[codex] Update clinical guide for Node 24

.github/workflows/ci.yml

@@ -24,12 +24,20 @@ jobs:
           node-version-file: ".nvmrc"
           cache: npm
 
+      - name: Setup Deno
+        uses: denoland/setup-deno@v2
+        with:
+          deno-version: v2.x
+
       - name: Install dependencies
         run: npm ci
 
       - name: Runtime alignment
         run: npm run check:runtime
 
+      - name: Edge function typecheck
+        run: npm run check:edge:functions
+
       - name: Production readiness (CI-safe)
         run: npm run check:production-readiness:ci
 

.gitignore

@@ -40,6 +40,7 @@ dev-server*.log
 
 # generated sample uploads
 /sample-documents/
+/tmp/
 
 # python
 __pycache__/

README.md

@@ -7,8 +7,8 @@ questions with source citations that link back to the original PDF/document.
 
 ## Setup
 
-1. Use Node.js 24.x. CI runs on Node 24, and `.nvmrc` / `.node-version`
-   pin the same runtime for local version managers.
+1. Use Node.js 24.x with npm 11.x. CI runs on Node 24, and `.nvmrc` /
+   `.node-version` pin the same runtime for local version managers. CI also runs `npm run check:edge:functions`, which requires Deno v2.x.
 2. Copy `.env.example` to `.env.local` and fill in Supabase and OpenAI values.
 3. Confirm the Supabase target:
 
@@ -30,13 +30,17 @@ demo mode if that stale ref appears in `.env.local`.
 
 4. Run `supabase/schema.sql` in the `Clinical KB Database` Supabase project SQL
    editor.
-5. Install optional PDF/OCR worker dependencies:
+5. Install Deno v2.x to run Edge Function type checks (`npm run check:edge:functions`).
+   CI installs Deno automatically via `denoland/setup-deno`. For local use, follow the
+   [Deno installation guide](https://docs.deno.com/runtime/getting_started/installation/)
+   and ensure `deno --version` reports a 2.x release.
+6. Install optional PDF/OCR worker dependencies:
 
 ```bash
 python -m pip install -r worker/python/requirements.txt
 ```
 
-6. Start the app:
+7. Start the app:
 
 ```bash
 npm run dev

docs/process-hardening.md

@@ -33,8 +33,9 @@ This document turns the current process review into phased, durable repo practic
 
 ## Phase 4 - Release maturity
 
-- `npm run check:runtime` is the strict release runtime gate and is now part of `npm run verify:release`; it fails outside Node 24.x.
-- CI runs `npm run check:runtime` after dependency install so branch verification cannot silently drift to Node 25+.
+- `npm run check:runtime` is the strict runtime gate and is now part of `npm run verify:cheap`, `npm run verify:ui`, and `npm run verify:release`; it fails outside Node 24.x or npm 11.x when run through npm.
+- CI runs `npm run check:runtime` after dependency install so branch verification cannot silently drift away from Node 24.
+- `npm run check:edge:functions` is the Deno type gate for the Supabase `indexing-v3-agent` Edge Function.
 - Decide whether CI should run all Playwright browser projects on protected branches, release branches, or a scheduled workflow instead of every push.
 - Add explicit review ownership for clinical source governance, outdated-source handling, incident review, and decommission decisions.
 - Record production-readiness outcomes in release notes whenever clinical workflow, source governance, privacy, or deployment assumptions change.

docs/production-readiness-checklist.md

@@ -3,7 +3,7 @@
 This is the runbook to make the app publishable in one focused pass.
 
 - Branch: `codex/premium-redesign` (do not touch `.env` / secrets directly).
-- Runtime target: Next.js 16.2.7, Node 24.x, npm >= 11.
+- Runtime target: Next.js 16.2.9, Node 24.x, npm 11.x.
 - Supabase target: `sjrfecxgysukkwxsowpy` (`Clinical KB Database`).
 
 ## Immediate completion targets
@@ -21,7 +21,7 @@ This is the runbook to make the app publishable in one focused pass.
   - used in CI and non-blocking on local-only secret absence.
 - [x] Added strict runtime release gate:
   - `npm run check:runtime`
-  - enforces Node 24.x before `npm run verify:release`.
+  - enforces Node 24.x and npm 11.x before broad local and release verification.
 
 ## Remaining high-priority publish items (same day)
 

docs/project-alignment-cleanup.md

@@ -18,7 +18,7 @@
 
 - CI verifies the project on Node.js 24, so local development should also use Node.js 24.x.
 - `.nvmrc`, `.node-version`, and `package.json` `engines` all declare the Node 24 runtime expectation.
-- New cleanup or dependency work should be verified on Node 24 before release, even when local shells happen to use newer Node versions.
+- New cleanup or dependency work should be verified on Node 24 before release, even when local shells happen to use a different Node version.
 
 ## Stale branch audit
 

docs/redesign/06-verification.md

@@ -51,7 +51,7 @@ Unverified or limited:
 | Lint             | `npm run lint` (eslint 9.39.4)                                  | ✅ pass, no warnings |
 | Smoke (chromium) | `npx playwright test tests/ui-smoke.spec.ts --project=chromium` | ✅ **22/22 pass**    |
 
-Clean-install caveat resolved in the reconciliation branch: `eslint` was pinned back to the latest compatible 9.x range because `eslint-config-next@16.2.7` pulls `eslint-plugin-react@7.37.5`, whose peer range supports ESLint 9 but not ESLint 10. `npm ci` now completes and `npm run lint` passes under Node 22.22.3.
+Clean-install caveat resolved in the reconciliation branch: `eslint` was pinned back to the latest compatible 9.x range because `eslint-config-next@16.2.9` pulls `eslint-plugin-react@7.37.5`, whose peer range supports ESLint 9 but not ESLint 10. The current runtime target is Node 24.x.
 
 ## 2. Smoke detail
 

docs/supabase-migration-reconciliation.md

@@ -0,0 +1,31 @@
+# Supabase Migration Reconciliation
+
+Last reviewed: 2026-06-27
+
+Target project: Clinical KB Database (`sjrfecxgysukkwxsowpy`)
+
+## Policy
+
+- Do not use `supabase db push` while local and remote migration history are divergent.
+- Use `supabase migration repair --linked --status applied <version>` only when live database evidence proves the migration effect already exists.
+- Leave all other local-only migrations unrepaired until their effects are verified or deliberately applied.
+
+## Verified Applied
+
+These versions are safe to mark applied in Supabase migration history:
+
+- `20260625033425` - `document_strict_gate_status` exists, `repair_strict_enrichment_gate_batch(integer)` exists, service role can read/execute, and anon cannot read/execute.
+- `20260625033944` - `complete_strict_enrichment_job(uuid, uuid, text, text, text)` exists, service role can execute, and anon cannot execute.
+- `20260626000000` - duplicate index `ingestion_job_stages_doc_idx` is absent and canonical index `ingestion_job_stages_document_started_idx` exists.
+
+## Skipped
+
+All other local-only migrations from `supabase migration list --linked` remain unrepaired until they are individually verified. This includes older search/retrieval/API-rate-limit migrations and the current `20260626020000` retrieval RPC performance migration.
+
+## Verification Commands
+
+```powershell
+npx supabase migration list --linked
+npx supabase db advisors --linked
+npx supabase db query --linked "select to_regclass('public.document_strict_gate_status') as gate_view, to_regprocedure('public.repair_strict_enrichment_gate_batch(integer)') as repair_rpc, to_regprocedure('public.complete_strict_enrichment_job(uuid, uuid, text, text, text)') as complete_rpc, to_regclass('public.ingestion_job_stages_doc_idx') as duplicate_index, to_regclass('public.ingestion_job_stages_document_started_idx') as canonical_stage_index;"
+```

mockups/README.md

@@ -6,11 +6,16 @@ This folder collects the current mockup files for the Clinical KB Database proje
 
 - `favourites-hub/page.tsx` - copied from `src/app/mockups/favourites-hub/page.tsx`
 - `medication-prescribing/page.tsx` - copied from `src/app/mockups/medication-prescribing/page.tsx`
+- `answer-evidence-popups/page.tsx` - copied from `src/app/mockups/answer-evidence-popups/page.tsx`
+- `user-home-profile/page.tsx` - copied from `src/app/mockups/user-home-profile/page.tsx`
+- `mode-dropdown` - runnable mockup only, in `src/app/mockups/mode-dropdown/page.tsx`
 
 ## App routes
 
 The runnable versions remain in the Next.js app route tree:
 
 - `/mockups/favourites-hub`
 - `/mockups/medication-prescribing`
-
+- `/mockups/answer-evidence-popups`
+- `/mockups/user-home-profile`
+- `/mockups/mode-dropdown`