BigSimmo · BigSimmo · Jul 16, 2026 · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026
@@ -63,9 +63,7 @@ npm run docs:check-links
 - [search-rag-master-plan.md](search-rag-master-plan.md) / [search-rag-master-context.md](search-rag-master-context.md) — search/RAG roadmap and shared context
 - [rag-hybrid-findings-and-todo.md](rag-hybrid-findings-and-todo.md) — hybrid retrieval findings backlog
 - [reindex-shadow-harness-design.md](reindex-shadow-harness-design.md) — designed-only shadow reindex harness (driver not built)
-- [forward-codify-retrieval-rpcs-workorder.md](forward-codify-retrieval-rpcs-workorder.md) — retrieval RPC codification workorder
 - [ingestion-concurrency-fix-workorder.md](ingestion-concurrency-fix-workorder.md) — ingestion concurrency workorder
-- [project-alignment-cleanup.md](project-alignment-cleanup.md) — repo alignment cleanup tracker
 - [redesign/](redesign/) — premium redesign plans, decision log, token adoption
 - [superpowers/](superpowers/) — agent-authored plans and specs
 
@@ -75,6 +73,8 @@ Dated status reports, reviews, and operator decisions. They describe the repo
 as it was on that date; supersede with a new dated document rather than editing.
 
 - [audit/](audit/) — repo and UX/accessibility audits
+- [forward-codify-retrieval-rpcs-workorder.md](forward-codify-retrieval-rpcs-workorder.md) — completed retrieval RPC codification workorder
+- [project-alignment-cleanup.md](project-alignment-cleanup.md) — completed June 2026 repo-alignment record
 - [capacity-review.md](capacity-review.md), [scale-readiness-review.md](scale-readiness-review.md), [tenancy-defense-in-depth-review.md](tenancy-defense-in-depth-review.md)
 - `*-2026-*` findings and status docs, e.g. [chunking-ocr-reindex-lever-finding-2026-07-08.md](chunking-ocr-reindex-lever-finding-2026-07-08.md), [source-governance-status-2026-07-08.md](source-governance-status-2026-07-08.md), [source-governance-priorities-2026-07-02.md](source-governance-priorities-2026-07-02.md), [source-review-priority-2026-07-02.md](source-review-priority-2026-07-02.md), [operator-apply-july8-batch.md](operator-apply-july8-batch.md)
 

@@ -557,5 +557,6 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-15 | PR #679 / claude/therapy-compass-pages-rz0m5l | f5ca25f8b6b14f41e63f708933fe4bb311994795 | Therapy Compass production promotion and review-followup | All five review findings are fixed on the reviewed head: run-enabled shared-composer links stay on the Therapy Compass route, production data loads outside `/mockups`, deep links seed the in-tool search, and same-route query changes remount the provider. No additional high-confidence defect remains in the changed scope. | GitHub review-thread inventory; exact-head hosted build, critical UI smoke, UI regression, unit coverage, static, security, and image checks green; focused Vitest 28/28; TypeScript; `git diff --check`. No live Supabase/OpenAI checks run. |
 | 2026-07-15 | PR #680 / claude/rag-scalability-review-x0s55l | 32e242ab7fc386ea82b19c7cfc2112aa41f06f9a | privacy, public-catalog throttling, ingestion-recovery, and merge-readiness review | Audit remediation wave 1 plus review follow-ups. Confirmed and fixed: mixed-owner document list/detail responses exposed nested summary internals and free-form document metadata for public rows; anonymous catalog rate limiting skipped known-slug detail routes; and ingestion recovery could retry a failed row without seeing a legitimate pending/fresh-processing sibling. Ownership-specific projections/redaction now cover list and detail responses, every catalog detail path is throttled, and both recovery scripts pass every open sibling to the planner. No remaining unresolved review thread or high-confidence defect. | GitHub exact-head review-thread inspection (0 unresolved); hosted required CI, UI regression, migration replay, build, coverage, static, and security checks green; local focused route/recovery Vitest 163/163; TypeScript; earlier full `verify:cheap`; Prettier; `git diff --check`. No live Supabase/OpenAI/provider checks run. |
 | 2026-07-15 | PR #682 / claude/codex-builder-perf-flakiness-ck5yv7 | dc942dddb87c8a1fa8d84d88052b3d50dd883a43 + reviewed follow-up diff | CI performance, cache correctness, browser-lane routing, and merge-readiness review | Confirmed and fixed two P2 CI safety gaps: the cached `node_modules` key ignored `package.json` and `.npmrc`, allowing install-contract changes to reuse stale modules and skip `npm ci`; and removing the advisory quarantine job made any newly tagged UI test run nowhere. The cache now covers every install input and the quarantine lane performs only a cheap source scan when empty, preserving the speed improvement without losing coverage. No remaining unresolved review thread or high-confidence defect. | GitHub exact-head checks green before final main sync; focused Vitest 6/6; GitHub Actions pin check; CI-scope self-test; TypeScript; Prettier; `git diff --check`. Final hosted exact-head checks required after push. No live Supabase/OpenAI checks run. |
+| 2026-07-15 | codex/outstanding-work-cleanup | 0c56f27a37af88a073d2bb695d2cf4c05067ff4f + working-tree diff | repo-wide outstanding-work reconciliation and cleanup | No high-confidence P0/P1 remained in the locally executable scope. Fixed the stale architecture index for DSM/specifier routes, pruned redundant Knip configuration, removed the unused `SignedImage` default export, and reconciled maintained docs so completed/superseded plans no longer present as active work. Retained explicitly blocked work: provider-gated operator actions, the live-eval shadow reindex harness, deep-memory section-ownership design, and RAG follow-ups that require live evidence or product/security decisions. Full Knip findings were triaged rather than mass-deleted; unresolved-import scan is clean. | Offline `npm run verify:cheap` passed with 2,417 tests/1 skipped; docs links 806, script refs 264, codebase index 35/35; Knip unresolved scan clean; typecheck clean; focused Vitest 15/15; env-name parity clean; `git diff --check`. Provider-backed Supabase/OpenAI/GitHub/Railway, dependency audit, browser, build, drift, and release gates not run. |
 | 2026-07-15 | codex/design-polish-pass | 0c56f27a37af88a073d2bb695d2cf4c05067ff4f + reviewed working diff | full live design, responsive, UX, accessibility, design-system, routing, performance, lint, testing, documentation, and release-readiness review | No P0/P1 reproduced. Fixed the P2 duplicate phone scroll surface in the shared standalone shell and added a regression test; fixed mode-menu Tab dismissal; explicitly hid decorative dynamic icons; restricted press scaling to motion-safe environments; moved sheet backdrops and forced-colour glass/backdrop behavior onto design tokens. External target fidelity remains blocked because no independent Figma/mockup source was supplied. | Live 30-route desktop + 21-route phone sweep; targeted 320/390/639/768/1440/1920 proofs; `npm run verify:cheap` (2417 passed/1 skipped); `npm run verify:ui` (175/175); focused keyboard 1/1; accessibility media/axe 5/5; scoped Prettier, ESLint, TypeScript, type-scale, and icon-scale passed. Provider-backed checks not run. |
 | 2026-07-15 | codex/documents-closed-default | 49f63791bced2b1764a11ab723aea94b45b026b6 | documents viewer disclosure defaults and related defect hunt | Fixed the inconsistent default-open document viewer sections by making indexed text, high-yield summary, tables/diagrams, and indexing details a native mutually exclusive closed disclosure group. The section navigation opens its requested disclosure and deep-linked evidence still reveals its target. The hunt also removed the explicitly open nested table-review queue, preserved printable summary content through the browser print lifecycle, and added cold-server readiness guards to the affected viewer tests. No other high-confidence default-open defect remains in the live Documents scope. | `npm run verify:cheap`; TypeScript; focused ESLint/Prettier; clean-worktree mocked Chromium coverage for deep-linked evidence, structured summary, closed/mutually-exclusive disclosures, navigation opening, and print state restore; `git diff --check`. Turbopack could not run through the local external `node_modules` junction, so clean browser verification used Next's supported Webpack dev mode. No Supabase/OpenAI/live-provider checks run. |
@@ -44,23 +44,26 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map
 - **App shell:** `src/components/clinical-dashboard/global-search-shell.tsx` — canonical route-aware shell and lazy dashboard dispatch. The mockup-named module is a compatibility re-export used only below `/mockups`.
 - **Home:** `src/app/page.tsx` — dashboard rendered by shell
 - **Dashboard:** `src/components/ClinicalDashboard.tsx` + `src/components/clinical-dashboard/`
-- **Modes (9):** `src/lib/app-modes.ts` — answer, documents, services, forms, favourites, differentials, formulation, prescribing, tools
+- **Modes (12):** `src/lib/app-modes.ts` — answer, documents, services, forms, favourites, differentials, DSM-5 diagnosis, specifiers, formulation, prescribing, tools, Therapy Compass
 
 ### Product pages (`src/app/`)
 
-| Route                                                                 | File                                   |
-| --------------------------------------------------------------------- | -------------------------------------- |
-| `/`                                                                   | `src/app/page.tsx`                     |
-| `/applications`                                                       | `src/app/applications/page.tsx`        |
-| `/differentials`, `/diagnoses`, `/presentations`                      | `src/app/differentials/`               |
-| `/documents/search`, `/source`, `/evidence`, `/[id]`                  | `src/app/documents/`                   |
-| `/favourites`                                                         | `src/app/favourites/page.tsx`          |
-| `/forms`, `/forms/[slug]`                                             | `src/app/forms/`                       |
-| `/medications`, `/medications/[slug]`                                 | `src/app/medications/`                 |
-| `/services`, `/services/[slug]`                                       | `src/app/services/`                    |
-| `/formulation`, `/formulation/[slug]`, `/builder`, `/compare`, `/map` | `src/app/formulation/`                 |
-| `/mockups/*`                                                          | `src/app/mockups/` (404 in production) |
-| `/auth/callback`                                                      | `src/app/auth/callback/route.ts`       |
+| Route                                                                                                     | File                                   |
+| --------------------------------------------------------------------------------------------------------- | -------------------------------------- |
+| `/`                                                                                                       | `src/app/page.tsx`                     |
+| `/applications`                                                                                           | `src/app/applications/page.tsx`        |
+| `/differentials`, `/diagnoses`, `/presentations`                                                          | `src/app/differentials/`               |
+| `/dsm`, `/dsm/search`, `/dsm/compare`, `/dsm/diagnoses/[slug]`                                            | `src/app/dsm/`                         |
+| `/documents/search`, `/source`, `/evidence`, `/[id]`                                                      | `src/app/documents/`                   |
+| `/favourites`                                                                                             | `src/app/favourites/page.tsx`          |
+| `/forms`, `/forms/[slug]`                                                                                 | `src/app/forms/`                       |
+| `/medications`, `/medications/[slug]`                                                                     | `src/app/medications/`                 |
+| `/services`, `/services/[slug]`                                                                           | `src/app/services/`                    |
+| `/therapy-compass`                                                                                        | `src/app/therapy-compass/`             |
+| `/specifiers`, `/specifiers/[slug]`, `/specifiers/builder`, `/specifiers/compare`, `/specifiers/map`      | `src/app/specifiers/`                  |
+| `/formulation`, `/formulation/[slug]`, `/formulation/builder`, `/formulation/compare`, `/formulation/map` | `src/app/formulation/`                 |
+| `/mockups/*`                                                                                              | `src/app/mockups/` (404 in production) |
+| `/auth/callback`                                                                                          | `src/app/auth/callback/route.ts`       |
 
 ### API routes (`src/app/api/`)
 
@@ -126,6 +129,7 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map
 | Module                                                               | Role                                                    |
 | -------------------------------------------------------------------- | ------------------------------------------------------- |
 | `differentials.ts`, `forms.ts`, `services.ts`, `registry-records.ts` | Registry-backed content                                 |
+| `dsm.ts`                                                             | Local DSM diagnosis catalogue and comparison helpers    |
 | `formulation.ts`                                                     | Local formulation mechanism library and builder helpers |
 | `clinical-safety.ts`, `demo-data.ts`, `ui-copy.ts`                   | Safety copy and demo mode                               |
 
@@ -249,7 +253,7 @@ Golden retrieval fixture: `scripts/fixtures/rag-retrieval-golden.json`
 
 ### Clinical KB surface
 
-- 9 app modes with unified search shell
+- 11 app modes with unified search shell
 - Documents mode: upload/manage private guidelines, search, cited answers
 - Answer mode: grounded Q&A with PDF-linked citations
 - Registry modes: services, forms, medications, differentials; Formulation is a local mechanism and structured-draft workspace

@@ -1,4 +1,11 @@
-# Ingestion-concurrency phase-3 — remaining fix work-order
+# Ingestion-concurrency phase-3 — fix work-order
+
+**Status refresh 2026-07-15:** the July-8 migration batch is applied and verified live. The only
+remaining repository design item in this document is deep-memory section ownership/delete scoping
+(see the final section); it is intentionally blocked on an explicit ownership model and a
+retrieval/eval-gated implementation. Worker redeploy and other live operations are tracked in
+[`operator-backlog.md`](operator-backlog.md). Historical author-time status below is retained as
+provenance and must not be read as current live state.
 
 Sequenced, operator-applied plan for the state-machine violations that could
 **not** be safely landed from a chat session. Companion to
@@ -7,7 +14,7 @@ Sequenced, operator-applied plan for the state-machine violations that could
 
 Author date: 2026-07-08. All facts below were read from the **live** project
 `Clinical KB Database` (`sjrfecxgysukkwxsowpy`) via read-only `execute_sql`;
-nothing here was applied to live at author time. **Status refresh 2026-07-09:** July 8 migrations are merged to `main` but pending live apply — see [`docs/operator-apply-july8-batch.md`](operator-apply-july8-batch.md). Function bodies are quoted from
+nothing here was applied to live at author time. **Historical status (2026-07-09):** July 8 migrations were merged to `main` but pending live apply — see [`docs/operator-apply-july8-batch.md`](operator-apply-july8-batch.md). Function bodies are quoted from
 `pg_get_functiondef` so migrations are derived from live truth, not `schema.sql`
 (which is known-drifted — see R24e and `docs/database-drift-detection.md`).
 
@@ -18,10 +25,10 @@ nothing here was applied to live at author time. **Status refresh 2026-07-09:**
   `src/lib/storage-cleanup-safety.ts`) and **R1 lease heartbeat**
   (`shouldPersistJobProgress` in `src/lib/ingestion.ts`, worker refresh of
   `locked_at`) — merged (PR #369).
-- **R1/R2/R7/R9/R23 RPC hardening** — migration `20260708130000` merged (PR #380); **pending live apply**.
-- **R24e** — phantom `ingestion_job_stages.job_id` FK dropped from `schema.sql` (PR #380 batch); **pending live apply** (no-op on live).
-- **R17** — partial unique index + reindex-route 409 handling merged (PR #405); migration `20260708170000` — **pending live apply** (normal `db push` when queue quiet).
-- **R5** — metadata deep-merge RPC + worker merged (PR #408); **pending live apply** + worker redeploy.
+- **R1/R2/R7/R9/R23 RPC hardening** — migration `20260708130000` merged (PR #380) and applied live.
+- **R24e** — phantom `ingestion_job_stages.job_id` FK dropped from `schema.sql` (PR #380 batch); live apply was a no-op as expected.
+- **R17** — partial unique index + reindex-route 409 handling merged (PR #405); migration `20260708170000` applied live.
+- **R5** — metadata deep-merge RPC + worker merged (PR #408); migration applied live; worker redeploy remains an operator action.
 
 ## Still open (not merged or needs design)
 

@@ -1,5 +1,9 @@
 # Clinical KB Production Readiness Checklist (Executable Today)
 
+**Status: reusable release-candidate checklist, not an outstanding-task ledger.** Live/provider-gated
+actions and their current status are tracked only in [`operator-backlog.md`](operator-backlog.md).
+Unchecked boxes below are rerun per release candidate; they do not imply abandoned repository work.
+
 This is the runbook to make the app publishable in one focused pass.
 
 Last reviewed: 2026-07-10. Applies to any feature branch or release candidate.

@@ -1,5 +1,9 @@
 # Project Alignment Cleanup
 
+**Status: complete (reconciled 2026-07-15).** This is a historical record of the June alignment pass,
+not an active cleanup backlog. Current dependency work is routed through the `dependency` shortcut;
+current operational work is tracked in [`operator-backlog.md`](operator-backlog.md).
+
 ## Dependency decisions
 
 - Updated direct runtime and development dependencies to their current compatible releases as part of the June 2026 alignment pass.

@@ -2,7 +2,10 @@
 
 **System:** Clinical KB Database. Users upload arbitrary PDF/DOCX; the worker OCRs, chunks, embeds, and enriches them; at query time an LLM composes cited clinical answers from the retrieved text.
 **Threat actor:** whoever controls the _content_ of an ingested document — the pixels of an embedded image, the body text, the file name, the title. Documents are **owner-scoped** ([`owner-scope.ts`](../src/lib/owner-scope.ts)), so this is not a cross-tenant attack; the realistic entry points are (a) a clinician/admin socially-engineered into uploading a tampered "official" guideline, (b) an org bulk-importing an untrusted/scraped source, and (c) non-malicious OCR corruption that mimics an attack. The blast radius is intra-org (everyone who queries that topic in that corpus).
-**Status:** Analysis only. No product code changed. Mitigations are proposed, not implemented — a later change will act on them.
+**Status:** Maintained threat model. The opening analysis records the original 2026-07-12 baseline;
+sections 6–8 record the mitigations subsequently implemented, the deliberately deferred architectural
+items, and their evidence gates. Do not treat the original `MISS`/`currently FAILS` labels as current
+without checking those implementation-status sections.
 **Companion:** [`docs/clinical-hazard-analysis.md`](clinical-hazard-analysis.md) frames these as patient-harm hazards (H6).
 
 ---

@@ -1,4 +1,7 @@
-# Deferred Items
+# Resolved Deferred Items
+
+**Status: closed (reconciled 2026-07-15).** Every item in this file is resolved. The original notes
+remain only as design-history context; this file is not an active backlog.
 
 ## 0. Tools page redesign (resolved June 23, 2026)