docs(ledger): record 24-hour merged-window regression audit at ef042cacd

[BigSimmo]

Summary

• Records the integrated post-merge regression audit of the full 24-hour merged window on main (d1937d78e..ef042ca08, ~30 PRs) in docs/branch-review-ledger.md, per the repo's review-ledger protocol.
• Audit outcome: no P0/P1 regression at the merged tip. One confirmed P2 (settings surface presents jurisdiction/population/answer-style/landing/home-content/compact-citations/notification preferences as live controls with no consumer — only density/motion and theme are functional), one plausible P2/P3 (AuthProvider initial getUser() round-trip resolves a valid stored session to signed_out on transient network failure), one P3 (/medications legacy redirect drops the query string). Cleared items and the full evidence trail are in the ledger row.
• Docs-only change; no product runtime, clinical behavior, or configuration is modified.

Verification

• Full unit suite at the audited tip after npm ci: typecheck clean, Vitest 2828 passed / 1 failed / 2 skipped — the sole failure is the long-baselined container-only tests/pdf-extraction-budget.test.ts artifact (hosted-CI-green through feat(pwa): retirement kill-switch, offline-version binding guard, and dev teardown flag #826/feat(pwa): manifest launch/display fallbacks, monochrome icons, iOS install hint #835/feat(pwa): align the offline page with the permanent colour direction #872/perf(services): keep the services snapshot out of the client route chunk #890).
• First verify:cheap run passed every static guard (runtime, actions-pin, ci-scope, ci-triage, pr-policy, sitemap, brand, type-scale, icon-scale, function-grants, owner-scope, lint).
• Verification not run: npm run verify:pr-local full gate — this PR is a single ledger-row docs change with no runtime surface; the audited evidence above was gathered against the identical tree content.
• UI verification not run: docs-only change.

Risk and rollout

• Risk: None — appends one audit-history row to the review ledger.
• Rollback: Revert the single docs commit.
• Provider or production effects: None. No OpenAI, Supabase, deployment, or provider-backed check ran during the audit.

Clinical Governance Preflight

Not applicable — docs-only ledger row; no ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output change.

Notes

• The audit findings themselves (inert settings controls, auth-init network-failure handling, /medications redirect query drop) are reported for human decision; no fixes are included in this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LxzDsyr6FXLG1zcuLGyFsf

---

Generated by Claude Code

Summary by CodeRabbit

• Documentation
  • Added a review record for the July 19, 2026 merged window.
  • Documented regression audit results, including confirmed and potential lower-severity issues.
  • Recorded verified fixes and checks across workflows, policies, accessibility, cancellation handling, and audit signals.
  • Noted container environment limitations and the remaining container-only test failure.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a 2026-07-19 origin/main 24-hour post-merge regression audit entry to the branch review ledger, including findings, cleared checks, environment notes, and test status.

Changes

Review ledger update

Layer / File(s)	Summary
Post-merge audit record docs/branch-review-ledger.md	Adds the dated audit outcome, documented P2/P3 findings, cleared verification items, container staleness notes, required commands, and the remaining container-only test failure.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• BigSimmo/Database#903: Updates the same ledger for the 2026-07-19 post-merge review window.
• BigSimmo/Database#852: Adds a related origin/main merge-closure verification entry.
• BigSimmo/Database#870: Extends the same dated review-record ledger structure.

Suggested labels: codex

Suggested reviewers: claude, copilot

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the docs-only merged-window regression audit ledger update.
Description check	✅ Passed	The description matches the template with summary, verification, risk/rollback, governance notes, and explicit non-runs where applicable.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/audit-recent-changes-kde66i

---

_{Comment @coderabbitai help to get the list of available commands.}

[BigSimmo]

@copilot resolve the merge conflicts on this branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8570c6abd0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/branch-review-ledger.md`:
- Line 623: Update the 2026-07-19 row in the branch ledger so its branch/ref
cell contains only the machine-readable reference origin/main. Move the
audit-window description, regression findings, environment notes, and
verification results into the appropriate scope/outcome columns, ensuring
slash-delimited prose such as P0/P1, P2/P3, ButtonFace/ButtonText, and
codex-autofix/pr-policy is not present in the branch/ref cell.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1eb121b4-c7a2-428c-a69b-6d95a5195eef

📥 Commits

Reviewing files that changed from the base of the PR and between 4034d2e and 063dee5.

📒 Files selected for processing (1)

• docs/branch-review-ledger.md

[coderabbitai]

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

Keep prose out of the branch/ref cell.

scripts/sweep-branch-ledger.mjs parses every slash-delimited token in this cell as a branch reference. This row therefore adds false branch names such as P0/P1, P2/P3, ButtonFace/ButtonText, and codex-autofix/pr-policy, not just origin/main. Keep the branch/ref cell machine-readable and move the audit-window prose into the scope/outcome columns.

Proposed fix

-| 2026-07-19 | origin/main 24-hour merged window (d1937d78e..ef042cacd, ~30 PRs incl. `#853/`#859/#861/#865/#868/#871–#874/#879/#885–#888/#890–#894/#896) | ef042cacd | ...
+| 2026-07-19 | origin/main | ef042cacd | ... 24-hour merged window (d1937d78e..ef042cacd, ~30 PRs incl. `#853/`#859/#861/#865/#868/#871–#874/#879/#885–#888/#890–#894/#896) ... |

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

| 2026-07-19 | origin/main 24-hour merged window (d1937d78e..ef042cacd, ~30 PRs incl. #853/#859/#861/#865/#868/#871–#874/#879/#885–#888/#890–#894/#896) | ef042cacd | integrated post-merge regression audit of the full 24h window (code review + design/performance/defect angles) | No P0/P1 regression found at the merged tip. One confirmed P2: the new settings surface (`use-app-preferences.ts` + `settings-dialog.tsx`) presents jurisdiction, population, answer-style, landing, home-content, compact-citations, and all notification preferences as live controls, but no consumer reads them — only density/motion (html attributes + globals.css) and theme are functional; a clinician selecting "Conservative" answer style reasonably but wrongly believes generation changed. One plausible P2/P3: `AuthProvider.initializeSession` now requires a live `getUser()` round-trip, so a transient network failure on load resolves a valid stored session to signed_out (INITIAL_SESSION replay is also skipped); the deliberate stale/tampered-token defense does not distinguish retryable network errors. One P3: `/medications` legacy redirect drops the query string while `/applications` and `/differentials/presentations` preserve theirs. Cleared after inspection: worker image-placement dedupe (key symmetric on both sides), title-word purge/scope migration (matches its replayed review), RPC-layer-only cancellation consolidation (intentional per PR #861), services route-chunk fix intact with no other heavy client value-imports (type-only imports verified), forced-colors ButtonFace/ButtonText flip, codex-autofix/pr-policy workflow changes conform to AGENTS.md (pin retained, rename-aware routing, workflow_sha checkout), audit-metadata allowlist exhaustive over the closed AuditAction union, answer-stream merged abort signals. Environment note (not a repo defect): the session-start hook skips `npm install` when node_modules exists, so this window's dependency bumps left the container stale and `verify:cheap` failed at typecheck until `npm ci`; the hook should compare a lockfile hash. | `npm ci` then typecheck clean and full Vitest 2828 passed / 1 failed / 2 skipped — the sole failure is the long-baselined container-only `tests/pdf-extraction-budget.test.ts` artifact (hosted-CI-green through #826/#835/#872/#890). First `verify:cheap` run passed every static guard (runtime, actions-pin, ci-scope, ci-triage, pr-policy, sitemap, brand, type-scale, icon-scale, function-grants, owner-scope, lint) before the stale-deps typecheck stop. No OpenAI, Supabase, deployment, or provider-backed check ran. |

| 2026-07-19 | origin/main | ef042cacd | integrated post-merge regression audit of the full 24h merged window (d1937d78e..ef042cacd, ~30 PRs incl. `#853/`#859/#861/#865/#868/#871–#874/#879/#885–#888/#890–#894/#896) (code review + design/performance/defect angles) | No P0/P1 regression found at the merged tip. One confirmed P2: the new settings surface (`use-app-preferences.ts` + `settings-dialog.tsx`) presents jurisdiction, population, answer-style, landing, home-content, compact-citations, and all notification preferences as live controls, but no consumer reads them — only density/motion (html attributes + globals.css) and theme are functional; a clinician selecting "Conservative" answer style reasonably but wrongly believes generation changed. One plausible P2/P3: `AuthProvider.initializeSession` now requires a live `getUser()` round-trip, so a transient network failure on load resolves a valid stored session to signed_out (INITIAL_SESSION replay is also skipped); the deliberate stale/tampered-token defense does not distinguish retryable network errors. One P3: `/medications` legacy redirect drops the query string while `/applications` and `/differentials/presentations` preserve theirs. Cleared after inspection: worker image-placement dedupe (key symmetric on both sides), title-word purge/scope migration (matches its replayed review), RPC-layer-only cancellation consolidation (intentional per PR `#861`), services route-chunk fix intact with no other heavy client value-imports (type-only imports verified), forced-colors ButtonFace/ButtonText flip, codex-autofix/pr-policy workflow changes conform to AGENTS.md (pin retained, rename-aware routing, workflow_sha checkout), audit-metadata allowlist exhaustive over the closed AuditAction union, answer-stream merged abort signals. Environment note (not a repo defect): the session-start hook skips `npm install` when node_modules exists, so this window's dependency bumps left the container stale and `verify:cheap` failed at typecheck until `npm ci`; the hook should compare a lockfile hash. | `npm ci` then typecheck clean and full Vitest 2828 passed / 1 failed / 2 skipped — the sole failure is the long-baselined container-only `tests/pdf-extraction-budget.test.ts` artifact (hosted-CI-green through `#826/`#835/#872/#890). First `verify:cheap` run passed every static guard (runtime, actions-pin, ci-scope, ci-triage, pr-policy, sitemap, brand, type-scale, icon-scale, function-grants, owner-scope, lint) before the stale-deps typecheck stop. No OpenAI, Supabase, deployment, or provider-backed check ran. |

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/branch-review-ledger.md` at line 623, Update the 2026-07-19 row in the
branch ledger so its branch/ref cell contains only the machine-readable
reference origin/main. Move the audit-window description, regression findings,
environment notes, and verification results into the appropriate scope/outcome
columns, ensuring slash-delimited prose such as P0/P1, P2/P3,
ButtonFace/ButtonText, and codex-autofix/pr-policy is not present in the
branch/ref cell.