Fix residual audit findings

docs/branch-review-ledger.md

@@ -630,3 +630,4 @@ Use this ledger to prevent repeated branch and PR reviews when the reviewed HEAD
 | 2026-07-19 | claude/audit-recent-changes-kde66i (audit-remediation follow-up to the ef042cacd audit row) | see PR head | remediation of the three 2026-07-19 audit findings | Fixed all three findings from the 24-hour merged-window audit. (1) Inert settings honesty (P2): every preference the app does not yet consume — jurisdiction, population, answer style, landing, both home-content toggles, compact citations, and all three notification toggles — now renders an explicit "Saved for later — not active yet" marker in `settings-dialog.tsx`; the functional appearance/density/motion rows stay unmarked. Wiring the preferences into answer generation was deliberately NOT done here (clinical-behavior change requiring governance review); the new dom test documents the contract for flipping a control live. (2) Auth offline resolution (P2/P3): `resolveInitialAuthState` gains `verificationUnavailable`, set from `isAuthRetryableFetchError(getUser().error)`, so an unreachable auth server keeps the stored session signed in while a reachable server that rejects the token still resolves signed_out; server-side bearer validation is unchanged. (3) `/medications` redirect (P3): now preserves the sanitized q/focus/run search context with the same allowlist as the root legacy-mode redirect. | Focused Vitest 30/30 across `settings-inert-preferences.dom` (new), `private-client-auth` (3 new cases), `audit-navigation-auth-regressions` (query-preservation case), `app-preferences`, and `site-map`. Full `verify:cheap` run recorded on the PR. No OpenAI, Supabase, deployment, or provider-backed check ran. |
 | 2026-07-19 | claude/audit-recent-changes-kde66i (preference wiring + session-start hook follow-up to the #906 remediation) | see PR head | wiring the wireable inert preferences live and fixing the stale-node_modules session-start gap | Wired three of the seven remaining inert preferences into real behavior and removed their "Saved for later" markers: (1) Default landing view — `GlobalSearchShellClient` applies a one-shot `router.replace` to the saved landing mode (`search`→documents, `browse`→tools via `landingModeForPreference`) on a bare "/" load only; explicit mode/query/run params always win, and the dashboard's existing URL-sync effect performs the switch. (2) Recent searches on home — `AnswerEmptyState` now gates its recent-query chips on `showRecentOnHome`. (3) Compact citations — the answer source capsule drops its text label to icon+count when `compactCitations` is on, with the "No direct source found" warning explicitly exempted so compact mode can never hide a missing-source signal. Still marked inactive with reasons documented in the test contract: jurisdiction/population/answer-style (wiring them into answer generation is provider-eval-gated per the confirmation boundary), saved-protocols-on-home (no protocols module exists), and the three notification toggles (no delivery infrastructure). Separately, `.claude/hooks/session-start.sh` now stamps the `package-lock.json` sha256 into `node_modules/.session-start-lock-hash` after `npm ci` and reinstalls when the lockfile no longer matches, closing the stale-container gap that faked a typecheck regression during the 24h audit. | New `tests/answer-preferences.dom.test.tsx` (recents gate on/off, compact capsule display incl. the missing-source exemption, landing mapping) and the updated `settings-inert-preferences.dom` contract (3 rows moved inert→functional) pass with `app-preferences` and `private-client-auth`: 26/26 focused. Full typecheck, scoped zero-warning ESLint, and the full Vitest suite recorded on the PR; `bash -n` on the hook. `check:production-readiness` not run: no secrets in this container (documented demo-mode expectation) and no answer-generation, retrieval, or source-governance logic changed — the capsule change is presentational with the missing-source warning locked by test. No OpenAI, Supabase, deployment, or provider-backed check ran. |
 | 2026-07-19 | main / `codex/supabase-database-review` | 4034d2e60ebb6616130ff17bf3cb69368f36f8f6 + reviewed working diff | live `Clinical KB Database` security, migration, schema-drift, integrity, and performance review | Confirmed and remediated private title-vocabulary exposure, applied the reviewed retrieval/audit/registry/title/rate-limit migrations, recovered and hardened the ingestion Edge Function to require POST plus a gateway-verified `service_role` claim, and restored the schema mirror and regression coverage. The review also documented the then-pending managed-role default-ACL repair and the intentional service-role-only table advisor. | Supabase project, migration, Edge Function, drift, advisor, ACL, index, Vault, post-apply, source-hash, and unauthenticated-rejection checks; focused schema/retrieval/Edge tests; offline RAG; function-grant guard; scoped lint, formatting, and `git diff --check`. Full PR-local and provider-backed follow-up gates were not run in that review task. |
+| 2026-07-19 | `codex/close-913-review-findings` / merged PR #913 residual threads | 8be909929db400651eecec277a0cd01379c9890c | targeted remediation and closure audit of the five unresolved current review findings left on PR #913 | Fixed all five findings: removed six legacy Therapy Compass duplicates and regenerated route artifacts; propagated summary cancellation through both Supabase reads; bounded fallback PDF images before decode with classified budget failures; retained semantic rerank scores when score explanations are absent; and preserved valid stored sessions on native retryable fetch failures. No additional unresolved current defect was found in the reviewed scope. | Focused Vitest passed 51 files / 635 tests; sitemap regression passed 6/6; final `verify:ui` passed 240/240 Chromium tests; final `verify:pr-local` passed format, lint, typecheck, 324 files / 2,950 tests / 1 skipped, the Next 16.2.10 production build with 1,676 generated pages, client-bundle secret scan, and 36 RAG fixtures across 21 suites. After integrating concurrent review fixes without force-pushing, TypeScript and the 25 focused PDF, Therapy, summary-cancellation, and released-search-order tests passed. Local production-readiness confirmed project identity and boot guard but could not run secret-backed checks because this isolated worktree has no provider secrets; hosted CI and the approved provider canary remain the handoff gates. |

docs/site-map.md

@@ -770,7 +770,6 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `applied-relaxation-relaxation-based-therapy`
 - `arts-therapies-for-psychosis`
 - `behaviour-therapy`
-- `behavioural-activation`
 - `behavioural-activation-ba`
 - `behavioural-couples-therapy-bct`
 - `behavioural-couples-therapy-for-substance-use-disorders-bct-sud`
@@ -820,7 +819,6 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `eating-disorder-focused-cognitive-behavioural-therapy-cbt-ed-cbt-e`
 - `eating-disorder-focused-focal-psychodynamic-therapy-fpt-for-adult-anorexia-nervosa`
 - `ect`
-- `emdr`
 - `emotion-focused-therapy`
 - `empowerment-focused-practice`
 - `existential-psychotherapy`
@@ -866,15 +864,13 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `interoceptive-exposure`
 - `interpersonal-and-social-rhythm-therapy-ipsrt`
 - `interpersonal-psychotherapy-ipt`
-- `interpersonal-therapy`
 - `life-review-therapy-reminiscence-therapy`
 - `low-intensity-relapse-prevention-programmes`
 - `matrix-model`
 - `maudsley-anorexia-nervosa-treatment-for-adults-mantra`
 - `meaning-centred-psychotherapy`
 - `mentalisation-based-therapy-mbt`
 - `metacognitive-therapy-mct`
-- `mindfulness-based-cognitive-therapy`
 - `mindfulness-based-cognitive-therapy-mbct`
 - `mindfulness-based-relapse-prevention-mbrp`
 - `mindfulness-based-stress-reduction`
@@ -904,11 +900,9 @@ This file is generated by `npm run sitemap:update`. Run `npm run sitemap:check`
 - `phase-oriented-trauma-therapy`
 - `play-therapy-play-based-therapies`
 - `problem-management-plus-pm`
-- `problem-solving-therapy`
 - `problem-solving-therapy-pst`
 - `process-groups`
 - `prolonged-exposure-pe`
-- `prolonged-exposure-therapy`
 - `psychoanalysis`
 - `psychodynamic-psychotherapy`
 - `psychoeducation`

public/therapy-compass-data/therapies-index.json

@@ -290,30 +290,6 @@
       "BA"
     ]
   },
-  {
-    "slug": "behavioural-activation",
-    "name": "Behavioural Activation (BA)",
-    "category": "Behavioural Therapies",
-    "modality": "individual",
-    "clinicalSummary": "Behavioural Activation is a structured approach to depression that targets the behavioural withdrawal and inactivity that perpetuates low mood. It helps clients re-engage with rewarding and meaningful activities.",
-    "bestUsedFor": "Depression, low mood, anhedonia, withdrawal, chronic fatigue",
-    "indications": "Mild to moderate depression, clients who have withdrawn from activities, avoidance maintaining low mood",
-    "contraindicationsOrCautions": "Needs careful pacing in chronic fatigue or medical conditions. Not appropriate as sole treatment for severe depression.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": true,
-    "tags": [
-      "depression",
-      "behavioural",
-      "mood",
-      "activation",
-      "brief-intervention"
-    ],
-    "aliases": []
-  },
   {
     "slug": "behavioural-couples-therapy-bct",
     "name": "Behavioural Couples Therapy (BCT)",
@@ -1919,29 +1895,6 @@
       "EMDR"
     ]
   },
-  {
-    "slug": "emdr",
-    "name": "Eye Movement Desensitisation and Reprocessing (EMDR)",
-    "category": "Trauma Therapies",
-    "modality": "individual",
-    "clinicalSummary": "EMDR is an integrative psychotherapy that facilitates the processing of traumatic memories through bilateral stimulation (typically eye movements). It follows a structured 8-phase protocol to reduce the distress associated with traumatic memories.",
-    "bestUsedFor": "PTSD, trauma, grief, phobias, anxiety disorders",
-    "indications": "PTSD, single-incident trauma, complex trauma, phobias, panic disorder",
-    "contraindicationsOrCautions": "Active psychosis, active substance use, severe dissociation without stabilisation, significant medical conditions affecting bilateral stimulation. Requires EMDR-trained therapist.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": false,
-    "tags": [
-      "PTSD",
-      "trauma",
-      "bilateral-stimulation",
-      "evidence-based"
-    ],
-    "aliases": []
-  },
   {
     "slug": "family-intervention-for-psychosis",
     "name": "Family Intervention for Psychosis",
@@ -2930,30 +2883,6 @@
       "IPT"
     ]
   },
-  {
-    "slug": "interpersonal-therapy",
-    "name": "Interpersonal Therapy (IPT)",
-    "category": "Relational Therapies",
-    "modality": "individual",
-    "clinicalSummary": "IPT is a structured, time-limited therapy that focuses on the link between interpersonal difficulties and psychological symptoms, particularly depression. It targets grief, interpersonal disputes, role transitions, and interpersonal deficits.",
-    "bestUsedFor": "Depression, bipolar disorder, eating disorders, perinatal mental health",
-    "indications": "Major depression (particularly with interpersonal precipitants), grief, adjustment to life transitions, interpersonal conflict",
-    "contraindicationsOrCautions": "Less suitable for personality pathology as primary focus, or where interpersonal context is not clearly relevant.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": false,
-    "tags": [
-      "depression",
-      "interpersonal",
-      "grief",
-      "relationship",
-      "evidence-based"
-    ],
-    "aliases": []
-  },
   {
     "slug": "life-review-therapy-reminiscence-therapy",
     "name": "Life-review therapy / reminiscence therapy",
@@ -3178,30 +3107,6 @@
       "MBCT"
     ]
   },
-  {
-    "slug": "mindfulness-based-cognitive-therapy",
-    "name": "Mindfulness-Based Cognitive Therapy (MBCT)",
-    "category": "Third Wave Therapies",
-    "modality": "group",
-    "clinicalSummary": "MBCT combines mindfulness meditation practices with cognitive therapy elements to prevent depressive relapse. It teaches clients to recognise and disengage from ruminative thought patterns.",
-    "bestUsedFor": "Recurrent depression (3+ episodes), residual depressive symptoms, relapse prevention, anxiety",
-    "indications": "History of recurrent major depression, particularly during partial or full remission. Evidence particularly strong for those with 3+ prior episodes.",
-    "contraindicationsOrCautions": "Active severe depression may require individual CBT first. Not recommended during acute depressive episode as primary treatment.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": false,
-    "tags": [
-      "depression",
-      "mindfulness",
-      "relapse-prevention",
-      "group",
-      "cognitive"
-    ],
-    "aliases": []
-  },
   {
     "slug": "mindfulness-based-relapse-prevention-mbrp",
     "name": "Mindfulness-Based Relapse Prevention (MBRP)",
@@ -3958,30 +3863,6 @@
     ],
     "aliases": []
   },
-  {
-    "slug": "problem-solving-therapy",
-    "name": "Problem Solving Therapy (PST)",
-    "category": "Cognitive Therapies",
-    "modality": "individual",
-    "clinicalSummary": "Problem Solving Therapy is a brief, structured approach that teaches systematic problem-solving skills to reduce psychological distress. It targets the connection between unresolved problems and emotional difficulties.",
-    "bestUsedFor": "Depression, anxiety, stress, adjustment difficulties, medically ill patients",
-    "indications": "Depression particularly with identifiable life stressors, adjustment disorder, mild-moderate anxiety, when practical problem-solving skills are needed",
-    "contraindicationsOrCautions": "May not be sufficient for severe or complex presentations. Problems need to be at least partially within the person's control.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": true,
-    "tags": [
-      "depression",
-      "anxiety",
-      "problem-solving",
-      "brief-intervention",
-      "skills"
-    ],
-    "aliases": []
-  },
   {
     "slug": "problem-solving-therapy-pst",
     "name": "Problem-Solving Therapy (PST)",
@@ -4068,30 +3949,6 @@
       "PE"
     ]
   },
-  {
-    "slug": "prolonged-exposure-therapy",
-    "name": "Prolonged Exposure Therapy (PE)",
-    "category": "Trauma Therapies",
-    "modality": "individual",
-    "clinicalSummary": "Prolonged Exposure is a cognitive-behavioural treatment for PTSD that involves systematic confrontation with trauma-related memories and situations. It reduces PTSD symptoms through habituation and cognitive processing.",
-    "bestUsedFor": "PTSD, trauma, sexual assault, combat trauma, accident-related trauma",
-    "indications": "DSM-5 PTSD diagnosis, trauma-related avoidance, intrusive symptoms",
-    "contraindicationsOrCautions": "Active suicidality, active self-harm, severe dissociation, ongoing trauma, active psychosis. Requires careful risk assessment and safety planning.",
-    "targetSymptoms": null,
-    "patientPopulation": null,
-    "setting": null,
-    "reviewStatus": "reviewed",
-    "patientSheetAvailable": false,
-    "briefInterventionAvailable": false,
-    "tags": [
-      "PTSD",
-      "trauma",
-      "exposure",
-      "anxiety",
-      "evidence-based"
-    ],
-    "aliases": []
-  },
   {
     "slug": "psychoanalysis",
     "name": "Psychoanalysis",