fix: remediate 2026-07-19 audit findings (inert settings, offline auth, redirect query)

[BigSimmo]

Summary

• Remediates all three findings from the 2026-07-19 24-hour merged-window audit (ledger row ef042cacd, landed via docs(ledger): record 24-hour merged-window regression audit at ef042cacd #904):
  1. Inert settings honesty (P2, confirmed): every preference the app does not yet consume — jurisdiction, population, answer style, default landing view, both home-content toggles, compact citations, and all three notification toggles — now renders an explicit "Saved for later — not active yet" badge in settings-dialog.tsx. The functional appearance/density/motion rows stay unmarked. Wiring these preferences into answer generation was deliberately not done here — that is a clinical-behavior change requiring governance review; the new dom test documents the exact contract for flipping a control live later.
  2. Offline auth resolution (P2/P3, plausible): resolveInitialAuthState gains a verificationUnavailable input, set from isAuthRetryableFetchError(getUser().error). An unreachable auth server (offline/flaky load) no longer silently drops a valid stored session to signed-out, while a reachable server that rejects the token still resolves signed-out (the stale/tampered-token defense is unchanged). Server-side bearer validation on every API route is untouched.
  3. /medications redirect (P3): now preserves the sanitized q/focus/run search context, using the same allowlist as the root legacy-mode redirect, so bookmarked /medications?q=… links keep their query.
• Also appends the remediation row to docs/branch-review-ledger.md.

Verification

• Focused Vitest 30/30: settings-inert-preferences.dom.test.tsx (new — locks exactly which rows carry the marker), private-client-auth.test.ts (3 new resolution cases), audit-navigation-auth-regressions.test.ts (new query-preservation case), app-preferences.test.ts, site-map.test.ts.
• Full local verify:cheap at this head: every static guard (runtime, actions-pin, ci-scope, ci-triage, pr-policy, sitemap, brand, type-scale, icon-scale, function-grants, owner-scope), lint, and typecheck passed; unit suite 2881 passed / 2 skipped with the sole failure being the long-baselined container-only tests/pdf-extraction-budget.test.ts artifact (fails identically on clean main in this container; hosted CI green on it throughout feat(pwa): retirement kill-switch, offline-version binding guard, and dev teardown flag #826–docs(ledger): record 24-hour merged-window regression audit at ef042cacd #904).

UI verification not run: the settings change adds a static badge to existing rows (ui-smoke asserts row visibility only, unaffected); the blocking hosted Production UI job covers this head in CI.

Risk and rollout

• Risk: Low. The auth change only widens the initial-resolution fallback for the network-unreachable case; token-rejection behavior and server-side validation are unchanged. The settings change is presentational. The redirect change only adds sanitized query passthrough.
• Rollback: Revert the single commit.
• Provider or production effects: None. No OpenAI, Supabase, deployment, or provider-backed check ran.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• No clinical decision-support behavior changed in this PR: the inert controls are now explicitly labeled as inactive rather than implying behavior change, which is why the SaMD check above holds without a classification change.
• The honest-labeling approach (rather than wiring preferences into the answer pipeline) keeps this PR out of clinical-behavior territory; wiring individual preferences up is a follow-up product decision per preference.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LxzDsyr6FXLG1zcuLGyFsf

Summary by CodeRabbit

• New Features

  • Settings now clearly label preferences that are saved for later and not yet active, with improved accessibility support.
  • Medication page redirects preserve relevant, sanitized search context and prescribing options.

• Bug Fixes

  • Stored sessions remain signed in when authentication verification is temporarily unavailable.
  • Reachable authentication failures still correctly sign users out.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 40eadb51-9f2e-45f0-81cb-52a8f52f754d

📥 Commits

Reviewing files that changed from the base of the PR and between e377ab1 and f53a303.

📒 Files selected for processing (7)

• docs/branch-review-ledger.md
• src/app/medications/route.ts
• src/components/clinical-dashboard/settings-dialog.tsx
• src/lib/supabase/client.tsx
• tests/audit-navigation-auth-regressions.test.ts
• tests/private-client-auth.test.ts
• tests/settings-inert-preferences.dom.test.tsx

---

📝 Walkthrough

Walkthrough

Changes

Audit remediation

Layer / File(s)	Summary
Inert settings markers src/components/clinical-dashboard/settings-dialog.tsx, tests/settings-inert-preferences.dom.test.tsx	Inert preference controls display a “Saved for later — not active yet” marker and reference it with aria-describedby; tests cover marker presence and accessibility behavior.
Unavailable auth verification src/lib/supabase/client.tsx, tests/private-client-auth.test.ts	Retryable verification failures preserve stored authenticated sessions, while reachable token rejection remains signed out.
Medication redirect context src/app/medications/route.ts, tests/audit-navigation-auth-regressions.test.ts, docs/branch-review-ledger.md	The medication redirect preserves sanitized q, focus, and run parameters alongside prescribing mode, with regression coverage and ledger documentation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• BigSimmo/Database#719: Adds a related branch review ledger entry.
• BigSimmo/Database#746: Also updates settings dialog field and control wiring.
• BigSimmo/Database#904: Documents the same audit findings addressed here.

Suggested labels: codex

Suggested reviewers: claude

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main audit remediation across settings, auth, and redirect behavior.
Description check	✅ Passed	The description follows the required template with summary, verification, risk, governance, and notes, and is mostly complete.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/audit-recent-changes-kde66i

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bde4c3a220

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: bde4c3a220

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[BigSimmo]

@copilot resolve the merge conflicts in this pull request

[Copilot]

@copilot resolve the merge conflicts in this pull request

The merge conflicts have already been resolved. The merge commit f53a303 successfully integrated changes from main (PR #905) into this branch. The conflict in docs/branch-review-ledger.md has been properly resolved with rows 624-625 from main now correctly positioned before row 626 from this branch.