diff --git a/docs/branch-review-ledger.md b/docs/branch-review-ledger.md
index 18fd426aa..20ed4fbdb 100644
--- a/docs/branch-review-ledger.md
+++ b/docs/branch-review-ledger.md
@@ -408,3 +408,8 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-14 | codex/specifiers-design | c3e7024e15d2157bbc0b989276324cc6ad3eea5c | Specifiers UI, clinical decision-support, accessibility, and release-readiness review | One P2 WCAG contrast defect was reproduced and fixed across the builder, comparison, and map accent eyebrows. No remaining high-confidence defect was found in the changed scope; residual risk is clinical/manual governance of the original specifier summaries. | Focused Vitest 18/18; focused Chromium desktop/mobile 2/2 with serious/critical axe WCAG A/AA scanning and overflow checks; `npm run check:production-readiness:ci` READY; `npm run verify:cheap` 2,210 passed/1 skipped; `npm run verify:pr-local` 2,213 passed/1 skipped plus production build and client-bundle secret scan; `git diff --check`. Full advisory `verify:ui` exceeded the local 10-minute execution window; provider-backed checks were not run. |
 | 2026-07-14 | PR #633 / codex/specifiers-design | 03daca3bfdf86517b9956f3c7d91be27d9f1a751 | Review follow-up and failed UI regression | Eight distinct P2 behaviors across nine review threads were confirmed and fixed: initial selection normalization, duplicate query removal, clinical applicability mapping, canonical Specifiers routing, severity-neutral base wording, diagnostic-section ordering, base/specifier compatibility, and severe psychotic-features wording. The failed app-menu keyboard test was a stale order assertion and now covers the inserted Specifiers item. | Focused Vitest 6/6; focused Chromium 4/4; scoped ESLint and TypeScript; CI-mode production readiness READY; production build and client-bundle secret scan passed. Hosted required checks passed on the refreshed `main` merge before the final compatibility fixes; provider-backed Supabase/OpenAI checks were not run. |
 | 2026-07-14 | PR #634 / codex/global-answer-reliability | b411329ec5f181661e5d49276c398440aa928fa2 | review-followup | One late P2 fast-context defect was confirmed: Australian tier ordering could push a higher-ranked supplementary passage outside the four-chunk routine fast budget. Fixed by preserving the retrieval-ranked, crowding-capped candidate budget before applying the order-only Australian preference within that set. | GitHub connector review-thread inspection; focused RAG context-budget suite 22/22; ESLint; TypeScript; Prettier; `git diff --check`. |
+| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | clinical governance + RAG full-repo audit (source governance/citations, answer verification/clinical safety, privacy/query-privacy/private-search-scope, generation failure modes/degradation, retrieval/ranking/selection, ingestion/OCR index quality) | No high-confidence P0/P1. Fail-closed governance chokepoint (`buildGovernedAnswerClientResponse`) applies to both `/api/answer` and `/api/answer/stream`; numeric/quote/citation verification, prompt-injection neutralization, owner-scope tenancy, and query/answer redaction all conservative. Two P3 observations: (1) `secondStageScore` demotion penalties can be floored away by `Math.max(hybrid_score, boosted)` at the tail of the list (rag.ts:663); (2) `outdatedPenalty` default-ON uses governance metadata to weight ranking (eval-gated, demotion-only) — in tension with the "no governance weighting" principle but conservative. D4/D5 (#649) levers verified default-OFF with tests. | Pure review, no mutations except this ledger append. Offline: focused Vitest governance/verification/privacy/scope suites 79/79 + 98/98 passed. Provider-backed (Supabase/OpenAI), browser, release, and live retrieval-quality checks not run (confirmation boundary). |
+| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | full repo-structure audit (broken imports, dead files, redundant config, module dependency, structural debt) | No P0/P1. P2: `RAG_TEXT_WEAK_OR_RELAXATION=true` in `.env.example` contradicts `default("false")` in `env.ts` (process-hardening hardened this to off); `reindex-eval-gate.ts` (488 lines) has no production importer — test-only orphan; `bundle-budget.json` still has `enforce: false` + `totalGzipBytes: null` after first production build window passed. P3: `client-env.ts` duplicates `isLocalNoAuthMode`/`publicUploadsEnabled` from `env.ts` using raw `process.env` (intentional server-only split, but divergent implementations); `OPENAI_PRICE_*`, `SPEND_ALERT_DAILY_USD` env vars undocumented in `.env.example`; `rag.ts` → extracted-module architecture still has acknowledged runtime back-edges in `rag-extractive-answer` but no import cycles detected by `architecture-boundaries.test.ts`; several `mockup`-named component files not removed from `src/components/` (production use gated via `mockupsEnabled()`). | `npm run verify:cheap` green (2,290 passed/2 skipped, 0 lint errors, typecheck clean, sitemap aligned, type-scale 0 hits, runtime Node 24/npm 11). `npm run check:env-parity` clean. `npm run docs:check-scripts` passed 266 refs. Architecture-boundaries suite (no cycles, server modules isolated, scripts not imported). Provider-backed (Supabase/OpenAI), browser, release, and live-eval checks not run (confirmation boundary). |
+| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | RAG retrieval/ranking/selection/answer-generation audit (fresh scoped pass; PR #649 D4/D5 governance levers safe-by-default focus, token/effort waste, provider routing) | No P0/P1. Both #649 levers verified safe-by-default and fail-safe: D4 `unknownCurrentnessPenalty` default 0 (no-op, clamped non-negative, activated only via `RAG_RANKING_CONFIG`); D5 `NEXT_PUBLIC_RAG_TRUST_CAP_ALL_CLAIMS` unset=false (only tightens display trust high→medium, never exposes more; `NEXT_PUBLIC` correct as `buildAnswerRenderModel` runs client-side in `ClinicalDashboard.tsx`). Reasoning-effort defaults correct (`OPENAI_STRONG_REASONING_EFFORT`=medium, fast=low; `strongReasoningEffortForQueryClass` never raises, caps routine at medium, keeps dose/threshold at configured). Provider mode default `auto`. P3 (reaffirmed): (1) `Math.max(hybrid_score, boosted)` floor at rag.ts:663 can nullify demotion penalties (outdated/unknown/poor/lowIndex) at the list tail, making D4 partly inert when activated; (2) `document_status` defaults to `"unknown"` (source-metadata.ts:34) for unenriched docs, so activating D4 penalizes the corpus-wide fallback status, not a curated signal — same mechanism that dropped selection doc-recall@5 1.0→0.76 (retrieval-selection.ts:340) — eval gate is the safeguard. | Pure review, no mutations except this ledger append. Offline focused Vitest: answer-render-policy + ranking-config + answer-responsiveness-gate 54/54 passed. Provider-backed (Supabase/OpenAI), `eval:retrieval:quality`, browser, and release checks not run (confirmation boundary). |
+| 2026-07-14 | HEAD (detached) 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | frontend/UI/accessibility audit — global-search-shell, master-search-header, composer, answer surfaces, document viewer, clinical dashboard modules; design-token usage, reduced-motion/forced-colors, icon aria, focus traps, composer/header placement | No P0. P2: (1) `aria-describedby`+`aria-hidden="true"` conflict in `mode-action-popup.tsx:622,651` makes menu descriptions invisible to AT; (2) ~25 dynamic `<Icon>` render sites missing `aria-hidden` across dashboard modules — ESLint `require-lucide-icon-aria` rule gap for LucideIcon-typed variables; (3) Mode menu (`role="menu"` in header) does not close on Tab — keyboard users can Tab away from an open menu without dismissing it; (4) No live region on streaming `NaturalLanguageAnswer` — screen reader users not notified of incremental answer content. P3: (5) `--surface-glass`/`--panel-gloss` not remapped in `@media (forced-colors: active)` block — image-lightbox and PDF toolbar control bars could become invisible in high-contrast; (6) `bg-black/45` on Sheet backdrop instead of `var(--overlay-backdrop)` token; (7) `active:scale-[0.99]` on action-popup buttons without `motion-safe:` — still fires as a visual jump under reduced-motion; (8) Microsoft/Google brand hex squares not `forced-color-adjust:none` — lose brand identity in high-contrast mode. | Pure static review, no mutations. Files read: `master-search-header.tsx`, `global-search-shell.tsx`, `globals.css`, `sheet.tsx`, `mode-action-popup.tsx`, `image-lightbox.tsx`, `answer-content.tsx`, `ClinicalDashboard.tsx` (partial), `use-dismissable-layer.ts`, `layout.tsx`, `eslint-rules/require-lucide-icon-aria.mjs`, `ui-accessibility.spec.ts`, `process-hardening.md`. Browser/live checks not run (confirmation boundary). |
+| 2026-07-14 | main / 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | 570e6ba56ae60bea56a32801b9cc96c5a8dfde4f | repo-wide multi-skill audit (repo-auditor, security, clinical-governance, RAG, ingestion-worker, API, frontend-ui, release-readiness, testing/code-quality) | Highest code P1: anonymous public catalogs bypass rate limits while serving multi-MB payloads (medications 3.4 MB, services 894 KB, differentials 1.2 MB; `shouldResolvePublicCatalogAccess()` early-return in registry/medications/differentials routes skips `consumeSubjectApiRateLimit()` for requests without session cookie or bearer token). Active OPERATOR/LEGAL launch blockers: PIA-1 APP 8 overseas processing (Railway SG + OpenAI US), PIA-2 Railway `RAG_QUERY_HASH_SECRET` verify, unrun `verify:release`/golden evals, staging soak, Eval Canary trust, operator-backlog staleness vs runbooks. Confirmed code P2 cluster: public-doc DTO leaks (`storage_path`), single-layer service-role tenancy, commit-RPC unreachable fallback (`worker/main.ts:545-547`), recovery plan pending+failed unique-index crash, unwired `decideReindexGate`, CI scope misses (`src/lib/app-modes.ts`/`clinical-safety.ts` skip UI/RAG gates), a11y describedby/icon/Tab/live-region gaps, soft `@critical` safety UI assert, unenforced bundle budget, `.env.example` weak-OR flag. Residual risk: OCR quality upstream labels + hybrid-RPC latency tail. | Specialist audits + `ci-change-scope` probe; structure `verify:cheap` (2,290/2 skipped); focused Vitest governance/RAG/ingestion suites; no provider/live Supabase/OpenAI/`verify:release`/`check:drift` (confirmation boundary). |