fix: resolve design-audit regression hardening for merge

docs/branch-review-ledger.md

@@ -28,6 +28,7 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-17 | PR #738 / cursor/storage-bucket-migration-02e7 | b2755c814b47cdec6868bd009f3ca1cdbc3a7dea | open-PR review + merge babysit | Merge-ready storage-bucket idempotent migration + PR-policy base_ref checkout. Comment clarified for on-conflict reconciliation. Duplicate #710 closed. Merged to main. | Hosted required checks + Migration replay green; review thread resolved. |
 | 2026-07-17 | PR #739 / cursor/pwa-optimization-merge-02e7 | 0d4aa5c73a4ff30274bb6286be04465286c815d7 | open-PR review + privacy fix + merge babysit | P1 fixed: removed backdated RAG migrations/schema seed that would regress public-only title corrector privacy. Also fixed sitemap API/redirect classification, services RightRail remount, focus=1 mode-menu flake, and merge conflict markers. Supersedes #735/#721. Merged to main. | Hosted full CI green including Production UI/Migration replay after fixes; unresolved CodeRabbit threads resolved. No OpenAI/Supabase writes. |
 | 2026-07-17 | PR batch #732-#739 (screenshot queue) | 1ab611915e0630a527a533ee7ff16b82fd3e8982 | multi-PR merge babysit summary | Merged in order: #738, #733, #737, #732, #736, #739. #735 left open (token cannot close; CONFLICTING/superseded by #739). #710/#721 closed as duplicates. Residual: close #735 manually. | Hosted CI babysit + merge-tree; #739 Production UI flake fixed and re-verified green before merge. |
+| 2026-07-17 | codex/ci-answer-progress-regression                   | bfa0ed3dfc69d5b333ba43479023cb9a8e8925d3 | CI verification gap                                        | Fixed: the production answer-progress Playwright journey was excluded by both top-level and Chromium project matchers, while its filename also skipped the CI UI trigger; its assertions could therefore change without the required UI job executing. | Local static inspection of `playwright.config.ts`, `scripts/ci-change-scope.mjs`, Vitest globs, and CI workflow; classifier self-test confirms the journey now sets `ui_changed=true`. Focused Playwright execution reached the isolated Next build but was blocked by unavailable Google font downloads; no hosted CI or provider-backed checks run. |
 
 | 2026-07-17 | PR #635 / claude/github-actions-codex-issue-f4t4s5       | ab09a8d52cc0a8a7e71b37885aaa358aae2522c8 | post-merge merge-readiness review                          | Already squash-merged to main on 2026-07-14 by BigSimmo. No open review threads or inline comments. CI required checks all green (Change scope, Static PR checks, Safety and config checks, Unit coverage, PR required, Semgrep, Gitleaks, GitGuardian); UI/build/migration jobs correctly skipped. Landed diff is test/guard hardening only for missing `CODEX_TRIGGER_TOKEN` graceful skip. No high-confidence P0-P2 defect. Source branch already deleted. No further merge action needed.                                                                                                                                                                      | Hosted CI status via `gh pr checks 635` (all required pass); local `node scripts/check-codex-autofix-workflow.mjs` pass; focused Vitest `tests/codex-autofix-workflow.test.ts` 41/41. No OpenAI/Supabase/provider writes.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | 2026-07-17 | PR #718 / codex/performance-latency-remediation-20260717 | b5f509744d4f4bac74d414644cd1802f64b97fa9 | CodeRabbit performance and SQL correctness follow-up       | Resolved nine confirmed findings and dispositioned one stale test comment: document downloads revalidate signed URLs on every action; committed-generation filtering precedes detail pagination; enrichment fallback errors preserve identity; caller cancellation leaves the shared classifier flight alive; registry seeding preserves its cache signal; aliases emit canonical corrections; rate-limit success metadata is coherent; ambiguous upserts use named constraints; and grantable default ACLs fail closed. The proxy mock duplicate was not present. No remaining high-confidence P0-P2 defect was found.                                            | Integrated focused Vitest 122/122; post-format Vitest 71/71; `npm run verify:cheap` passed runtime/policy/static guards, ESLint, TypeScript, and 2,684/2,684 tests; focused Prettier and `git diff --check`; disposable Docker replay, regenerated drift manifest, and transactional local SQL probes. No OpenAI calls, live Supabase DDL/migration/data write, deployment, or production mutation ran.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |

docs/codebase-index.md

@@ -68,17 +68,19 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map
 
 ### API routes (`src/app/api/`)
 
-| Area        | Routes                                                                  | Entry files                                                     |
-| ----------- | ----------------------------------------------------------------------- | --------------------------------------------------------------- |
-| Answers     | `/api/answer`, `/api/answer/stream`, `/api/answer-feedback`             | `answer/route.ts`, `answer/stream/route.ts`, `answer-feedback/` |
-| Search      | `/api/search`, `/api/search/interaction`                                | `search/`                                                       |
-| Upload      | `/api/upload`                                                           | `upload/route.ts`                                               |
-| Documents   | CRUD, bulk, reindex, labels, search, summarize, table-facts, signed-url | `documents/`                                                    |
-| Ingestion   | batches, jobs, retry, quality                                           | `ingestion/`                                                    |
-| Registry    | records CRUD                                                            | `registry/records/`                                             |
-| Images      | signed URLs                                                             | `images/[id]/signed-url/route.ts`                               |
-| Ops         | health, setup-status, local-project-id                                  | `health/`, `setup-status/`, `local-project-id/`                 |
-| Eval / jobs | eval cases, job state                                                   | `eval-cases/`, `jobs/`                                          |
+| Area          | Routes                                                                                                              | Entry files                                                     |
+| ------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- |
+| Answers       | `/api/answer`, `/api/answer/stream`, `/api/answer-feedback`                                                         | `answer/route.ts`, `answer/stream/route.ts`, `answer-feedback/` |
+| Search        | `/api/search`, `/api/search/interaction`, `/api/search/universal`                                                   | `search/`                                                       |
+| Upload        | `/api/upload`                                                                                                       | `upload/route.ts`                                               |
+| Documents     | `/api/documents`, `/api/documents/[id]`, bulk/reindex, labels, reviews, search, signed URLs, summaries, table facts | `documents/`                                                    |
+| Differentials | `/api/differentials`, `/api/differentials/[slug]`, `/api/differentials/presentations/[slug]`                        | `differentials/`                                                |
+| Medications   | `/api/medications`, `/api/medications/[slug]`                                                                       | `medications/`                                                  |
+| Ingestion     | `/api/ingestion/batches`, `/api/ingestion/jobs`, retry, quality                                                     | `ingestion/`                                                    |
+| Registry      | `/api/registry/records`, `/api/registry/records/[slug]`                                                             | `registry/records/`                                             |
+| Images        | `/api/images/[id]/signed-url`                                                                                       | `images/[id]/signed-url/route.ts`                               |
+| Ops           | `/api/health`, `/api/health/ready`, `/api/setup-status`, `/api/local-project-id`                                    | `health/`, `setup-status/`, `local-project-id/`                 |
+| Eval / jobs   | `/api/eval-cases`, `/api/jobs`                                                                                      | `eval-cases/`, `jobs/`                                          |
 
 ---
 
@@ -151,12 +153,12 @@ Structured map for AI agents and onboarding. For live routes, see `docs/site-map
 
 - **CLI:** `supabase/config.toml` — `indexing-v3-agent` function, `verify_jwt = false`
 - **Schema mirror:** `supabase/schema.sql` (reference; migrations are source of truth)
-- **Migrations:** `supabase/migrations/*.sql` (~90 files, May–Jul 2026)
+- **Migrations:** `supabase/migrations/*.sql` (chronological source of truth; do not hardcode a count)
 - **Drift policy:** `docs/supabase-migration-reconciliation.md`
 
-### Core tables
+### Schema tables
 
-`documents`, `document_pages`, `document_images`, `document_chunks`, `document_embedding_fields`, `document_index_units`, `document_table_facts`, `document_labels`, `document_summaries`, `document_sections`, `document_memory_cards`, `document_index_quality`, `ingestion_jobs`, `ingestion_job_stages`, `indexing_v3_agent_jobs`, `import_batches`, `rag_queries`, `rag_query_misses`, `rag_aliases`, `rag_response_cache`, `rag_retrieval_logs`, `clinical_registry_records`, `api_rate_limits`, `audit_logs`, `storage_cleanup_jobs`
+`documents`, `document_pages`, `document_images`, `document_chunks`, `document_embedding_fields`, `document_index_units`, `document_table_facts`, `document_labels`, `document_summaries`, `document_sections`, `document_memory_cards`, `document_index_quality`, `document_title_words`, `ingestion_jobs`, `ingestion_job_stages`, `indexing_v3_agent_jobs`, `import_batches`, `image_caption_cache`, `rag_queries`, `rag_query_misses`, `rag_aliases`, `rag_response_cache`, `rag_retrieval_logs`, `rag_visual_eval_cases`, `rag_visual_eval_runs`, `rag_answer_feedback`, `clinical_registry_records`, `clinical_registry_record_sources`, `medication_records`, `differential_records`, `source_review_events`, `api_rate_limits`, `api_rate_limit_subjects`, `audit_logs`, `storage_cleanup_jobs`
 
 **Storage buckets:** `clinical-documents`, `clinical-images` (private)
 

docs/site-map.md

@@ -2,7 +2,7 @@
 
 This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check` to verify it is current.
 
-## Main product pages
+## Main product routes
 
 - `/` - Main Clinical KB shell. Source: `src/app/page.tsx`.
 - `/differentials` - Differentials home and search surface. Source: `src/app/differentials/page.tsx`.
@@ -802,6 +802,11 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `/mockups/universal-search-command` - Route discovered from app directory Source: `src/app/mockups/universal-search-command/page.tsx`.
 - `/mockups/universal-search-redesign` - Route discovered from app directory Source: `src/app/mockups/universal-search-redesign/page.tsx`.
 
+## Public utility route handlers
+
+- `/auth/callback` - Authentication callback handler. Source: `src/app/auth/callback/route.ts`.
+- `/icons/[variant]` - Dynamically generated application icon handler. Source: `src/app/icons/[variant]/route.tsx`.
+
 ## API routes
 
 - `/api/answer` - Generate answer response. Source: `src/app/api/answer/route.ts`.
@@ -841,10 +846,6 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `/api/setup-status` - Setup status. Source: `src/app/api/setup-status/route.ts`.
 - `/api/upload` - Upload endpoint. Source: `src/app/api/upload/route.ts`.
 
-## App route handlers
-
-- `/auth/callback` - Route discovered from app directory Source: `src/app/auth/callback/route.ts`.
-
 ## Redirects
 
 - `/applications` - Redirects to `/tools`. Source: `src/app/applications/route.ts`.

scripts/check-github-action-pins.mjs

@@ -1,4 +1,4 @@
-import { readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import path from "node:path";
 import { validateActionReference } from "./github-action-pins.mjs";
 import { yamlBlock } from "./yaml-contract.mjs";
@@ -10,10 +10,16 @@ const failures = [];
 const expectedSupabaseCliVersion = "2.108.0";
 const expectedSupabaseCliVersionPattern = expectedSupabaseCliVersion.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
-for (const fileName of readdirSync(workflowDir)
-  .filter((name) => /\.ya?ml$/i.test(name))
-  .sort()) {
-  const filePath = path.join(workflowDir, fileName);
+function discoverGitHubActionFiles(workflowRoot) {
+  const workflowDir = path.join(workflowRoot, ".github", "workflows");
+  if (!existsSync(workflowDir)) return [];
+  return readdirSync(workflowDir, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && /\.ya?ml$/i.test(entry.name))
+    .map((entry) => path.join(workflowDir, entry.name));
+}
+
+for (const filePath of discoverGitHubActionFiles(process.cwd())) {
+  const fileName = path.relative(process.cwd(), filePath).replaceAll("\\", "/");
   const lines = readFileSync(filePath, "utf8").split(/\r?\n/);
 
   lines.forEach((line, index) => {