24 | codex/reindex-agent-enrichment-guard (PR #1143) | f82cf9cfa | Run PR sweep: CI fix + threads + drift | Before: PR required green, 1 unresolved reindex/agent-claim serialization thread, branch behind main. After: remote branch already had atomic RPC fix 2bb0470d plus merge-main d2d57d7c; validated pushed head, resolved thread via GraphQL; reply mutation 403 noted in commit f82cf9cf. | node scripts/run-vitest.mjs run --reporter=dot tests/reindex-enrichment-lease.test.ts tests/private-access-routes.test.ts tests/supabase-schema.test.ts tests/drift-detection.test.ts PASS (218/218); npm run check:migration-role PASS; npm run typecheck PASS; npm run check:production-readiness PASS with non-blocking warnings; no live eval gates run. | -## 2026-07-24 — work search chrome behaviour review +## 2026-07-24 ??? work search chrome behaviour review - Branch/ref: PR #1137 / `codex/review-search-bar-behavior-and-establish-rules` - HEAD: 6ee0484cc97b087c0e4f3661a49493f24a3ea9ba @@ -744,7 +744,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-24 | cursor/search-performance-review-4ee9 (PR #1134) | 022a1ab95718e5e7636226f0dfebe88d7d7bc4f4 | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green (pr-required), 0 unresolved threads. After: merged origin/main cleanly (auto-merge ledger/codebase-index); pushed 022a1ab95. Threads: none. Residual: CI re-running post-merge. | merge origin/main only; no provider-backed checks run | | 2026-07-24 | cursor/search-performance-review-4ee9 (PR #1134) | 9311d01212fe42bd41ffb22a83bfa51f1a4d19f2 | Run PR re-sync sweep | Re-check: CONFLICTING on use-differential-catalog.ts (+ related). Not cheap; merge aborted, no push. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | cursor/comprehensive-repo-review-ledger-d9a1 (PR #1150) | 60a3c3a83a31e65ec2759540629687e7113e2489 | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green, 0 threads. After: merged origin/main cleanly (ledger auto-merge); pushed 60a3c3a83. Threads: none. Residual: CI re-running. | merge origin/main only; no provider-backed checks run | -| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138) | ff4b293d95f922e70ebf5ee9b0c156c41a8bff3b | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green, 0 threads. RAG impact: no retrieval behaviour change — PR is client deferred-search/UI only (no src/lib/rag/**). After: merged origin/main; conflict resolved in src/components/ui/sheet.tsx by keeping main restoreTimersRef/unmountingRef focus-restore fix; pushed ff4b293d9. Threads: none. | merge origin/main only; no provider-backed checks run | +| 2026-07-24 | cursor/search-interactive-perf-af54 (PR #1138) | ff4b293d95f922e70ebf5ee9b0c156c41a8bff3b | Run PR sweep: CI fix + threads + drift | Before: CONFLICTING, CI green, 0 threads. RAG impact: no retrieval behaviour change ??? PR is client deferred-search/UI only (no src/lib/rag/**). After: merged origin/main; conflict resolved in src/components/ui/sheet.tsx by keeping main restoreTimersRef/unmountingRef focus-restore fix; pushed ff4b293d9. Threads: none. | merge origin/main only; no provider-backed checks run | | 2026-07-24 | implement-audit-recommendations-fix (PR #1141) | b5f8959af8ec44de63200b1d19c273bae1b7d541 | Run PR sweep: CI fix + threads + drift | Before: behind main by 6. After: merged origin/main cleanly (no conflicts). Threads: non-P0/P1 left open. CI not waited. | merge origin/main only; thread scan read-only; no provider-backed checks run | | 2026-07-24 | cursor/pr1135-native-disabled-followup-6780 (PR #1157) | 6528aec920eb3cda84149980bdd26a20845227ec | Run PR sweep: CI fix + threads + drift | Before: behind main. After: merged origin/main cleanly (no conflicts). Unresolved review threads left as non-P0/P1. CI not waited. | merge origin/main only; thread scan read-only; no provider-backed checks run | | 2026-07-24 | cursor/pr1135-native-disabled-followup-6780 (PR #1157) | 69af1e5db0d3fff45214b1cc17f37b0fbd5fffb2 | Run PR babysit: CI/threads/drift | Run PR babysit: Codex P2 density assertion fixed + thread resolved. Before: CI mostly green (Production UI in progress), 1 unresolved Codex P2 (3644978153). After: scoped per-button density assertions + count=2; reply+resolve PRRT_kwDOSh5Fis6TiJPl. Not behind main. | npx vitest run tests/mobile-interaction-regressions.test.ts PASS (5/5). No provider-backed checks run. | @@ -773,7 +773,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-24 | cursor/pr1135-native-disabled-followup-6780 (PR #1157) | 90cd914f07fc33019c3d80e37edd92f8d73d71f9 | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | mobile-ergonomics-fixes (PR #1156) | 5cff1cd0cf69539f18307fdeabbe87fc8a0fb13c | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | cursor/information-page-structure-2a5d (PR #1148) | 230770a53f9bfb53ba69abc81d6e8491e021f8a9 | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean. | merge origin/main and/or conflict re-check only; no provider-backed checks run | -| 2026-07-24 | codex/audit-remediation-final (PR #1158) | 78fab6be0c43cf5e92361315399d393ee7742f2e | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean (no RAG conflict markers). NOTE: PR still intentionally adds deterministic broad_summary queryClass shortcut in src/lib/rag/rag.ts (+17) — RAG impact behaviour change, not dropped during merge. | merge origin/main and/or conflict re-check only; no provider-backed checks run | +| 2026-07-24 | codex/audit-remediation-final (PR #1158) | 78fab6be0c43cf5e92361315399d393ee7742f2e | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean (no RAG conflict markers). NOTE: PR still intentionally adds deterministic broad_summary queryClass shortcut in src/lib/rag/rag.ts (+17) ??? RAG impact behaviour change, not dropped during merge. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | implement-audit-viewport-fixes (PR #1140) | a541b75c0e49f84125fc7e5d114cd9fc32d1a694 | Run PR re-sync sweep | Before: CONFLICTING. After: merged origin/main clean. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | codex/hydration-fixes (PR #1131) | a29b0d778b542932972aa6035ee115b91e49025a | Run PR re-sync sweep | Before: CONFLICTING + Static PR FAIL (suppressHydrationWarning on skip link). After: merged origin/main; removed illegal suppressHydrationWarning from skip-to-content anchor; theme fix already on PR head b4b5f21b9. CI re-running. | merge origin/main and/or conflict re-check only; no provider-backed checks run | | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | d0a96caa01b90dffa40e60770b7700f36e8ba43f | Run PR re-sync sweep | Before: CONFLICTING @8adaaf229. After: merged origin/main clean (ort). CI re-running. Threads: not re-triaged. | merge origin/main and/or conflict re-check only; no provider-backed checks run | @@ -787,26 +787,29 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | c59ae820db3034ef3cf74ae6d0030a0472a3a264 | Run PR babysit: merge/CI/threads | Before: CONFLICTING + Static PR checks FAIL (duplicate #1149 ledger row) + 2 unresolved Codex P2s. After: merged origin/main; removed duplicate ledger row; Differentials hero slot gated on !(query.trim() && documentMatches.length); threads resolved. | vitest mobile-composer-reserve 9/9; check:branch-review-ledger pass; maintainability 4132/4140. No provider-backed checks run. | | 2026-07-25 | codex/document-clinical-summary-20260725 (PR #1169) | 6bbce2b97477cb4497624abe2a37c74864e872c8 | Open-PR maintenance: review-thread verification | Before: 2 unresolved Codex threads; branch current with main and required CI running. After: both persisted-profile/placeholder-summary fixes confirmed on the exact head and ready for reply-then-resolve; no further code change required. | `node scripts/run-vitest.mjs run tests/document-clinical-summary.test.ts tests/document-clinical-summary.dom.test.tsx --reporter=dot` pass (5/5); `git diff --check` pass; no provider-backed checks run. | | 2026-07-25 | cursor/pr-babysit-bugbot-agents-6c52 (PR #1167) | ee44812aae9dad1973d8302eba5bfca5000dffb6 | Open-PR maintenance: review-thread fixes | Before: 8 unresolved Codex/CodeRabbit threads; branch current with main. After: target-head pinning, fresh-main verification, exact `cursor[bot]` identity checks, explicit mutation/provider authorization, direct reply-then-resolve semantics, and no-op ledger bookkeeping are documented. | Prettier check on both agent files pass; `git diff --check` pass; GitHub author probe confirmed `cursor[bot]` account type `Bot`; no provider-backed checks run. | -| 2026-07-24 | cursor/pr-babysit-bugbot-agents-6c52 (PR #1167) | 6ec7a852 | Babysit sweep: CI fix + Codex/CodeRabbit threads | Before: mergeable, PR required green, 8 unresolved agent-guidance threads. After: fixed pr-babysit/pr-bugbot agents (fetch origin/main, no Run PR live-gate auth, pin target head SHA, exact bot identity, ledger-after-every-sweep). Thread reply/resolve 403 on this token — fixes pushed. | typecheck on agent files; no provider-backed checks run | +| 2026-07-24 | cursor/pr-babysit-bugbot-agents-6c52 (PR #1167) | 6ec7a852 | Babysit sweep: CI fix + Codex/CodeRabbit threads | Before: mergeable, PR required green, 8 unresolved agent-guidance threads. After: fixed pr-babysit/pr-bugbot agents (fetch origin/main, no Run PR live-gate auth, pin target head SHA, exact bot identity, ledger-after-every-sweep). Thread reply/resolve 403 on this token ??? fixes pushed. | typecheck on agent files; no provider-backed checks run | | 2026-07-24 | codex/fix-merge-conflicts-and-ci-on-open-prs (PR #1170) | 48fcb485 | Babysit sweep: CI fix | Before: Static PR checks FAIL (docs:check-links missing legacy route paths). After: expanded check-docs-links allowlist for pre-(search-app) paths. Production UI re-running. | npm run docs:check-links PASS; no provider-backed checks run | | 2026-07-24 | codex/document-clinical-summary-20260725 (PR #1169) | ef4ffca5 | Babysit sweep: Codex P2 threads | Before: 2 unresolved Codex P2s (missing pages guard, placeholder summary filter). After: profileItemPages helper + usefulSummaryText placeholder filter. CI re-running. | npm run typecheck PASS; no provider-backed checks run | | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | fb39314e | Babysit sweep: drift | Before: behind main, PR required cancelled. After: merged origin/main cleanly. CI re-running. | merge origin/main only; no provider-backed checks run | | 2026-07-24 | cursor/pr1135-native-disabled-followup-6780 (PR #1157) | 05ec10d5 | Babysit sweep: CI fix + drift | Before: CONFLICTING, Static PR + PR required FAIL (duplicate ledger row). After: merged origin/main; removed duplicate PR #1149 ledger row. CI re-running. | check-branch-review-ledger PASS; merge origin/main; no provider-backed checks run | | 2026-07-24 | codex/hydration-fixes (PR #1131) | 21bdde7d | Babysit sweep: CI fix + drift | Before: CONFLICTING, Static PR + PR required FAIL. After: merged origin/main; removed duplicate PR #1149 ledger row; lint already green on head. CI re-running. | npm run lint PASS; check-branch-review-ledger PASS; no provider-backed checks run | | 2026-07-24 | cursor/frontend-ui-review-docs-e8d9 (PR #1146) | c29d57c5 | Babysit sweep: drift | Before: CONFLICTING. After: merged origin/main cleanly. 1 unresolved Codex P2 (ledger insert vs append) left for human. | merge origin/main only; no provider-backed checks run | -| 2026-07-24 | execute-audit-code-remediation (PR #1162) | b4675d7b | Babysit sweep: drift skipped | Before: CONFLICTING, PR policy FAIL. Merge origin/main aborted: 20+ conflict files across clinical/auth/API surfaces — needs human resolution. | merge --abort; no provider-backed checks run | +| 2026-07-24 | execute-audit-code-remediation (PR #1162) | b4675d7b | Babysit sweep: drift skipped | Before: CONFLICTING, PR policy FAIL. Merge origin/main aborted: 20+ conflict files across clinical/auth/API surfaces ??? needs human resolution. | merge --abort; no provider-backed checks run | | 2026-07-25 | codex/fix-merge-conflicts-and-ci-on-open-prs (PR #1170) | e979fc892f11a17b1a8f2ef1ab058ef40d629182 | Open-PR maintenance: CI fix + threads + drift | Before: Static PR checks failed because route-group moves made nine valid legacy `src/app/*` documentation references appear missing; 0 unresolved threads; branch already contained current main. After: docs-link resolution checks known App Router route groups and the focused failure is fixed. | `node scripts/check-docs-links.mjs` pass (1162 references); Prettier check pass; `git diff --check` pass; no provider-backed checks run. | | 2026-07-25 | implement-audit-recommendations-fix (PR #1141) | 0aaf441775786e5def408a2eda551d9b5d95542d | Open-PR maintenance: review fix + drift | Before: 24 commits behind and 1 unresolved P2 thread; nested result content retained safe-area padding after the shared dock hid. After: current main is merged and child content uses fixed small phone gaps so the shared zero hidden reserve reaches the viewport edge. | focused Vitest pass (7/7); Prettier check pass; `git diff --check` pass; no provider-backed checks run. | | 2026-07-24 | open-PR conflict sweep (13 clean + 5 conflicted) | multi-head | Conflict fix sweep | Merged origin/main into #1124 #1140-1142 #1146-1148 #1153 #1156-1158 #1167 #1169 #1171 #1172 (clean). Resolved conflicts on #1131 #1134 #1153 #1167 #1162. All 18 open PRs mergeable after sweep. | merge-tree classify + per-PR merge; focused private-access tests on #1162; Bugbot on #1162; no provider-backed checks | | 2026-07-24 | execute-audit-code-remediation (PR #1162) | 3cb7c977 | Conflict fix + Bugbot + local review | Before: CONFLICTING (21 files). After: mergeable. Restored atomic upload RPC; aligned private-access tests (133/133). Bugbot 2 medium left open. | private-access-routes 133/133; no provider-backed checks | | 2026-07-25 | codex/document-clinical-summary-20260725 (PR #1169) | 605a47b551a03774fab41416bf980dfbc9610221 | Open-PR maintenance: malformed persisted profile guard | Before: one actionable thread showed non-array or malformed persisted summary groups could throw during render. After: every priority group is normalized through an array/item guard and malformed values are ignored while valid items still render. | Focused Vitest 7/7 pass; Prettier and diff checks pass; no provider-backed checks run. | +| 2026-07-25 | cursor/search-performance-review-4ee9 (PR #1134) | 692834a86e612cc8b311dc6895e007f182f5c5b8 | Open-PR maintenance: superseded docs-link thread and clean main sync | Before: branch was behind current main with one outdated docs-link thread; its product tree already matched main. After: merged current main cleanly and verified the route-group-aware docs-link fix now covers legacy route references. RAG impact: no retrieval behaviour change ??? history sync and docs tooling verification only. | `node scripts/check-docs-links.mjs` pass (1154 references); clean merge-tree; no live RAG canary or provider-backed check run. | +| 2026-07-24 | `cursor/sidebar-six-item-land-cfa0` / PR #1174 content-proof `d97c11e6` | `d97c11e6` | #066 land/proof of six-item sidebar from `cd54e68f` onto main | PROVE — feature content landed; focused 20/20; verify:pr-local PASS; ensure spot-check PASS; verify:ui 267/267. Not merged to main. | vitest favourites+therapy; verify:pr-local; ensure+computerUse spot-check; verify:ui | +| 2026-07-24 | PR #1175 / `cursor/ledger-009-010-032-041-063-519b` | f3986abc39468e077643611ec2d95e374c2e901f | PR review + CI fix (ledger docs #009/#010/#032/#041/#063) | FINDINGS FIXED. P1: Static PR checks failed on Prettier (5 docs). P1: leftover `PR_POLICY_BODY.md` from merged #1134 caused Sync PR policy body to overwrite this docs PR description with search-performance text ??? deleted the stale template. No P0. Product scope remains docs-only; gated brief follow-ups (wire coming-soon, Current Clinical Work storage, Factsheets second mode, governance ranking) correctly not implemented. Residual: human approving review once CI green. | Local: prettier --check on touched docs; ledger open/resolved/queue integrity for five IDs; no client fetch(`/api/jobs`); `verify:cheap` earlier on tip 95d68c6b. No OpenAI/Supabase writes. | | 2026-07-25 | cursor/search-performance-review-4ee9 (PR #1134) | 692834a86e612cc8b311dc6895e007f182f5c5b8 | Open-PR maintenance: superseded docs-link thread and clean main sync | Before: branch was behind current main with one outdated docs-link thread; its product tree already matched main. After: merged current main cleanly and verified the route-group-aware docs-link fix now covers legacy route references. RAG impact: no retrieval behaviour change — history sync and docs tooling verification only. | `node scripts/check-docs-links.mjs` pass (1154 references); clean merge-tree; no live RAG canary or provider-backed check run. | | 2026-07-24 | cursor/search-correctness-030-075-6273 (PR #1177) | 54ab9f8498751ef7e96815dd2496b8137f29dad7 | Review + follow-up hardening of #030/#075 search-correctness fixes | Findings fixed: (P2) one combo-titled source could still make multi-slot allHit true via substring alias hits — `expectedFileCoverage` now assigns each retrieved top-file to at most one expected slot; (P2) label pagination could loop forever on a stuck full-page API — fail-closed page budget added; (P2 process) stale `PR_POLICY_BODY.md` from search-performance leftover was overwriting this PR body via Sync PR policy body — corrected then deleted. No remaining high-confidence P0–P1 in product scope. Residual: human approving review; Unit coverage CI still finishing on later heads. RAG impact: no retrieval behaviour change — eval matching / label pagination only. | Focused Vitest 32/32; `verify:cheap` green; `verify:pr-local` green (lint/typecheck/3326 unit/build/client-bundle/offline RAG fixtures 36/36). No OpenAI/live Supabase/provider-backed canary. | | 2026-07-24 | cursor/search-correctness-030-075-6273 (PR #1177) | 96ba6152c1f8e5e0000000000000000000000000 | Supersedes prior #1177 review row with post-sync tip | Same product outcome as prior row; tip includes correct PR_POLICY_BODY sync + template deletion so Sync PR policy body cannot reintroduce the stale search-performance description. | `npm run check:branch-review-ledger` pass; no provider-backed checks run. | | 2026-07-24 | PR #1175 / `cursor/ledger-009-010-032-041-063-519b` | f3986abc39468e077643611ec2d95e374c2e901f | PR review + CI fix (ledger docs #009/#010/#032/#041/#063) | FINDINGS FIXED. P1: Static PR checks failed on Prettier (5 docs). P1: leftover `PR_POLICY_BODY.md` from merged #1134 caused Sync PR policy body to overwrite this docs PR description with search-performance text — deleted the stale template. No P0. Product scope remains docs-only; gated brief follow-ups (wire coming-soon, Current Clinical Work storage, Factsheets second mode, governance ranking) correctly not implemented. Residual: human approving review once CI green. | Local: prettier --check on touched docs; ledger open/resolved/queue integrity for five IDs; no client fetch(`/api/jobs`); `verify:cheap` earlier on tip 95d68c6b. No OpenAI/Supabase writes. | | 2026-07-24 | PR #1175 / `cursor/ledger-009-010-032-041-063-519b` | 15a5d080a375635ca6ef042659fe8837d485c8e3 | PR #1175 follow-up (description restore + template removal) | SUPERSEDES prior #1175 row on `f3986abc`. PR description restored via temporary `PR_POLICY_BODY.md` sync then file deleted again so merge will not reintroduce the #1134 leftover. Scope unchanged: docs-only ledger closeout. | Sync PR policy body SUCCESS with correct ledger summary; prettier clean on prior tip. Awaiting Static/Unit on final tip. No providers. | | 2026-07-25 | implement-audit-viewport-fixes (PR #1140) | 283ad65377ee3e60ceb70f5cd01974caf0a54227 | Open-PR maintenance: keyboard overlay fallback | Before: fixed docks always consumed the measured visual-viewport height, double-lifting them when `interactive-widget=resizes-content` already resized the layout viewport. After: the provider subtracts layout shrink and exposes only residual overlay height to CSS while retaining keyboard-open state. | Focused Vitest 18/18 pass; `npm run ensure` verified http://localhost:3264; Prettier and diff checks pass; no provider-backed checks run. | -| 2026-07-24 | `main` / `01c209576207a3c279972697718d06c819fff000` | `01c209576207a3c279972697718d06c819fff000` | Sitewide design/UX/interactive review (production pages, breakpoints, a11y) | CHANGES REQUESTED / findings. No P0. Two confirmed P2 UX defects: (1) mobile presentation Compare tab is a self-link that drops `ids`/`q` and resets selection (1→default 4) + clears Query chip; (2) document “Browse by tag” / `searchByTag` navigates to `/?mode=documents&q=…` without `run=1`, so results do not run. P3: comparison disabled dropdown/filter controls lack `aria-describedby` placeholder contract; bare `/documents` 404 (no inbound links; `/documents/search` is canonical); phone mode-switcher truncates “Differenti…”. Deduped: `/tools` vs `/?mode=tools` remains #007; coming-soon density/favourites/forms remain #010. Phone docks flush `bottom:0` on sampled result routes; no document horizontal overflow at 390/768/1280 across 30 routes. | `npm run workflow:design-sweep -- --write-evidence`; `npm run ensure` → http://localhost:4461 identity Clinical KB; Playwright HTTP+overflow matrix 30/30 no overflow; live Compare/tag proofs + phone route matrix; `npm run test:e2e:accessibility` 12/12; screenshots under `/opt/cursor/artifacts/screenshots/design-review-2026-07-24/`. No OpenAI/Supabase/GitHub/hosted CI/provider mutations. Added project subagent `.cursor/agents/design-review.md`. | +| 2026-07-24 | `main` / `01c209576207a3c279972697718d06c819fff000` | `01c209576207a3c279972697718d06c819fff000` | Sitewide design/UX/interactive review (production pages, breakpoints, a11y) | CHANGES REQUESTED / findings. No P0. Two confirmed P2 UX defects: (1) mobile presentation Compare tab is a self-link that drops `ids`/`q` and resets selection (1???default 4) + clears Query chip; (2) document ???Browse by tag??? / `searchByTag` navigates to `/?mode=documents&q=???` without `run=1`, so results do not run. P3: comparison disabled dropdown/filter controls lack `aria-describedby` placeholder contract; bare `/documents` 404 (no inbound links; `/documents/search` is canonical); phone mode-switcher truncates ???Differenti??????. Deduped: `/tools` vs `/?mode=tools` remains #007; coming-soon density/favourites/forms remain #010. Phone docks flush `bottom:0` on sampled result routes; no document horizontal overflow at 390/768/1280 across 30 routes. | `npm run workflow:design-sweep -- --write-evidence`; `npm run ensure` ??? http://localhost:4461 identity Clinical KB; Playwright HTTP+overflow matrix 30/30 no overflow; live Compare/tag proofs + phone route matrix; `npm run test:e2e:accessibility` 12/12; screenshots under `/opt/cursor/artifacts/screenshots/design-review-2026-07-24/`. No OpenAI/Supabase/GitHub/hosted CI/provider mutations. Added project subagent `.cursor/agents/design-review.md`. | | 2026-07-24 | PR #1176 / `cursor/pdf-crop-malformed-repro-9b3e` | `5391bf185cd5dffd00a31eb1d282ccfc93277a73` | #076 page-edge table crop geometry fix + fixture regression | APPROVE. No P0-P1. Fix is narrowly scoped to post-find_tables candidate extension from contiguous cell drawings; title/footer inflation avoided by ignoring text during geometry growth; incompleteness warning retained when content continues past the page. Highest residual risk: text-grid tables without cell drawings still will not edge-extend; left/right/top paths are symmetric but fixture-proven only for bottom. Broad PR #1129 retention/padding/storage changes remain out of scope. | Python page-edge + budget 6/6; Vitest pdf-extractor 3 passed / 1 skipped; offline only. | | 2026-07-24 | PR #1176 / `cursor/pdf-crop-malformed-repro-9b3e` | `28c1e2352a7cabb9c73f52d5084ee69f47895c5e` | #076 page-edge table crop geometry fix (post-merge tip) | APPROVE (supersedes prior #1176 row for 5391bf18 after remote merge). No P0-P1. Same scoped drawing-based edge extension; residual: text-grid tables without drawings, and left/right/top only unit-symmetric. PR #1129 retention/padding still out of scope. | Re-ran Python page-edge + budget 6/6 and Vitest pdf-extractor 3/1 skipped after merge; offline only. | | 2026-07-25 | codex/hydration-fixes (PR #1131) | 555213fcf4dec82c6dbb445630e59e0d5465149a | Open-PR maintenance: persisted-state hydration coverage | Before: the browser guard covered only an empty-storage dashboard load. After: it seeds theme localStorage plus cookie, sidebar state, and document-viewer PDF mode before navigation, while retaining the default case. | Repository Playwright runner built the isolated production app and passed 3/3 Chromium hydration scenarios; Prettier and diff checks pass; no provider-backed checks run. | @@ -814,6 +817,7 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-24 | open-PR conflict sync (22 PRs) | multi-head | Conflict resolution pass | Before: all 22 open PRs behind/dirty vs main (several CONFLICTING/DIRTY). After: merged origin/main into every open head; all pushes OK; merge-tree classified 22/22 clean. | merge origin/main per branch; check:branch-review-ledger on #1172; no provider-backed checks run | | 2026-07-24 | cursor/pr-queue-hygiene-72ec | pending-push | PR queue hygiene | Add pr-branch-sync workflow + sync:pr-branches helper; bump postcss to clear npm audit high; document anti-churn guidance in AGENTS/process-hardening/pr-babysit/run-pr. | check:github-actions PASS; docs:check-scripts/index PASS; vitest sync-open-pr-branches 3/3; npm audit high clean; no provider-backed checks run | | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | pending | Babysit: ledger dedupe + merge readiness | Before: Static PR failed on exact duplicate ledger rows after main sync. After: removed duplicate rows; squash auto-merge armed. | check:branch-review-ledger PASS; no provider-backed checks run | +| 2026-07-25 | cursor/sidebar-six-item-land-cfa0 (PR #1174) | c44a5c536e43f300feb1b88892d0b2a8ca2c4feb | Run PR sweep: CI fix + threads + drift | Before: GitHub reported DIRTY and Static PR checks failed formatting `docs/outstanding-issues.md`; 0 unresolved threads. After: merged current `origin/main` cleanly and formatted the failing document. | Prettier check pass; `git diff --check` pass; no provider-backed checks run. | | 2026-07-25 | cursor/pdf-crop-malformed-repro-9b3e (PR #1176) | c31543f5b5862dbe6911079029f28500a6af2a59 | Run PR sweep: CI fix + threads + drift | Before: GitHub reported DIRTY and Static PR checks failed formatting `docs/outstanding-issues.md` and `tests/pdf-extractor.test.ts`; 0 unresolved threads. After: merged current `origin/main` cleanly and formatted both failing files. | Prettier check pass; `git diff --check` pass; no provider-backed checks run. | | 2026-07-25 | codex/search-results-filters-20260725 | 88131e7267efd33059766dec80355a9246fbb2bf | Search result filters and document Sources merge-readiness review | APPROVE. No P0-P2 finding after current-main sync. Documents open Sources as an on-screen filtering surface with source-type controls; the shared results ribbon is applied across search pages. Highest residual risk: unusual real-content combinations may alter perceived density, while responsive, forced-colors, focus, and overflow paths are browser-covered. RAG impact: no retrieval behaviour change - UI controls and source browsing only. | `npm run verify:ui` pass 268/268; `npm run verify:cheap` pass (377 files, 3340 passed, 1 skipped); post-sync `npm run verify:pr-local` pass (378 files, 3349 passed, 1 skipped, production build, bundle-secret scan, offline RAG fixtures); `npm run check:production-readiness` pass with OPENAI_SAFETY_IDENTIFIER_SECRET warning; no live/provider-backed app checks run. | | 2026-07-25 | `codex/therapy-page-polish-ad78b4` | `157559aa0678f02de09c14f66d544b62a5138c4a` | Targeted release review: Therapy naming, centred navigation, and white canvas | APPROVE. No P0-P3 findings. The production Therapy route consistently uses the title Therapy, the shared page background token, and a centred overflow-safe section navigation. The latest `origin/main` merge was clean and retained both upstream responsive/home-composer assertions. Highest residual risk is visual drift at an untested browser engine; exact desktop and phone Chromium measurements were stable. | Focused Vitest 40/40; pre-sync `verify:cheap` 378 files / 3342 passed / 1 skipped; pre-sync `verify:ui` passed; integrated runtime, Prettier, lint, and typecheck passed; integrated Vitest was interrupted by the shared heavyweight-test queue after an independent 378-file / 3342-pass run. Required hosted checks must pass on the published exact head before merge. No clinical/provider workflow ran. | @@ -826,6 +830,16 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-25 | fix-physics-animation-audit (PR #1142) | bdfe81e15c57d376ff74ddb611a8959b0ae94cc9 | Open-PR maintenance: review fix + drift | Before: 24 commits behind and 1 unresolved P2 thread; CSS changed phone reserve timing without pinning the timing in static/phone-scroll coverage. After: current main is merged; static coverage pins 200/240ms transitions and the motion-enabled phone-scroll sweep asserts the active 200ms reserve transition before geometry checks. | Prettier check pass; `git diff --check` pass; focused Vitest/Playwright not run because repository heavyweight lock is owned by worktree 6314; hosted CI will exercise the updated tests; no provider-backed checks run. | | 2026-07-25 | fix-physics-animation-audit (PR #1142) | c88c4516476cae3246e1975ce648dff0f3ecb3f7 | Ledger append-only placement fix | CORRECTION: relocated the five PR #1142-unique ledger rows that had been inserted below the table header / among older entries so they append after the final existing record, without rewriting any other rows' content. Restores the append-only contract called out in the Codex P1. | `npm run check:branch-review-ledger`; no provider-backed checks run | | 2026-07-25 | implement-audit-viewport-fixes (PR #1140) | f4ae0a7217e513b893d14400fcfd49f31a3dd090 | PR babysit sweep: sync + threads + CI fix + squash merge | Before: CONFLICTING/DIRTY (stale), threads open, behind main. After: merged origin/main, resolved Codex/CodeRabbit threads, fixed document-viewer keyboard lift + baseline reset + Sources focus restore; Production UI green; squash-merged. | Hosted CI PR required SUCCESS on tip 761765a3f; focused vitest keyboard/overlay contracts. No provider-backed checks run. | +| 2026-07-25 | implement-audit-recommendations-fix (PR #1140) | f4ae0a7217e | Babysit sweep: viewport/keyboard audit ? squash-merged after CI green + thread triage | production-ui + pr-required | merged | +| 2026-07-25 | fix-physics-animation-audit (PR #1142) | e966b5aa972 | Babysit sweep: spring physics / reduced-motion ? auto-merged after main sync | pr-required | merged | +| 2026-07-25 | information-page-shell (PR #1148) | 5b9574af480 | Babysit sweep: unify information-page structure ? squash-merged | pr-required | merged | +| 2026-07-25 | mobile-ergonomics-fixes (PR #1156) | de1a82b4936 | Babysit sweep: mobile touch ergonomics ? squash-merged | pr-required | merged | +| 2026-07-25 | automated-audit-remediations (PR #1158) | aa745922f00 | Babysit sweep: automated audit remediations ? squash-merged | pr-required | merged | +| 2026-07-25 | cursor-indexing-ignore (PR #1171) | 3a4036580df | Babysit sweep: Cursor indexing ignore rules ? squash-merged | pr-required | merged | +| 2026-07-25 | cursor/ledger-009-010-032-041-063-519b (PR #1175) | 87b6b432c19 | Babysit sweep: close ledger #009/#010/#032/#041/#063 ? resolved outstanding-issues merge + prettier, squash-merged | static-pr + pr-required | merged | +| 2026-07-25 | canary-comparison-preflight (PR #1180) | 43f261cf229 | Babysit sweep: canary comparison preflight docs ? squash-merged | pr-required | merged | +| 2026-07-25 | sitewide-design-review-ledger (PR #1181) | 8284fcd4420 | Babysit sweep: design-review ledger ? auto-merged after sync | pr-required | merged | +| 2026-07-25 | codex/complete-all-pending-tasks (PR #1191) | e2488dbb108 | Babysit sweep: scoped-label pagination + order assertion for CodeRabbit thread ? squash-merged | unit + pr-required | merged | | 2026-07-25 | implement-audit-recommendations-fix (PR #1140) | f4ae0a7217e | Babysit sweep: viewport/keyboard audit — squash-merged after CI green + thread triage | production-ui + pr-required | merged | | 2026-07-25 | fix-physics-animation-audit (PR #1142) | e966b5aa972 | Babysit sweep: spring physics / reduced-motion — auto-merged after main sync | pr-required | merged | | 2026-07-25 | information-page-shell (PR #1148) | 5b9574af480 | Babysit sweep: unify information-page structure — squash-merged | pr-required | merged | @@ -844,3 +858,6 @@ This file is append-only. Never rewrite or delete an existing review record; app | 2026-07-25 | cursor/codebase-indexing-optimize-7a2b (PR #1171) | 3a4036580df1f7701b600df26d368b66bcfc3251 | PR babysit sweep + squash merge | Retriggered CI via ledger note; squash-merged when PR required green. | Hosted PR required SUCCESS. No provider-backed checks. | | 2026-07-25 | cursor/canary-artifact-comparison-8e05 (PR #1180) | 43f261cf229cbc0baf7e289bdbc3e5a534161543 | PR babysit sweep + squash merge | Synced main after #1171; squash-merged. | Hosted PR required SUCCESS. No provider-backed checks. | | 2026-07-25 | codex/audit-remediation-final (PR #1158) | aa745922f00 | PR babysit sweep + squash merge | Synced main; auto-merge completed. | Hosted CI green. No provider-backed checks. | +| 2026-07-25 | cursor/sidebar-six-item-land-cfa0 (PR #1174) | pending-merge | CORRECTION: clarify sync vs product merge for the d97c11e6 content-proof row | The earlier "from `cd54e68f` onto main" / "merged onto current main" wording meant the feature branch was synchronized with `origin/main` (main merged into the feature branch); the six-item sidebar product change is not yet on `main` until this PR merges. Date 2026-07-25 on the c44a5c53 sweep row is the actual execution date (not future-dated). | CodeRabbit threads on ledger/OI wording; no provider-backed checks run. | +| 2026-07-25 | cursor/search-correctness-030-075-6273 (PR #1177) | 4138c0dd9ac0096787af47f7d86a9adc390eeb44 | PR babysit sweep + squash merge | Before: CONFLICTING on outstanding-issues + search-scope vs #1191; PR policy missing RAG/clinical checklist. After: kept loadScopeLabels batching, closed #030/#075, fixed PR body; squash-merged. | pr-required + PR policy + Gitleaks; focused search-scope/eval tests; no provider-backed checks. | +| 2026-07-25 | open-pr-babysit-continuation-20260725 | multipass | Babysit continuation after 14 merges: #1177 landed; #1174/#1178/#1153 in progress; drafts #1187/#1192 skipped; large cluster #1162/#1185/#1186/#1188/#1190 content-conflicted (skip). | merge-tree inventory; no provider-backed checks. | diff --git a/docs/outstanding-issues.md b/docs/outstanding-issues.md index 3dc64d29d..297064b74 100644 --- a/docs/outstanding-issues.md +++ b/docs/outstanding-issues.md @@ -101,7 +101,7 @@ removed after current-main verification; it is not missing recommended work. | #059 | P1 | task | Verify containment of every credential reported exposed in chat | **Outcome:** every reported exposed credential is rejected or retired. **Next:** in approved security windows, verify and revoke or rotate the GitHub token, OpenAI key, Supabase service-role JWT, database password, and E2E credential; create replacements only when required and update only intended secret stores. **Success:** provider evidence confirms the old credentials cannot authenticate, replacements are distinct and minimally scoped, presence/readiness checks pass, and secret scans remain clean. **Stop:** no provider or secret-store action without approval; never print or paste values into Git, logs, issues, or chat. | session 2026-07-24 security reconciliation; AI Agent Target Manifest | 2026-07-24 | | #064 | P2 | task | Reconcile the preserved browser and contrast patch | **Outcome:** the isolated dirty formulation/contrast patch is safely landed or explicitly dispositioned. **Next:** rebase its intent against current `main` without overwriting the worktree, then run focused Playwright coverage and `verify:ui`. **Success:** intended disabled/contrast behavior is accessible, browser assertions remain meaningful, and unrelated work is preserved. **Stop:** do not discard or auto-merge the dirty worktree; pause on ambiguous ownership or scope. | `agent/formulation-disabled-contrast`; session 2026-07-24 | 2026-07-24 | | #065 | P2 | task | Complete the paused compact document source-text accordion | **Outcome:** the document viewer uses compact nested disclosures while retaining complete text, citation/search navigation, print behavior, and composer clearance. **Next:** only when the user explicitly resumes, reconcile `codex/chat-document-text-accordion-7cb4` with current `main` and complete the focused 320/390/1280 px tests. **Success:** default disclosures are closed; deep links and search open only the active passage; printing expands/restores state; no overflow. **Verify:** focused document-viewer Playwright, `verify:cheap`, `verify:ui`, and static production-readiness. **Stop:** remain paused until explicit user return; no provider calls. | paused document-viewer task; `codex/chat-document-text-accordion-7cb4` | 2026-07-24 | -| #066 | P2 | task | Land and prove the streamlined six-item sidebar | Implementation and the corrected Therapy wiring assertion are recoverable from remote branch `origin/codex/sidebar-test-fix-20260723` at full commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54`; fetch it in a fresh checkout with `git fetch origin refs/heads/codex/sidebar-test-fix-20260723`. Focused sidebar/favourites suites pass 18/18. Remaining: run `verify:pr-local`, start the app and inspect desktop/tablet/mobile plus short-height scrolling and keyboard/focus behavior, run `verify:ui`, production build and bundle-budget checks, then open/merge the PR and prove the exact content is on `origin/main`. | remote branch `origin/codex/sidebar-test-fix-20260723`; commit `cd54e68fbf7b07b5dffe3220e36af2caa528da54`; session 2026-07-24 | 2026-07-24 | +| #066 | P2 | task | Land and prove the streamlined six-item sidebar | **Landed/proven on feature branch (not yet on `main`).** PR #1174 tip; current `origin/main` was merged into the feature branch. Six-item rail: Answer, Documents, Services, Medications, Factsheets, Tools (Favourites in Your library). **Remaining:** merge PR #1174 and prove the exact content SHA is on `origin/main`. **Stop:** do not merge without explicit ask; no provider calls. | feature `cursor/sidebar-six-item-land-cfa0`; PR #1174; session 2026-07-25 | 2026-07-24 | | #067 | P2 | issue | Reconciliation preflight test times out under full-suite load | **Outcome:** the reconciliation preflight subprocess test is deterministic under the repository's serialized heavy-test workflow. During PR #1119 validation, the 30-second test timeout occurred twice under loaded full-suite execution, while the isolated file passed 5/5 and a separate `verify:cheap` full suite passed. **Next:** reproduce with timing around subprocess startup, output and teardown, then fix the smallest proven harness lifecycle cause. **Success:** repeated focused and full-suite runs complete without extending the global timeout. **Stop:** do not hide the cause by raising broad timeouts, adding retries, or bypassing the shared test lock. | `tests/reconciliation-preflight.test.ts`; PR #1119 validation; session 2026-07-24 | 2026-07-24 | | #051 | P2 | task | Stabilise the live answer-quality canary before more RAG tuning | Diagnostics landed in PR #1095: structured JSON/Markdown artifacts now record the actual checked-out SHA, run identity and latency context, and the offline trend tool separates content, provider-route and latency outcomes. First validating run `30018289898` recorded the expected tree and cost, with 36/36 retrieval green, but one report cannot establish variability; PR #1097 prevents a single failure being mislabeled as repeated. Next: compare the scheduled 2026-07-26 structured report with this run. Do not spend on an immediate retry or reapply the archived lithium guard before that comparison. | PR #1095; run `30018289898`; PR #1097; archive ref `refs/archive/rejected-rag/20260723/monitoring-subject-gate` | 2026-07-23 | | #001 | P2 | task | Semantic reranking still gated off | `RAG_SEMANTIC_RERANK_ENABLED=false` from PR #901. Do not enable until the provider-backed 36/36 retrieval-quality gate **and** an ambiguity-focused canary are explicitly approved and recorded. | `docs/process-hardening.md` (Semantic reranking rollout debt); PR #901 | 2026-07-21 | diff --git a/src/components/ClinicalDashboard.tsx b/src/components/ClinicalDashboard.tsx index 74ca8e5f5..ca493afe7 100644 --- a/src/components/ClinicalDashboard.tsx +++ b/src/components/ClinicalDashboard.tsx @@ -49,13 +49,12 @@ import { textMuted, } from "@/components/ui-primitives"; import { useAuthSession } from "@/lib/supabase/client"; -import { AccountSetupDialog } from "@/components/clinical-dashboard/account-setup-dialog"; import { useEventCallback } from "@/components/clinical-dashboard/use-event-callback"; import { AuthPanel } from "@/components/clinical-dashboard/auth-panel"; import { buildMobileSectionFabState, MobileSectionFab, ToolsHub } from "@/components/clinical-dashboard/dashboard-nav"; -import { SettingsDialog } from "@/components/clinical-dashboard/settings-dialog"; import { useSidebarCollapsed } from "@/components/clinical-dashboard/use-sidebar-collapsed"; -import { useTheme } from "@/components/clinical-dashboard/use-theme"; +import * as SidebarDialogs from "@/components/clinical-dashboard/lazy-sidebar-dialogs"; +import { useSettingsGuideFlow } from "@/components/clinical-dashboard/use-settings-guide-flow"; import { deriveSidebarIdentity, ClinicalDesktopSidebar, @@ -209,7 +208,6 @@ import { maxVisiblePriorTurns, PriorAnswerTurnSurface, } from "@/components/clinical-dashboard/answer-thread-turn"; - const documentPageSize = 150; const activeIndexingPollFallbackMs = 5_000; const indexingWorkDetailsPollMs = 15_000; @@ -260,7 +258,6 @@ type IngestionQualityPayload = { items?: IngestionQualityReviewItem[]; demoMode?: boolean; }; - export const clinicalQueryModeOptions: Array<{ value: ClinicalQueryMode; label: string }> = [ { value: "auto", label: "Auto" }, { value: "monitoring_schedule", label: "Monitoring" }, @@ -270,7 +267,6 @@ export const clinicalQueryModeOptions: Array<{ value: ClinicalQueryMode; label: { value: "required_documentation", label: "Documentation" }, { value: "compare_guidance", label: "Compare" }, ]; - type SearchResultModePayload = | { kind: "documents"; @@ -288,9 +284,7 @@ type SearchResultModePayload = query: string; payload: AnswerPayload; }; - type SourceLibrarySearchMode = Extract; - type LibraryHealthTarget = "documents" | "setup" | "indexing" | "failures"; type IndexingMonitorFilter = "all" | "active" | "failed"; type UploadIndexingTab = "setup" | "upload" | "jobs" | "quality"; @@ -538,7 +532,6 @@ export function ClinicalDashboard({ const [indexingActive, setIndexingActive] = useState(false); const [userStartedIngestion, setUserStartedIngestion] = useState(false); const [nextRefreshDelayMs, setNextRefreshDelayMs] = useState(null); - const { theme, toggleTheme } = useTheme(); const auth = useAuthSession(); const { status: authStatus, @@ -665,6 +658,13 @@ export function ClinicalDashboard({ setUploadDrawerOpen, prefetch: (href) => router.prefetch(href), }); + const settingsGuideFlow = useSettingsGuideFlow({ + openGuide, + closeGuide, + openSettings, + openAccountProfile, + setSettingsOpen, + }); const answerThreadOwnerId = auth.session?.user.id ?? (clientDemoMode ? demoRecentQueryOwnerId : null); const previousAnswerThreadOwnerIdRef = useRef(answerThreadOwnerId); useEffect(() => { @@ -3320,11 +3320,10 @@ export function ClinicalDashboard({ onCollapsedChange={setSidebarCollapsed} onNewChat={startNewChat} onPickRecent={pickRecentQuery} - onOpenGuide={openGuide} - onOpenSettings={openSettings} - onOpenAccount={openAccountProfile} - theme={theme} - onToggleTheme={toggleTheme} + onOpenSettings={settingsGuideFlow.openSettingsWithDefaultFocus} + onOpenAccount={settingsGuideFlow.openAccountProfileWithDefaultFocus} + onPrefetchSettings={SidebarDialogs.loadSettingsDialog} + onPrefetchAccount={SidebarDialogs.prefetchAccountDialog} onPrefetchApplications={prefetchApplications} showAccountLibrary={favouritesAccessible} /> @@ -4096,15 +4095,20 @@ export function ClinicalDashboard({ hidden onNavigate={navigateMobileSection} /> - - + + - diff --git a/src/components/clinical-dashboard/ClinicalSidebar.tsx b/src/components/clinical-dashboard/ClinicalSidebar.tsx index 80a719964..4af45b67e 100644 --- a/src/components/clinical-dashboard/ClinicalSidebar.tsx +++ b/src/components/clinical-dashboard/ClinicalSidebar.tsx @@ -1,25 +1,18 @@ "use client"; -import { useState, useSyncExternalStore } from "react"; +import { useState } from "react"; import Link from "next/link"; import { - BookOpen, - BrainCircuit, - ClipboardPen, FileText, Heart, MessageSquarePlus, MessageSquare, - Moon, - Network, PanelLeftClose, PanelLeftOpen, Pill, Search, Settings as SettingsIcon, Sparkles, - Sun, - Tags, Wrench, } from "lucide-react"; import { appModeIcons } from "@/lib/app-mode-icons"; @@ -33,16 +26,8 @@ import { textMuted, } from "@/components/ui-primitives"; -function useClientMounted() { - return useSyncExternalStore( - () => () => undefined, - () => true, - () => false, - ); -} import { Sheet } from "@/components/ui/sheet"; -import { appModeDefinition, type AppModeId, isAppModeId, isAppModeVisible } from "@/lib/app-modes"; -import { type ResolvedTheme } from "@/lib/theme"; +import { type AppModeId } from "@/lib/app-modes"; export type SidebarIdentity = { displayName: string; @@ -73,47 +58,16 @@ const sidebarToolItems = [ { id: "answer", label: "Answer", icon: Sparkles, href: "/?mode=answer" }, { id: "documents", label: "Documents", icon: FileText, href: "/?mode=documents" }, { id: "services", label: "Services", icon: appModeIcons.services, href: "/services" }, - // badge = catalogue-maturity pill: the Forms registry is a small starter set. - { id: "forms", label: "Forms", icon: ClipboardPen, href: "/forms", badge: "Early access" }, - { id: "differentials", label: "Differentials", icon: BrainCircuit, href: "/differentials" }, - { id: "dsm", label: "DSM-5 Diagnosis", icon: appModeIcons.dsm, href: "/dsm" }, - { id: "specifiers", label: "Specifiers", icon: Tags, href: "/specifiers" }, - { id: "formulation", label: "Formulation", icon: Network, href: "/formulation" }, - { id: "prescribing", label: "Medication", icon: Pill, href: "/?mode=prescribing" }, - { id: "tools", label: "Tools", icon: Wrench, href: "/?mode=tools" }, - { - id: "therapy-compass", - label: appModeDefinition("therapy-compass").label, - icon: appModeIcons["therapy-compass"], - href: "/therapy-compass", - }, + { id: "prescribing", label: "Medications", icon: Pill, href: "/?mode=prescribing" }, { id: "factsheets", label: "Factsheets", icon: appModeIcons.factsheets, href: "/factsheets" }, + { id: "tools", label: "Tools", icon: Wrench, href: "/?mode=tools" }, ] as const; const sidebarAccountLibraryItems = [ { id: "favourites" as const, label: "Favourites", icon: Heart, href: "/favourites" }, ] as const; -const primarySidebarToolIds = new Set<(typeof sidebarToolItems)[number]["id"]>([ - "answer", - "documents", - "services", - "forms", - "tools", - "therapy-compass", -]); - -// Keep the persistent sidebar intentionally short. Secondary catalogues and -// specialist workspaces remain reachable through the MODE picker, search, and -// the Tools hub, but they should not all appear in the left rail. Still honour -// app-mode visibility so dev-only modes cannot leak into production nav. -const visibleSidebarToolItems = sidebarToolItems.filter( - (item) => primarySidebarToolIds.has(item.id) && (!isAppModeId(item.id) || isAppModeVisible(item.id)), -); - -function sidebarItemBadge(item: (typeof sidebarToolItems)[number]): string | undefined { - return "badge" in item ? item.badge : undefined; -} +const visibleSidebarToolItems = sidebarToolItems; // Display-free base so callers can compose `grid` / `hidden lg:grid` without // conflicting display utilities (cn does not de-duplicate classes). @@ -130,11 +84,10 @@ export function ClinicalSidebarContent({ showAccountLibrary = false, onNewChat, onPickRecent, - onOpenGuide, onOpenSettings, onOpenAccount, - theme, - onToggleTheme, + onPrefetchSettings, + onPrefetchAccount, onPrefetchApplications, showHeader = true, onCollapsedChange, @@ -147,11 +100,10 @@ export function ClinicalSidebarContent({ showAccountLibrary?: boolean; onNewChat: () => void; onPickRecent: (query: string) => void; - onOpenGuide: () => void; onOpenSettings: () => void; onOpenAccount: () => void; - theme: ResolvedTheme; - onToggleTheme: () => void; + onPrefetchSettings?: () => void; + onPrefetchAccount?: () => void; onPrefetchApplications?: () => void; showHeader?: boolean; onCollapsedChange?: (collapsed: boolean) => void; @@ -163,10 +115,6 @@ export function ClinicalSidebarContent({ ? recentQueries.filter((recent) => recent.toLowerCase().includes(normalizedChatFilter)) : recentQueries; const visibleRecentQueries = matchingRecentQueries.slice(0, 5); - const ThemeIcon = theme === "dark" ? Sun : Moon; - const nextThemeLabel = theme === "dark" ? "Light mode" : "Dark mode"; - const themeToggleLabel = theme === "dark" ? "Switch to light mode" : "Switch to dark mode"; - const themeUiReady = useClientMounted(); const accountLabel = accountProfileLabel(identity); return ( @@ -206,7 +154,7 @@ export function ClinicalSidebarContent({ {/* Scroll region: search, recent chats, and tools scroll together on short viewports while the header, New chat, and account footer stay pinned. */} -
+
- - - {visibleSidebarToolItems.map((item) => { - const Icon = item.icon; - const active = activeMode === item.id; - return ( - - - - ); - })} - {showAccountLibrary - ? sidebarAccountLibraryItems.map((item) => { - const Icon = item.icon; - const active = activeMode === item.id; - return ( - - - - ); - }) - : null} -
@@ -728,15 +741,16 @@ function GlobalStandaloneSearchShellClient({
- setGuideOpen(false)} /> - + setSettingsOpen(false)} identity={sidebarIdentity} onSignOut={auth.signOut} - onOpenGuide={openGuide} + onOpenGuide={openGuideFromSettings} + initialFocus={settingsInitialFocus} /> - + diff --git a/src/components/clinical-dashboard/lazy-sidebar-dialogs.tsx b/src/components/clinical-dashboard/lazy-sidebar-dialogs.tsx new file mode 100644 index 000000000..403ee5530 --- /dev/null +++ b/src/components/clinical-dashboard/lazy-sidebar-dialogs.tsx @@ -0,0 +1,27 @@ +"use client"; + +import dynamic from "next/dynamic"; +import type { ComponentProps } from "react"; + +export const loadSettingsDialog = () => + import("@/components/clinical-dashboard/settings-dialog").then((module) => module.SettingsDialog); + +export const SettingsDialog = dynamic(loadSettingsDialog, { ssr: false }); + +const loadAccountSetupDialog = () => + import("@/components/clinical-dashboard/account-setup-dialog").then((module) => module.AccountSetupDialog); + +export const AccountSetupDialog = dynamic(loadAccountSetupDialog, { ssr: false }); + +export function prefetchAccountDialog() { + void loadSettingsDialog(); + void loadAccountSetupDialog(); +} + +export function SidebarSettingsDialog(props: ComponentProps) { + return props.open ? : null; +} + +export function SidebarAccountSetupDialog(props: ComponentProps) { + return props.open ? : null; +} diff --git a/src/components/clinical-dashboard/settings-dialog.tsx b/src/components/clinical-dashboard/settings-dialog.tsx index 23c67a5be..55b006f08 100644 --- a/src/components/clinical-dashboard/settings-dialog.tsx +++ b/src/components/clinical-dashboard/settings-dialog.tsx @@ -110,14 +110,17 @@ export function SettingsDialog({ identity, onSignOut, onOpenGuide, + initialFocus = "close", }: { open: boolean; onClose: () => void; identity: SidebarIdentity; onSignOut: () => void; onOpenGuide: () => void; + initialFocus?: "close" | "guide"; }) { const closeButtonRef = useRef(null); + const guideButtonRef = useRef(null); const scrollRef = useRef(null); const settingsEmailInputRef = useRef(null); @@ -292,7 +295,7 @@ export function SettingsDialog({ onClose={onClose} closeLabel="Close settings" labelledBy="account-settings-title" - initialFocusRef={closeButtonRef} + initialFocusRef={initialFocus === "guide" ? guideButtonRef : closeButtonRef} mobilePlacement="fullscreen" contentClassName="w-full max-w-none border-[color:var(--border-lux)] bg-[color:var(--background)] font-sans shadow-none max-lg:!pb-0 lg:max-w-[940px] lg:bg-[color:var(--surface-lux)] lg:shadow-[var(--shadow-lux)]" bodyClassName="p-0" @@ -793,7 +796,9 @@ export function SettingsDialog({ primary guideline before acting.

diff --git a/src/components/clinical-dashboard/use-settings-guide-flow.ts b/src/components/clinical-dashboard/use-settings-guide-flow.ts new file mode 100644 index 000000000..dd0384b26 --- /dev/null +++ b/src/components/clinical-dashboard/use-settings-guide-flow.ts @@ -0,0 +1,44 @@ +"use client"; + +import { useCallback, useRef, useState } from "react"; + +type SettingsGuideFlowOptions = { + openGuide: () => void; + closeGuide: () => void; + openSettings: () => void; + openAccountProfile: () => void; + setSettingsOpen: (open: boolean) => void; +}; + +export function useSettingsGuideFlow(options: SettingsGuideFlowOptions) { + const [settingsInitialFocus, setSettingsInitialFocus] = useState<"close" | "guide">("close"); + const guideReturnsToSettingsRef = useRef(false); + + const openGuideFromSettings = useCallback(() => { + guideReturnsToSettingsRef.current = true; + options.openGuide(); + }, [options]); + const closeGuideWithRestore = useCallback(() => { + options.closeGuide(); + if (!guideReturnsToSettingsRef.current) return; + guideReturnsToSettingsRef.current = false; + setSettingsInitialFocus("guide"); + options.setSettingsOpen(true); + }, [options]); + const openSettingsWithDefaultFocus = useCallback(() => { + setSettingsInitialFocus("close"); + options.openSettings(); + }, [options]); + const openAccountProfileWithDefaultFocus = useCallback(() => { + setSettingsInitialFocus("close"); + options.openAccountProfile(); + }, [options]); + + return { + settingsInitialFocus, + openGuideFromSettings, + closeGuideWithRestore, + openSettingsWithDefaultFocus, + openAccountProfileWithDefaultFocus, + }; +} diff --git a/tests/favourites-auth-gate.dom.test.tsx b/tests/favourites-auth-gate.dom.test.tsx index bb6652bd9..abc7b2b88 100644 --- a/tests/favourites-auth-gate.dom.test.tsx +++ b/tests/favourites-auth-gate.dom.test.tsx @@ -50,11 +50,8 @@ function sidebarProps(showAccountLibrary: boolean) { showAccountLibrary, onNewChat: () => undefined, onPickRecent: () => undefined, - onOpenGuide: () => undefined, onOpenSettings: () => undefined, onOpenAccount: () => undefined, - theme: "light" as const, - onToggleTheme: () => undefined, }; } @@ -89,21 +86,31 @@ describe("favourites auth gate DOM", () => { authSession.error = null; }); - it("shows Your library with Favourites only when showAccountLibrary is true", () => { + it("keeps the six canonical navigation entries separate from conditional Favourites", () => { const { rerender } = render(); expect(screen.queryByRole("navigation", { name: "Your library" })).toBeNull(); + const navigation = within(screen.getByRole("navigation", { name: "Navigation" })); expect( - within(screen.getByRole("navigation", { name: "Tools" })).getByRole("link", { name: "Answer" }), - ).toBeTruthy(); + navigation.getAllByRole("link").map((link) => ({ name: link.textContent, href: link.getAttribute("href") })), + ).toEqual([ + { name: "Answer", href: "/?mode=answer" }, + { name: "Documents", href: "/?mode=documents" }, + { name: "Services", href: "/services" }, + { name: "Medications", href: "/?mode=prescribing" }, + { name: "Factsheets", href: "/factsheets" }, + { name: "Tools", href: "/?mode=tools" }, + ]); expect(screen.queryByRole("link", { name: "Favourites" })).toBeNull(); + expect(screen.queryByRole("button", { name: /^Guide & help$/ })).toBeNull(); + expect(screen.queryByRole("button", { name: /^(Switch to )?(dark|light) mode$/i })).toBeNull(); rerender(); expect(screen.getByRole("navigation", { name: "Your library" })).toBeVisible(); expect(screen.getByRole("link", { name: "Favourites" })).toHaveAttribute("href", "/favourites"); expect( - within(screen.getByRole("navigation", { name: "Tools" })).queryByRole("link", { name: "Favourites" }), + within(screen.getByRole("navigation", { name: "Navigation" })).queryByRole("link", { name: "Favourites" }), ).toBeNull(); }); diff --git a/tests/favourites-auth-gate.test.ts b/tests/favourites-auth-gate.test.ts index 951718fb4..938d0f07e 100644 --- a/tests/favourites-auth-gate.test.ts +++ b/tests/favourites-auth-gate.test.ts @@ -28,19 +28,25 @@ describe("favourites auth gate", () => { expect(sidebar).toContain("Your library"); expect(sidebar).toContain('aria-label="Your library"'); expect(sidebar).toContain("showAccountLibrary"); - expect(sidebar).toContain("primarySidebarToolIds"); + expect(sidebar).toContain("const visibleSidebarToolItems = sidebarToolItems"); expect(sidebar).not.toMatch(/const sidebarToolItems = \[[\s\S]*\{ id: "favourites", label: "Favourites"/); - // Constrain to the Set initializer so later activeMode/href mentions of - // specialist modes (e.g. differentials) do not false-fail the exclusion check. - const primarySidebarInitializer = sidebar.match( - /const primarySidebarToolIds = new Set<\(typeof sidebarToolItems\)\[number\]\["id"\]>\(\[([\s\S]*?)\]\);/, - )?.[1]; - expect(primarySidebarInitializer).toBeTruthy(); - const primarySidebarIds = [...(primarySidebarInitializer ?? "").matchAll(/"([^"]+)"/g)].map((match) => match[1]); - expect(primarySidebarIds).toEqual(["answer", "documents", "services", "forms", "tools", "therapy-compass"]); - for (const excludedId of ["differentials", "dsm", "specifiers", "formulation", "prescribing", "factsheets"]) { - expect(primarySidebarIds).not.toContain(excludedId); + // The persistent rail is the six-item canonical list only; Favourites stays + // in Your library, and specialist catalogues stay out of the rail source. + const sidebarToolInitializer = sidebar.match(/const sidebarToolItems = \[([\s\S]*?)\] as const;/)?.[1]; + expect(sidebarToolInitializer).toBeTruthy(); + const sidebarToolIds = [...(sidebarToolInitializer ?? "").matchAll(/id: "([^"]+)"/g)].map((match) => match[1]); + expect(sidebarToolIds).toEqual(["answer", "documents", "services", "prescribing", "factsheets", "tools"]); + for (const excludedId of [ + "differentials", + "dsm", + "specifiers", + "formulation", + "forms", + "therapy-compass", + "favourites", + ]) { + expect(sidebarToolIds).not.toContain(excludedId); } expect(shell).toContain("showAccountLibrary={favouritesAccessible}"); diff --git a/tests/therapy-compass-mode-wiring.test.ts b/tests/therapy-compass-mode-wiring.test.ts index b16ecf8a9..5b10f836c 100644 --- a/tests/therapy-compass-mode-wiring.test.ts +++ b/tests/therapy-compass-mode-wiring.test.ts @@ -49,7 +49,7 @@ describe("Therapy Compass production-mode wiring", () => { expect(homeSrc).toContain('title="Therapy"'); expect(searchSrc).toContain('className="tc-screens-search-screen-002">Therapy'); expect(workspaceSrc).toContain("Therapy could not load"); - expect(sidebarSrc).toContain('label: appModeDefinition("therapy-compass").label'); + expect(sidebarSrc).not.toContain('id: "therapy-compass"'); expect(appModesSrc).not.toContain("Therapy mode"); expect(homeSrc).not.toContain("Therapy mode"); expect(searchSrc).not.toContain("Therapy Search"); diff --git a/tests/ui-smoke.spec.ts b/tests/ui-smoke.spec.ts index f8962ecf8..207738351 100644 --- a/tests/ui-smoke.spec.ts +++ b/tests/ui-smoke.spec.ts @@ -752,8 +752,22 @@ async function openMobileClinicalGuideMenu(page: Page) { await expect(menu.getByRole("button", { name: "New chat" })).toBeVisible(); await expect(menu.getByPlaceholder("Search chats")).toBeVisible(); await expect(menu.getByText("Recent chats", { exact: true })).toBeVisible(); - await expect(menu.getByRole("link", { name: "Tools", exact: true })).toBeVisible(); - await expect(menu.getByRole("button", { name: "Guide & help" })).toBeVisible(); + const navigation = menu.getByRole("navigation", { name: "Navigation" }); + await expect(navigation).toBeVisible(); + expect( + await navigation + .getByRole("link") + .evaluateAll((links) => links.map((link) => ({ name: link.textContent, href: link.getAttribute("href") }))), + ).toEqual([ + { name: "Answer", href: "/?mode=answer" }, + { name: "Documents", href: "/?mode=documents" }, + { name: "Services", href: "/services" }, + { name: "Medications", href: "/?mode=prescribing" }, + { name: "Factsheets", href: "/factsheets" }, + { name: "Tools", href: "/?mode=tools" }, + ]); + await expect(menu.getByRole("button", { name: "Guide & help", exact: true })).toHaveCount(0); + await expect(menu.getByRole("button", { name: /^(Switch to )?(dark|light) mode$/i })).toHaveCount(0); await expect(menu.getByRole("button", { name: "Settings", exact: true })).toBeVisible(); await expect(menu.getByText("Guest")).toBeVisible(); await expect(page.getByRole("dialog", { name: "Clinical KB guide" })).toHaveCount(0); @@ -784,24 +798,32 @@ async function waitForPersistedAnswerThread(page: Page, minPriorTurns = 1) { } async function openGuide(page: Page) { - const viewport = page.viewportSize(); const dialog = page.getByRole("dialog", { name: "Clinical KB guide" }); - const expandedGuide = page.locator("#clinical-tools-sidebar").getByRole("button", { name: "Guide & help" }); - const railGuide = page.getByRole("button", { name: "Guide and help", exact: true }); - - if (viewport && viewport.width >= 768) { - const trigger = (await expandedGuide.isVisible().catch(() => false)) ? expandedGuide : railGuide; - await expect(trigger).toBeVisible(); - await expect(trigger).toBeEnabled(); - await waitForReactEventHandler(trigger, "onClick"); - await trigger.click(); - await expect(dialog).toBeVisible({ timeout: uiAssertionTimeoutMs }); - } else { - const menu = await openMobileClinicalGuideMenu(page); - await menu.getByRole("button", { name: "Guide & help" }).click(); - await expect(dialog).toBeVisible(); + const settings = accountSettingsDialog(page); + const viewport = page.viewportSize(); + + // Guide now lives inside Settings. If Settings is already open (e.g. after + // closing Guide restores it), skip the reopen click that would hit the overlay. + if (!(await settings.isVisible().catch(() => false))) { + if (viewport && viewport.width < 768) { + const menu = await openMobileClinicalGuideMenu(page); + await menu.getByRole("button", { name: "Settings", exact: true }).click(); + } else if (viewport && viewport.width < 1024) { + const rail = page.getByLabel("Clinical Guide collapsed sidebar"); + await expect(rail.getByRole("button", { name: "Settings", exact: true })).toBeVisible(); + await rail.getByRole("button", { name: "Settings", exact: true }).click(); + } else { + const sidebar = page.locator("#clinical-tools-sidebar"); + const settingsTrigger = (await sidebar.isVisible().catch(() => false)) + ? sidebar.getByRole("button", { name: "Settings", exact: true }) + : page.getByLabel("Clinical Guide collapsed sidebar").getByRole("button", { name: "Settings", exact: true }); + await expect(settingsTrigger).toBeVisible(); + await settingsTrigger.click(); + } } + await expect(settings).toBeVisible({ timeout: uiAssertionTimeoutMs }); + await settings.getByRole("button", { name: "Guide & help", exact: true }).click(); await expect(dialog).toBeVisible(); await expect(dialog.getByText("Ask and verify")).toBeVisible(); await expect(dialog.getByText("Top source and citations")).toBeVisible(); @@ -1031,7 +1053,7 @@ test.describe("Clinical KB UI smoke coverage", () => { await gotoApp(page, "/?mode=answer"); await waitForDemoDashboardReady(page); - // No stored preference (PT-10): eight icon-only destinations demand recall, + // No stored preference (PT-10): the labelled navigation remains the default, // so first-run desktop shows the labelled sidebar; collapse is remembered. await expect(page.locator("#clinical-tools-sidebar")).toBeVisible(); await expect(page.getByRole("button", { name: "Collapse sidebar" })).toBeVisible(); @@ -1097,22 +1119,39 @@ test.describe("Clinical KB UI smoke coverage", () => { await expect(page.locator("#clinical-tools-sidebar")).toBeHidden(); await expect(page.getByLabel("Clinical Guide collapsed sidebar")).toBeVisible(); - for (const tool of [ + const rail = page.getByLabel("Clinical Guide collapsed sidebar"); + const scrollRegion = rail.getByTestId("collapsed-sidebar-scroll-region"); + const navigation = rail.getByRole("navigation", { name: "Navigation" }); + const library = rail.getByRole("navigation", { name: "Your library" }); + await expect(rail.getByRole("button", { name: "New chat" })).toBeVisible(); + await expect(rail.getByRole("button", { name: "Settings" })).toBeVisible(); + await expect(scrollRegion.getByRole("button", { name: "New chat" })).toHaveCount(0); + await expect(scrollRegion.getByRole("button", { name: "Settings" })).toHaveCount(0); + expect( + await navigation + .getByRole("link") + .evaluateAll((links) => + links.map((link) => ({ name: link.getAttribute("aria-label"), href: link.getAttribute("href") })), + ), + ).toEqual([ { name: "Answer", href: "/?mode=answer" }, { name: "Documents", href: "/?mode=documents" }, { name: "Services", href: "/services" }, - // The rail speaks the catalogue-maturity badge as part of the Forms name. - { name: "Forms (Early access)", href: "/forms" }, + { name: "Medications", href: "/?mode=prescribing" }, + { name: "Factsheets", href: "/factsheets" }, { name: "Tools", href: "/?mode=tools" }, - { name: "Therapy", href: "/therapy-compass" }, - // Demo mode still exposes Favourites via the account-library rail entry. - { name: "Favourites", href: "/favourites" }, - ] as const) { - await expect(page.getByRole("link", { name: tool.name, exact: true })).toHaveAttribute("href", tool.href); - } + ]); + expect( + await library + .getByRole("link") + .evaluateAll((links) => + links.map((link) => ({ name: link.getAttribute("aria-label"), href: link.getAttribute("href") })), + ), + ).toEqual([{ name: "Favourites", href: "/favourites" }]); // Specialist catalogues stay out of the persistent rail (MODE picker / Tools hub). await expect(page.getByRole("link", { name: "Differentials", exact: true })).toHaveCount(0); await expect(page.getByRole("link", { name: "Medication", exact: true })).toHaveCount(0); + await expect(page.getByRole("link", { name: "Therapy", exact: true })).toHaveCount(0); await expectNoPageHorizontalOverflow(page); }); @@ -1125,8 +1164,8 @@ test.describe("Clinical KB UI smoke coverage", () => { { path: "/?mode=answer", label: "Answer" }, { path: "/?mode=documents", label: "Documents" }, { path: "/favourites", label: "Favourites" }, + { path: "/?mode=prescribing", label: "Medications" }, { path: "/?mode=tools", label: "Tools" }, - { path: "/therapy-compass", label: "Therapy" }, ] as const) { await gotoApp(page, route.path); if (route.path.includes("mode=answer")) { @@ -2939,7 +2978,7 @@ test.describe("Clinical KB UI smoke coverage", () => { await acamprosateResult.click(); await expect(page).toHaveURL(/\/medications\/acamprosate$/, { timeout: 30_000 }); await expectSingleMedicationPage(page); - await expect(page.getByRole("link", { name: "Medications" })).toBeVisible(); + await expect(page.getByRole("link", { name: "Medications", exact: true }).first()).toBeVisible(); expect(parentNodeErrors).toEqual([]); }); @@ -3995,6 +4034,9 @@ test.describe("Clinical KB UI smoke coverage", () => { await expect.poll(async () => dialog.evaluate((element) => element.contains(document.activeElement))).toBe(true); await dialog.getByRole("button", { name: "Close guide" }).click(); await expect(dialog).toBeHidden(); + const restoredSettings = accountSettingsDialog(page); + await expect(restoredSettings).toBeVisible(); + await expect(restoredSettings.getByRole("button", { name: "Guide & help", exact: true })).toBeFocused(); const reopenedDialog = await openGuide(page); await tapOutsideActiveSurface(page);