Local presence checks (#054) and canonical /tools entry (#007)

docs/branch-review-ledger.md

@@ -809,6 +809,9 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-24 | `cursor/sidebar-six-item-land-cfa0` / PR #1174 content-proof `d97c11e6` | `d97c11e6` | #066 land/proof of six-item sidebar from `cd54e68f` onto main | PROVE — feature content landed; focused 20/20; verify:pr-local PASS; ensure spot-check PASS; verify:ui 267/267. Not merged to main. | vitest favourites+therapy; verify:pr-local; ensure+computerUse spot-check; verify:ui |
 | 2026-07-24 | PR #1175 / `cursor/ledger-009-010-032-041-063-519b` | f3986abc39468e077643611ec2d95e374c2e901f | PR review + CI fix (ledger docs #009/#010/#032/#041/#063) | FINDINGS FIXED. P1: Static PR checks failed on Prettier (5 docs). P1: leftover `PR_POLICY_BODY.md` from merged #1134 caused Sync PR policy body to overwrite this docs PR description with search-performance text ??? deleted the stale template. No P0. Product scope remains docs-only; gated brief follow-ups (wire coming-soon, Current Clinical Work storage, Factsheets second mode, governance ranking) correctly not implemented. Residual: human approving review once CI green. | Local: prettier --check on touched docs; ledger open/resolved/queue integrity for five IDs; no client fetch(`/api/jobs`); `verify:cheap` earlier on tip 95d68c6b. No OpenAI/Supabase writes. |
 | 2026-07-25 | cursor/search-performance-review-4ee9 (PR #1134) | 692834a86e612cc8b311dc6895e007f182f5c5b8 | Open-PR maintenance: superseded docs-link thread and clean main sync | Before: branch was behind current main with one outdated docs-link thread; its product tree already matched main. After: merged current main cleanly and verified the route-group-aware docs-link fix now covers legacy route references. RAG impact: no retrieval behaviour change — history sync and docs tooling verification only. | `node scripts/check-docs-links.mjs` pass (1154 references); clean merge-tree; no live RAG canary or provider-backed check run. |
+
+| 2026-07-24 | PR #1178 / `cursor/local-presence-054-7cf3` | `c1b462a0d2db74b4a9e2f7136c33bf075ab52c7e` | Local presence #054 + Tools canonical #007 + CI remediation | FINDINGS FIXED. P1 Prettier on presence files formatted. P1 Safety audit postcss<=8.5.17 cleared by bumping to ^8.5.18/$postcss (8.5.23). P1 stale PR_POLICY_BODY.md removed so Sync PR policy no longer overwrites this PR with unrelated search-performance text. #007 implemented as `/tools` canonical (PT-11); `/?mode=tools` alias retained. No P0. Residual: hosted #054 secrets remain operator-owned. | Focused Vitest 70/70; verify:cheap 374/3326; npm audit high clean; check:local-presence ok. No hosted secret/provider mutations. |
+| 2026-07-24 | PR #1178 / `cursor/local-presence-054-7cf3` | `162f64cfdb475262d5f8534313397c3e895457d4` | Local presence #054 + Tools canonical #007 + CI remediation (supersedes prior tip review) | Same findings fixed on tip including PR_POLICY_BODY.md deletion commit. No new high-confidence defects. Residual: hosted #054. | verify:cheap green on prior tip; tip adds leftover PR_POLICY_BODY removal + this ledger row. |
 | 2026-07-24 | cursor/search-correctness-030-075-6273 (PR #1177) | 54ab9f8498751ef7e96815dd2496b8137f29dad7 | Review + follow-up hardening of #030/#075 search-correctness fixes | Findings fixed: (P2) one combo-titled source could still make multi-slot allHit true via substring alias hits — `expectedFileCoverage` now assigns each retrieved top-file to at most one expected slot; (P2) label pagination could loop forever on a stuck full-page API — fail-closed page budget added; (P2 process) stale `PR_POLICY_BODY.md` from search-performance leftover was overwriting this PR body via Sync PR policy body — corrected then deleted. No remaining high-confidence P0–P1 in product scope. Residual: human approving review; Unit coverage CI still finishing on later heads. RAG impact: no retrieval behaviour change — eval matching / label pagination only. | Focused Vitest 32/32; `verify:cheap` green; `verify:pr-local` green (lint/typecheck/3326 unit/build/client-bundle/offline RAG fixtures 36/36). No OpenAI/live Supabase/provider-backed canary. |
 | 2026-07-24 | cursor/search-correctness-030-075-6273 (PR #1177) | 96ba6152c1f8e5e0000000000000000000000000 | Supersedes prior #1177 review row with post-sync tip | Same product outcome as prior row; tip includes correct PR_POLICY_BODY sync + template deletion so Sync PR policy body cannot reintroduce the stale search-performance description. | `npm run check:branch-review-ledger` pass; no provider-backed checks run. |
 | 2026-07-24 | PR #1175 / `cursor/ledger-009-010-032-041-063-519b` | f3986abc39468e077643611ec2d95e374c2e901f | PR review + CI fix (ledger docs #009/#010/#032/#041/#063) | FINDINGS FIXED. P1: Static PR checks failed on Prettier (5 docs). P1: leftover `PR_POLICY_BODY.md` from merged #1134 caused Sync PR policy body to overwrite this docs PR description with search-performance text — deleted the stale template. No P0. Product scope remains docs-only; gated brief follow-ups (wire coming-soon, Current Clinical Work storage, Factsheets second mode, governance ranking) correctly not implemented. Residual: human approving review once CI green. | Local: prettier --check on touched docs; ledger open/resolved/queue integrity for five IDs; no client fetch(`/api/jobs`); `verify:cheap` earlier on tip 95d68c6b. No OpenAI/Supabase writes. |
@@ -822,6 +825,7 @@ This file is append-only. Never rewrite or delete an existing review record; app
 | 2026-07-24 | open-PR conflict sync (22 PRs) | multi-head | Conflict resolution pass | Before: all 22 open PRs behind/dirty vs main (several CONFLICTING/DIRTY). After: merged origin/main into every open head; all pushes OK; merge-tree classified 22/22 clean. | merge origin/main per branch; check:branch-review-ledger on #1172; no provider-backed checks run |
 | 2026-07-24 | cursor/pr-queue-hygiene-72ec | pending-push | PR queue hygiene | Add pr-branch-sync workflow + sync:pr-branches helper; bump postcss to clear npm audit high; document anti-churn guidance in AGENTS/process-hardening/pr-babysit/run-pr. | check:github-actions PASS; docs:check-scripts/index PASS; vitest sync-open-pr-branches 3/3; npm audit high clean; no provider-backed checks run |
 | 2026-07-24 | codex/apply-phone-layout-to-all-home-pages (PR #1124) | pending | Babysit: ledger dedupe + merge readiness | Before: Static PR failed on exact duplicate ledger rows after main sync. After: removed duplicate rows; squash auto-merge armed. | check:branch-review-ledger PASS; no provider-backed checks run |
+| 2026-07-25 | cursor/local-presence-054-7cf3 (PR #1178) | b438cd872286c831c6d9c8db49b017745f98abcc | Run PR sweep: CI fix + threads + drift | Before: GitHub reported DIRTY; Static PR checks found three stale `npm run check:local-presence` references because the implemented script was not registered; Production UI had one focus-restoration failure after 266 passes; 0 unresolved threads. After: merged current `origin/main` cleanly and registered the missing local script, so all 348 docs script references resolve. | `node scripts/check-docs-script-refs.mjs` pass; Prettier and `git diff --check` pass; focused Vitest/UI rerun deferred while another worktree owns the heavyweight lock; environment-reading presence mode and provider-backed checks not run. |
 | 2026-07-25 | cursor/sidebar-six-item-land-cfa0 (PR #1174) | c44a5c536e43f300feb1b88892d0b2a8ca2c4feb | Run PR sweep: CI fix + threads + drift | Before: GitHub reported DIRTY and Static PR checks failed formatting `docs/outstanding-issues.md`; 0 unresolved threads. After: merged current `origin/main` cleanly and formatted the failing document. | Prettier check pass; `git diff --check` pass; no provider-backed checks run. |
 | 2026-07-25 | cursor/pdf-crop-malformed-repro-9b3e (PR #1176) | c31543f5b5862dbe6911079029f28500a6af2a59 | Run PR sweep: CI fix + threads + drift | Before: GitHub reported DIRTY and Static PR checks failed formatting `docs/outstanding-issues.md` and `tests/pdf-extractor.test.ts`; 0 unresolved threads. After: merged current `origin/main` cleanly and formatted both failing files. | Prettier check pass; `git diff --check` pass; no provider-backed checks run. |
 | 2026-07-25 | codex/search-results-filters-20260725 | 88131e7267efd33059766dec80355a9246fbb2bf | Search result filters and document Sources merge-readiness review | APPROVE. No P0-P2 finding after current-main sync. Documents open Sources as an on-screen filtering surface with source-type controls; the shared results ribbon is applied across search pages. Highest residual risk: unusual real-content combinations may alter perceived density, while responsive, forced-colors, focus, and overflow paths are browser-covered. RAG impact: no retrieval behaviour change - UI controls and source browsing only. | `npm run verify:ui` pass 268/268; `npm run verify:cheap` pass (377 files, 3340 passed, 1 skipped); post-sync `npm run verify:pr-local` pass (378 files, 3349 passed, 1 skipped, production build, bundle-secret scan, offline RAG fixtures); `npm run check:production-readiness` pass with OPENAI_SAFETY_IDENTIFIER_SECRET warning; no live/provider-backed app checks run. |

docs/codebase-index.md

@@ -303,15 +303,8 @@ sequenceDiagram
 
 One shared composer (`master-search-header.tsx`) serves every mode. Placement:
 
-<<<<<<< HEAD
-
-- **Mode homes** (`/services`, `/forms`, `/favourites`, `/differentials`, `/formulation`, `/tools`, and dashboard homes): inline in the hero via the `mode-home-composer-slot` portal, on phone and tablet+ alike. (`/applications` is a redirect to `/tools`, not a composer surface.)
-- **Information (detail) pages**: catalogue/record routes under each mode (`/services/[slug]`, `/forms/[slug]`, `/medications/[slug]`, `/specifiers/[slug]`, `/formulation/[slug]`, `/factsheets/[slug]`, `/dsm/diagnoses/[slug]`, …). Route detection: `src/lib/information-pages.ts` (`isInformationPage`). Shared outer chrome: `src/components/information-page-shell.tsx` (`InformationPageShell`, breadcrumbs, optional footer). Specifier/formulation mode shells re-export that primitive. Intentional opt-outs: document viewer, therapy-compass CSS workspace, differentials presentation workflow.
-  \=======
 - **Mode homes** (`/services`, `/forms`, `/favourites`, `/differentials`, `/dsm`, `/specifiers`, `/formulation`, `/factsheets`, `/therapy-compass`, `/tools`, and dashboard homes): inline in the hero via the `mode-home-composer-slot` portal, on phone and tablet+ alike. (`/applications` is a redirect to `/tools`, not a composer surface.)
-
-> > > > > > > origin/main
-
+- **Information (detail) pages**: catalogue/record routes under each mode (`/services/[slug]`, `/forms/[slug]`, `/medications/[slug]`, `/specifiers/[slug]`, `/formulation/[slug]`, `/factsheets/[slug]`, `/dsm/diagnoses/[slug]`, …). Route detection: `src/lib/information-pages.ts` (`isInformationPage`). Shared outer chrome: `src/components/information-page-shell.tsx` (`InformationPageShell`, breadcrumbs, optional footer). Specifier/formulation mode shells re-export that primitive. Intentional opt-outs: document viewer, therapy-compass CSS workspace, differentials presentation workflow.
 - **Result and detail views**: fixed bottom dock on phone (compact variant on submitted searches), sticky top from `sm` up.
 - **Results routing**: standalone routes own their submitted searches via `?q=…&run=1` (`/services` → `ServicesNavigatorPage`, `/forms` → `FormsSearchResultsPage`, `/differentials` → `DifferentialsHome` results view, `/formulation` → local mechanism results, `/favourites` filters the command library in place). Answer, Documents, and Prescribing submitted searches render inside `ClinicalDashboard` — intentional, since they need retrieval/answer state. `/?mode=favourites` redirects to `/favourites`; `/?mode=differentials` redirects to `/differentials`; `/?mode=dsm` redirects to `/dsm`; `/?mode=specifiers` redirects to `/specifiers`; `/?mode=formulation` redirects to `/formulation`.
 - **Intentionally composer-free routes**: `/differentials/presentations/*` (comparison workflow owns its chrome), `/documents/[id]` viewer (has its own in-document ask composer), `/documents/source/*` (document flow owns mobile chrome). Do not re-flag these in search-consistency audits.

docs/operator-backlog.md

@@ -44,6 +44,7 @@ dashboard/CLI action, never committed.
 
 | Secret / config                            | Status     | Where                                | Notes                                                                                                                                                                                                             |
 | ------------------------------------------ | ---------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Local fillable HMAC/probe secrets          | ✅ local   | `.env.local` (gitignored)            | Use `npm run check:local-presence` / `--fill` for distinct local `OPENAI_SAFETY_IDENTIFIER_SECRET`, `RAG_QUERY_HASH_SECRET`, and `HEALTH_DEEP_PROBE_SECRET`. Never commit values. Hosted stores are separate.     |
 | `RAG_QUERY_HASH_SECRET` (prod)             | 🔎 verify  | Railway runtime secret               | GitHub repo secret present since 2026-07-10 (CI green); confirm the SAME value is set in Railway runtime. PIA-2 fail-closed guard requires it at boot (min 16 chars)                                              |
 | `HEALTH_DEEP_PROBE_SECRET` (prod + GitHub) | ⚠️ partial | Railway runtime + GitHub repo secret | Railway production was set and the authorized deep probe returned healthy on 2026-07-19. GitHub remains pending: set the same value as a repo secret, set `PROD_HEALTH_URL`, then enable the ops-digest schedule. |
 | `SUPABASE_SERVICE_ROLE_KEY` (per env)      | ⏳ pending | Railway runtime secret               | accepts the `sb_secret_…` key                                                                                                                                                                                     |